| |
| |||||||
Log-Analyse und Auswertung: Google Suchbegriffe werden falsch weitergeleitetWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
06.10.2011, 14:13
| #1 |
| |  Google Suchbegriffe werden falsch weitergeleitet Hallo, hab seit einiger zeit ein problem mit meinem notebook (Win7 64bit). es fuhr nicht mehr richtig runter und ließ sich auch nicht mehr problemlos starten. das system erkannte fehler und versuchte sie zu beseitigen - oft vergebens. habe daraufhin die recovery-funktion genutzt und den rechner auf werkseinstellung zurückzusetzen, was auch funktioniert hat. ich habe nun festgestellt, dass ich bei der google-Suchfunktion ständig auf andere seiten weitergeleitet wurde. zudem trat das problem mit dem herunterfahren bzw. starten wieder auf. wollte auch mal durch avast scannen lassen. da kam die fehlermeldung, dass die side-by-side-konfiguration nicht möglich ist. folglich habe ich gegooglet und bin auf das thema maleware bzw spyware aufmerksam geworden. hxxp://forum.sysprofile.de/computerfragen/73759-ist-eine-side-side-konfiguration-will-avast-installieren-dann-kommt-diese-meldung.html ich habe daraufhin mit malewarebytes und SUPERAntiSpyware gescannt. ersteres hat nicht gefunden. anbei poste ich den scanlog von superantispyware: SUPERAntiSpyware Scan Log hxxp://www.superantispyware.com Generated 10/06/2011 at 02:24 PM Application Version : 5.0.1128 Core Rules Database Version : 7763 Trace Rules Database Version: 5575 Scan type : Complete Scan Total Scan Time : 00:56:46 Operating System Information Windows 7 Home Premium 64-bit (Build 6.01.7600) UAC On - Administrator Memory items scanned : 782 Memory threats detected : 0 Registry items scanned : 69864 Registry threats detected : 0 File items scanned : 130453 File threats detected : 177 Adware.Tracking Cookie C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@serving-sys[2].txt [ Cookie:staeps@serving-sys.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@track.adform[1].txt [ Cookie:staeps@track.adform.net/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@adform[2].txt [ Cookie:staeps@adform.net/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@imrworldwide[2].txt [ Cookie:staeps@imrworldwide.com/cgi-bin ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@doubleclick[2].txt [ Cookie:staeps@doubleclick.net/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@adfarm1.adition[2].txt [ Cookie:staeps@adfarm1.adition.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@questionmarket[1].txt [ Cookie:staeps@questionmarket.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@game-advertising-online[1].txt [ Cookie:staeps@game-advertising-online.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@tradedoubler[1].txt [ Cookie:staeps@tradedoubler.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@olympiaverlag.122.2o7[1].txt [ Cookie:staeps@olympiaverlag.122.2o7.net/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@webmasterplan[2].txt [ Cookie:staeps@webmasterplan.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@fastclick[1].txt [ Cookie:staeps@fastclick.net/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@advertise[1].txt [ Cookie:staeps@advertise.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@apmebf[2].txt [ Cookie:staeps@apmebf.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@ich.adscale[2].txt [ Cookie:staeps@ich.adscale.de/adserver-ich/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@traffictrack[1].txt [ Cookie:staeps@traffictrack.de/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@ad.zanox[1].txt [ Cookie:staeps@ad.zanox.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@invitemedia[1].txt [ Cookie:staeps@invitemedia.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@ad4.adfarm1.adition[1].txt [ Cookie:staeps@ad4.adfarm1.adition.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@zanox[2].txt [ Cookie:staeps@zanox.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@adviva[1].txt [ Cookie:staeps@adviva.net/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@ad1.adfarm1.adition[1].txt [ Cookie:staeps@ad1.adfarm1.adition.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@ad3.adfarm1.adition[2].txt [ Cookie:staeps@ad3.adfarm1.adition.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@smartadserver[2].txt [ Cookie:staeps@smartadserver.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@server.cpmstar[1].txt [ Cookie:staeps@server.cpmstar.com/ ] C:\USERS\STAEPS\AppData\Roaming\Microsoft\Windows\Cookies\Low\staeps@statcounter[1].txt [ Cookie:staeps@statcounter.com/ ] C:\USERS\STAEPS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\STAEPS@AD.AD-SRV[1].TXT [ /AD.AD-SRV ] C:\USERS\STAEPS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\STAEPS@AD2.ADFARM1.ADITION[2].TXT [ /AD2.ADFARM1.ADITION ] C:\USERS\STAEPS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\STAEPS@ADS.BRANDWIRE[1].TXT [ /ADS.BRANDWIRE ] C:\USERS\STAEPS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\STAEPS@ADS.CREATIVE-SERVING[2].TXT [ /ADS.CREATIVE-SERVING ] C:\USERS\STAEPS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\STAEPS@ADX.CHIP[1].TXT [ /ADX.CHIP ] C:\USERS\STAEPS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\STAEPS@IM.BANNER.T-ONLINE[1].TXT [ /IM.BANNER.T-ONLINE ] C:\USERS\STAEPS\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\STAEPS@SPECIFICCLICK[1].TXT [ /SPECIFICCLICK ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD.360YIELD[2].TXT [ /AD.360YIELD ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD.ADITION[1].TXT [ /AD.ADITION ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD.ADITION[2].TXT [ /AD.ADITION ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD.ADNET[2].TXT [ /AD.ADNET ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD.JMG[2].TXT [ /AD.JMG ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD.YIELDMANAGER[1].TXT [ /AD.YIELDMANAGER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD.YIELDMANAGER[3].TXT [ /AD.YIELDMANAGER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD.ZANOX[2].TXT [ /AD.ZANOX ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD1.ADFARM1.ADITION[1].TXT [ /AD1.ADFARM1.ADITION ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD1.ADFARM1.ADITION[2].TXT [ /AD1.ADFARM1.ADITION ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD2.ADFARM1.ADITION[1].TXT [ /AD2.ADFARM1.ADITION ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD2.ADFARM1.ADITION[3].TXT [ /AD2.ADFARM1.ADITION ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD3.ADFARM1.ADITION[1].TXT [ /AD3.ADFARM1.ADITION ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD3.ADFARM1.ADITION[3].TXT [ /AD3.ADFARM1.ADITION ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD4.ADFARM1.ADITION[1].TXT [ /AD4.ADFARM1.ADITION ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD4.ADFARM1.ADITION[3].TXT [ /AD4.ADFARM1.ADITION ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADBRITE[2].TXT [ /ADBRITE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADFARM1.ADITION[2].TXT [ /ADFARM1.ADITION ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADJUGGLER[1].TXT [ /ADJUGGLER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADMEDIATE[1].TXT [ /ADMEDIATE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADS.247ACTIVEMEDIA[1].TXT [ /ADS.247ACTIVEMEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADS.AD4GAME[1].TXT [ /ADS.AD4GAME ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADS.ADK2[2].TXT [ /ADS.ADK2 ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADS.ADXVALUE[2].TXT [ /ADS.ADXVALUE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADS.CPXCENTER[2].TXT [ /ADS.CPXCENTER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADS.CREATIVE-SERVING[1].TXT [ /ADS.CREATIVE-SERVING ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADS.CREATIVE-SERVING[2].TXT [ /ADS.CREATIVE-SERVING ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADS.GAMERSMEDIA[2].TXT [ /ADS.GAMERSMEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADS.INTERGI[1].TXT [ /ADS.INTERGI ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADS.LZJL[2].TXT [ /ADS.LZJL ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADS.LZJL[3].TXT [ /ADS.LZJL ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADS.PUBMATIC[1].TXT [ /ADS.PUBMATIC ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADS.PUBMATIC[2].TXT [ /ADS.PUBMATIC ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADSERVER.ADTECHUS[1].TXT [ /ADSERVER.ADTECHUS ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADSERVER[2].TXT [ /ADSERVER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADSRV1.ADMEDIATE[1].TXT [ /ADSRV1.ADMEDIATE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADTECH[1].TXT [ /ADTECH ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADTECH[2].TXT [ /ADTECH ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADVERTISE[2].TXT [ /ADVERTISE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADVERTISE[3].TXT [ /ADVERTISE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADXPOSE[1].TXT [ /ADXPOSE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AIM4MEDIA[2].TXT [ /AIM4MEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@APMEBF[1].TXT [ /APMEBF ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ATDMT[2].TXT [ /ATDMT ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AUTOXTRAFFIC[2].TXT [ /AUTOXTRAFFIC ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@BIZRATE[1].TXT [ /BIZRATE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@BIZZCLICK[1].TXT [ /BIZZCLICK ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@BIZZCLICK[3].TXT [ /BIZZCLICK ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@BRIGHTHOUSE.122.2O7[1].TXT [ /BRIGHTHOUSE.122.2O7 ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@BS.SERVING-SYS[1].TXT [ /BS.SERVING-SYS ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@BS.SERVING-SYS[2].TXT [ /BS.SERVING-SYS ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@CASALEMEDIA[2].TXT [ /CASALEMEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@CLICK.IWANTUONLINE[1].TXT [ /CLICK.IWANTUONLINE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@CLICKBANK[1].TXT [ /CLICKBANK ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@CLICKSOR[1].TXT [ /CLICKSOR ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@CLICKSOR[3].TXT [ /CLICKSOR ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@CONTENT.YIELDMANAGER[2].TXT [ /CONTENT.YIELDMANAGER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@CONTENT.YIELDMANAGER[3].TXT [ /CONTENT.YIELDMANAGER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@CPCADNET[2].TXT [ /CPCADNET ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@DAIMLERAG.122.2O7[1].TXT [ /DAIMLERAG.122.2O7 ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@DISCOUNT24[1].TXT [ /DISCOUNT24 ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@DISCOUNTINSURERS[2].TXT [ /DISCOUNTINSURERS ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@DOUBLECLICK[1].TXT [ /DOUBLECLICK ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@DOUBLECLICK[2].TXT [ /DOUBLECLICK ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@EAS.APM.EMEDIATE[1].TXT [ /EAS.APM.EMEDIATE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@EAS.APM.EMEDIATE[2].TXT [ /EAS.APM.EMEDIATE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@FASTCLICK[1].TXT [ /FASTCLICK ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@FIDELITY.ROTATOR.HADJ7.ADJUGGLER[2].TXT [ /FIDELITY.ROTATOR.HADJ7.ADJUGGLER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@FIDELITY.ROTATOR.HADJ7.ADJUGGLER[3].TXT [ /FIDELITY.ROTATOR.HADJ7.ADJUGGLER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@FILTER.PLUSFIND[1].TXT [ /FILTER.PLUSFIND ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@FILTER.PLUSFIND[2].TXT [ /FILTER.PLUSFIND ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@FINDOLOGY[1].TXT [ /FINDOLOGY ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@FRIENDFINDER[2].TXT [ /FRIENDFINDER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@GO.WANTUSEXY[1].TXT [ /GO.WANTUSEXY ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@HISTATS[1].TXT [ /HISTATS ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@HISTATS[2].TXT [ /HISTATS ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@IM.BANNER.T-ONLINE[2].TXT [ /IM.BANNER.T-ONLINE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@IMRWORLDWIDE[2].TXT [ /IMRWORLDWIDE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@INSIGHTEXPRESSAI[2].TXT [ /INSIGHTEXPRESSAI ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@INVITEMEDIA[1].TXT [ /INVITEMEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@LIVEPERSON[1].TXT [ /LIVEPERSON ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@LIVEPERSON[3].TXT [ /LIVEPERSON ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@MEDIA6DEGREES[1].TXT [ /MEDIA6DEGREES ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@MEDIABRANDSWW[1].TXT [ /MEDIABRANDSWW ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@MEDIAPLEX[1].TXT [ /MEDIAPLEX ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@MEDIATRAFFIC[2].TXT [ /MEDIATRAFFIC ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@MM.CHITIKA[1].TXT [ /MM.CHITIKA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@MM.CHITIKA[2].TXT [ /MM.CHITIKA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@MMOTRAFFIC[2].TXT [ /MMOTRAFFIC ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@MYROITRACKING[1].TXT [ /MYROITRACKING ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@OVERTURE[1].TXT [ /OVERTURE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@OVERTURE[2].TXT [ /OVERTURE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@P179T1S6136934.KRONOS.BRAVENETMEDIA[1].TXT [ /P179T1S6136934.KRONOS.BRAVENETMEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@P221T1S1846949.KRONOS.BRAVENETMEDIA[1].TXT [ /P221T1S1846949.KRONOS.BRAVENETMEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@P221T1S5374784.KRONOS.BRAVENETMEDIA[1].TXT [ /P221T1S5374784.KRONOS.BRAVENETMEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@P222T1S6000087.KRONOS.BRAVENETMEDIA[1].TXT [ /P222T1S6000087.KRONOS.BRAVENETMEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@P306T1S1823103.KRONOS.BRAVENETMEDIA[1].TXT [ /P306T1S1823103.KRONOS.BRAVENETMEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@P306T1S6399789.KRONOS.BRAVENETMEDIA[1].TXT [ /P306T1S6399789.KRONOS.BRAVENETMEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@P381T1S2921466.KRONOS.BRAVENETMEDIA[1].TXT [ /P381T1S2921466.KRONOS.BRAVENETMEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@P471T1S6411850.KRONOS.BRAVENETMEDIA[1].TXT [ /P471T1S6411850.KRONOS.BRAVENETMEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@QUESTIONMARKET[1].TXT [ /QUESTIONMARKET ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@REALMEDIA[1].TXT [ /REALMEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@REVSCI[1].TXT [ /REVSCI ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@RU4[2].TXT [ /RU4 ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@S09.FLAGCOUNTER[1].TXT [ /S09.FLAGCOUNTER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@SECMEDIA[2].TXT [ /SECMEDIA ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@SERVER.CPMSTAR[2].TXT [ /SERVER.CPMSTAR ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@SERVER.LON.LIVEPERSON[1].TXT [ /SERVER.LON.LIVEPERSON ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@SERVING-SYS[1].TXT [ /SERVING-SYS ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@SERVING-SYS[2].TXT [ /SERVING-SYS ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@SMARTADSERVER[2].TXT [ /SMARTADSERVER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@SPECIFICCLICK[1].TXT [ /SPECIFICCLICK ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@STAT.DEALTIME[2].TXT [ /STAT.DEALTIME ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@STATCOUNTER[2].TXT [ /STATCOUNTER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@STATS.ILIVID[1].TXT [ /STATS.ILIVID ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@STATSE.WEBTRENDSLIVE[2].TXT [ /STATSE.WEBTRENDSLIVE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRACK.EFFILIATION[1].TXT [ /TRACK.EFFILIATION ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRACK.EFFILIATION[2].TXT [ /TRACK.EFFILIATION ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRACK.RIGHT-ADS[2].TXT [ /TRACK.RIGHT-ADS ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRACKING.GAMEFORGE[1].TXT [ /TRACKING.GAMEFORGE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRACKING.PROJOP[1].TXT [ /TRACKING.PROJOP ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRACKING1.ALEADPAY[1].TXT [ /TRACKING1.ALEADPAY ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRACKING1.ALEADPAY[3].TXT [ /TRACKING1.ALEADPAY ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRADEDOUBLER[2].TXT [ /TRADEDOUBLER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRADEDOUBLER[3].TXT [ /TRADEDOUBLER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRAFFICENGINE[2].TXT [ /TRAFFICENGINE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRAFFICTRACK[2].TXT [ /TRAFFICTRACK ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRIBALFUSION[2].TXT [ /TRIBALFUSION ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@VIDASCO.ROTATOR.HADJ7.ADJUGGLER[1].TXT [ /VIDASCO.ROTATOR.HADJ7.ADJUGGLER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@VIDASCO.ROTATOR.HADJ7.ADJUGGLER[2].TXT [ /VIDASCO.ROTATOR.HADJ7.ADJUGGLER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@WEBMASTERPLAN[2].TXT [ /WEBMASTERPLAN ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@WW251.SMARTADSERVER[2].TXT [ /WW251.SMARTADSERVER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@WWW.CPCADNET[1].TXT [ /WWW.CPCADNET ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@WWW.ETRACKER[1].TXT [ /WWW.ETRACKER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@WWW.GOOGLEADSERVICES[1].TXT [ /WWW.GOOGLEADSERVICES ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@WWW.MEDIATRAFFIC[2].TXT [ /WWW.MEDIATRAFFIC ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@WWW.WEBCAMSEX[2].TXT [ /WWW.WEBCAMSEX ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@WWW.WEBCAMSEX[3].TXT [ /WWW.WEBCAMSEX ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@XML.TRAFFICENGINE[2].TXT [ /XML.TRAFFICENGINE ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@YIELDMANAGER[2].TXT [ /YIELDMANAGER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@YIELDMANAGER[3].TXT [ /YIELDMANAGER ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ZANOX[2].TXT [ /ZANOX ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ZEDO[2].TXT [ /ZEDO ] C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ZEDO[3].TXT [ /ZEDO ] sorry, wenn ich unsinnige info liefere. bin neu hier. hilfe wäre super |
|
06.10.2011, 14:22
| #2 |
| /// Malware-holic   | Google Suchbegriffe werden falsch weitergeleitet nein, deine beschreibung war gut.
__________________auch das posten vorhandener logs, gut :-) da könnten sich andere ne scheibe von abschneiden. otl: Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)
__________________ |
|
07.10.2011, 06:42
| #3 |
| | Google Suchbegriffe werden falsch weitergeleitet OTL Logfile:
__________________Code:
ATTFilter OTL logfile created on: 07.10.2011 07:19:59 - Run 1 OTL by OldTimer - Version 3.2.29.1 Folder = C:\Users\Staeps\Downloads 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,41 Gb Available Physical Memory | 60,31% Memory free 7,99 Gb Paging File | 5,89 Gb Available in Paging File | 73,73% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 230,52 Gb Total Space | 200,45 Gb Free Space | 86,95% Space Free | Partition Type: NTFS Computer Name: STAEPS-PC | User Name: Staeps | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Staeps\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Programme\AVAST Software\Avast\AvastSvc.exe (AVAST Software) PRC - C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe (McAfee, Inc.) PRC - c:\PROGRA~2\mcafee.com\agent\mcagent.exe (McAfee, Inc.) PRC - C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) PRC - C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe (McAfee, Inc.) PRC - C:\Program Files (x86)\McAfee\MSK\MskSrver.exe (McAfee, Inc.) PRC - C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) PRC - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.) PRC - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.) PRC - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe (Egis Technology Inc.) PRC - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.) PRC - C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.) PRC - C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.) PRC - C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.) PRC - C:\Windows\SysWOW64\PING.EXE (Microsoft Corporation) PRC - c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee, Inc.) PRC - C:\Programme\Acer\Acer Updater\UpdaterService.exe (Acer) PRC - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe (Acer Incorporated) PRC - c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe (McAfee, Inc.) PRC - C:\Windows\PLFSetI.exe () ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll () MOD - C:\Windows\PLFSetI.exe () ========== Win32 Services (SafeList) ========== SRV:64bit: - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software) SRV:64bit: - (!SASCORE) -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com) SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV - (McODS) -- C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.) SRV - (McShield) -- C:\Programme\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.) SRV - (McSysmon) -- C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe (McAfee, Inc.) SRV - (0125741317886677mcinstcleanup) McAfee Application Installer Cleanup (0125741317886677) -- C:\Windows\Temp\0125741317886677mcinst.exe (McAfee, Inc.) SRV - (mcmscsvc) -- C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) SRV - (McAfee SiteAdvisor Service) -- C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.) SRV - (MpfService) -- C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe (McAfee, Inc.) SRV - (MSK80Service) -- C:\Program Files (x86)\McAfee\MSK\MskSrver.exe (McAfee, Inc.) SRV - (Partner Service) -- C:\ProgramData\Partner\Partner.exe (Google Inc.) SRV - (NTI IScheduleSvc) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.) SRV - (MWLService) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe () SRV - (ePowerSvc) -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) SRV - (McProxy) -- c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee, Inc.) SRV - (Updater Service) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe (Acer) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (Greg_Service) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe (Acer Incorporated) SRV - (McNASvc) -- c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe (McAfee, Inc.) SRV - (AgereModemAudio) -- C:\Programme\LSI SoftModem\agr64svc.exe (LSI Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software) DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software) DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software) DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr.sys (AVAST Software) DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software) DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software) DRV:64bit: - (mferkdk) -- C:\Windows\SysNative\drivers\mferkdk.sys (McAfee, Inc.) DRV:64bit: - (mfehidk) -- C:\Windows\SysNative\drivers\mfehidk.sys (McAfee, Inc.) DRV:64bit: - (mfesmfk) -- C:\Windows\SysNative\drivers\mfesmfk.sys (McAfee, Inc.) DRV:64bit: - (mfeavfk) -- C:\Windows\SysNative\drivers\mfeavfk.sys (McAfee, Inc.) DRV:64bit: - (MPFP) -- C:\Windows\SysNative\drivers\Mpfp.sys (McAfee, Inc.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.) DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (k57nd60a) Broadcom NetLink (TM) -- C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation) DRV:64bit: - (L1E) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20) -- C:\Windows\SysNative\drivers\L1E62x64.sys (Atheros Communications, Inc.) DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated) DRV:64bit: - (AgereSoftModem) -- C:\Windows\SysNative\drivers\agrsm64.sys (LSI Corporation) DRV:64bit: - (SrvHsfV92) -- C:\Windows\SysNative\drivers\VSTDPV6.SYS (Conexant Systems, Inc.) DRV:64bit: - (SrvHsfWinac) -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS (Conexant Systems, Inc.) DRV:64bit: - (SrvHsfHDA) -- C:\Windows\SysNative\drivers\VSTAZL6.SYS (Conexant Systems, Inc.) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Research Inc.) DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.) DRV:64bit: - (mwlPSDVDisk) -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys (Egis Technology Inc.) DRV:64bit: - (mwlPSDFilter) -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys (Egis Technology Inc.) DRV:64bit: - (mwlPSDNServ) -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys (Egis Technology Inc.) DRV:64bit: - (NTIDrvr) -- C:\Windows\SysNative\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.) DRV:64bit: - (UBHelper) -- C:\Windows\SysNative\drivers\UBHelper.sys (NewTech Infosystems Corporation) DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices) DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl (CyberLink Corp.) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\2.0.40115.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8064.0206: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files (x86)\McAfee\SiteAdvisor [2011.10.06 07:38:04 | 000,000,000 | ---D | M] Hosts file not found O2:64bit: - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~2\mcafee\msk\MSKAPB~1.DLL () O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.) O2:64bit: - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner64.dll (Google Inc.) O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.) O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~2\mcafee\msk\mskapbho.dll () O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~2\mcafee\VIRUSS~1\scriptsn.dll (McAfee, Inc.) O2 - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll (Google Inc.) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.) O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated) O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.) O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe () O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.) O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.) O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [mcagent_exe] C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe (Symantec Corporation) O4 - HKLM..\Run: [PlayMovie] C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C4FDA47B-1765-437E-8DB1-AC387FC56285}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.10.06 12:12:37 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Roaming\SUPERAntiSpyware.com [2011.10.06 12:12:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware [2011.10.06 12:11:49 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com [2011.10.06 12:11:49 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware [2011.10.06 12:03:03 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Roaming\Malwarebytes [2011.10.06 12:02:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.10.06 12:02:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.10.06 12:02:51 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.10.06 12:02:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.10.06 09:13:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OEM [2011.10.06 09:12:35 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Roaming\ATI [2011.10.06 09:12:35 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Local\ATI [2011.10.06 09:12:35 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2011.10.06 08:42:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works [2011.10.06 08:33:30 | 004,398,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_32.dll [2011.10.06 08:33:30 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_32.dll [2011.10.06 08:31:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition [2011.10.06 08:29:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft [2011.10.06 08:29:26 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\microsoft [2011.10.06 08:28:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live SkyDrive [2011.10.06 08:28:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live [2011.10.06 08:27:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live [2011.10.06 08:24:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live [2011.10.06 08:15:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8 [2011.10.06 08:13:06 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Local\Microsoft Help [2011.10.06 08:04:16 | 000,000,000 | ---D | C] -- C:\BOOK [2011.10.06 08:03:35 | 001,233,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml4.dll [2011.10.06 08:03:35 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml4r.dll [2011.10.06 08:03:35 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml4a.dll [2011.10.06 08:01:33 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer Arcade Deluxe [2011.10.06 08:01:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cyberlink [2011.10.06 07:58:27 | 000,024,408 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys [2011.10.06 07:58:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus [2011.10.06 07:58:26 | 000,301,912 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys [2011.10.06 07:58:21 | 000,042,328 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr.sys [2011.10.06 07:58:19 | 000,058,200 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys [2011.10.06 07:58:17 | 000,601,944 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys [2011.10.06 07:58:12 | 000,254,400 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe [2011.10.06 07:58:12 | 000,065,368 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys [2011.10.06 07:57:46 | 000,199,304 | ---- | C] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe [2011.10.06 07:57:46 | 000,041,184 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr [2011.10.06 07:57:36 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software [2011.10.06 07:57:36 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software [2011.10.06 07:54:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Acer Arcade Deluxe [2011.10.06 07:54:11 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink [2011.10.06 07:54:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Temp [2011.10.06 07:47:41 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Screensaver [2011.10.06 07:47:41 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Roaming\Macromedia [2011.10.06 07:47:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Launch Manager [2011.10.06 07:47:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Launch Manager [2011.10.06 07:46:45 | 001,658,880 | ---- | C] (SuYin) -- C:\Windows\Acer Crystal Eye webcam.EXE [2011.10.06 07:46:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer Crystal Eye Webcam [2011.10.06 07:45:14 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Roaming\InstallShield [2011.10.06 07:44:56 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics [2011.10.06 07:44:09 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM [2011.10.06 07:43:58 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek [2011.10.06 07:43:56 | 000,513,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll [2011.10.06 07:43:56 | 000,211,376 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll [2011.10.06 07:43:56 | 000,193,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll [2011.10.06 07:43:56 | 000,150,528 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll [2011.10.06 07:43:54 | 000,611,872 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTSnMg64.cpl [2011.10.06 07:43:53 | 001,393,696 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtPgEx64.dll [2011.10.06 07:43:53 | 000,332,320 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtlCPAPI64.dll [2011.10.06 07:43:52 | 000,149,536 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkCfg64.dll [2011.10.06 07:43:51 | 001,603,104 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkAPO64.dll [2011.10.06 07:43:50 | 001,167,904 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTCOM64.dll [2011.10.06 07:43:50 | 000,417,824 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkApi64.dll [2011.10.06 07:43:50 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll [2011.10.06 07:43:50 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll [2011.10.06 07:43:50 | 000,063,008 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RCoInst64.dll [2011.10.06 07:43:46 | 000,311,296 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll [2011.10.06 07:43:44 | 000,294,400 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll [2011.10.06 07:43:43 | 000,166,400 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\SysNative\AERTAC64.dll [2011.10.06 07:43:43 | 000,108,032 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\SysNative\AERTAR64.dll [2011.10.06 07:43:42 | 000,831,488 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\RtlExUpd.dll [2011.10.06 07:43:42 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp [2011.10.06 07:43:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield [2011.10.06 07:43:22 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Roaming\Adobe [2011.10.06 07:43:21 | 000,000,000 | ---D | C] -- C:\Program Files\DIFX [2011.10.06 07:43:18 | 000,034,872 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\usbfilter.sys [2011.10.06 07:43:18 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE [2011.10.06 07:43:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD [2011.10.06 07:43:05 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Roaming\Google [2011.10.06 07:43:03 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Local\Google [2011.10.06 07:42:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center [2011.10.06 07:41:05 | 000,000,000 | ---D | C] -- C:\Program Files\ATI [2011.10.06 00:05:15 | 000,000,000 | ---D | C] -- C:\Windows\de-DE [2011.10.06 00:05:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\XPSViewer [2011.10.06 00:05:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\de-DE [2011.10.06 00:05:14 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\de-DE [2011.10.06 00:05:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\de [2011.10.06 00:05:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0407 [2011.10.06 00:05:14 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0407 [2011.10.06 00:05:13 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\de [2011.10.06 00:04:37 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\usbrpm.sys.mui [2011.10.06 00:04:32 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\fvevol.sys.mui [2011.10.06 00:04:23 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\qwavedrv.sys.mui [2011.10.06 00:04:22 | 000,017,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\nwifi.sys.mui [2011.10.06 00:04:22 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\qwavedrv.sys.mui [2011.10.06 00:04:19 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\volsnap.sys.mui [2011.10.06 00:04:19 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\usbport.sys.mui [2011.10.06 00:04:19 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\processr.sys.mui [2011.10.06 00:04:19 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\intelppm.sys.mui [2011.10.06 00:04:19 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\amdppm.sys.mui [2011.10.06 00:04:19 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\amdk8.sys.mui [2011.10.06 00:04:19 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\usbhub.sys.mui [2011.10.06 00:04:19 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\serial.sys.mui [2011.10.06 00:04:19 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ohci1394.sys.mui [2011.10.06 00:04:19 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\1394ohci.sys.mui [2011.10.06 00:04:19 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui [2011.10.06 00:04:19 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui [2011.10.06 00:04:19 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\i8042prt.sys.mui [2011.10.06 00:04:19 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\acpi.sys.mui [2011.10.06 00:04:19 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\battc.sys.mui [2011.10.06 00:04:19 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pci.sys.mui [2011.10.06 00:04:19 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\IPMIDrv.sys.mui [2011.10.06 00:04:19 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\sermouse.sys.mui [2011.10.06 00:04:19 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\kbdclass.sys.mui [2011.10.06 00:04:19 | 000,004,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mouclass.sys.mui [2011.10.06 00:04:19 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\wacompen.sys.mui [2011.10.06 00:04:19 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\vhdmp.sys.mui [2011.10.06 00:04:19 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\vdrvroot.sys.mui [2011.10.06 00:04:19 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\tpm.sys.mui [2011.10.06 00:04:19 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\isapnp.sys.mui [2011.10.06 00:04:19 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\hdaudbus.sys.mui [2011.10.06 00:04:19 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\parport.sys.mui [2011.10.06 00:04:19 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ataport.sys.mui [2011.10.06 00:04:19 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\umbus.sys.mui [2011.10.06 00:04:19 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mssmbios.sys.mui [2011.10.06 00:04:19 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mouhid.sys.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\vwifibus.sys.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ULIAGPKX.SYS.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\UAGP35.SYS.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\NV_AGP.SYS.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\MTConfig.sys.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\kbdhid.sys.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\GAGP30KX.SYS.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\AGP440.sys.mui [2011.10.06 00:04:19 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\wd.sys.mui [2011.10.06 00:04:19 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\disk.sys.mui [2011.10.06 00:04:19 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\cdrom.sys.mui [2011.10.06 00:04:19 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\amdide.sys.mui [2011.10.06 00:04:18 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\tcpip.sys.mui [2011.10.06 00:04:18 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mpio.sys.mui [2011.10.06 00:04:18 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bthport.sys.mui [2011.10.06 00:04:18 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\msdsm.sys.mui [2011.10.06 00:04:18 | 000,004,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pcmcia.sys.mui [2011.10.06 00:04:18 | 000,004,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bthpan.sys.mui [2011.10.06 00:04:18 | 000,004,096 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui [2011.10.06 00:04:18 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\portcls.sys.mui [2011.10.06 00:04:18 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\HdAudio.sys.mui [2011.10.06 00:04:18 | 000,003,584 | ---- | C] (ATI Technologies Inc.) -- C:\Windows\SysNative\drivers\de-DE\atikmdag.sys.mui [2011.10.06 00:04:18 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\serscan.sys.mui [2011.10.06 00:04:18 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\rndismpx.sys.mui [2011.10.06 00:04:18 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\rndismp6.sys.mui [2011.10.06 00:04:18 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\hidbth.sys.mui [2011.10.06 00:04:18 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pnpmem.sys.mui [2011.10.06 00:04:18 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\Dot4usb.sys.mui [2011.10.06 00:04:18 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\BTHUSB.SYS.mui [2011.10.06 00:04:18 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui [2011.10.06 00:04:18 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ws2ifsl.sys.mui [2011.10.06 00:04:18 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bthenum.sys.mui [2011.10.06 00:04:14 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pacer.sys.mui [2011.10.06 00:04:12 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bfe.dll.mui [2011.10.06 00:04:12 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\modem.sys.mui [2011.10.06 00:04:11 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ipnat.sys.mui [2011.10.06 00:04:10 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\afd.sys.mui [2011.10.06 00:04:10 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\volmgrx.sys.mui [2011.10.06 00:04:09 | 000,072,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ntfs.sys.mui [2011.10.06 00:04:09 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\tunnel.sys.mui [2011.10.06 00:04:09 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\luafv.sys.mui [2011.10.06 00:04:09 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\ndiscap.sys.mui [2011.10.06 00:04:09 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\rdbss.sys.mui [2011.10.06 00:04:09 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\srv.sys.mui [2011.10.06 00:04:09 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\scfilter.sys.mui [2011.10.06 00:04:07 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ndisuio.sys.mui [2011.10.06 00:04:07 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\partmgr.sys.mui [2011.10.06 00:04:07 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mountmgr.sys.mui [2011.10.06 00:04:06 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\RNDISMP.sys.mui [2011.10.06 00:04:05 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\tcpip.sys.mui [2011.10.06 00:04:05 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ndiscap.sys.mui [2011.10.06 00:04:05 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\scfilter.sys.mui [2011.10.06 00:04:04 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ndis.sys.mui [2011.10.06 00:04:04 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\fltmgr.sys.mui [2011.10.06 00:04:04 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\wdf01000.sys.mui [2011.10.06 00:04:02 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\http.sys.mui [2011.10.06 00:04:02 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\bfe.dll.mui [2011.10.06 00:04:02 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\pacer.sys.mui [2011.10.06 00:04:02 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\scsiport.sys.mui [2011.10.05 23:56:57 | 000,347,656 | ---- | C] (Dritek System Inc.) -- C:\Windows\UNINST32.EXE [2011.10.05 23:56:57 | 000,025,608 | ---- | C] (Dritek System Inc.) -- C:\Windows\SysWow64\drivers\DKbFltr.sys [2011.10.05 23:56:55 | 001,484,800 | ---- | C] (Atheros Communications, Inc.) -- C:\Windows\SysNative\drivers\athrx.sys [2011.10.05 23:56:51 | 001,436,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WdfCoInstaller01009.dll [2011.10.05 23:56:51 | 000,395,048 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynCOM.dll [2011.10.05 23:56:51 | 000,272,432 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\drivers\SynTP.sys [2011.10.05 23:56:51 | 000,260,904 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynCtrl.dll [2011.10.05 23:56:51 | 000,206,120 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynCtrl.dll [2011.10.05 23:56:51 | 000,203,560 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynTPAPI.dll [2011.10.05 23:56:51 | 000,169,256 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynCOM.dll [2011.10.05 23:56:51 | 000,147,752 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynTPCo4.dll [2011.10.05 23:56:51 | 000,107,816 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynTPCOM.dll [2011.10.05 23:56:47 | 001,208,320 | ---- | C] (LSI Corporation) -- C:\Windows\SysNative\drivers\agrsm64.sys [2011.10.05 23:56:47 | 000,064,000 | ---- | C] (LSI Corporation) -- C:\Windows\agrsmdel.exe [2011.10.05 23:56:47 | 000,042,496 | ---- | C] (LSI Corporation) -- C:\Windows\agrdel64.exe [2011.10.05 23:56:47 | 000,014,848 | ---- | C] (LSI Corporation) -- C:\Windows\SysNative\agrsco64.dll [2011.10.05 23:56:32 | 000,114,192 | ---- | C] (ATI Research Inc.) -- C:\Windows\SysNative\drivers\AtiHdmi.sys [2011.10.05 23:56:32 | 000,067,128 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\amdsata.sys [2011.10.05 23:56:32 | 000,028,216 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\amdxata.sys [2011.10.05 23:56:32 | 000,016,440 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\drivers\AtiPcie.sys [2011.10.05 23:56:31 | 004,059,648 | ---- | C] (ATI Technologies Inc. ) -- C:\Windows\SysNative\atiumd64.dll [2011.10.05 23:56:31 | 003,105,280 | ---- | C] (ATI Technologies Inc. ) -- C:\Windows\SysWow64\atiumdag.dll [2011.10.05 23:56:31 | 002,868,224 | ---- | C] (ATI Technologies Inc. ) -- C:\Windows\SysWow64\atiumdva.dll [2011.10.05 23:56:31 | 002,622,464 | ---- | C] (ATI Technologies Inc. ) -- C:\Windows\SysNative\atiumd6a.dll [2011.10.05 23:56:31 | 000,421,376 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysNative\atipdl64.dll [2011.10.05 23:56:31 | 000,356,352 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\atipdlxx.dll [2011.10.05 23:56:31 | 000,120,320 | ---- | C] (AMD) -- C:\Windows\SysNative\atitmm64.dll [2011.10.05 23:56:31 | 000,055,296 | ---- | C] (AMD) -- C:\Windows\SysNative\coinst.dll [2011.10.05 23:56:31 | 000,040,448 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiu9p64.dll [2011.10.05 23:56:31 | 000,038,912 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiuxp64.dll [2011.10.05 23:56:31 | 000,029,696 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiuxpag.dll [2011.10.05 23:56:31 | 000,029,696 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiu9pag.dll [2011.10.05 23:56:30 | 015,062,016 | ---- | C] (ATI Technologies Inc.) -- C:\Windows\SysNative\atio6axx.dll [2011.10.05 23:56:30 | 011,650,560 | ---- | C] (ATI Technologies Inc.) -- C:\Windows\SysWow64\atioglxx.dll [2011.10.05 23:56:30 | 006,036,480 | ---- | C] (ATI Technologies Inc.) -- C:\Windows\SysNative\drivers\atikmdag.sys [2011.10.05 23:56:30 | 004,289,536 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticaldd64.dll [2011.10.05 23:56:30 | 003,264,512 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticaldd.dll [2011.10.05 23:56:30 | 002,921,984 | ---- | C] (ATI Technologies Inc. ) -- C:\Windows\SysNative\atidxx64.dll [2011.10.05 23:56:30 | 002,469,888 | ---- | C] (ATI Technologies Inc. ) -- C:\Windows\SysWow64\atidxx32.dll [2011.10.05 23:56:30 | 000,442,368 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\ATIDEMGX.dll [2011.10.05 23:56:30 | 000,420,352 | ---- | C] (AMD) -- C:\Windows\SysNative\atieclxx.exe [2011.10.05 23:56:30 | 000,251,904 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atiadlxx.dll [2011.10.05 23:56:30 | 000,203,264 | ---- | C] (AMD) -- C:\Windows\SysNative\atiesrxx.exe [2011.10.05 23:56:30 | 000,184,320 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysWow64\atiadlxy.dll [2011.10.05 23:56:30 | 000,134,144 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\atikmpag.sys [2011.10.05 23:56:30 | 000,118,784 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atibtmon.exe [2011.10.05 23:56:30 | 000,059,392 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysNative\atiedu64.dll [2011.10.05 23:56:30 | 000,053,248 | ---- | C] (ATI Technologies Inc.) -- C:\Windows\SysNative\drivers\ati2erec.dll [2011.10.05 23:56:30 | 000,053,248 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticalrt.dll [2011.10.05 23:56:30 | 000,053,248 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticalcl.dll [2011.10.05 23:56:30 | 000,052,224 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atimpc64.dll [2011.10.05 23:56:30 | 000,052,224 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\amdpcom64.dll [2011.10.05 23:56:30 | 000,051,712 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atimpc32.dll [2011.10.05 23:56:30 | 000,051,712 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\amdpcom32.dll [2011.10.05 23:56:30 | 000,048,640 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticalrt64.dll [2011.10.05 23:56:30 | 000,043,520 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\ati2edxx.dll [2011.10.05 23:56:30 | 000,041,984 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticalcl64.dll [2011.10.05 23:56:30 | 000,017,408 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atig6txx.dll [2011.10.05 23:56:30 | 000,016,384 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atig6pxx.dll [2011.10.05 23:56:30 | 000,015,360 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atigktxx.dll [2011.10.05 23:56:30 | 000,012,800 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiglpxx.dll [2011.10.05 23:56:30 | 000,012,288 | ---- | C] (AMD) -- C:\Windows\SysNative\atimuixx.dll [2011.10.05 23:56:15 | 000,000,000 | ---D | C] -- C:\Windows\Lan [2011.10.05 23:55:35 | 000,431,104 | ---- | C] (Wistron Corp.) -- C:\Windows\WisMvImg.exe [2011.10.05 23:55:35 | 000,249,856 | ---- | C] (Wistron Corp.) -- C:\Windows\Wisi2Bat.exe [2011.10.05 23:55:35 | 000,159,744 | ---- | C] (Wistron Corp.) -- C:\Windows\PatchFul.exe [2011.10.05 23:55:34 | 000,382,976 | ---- | C] (Wistron Corp.) -- C:\Windows\WisGAPasx64.exe [2011.10.05 23:55:34 | 000,335,872 | ---- | C] (Acer Inc.) -- C:\Windows\ParseModule_X64.exe [2011.10.05 23:55:33 | 000,322,048 | ---- | C] (Wistron Corp.) -- C:\Windows\WisGAPas.exe [2011.10.05 23:55:33 | 000,225,280 | ---- | C] (Acer Inc.) -- C:\Windows\ParseModule_X86.exe [2011.10.05 14:31:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies [2011.10.05 14:28:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies [2011.10.05 14:28:27 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Local\EgisTec [2011.10.05 14:28:27 | 000,000,000 | ---D | C] -- C:\ProgramData\EgisTec [2011.10.05 14:27:32 | 000,000,000 | R--D | C] -- C:\Users\Staeps\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2011.10.05 14:27:32 | 000,000,000 | R--D | C] -- C:\Users\Staeps\Searches [2011.10.05 14:27:32 | 000,000,000 | R--D | C] -- C:\Users\Staeps\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011.10.05 14:27:04 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Roaming\Identities [2011.10.05 14:26:53 | 000,000,000 | R--D | C] -- C:\Users\Staeps\Contacts [2011.10.05 14:26:22 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Acer [2011.10.05 14:24:58 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Local\VirtualStore [2011.10.05 14:24:38 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\Vorlagen [2011.10.05 14:24:38 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\AppData\Local\Verlauf [2011.10.05 14:24:38 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\AppData\Local\Temporary Internet Files [2011.10.05 14:24:38 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\Startmenü [2011.10.05 14:24:38 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\SendTo [2011.10.05 14:24:38 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\Recent [2011.10.05 14:24:38 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\Lokale Einstellungen [2011.10.05 14:24:38 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\AppData\Local\Anwendungsdaten [2011.10.05 14:24:37 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\Netzwerkumgebung [2011.10.05 14:24:37 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\Documents\Eigene Videos [2011.10.05 14:24:37 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\Documents\Eigene Musik [2011.10.05 14:24:37 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\Eigene Dateien [2011.10.05 14:24:37 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\Documents\Eigene Bilder [2011.10.05 14:24:37 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\Druckumgebung [2011.10.05 14:24:37 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\Cookies [2011.10.05 14:24:37 | 000,000,000 | -HSD | C] -- C:\Users\Staeps\Anwendungsdaten [2011.10.05 14:24:35 | 000,000,000 | --SD | C] -- C:\Users\Staeps\AppData\Roaming\Microsoft [2011.10.05 14:24:35 | 000,000,000 | R--D | C] -- C:\Users\Staeps\Videos [2011.10.05 14:24:35 | 000,000,000 | R--D | C] -- C:\Users\Staeps\Saved Games [2011.10.05 14:24:35 | 000,000,000 | R--D | C] -- C:\Users\Staeps\Pictures [2011.10.05 14:24:35 | 000,000,000 | R--D | C] -- C:\Users\Staeps\Music [2011.10.05 14:24:35 | 000,000,000 | R--D | C] -- C:\Users\Staeps\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011.10.05 14:24:35 | 000,000,000 | R--D | C] -- C:\Users\Staeps\Links [2011.10.05 14:24:35 | 000,000,000 | R--D | C] -- C:\Users\Staeps\Favorites [2011.10.05 14:24:35 | 000,000,000 | R--D | C] -- C:\Users\Staeps\Downloads [2011.10.05 14:24:35 | 000,000,000 | R--D | C] -- C:\Users\Staeps\Documents [2011.10.05 14:24:35 | 000,000,000 | R--D | C] -- C:\Users\Staeps\Desktop [2011.10.05 14:24:35 | 000,000,000 | R--D | C] -- C:\Users\Staeps\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011.10.05 14:24:35 | 000,000,000 | -H-D | C] -- C:\Users\Staeps\AppData [2011.10.05 14:24:35 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Local\Temp [2011.10.05 14:24:35 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Local\Microsoft [2011.10.05 14:24:35 | 000,000,000 | ---D | C] -- C:\Users\Staeps\AppData\Roaming\Media Center Programs [2011.10.05 14:24:11 | 000,000,000 | -HSD | C] -- C:\Recovery [2011.10.05 14:24:10 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2011.10.05 14:24:10 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2011.10.05 14:24:10 | 000,000,000 | -HSD | C] -- C:\Programme [2011.10.05 14:24:10 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2011.10.05 14:24:10 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2011.10.05 14:24:10 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2011.10.05 14:24:10 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2011.10.05 14:24:10 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2011.10.05 14:24:10 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2011.10.05 14:24:10 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2011.10.05 14:24:10 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2011.10.05 14:14:55 | 000,000,000 | ---D | C] -- C:\Program Files\LSI SoftModem [2011.10.05 14:14:19 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2011.10.05 14:10:58 | 000,000,000 | -HSD | C] -- C:\System Volume Information [2009.08.22 11:01:18 | 000,036,136 | ---- | C] (Oberon Media) -- C:\ProgramData\FullRemove.exe ========== Files - Modified Within 30 Days ========== [2011.10.07 07:25:52 | 000,001,181 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft Works.lnk [2011.10.07 07:15:19 | 000,017,376 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.10.07 07:15:19 | 000,017,376 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.10.07 07:10:28 | 000,007,577 | ---- | M] () -- C:\Windows\SysNative\Config.MPF [2011.10.07 07:07:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.10.07 07:06:55 | 3219,922,944 | -HS- | M] () -- C:\hiberfil.sys [2011.10.06 12:12:08 | 000,001,812 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2011.10.06 12:02:56 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.10.06 09:13:46 | 000,000,201 | ---- | M] () -- C:\Windows\USER.XML [2011.10.06 09:13:13 | 000,002,609 | ---- | M] () -- C:\Users\Public\Desktop\eBay.lnk [2011.10.06 09:12:51 | 000,001,174 | ---- | M] () -- C:\Users\Public\Desktop\Acer Zubehör Shop.lnk [2011.10.06 09:09:38 | 000,343,008 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.10.06 08:47:41 | 000,000,214 | ---- | M] () -- C:\Windows\Factory.xml [2011.10.06 07:58:27 | 000,001,845 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk [2011.10.06 07:58:12 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt [2011.10.06 07:47:54 | 000,000,033 | ---- | M] () -- C:\Windows\0 [2011.10.06 07:47:19 | 000,000,089 | ---- | M] () -- C:\Windows\LManager.UNI [2011.10.06 07:45:04 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf [2011.10.06 07:38:38 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\McDefragTask.job [2011.10.06 07:38:38 | 000,000,320 | ---- | M] () -- C:\Windows\tasks\McQcTask.job [2011.10.06 00:08:54 | 000,001,667 | ---- | M] () -- C:\Windows\WPatchProgress.ini [2011.10.06 00:05:02 | 000,295,922 | ---- | M] () -- C:\Windows\SysNative\perfi007.dat [2011.10.06 00:05:02 | 000,038,104 | ---- | M] () -- C:\Windows\SysNative\perfd007.dat [2011.10.06 00:04:37 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\usbrpm.sys.mui [2011.10.06 00:04:32 | 000,017,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\fvevol.sys.mui [2011.10.06 00:04:29 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\UMDF\de-DE\WpdMtpDr.dll.mui [2011.10.06 00:04:23 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\qwavedrv.sys.mui [2011.10.06 00:04:22 | 000,017,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\nwifi.sys.mui [2011.10.06 00:04:22 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\qwavedrv.sys.mui [2011.10.06 00:04:19 | 000,028,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\volsnap.sys.mui [2011.10.06 00:04:19 | 000,025,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\usbport.sys.mui [2011.10.06 00:04:19 | 000,020,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\processr.sys.mui [2011.10.06 00:04:19 | 000,020,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\intelppm.sys.mui [2011.10.06 00:04:19 | 000,020,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\amdppm.sys.mui [2011.10.06 00:04:19 | 000,020,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\amdk8.sys.mui [2011.10.06 00:04:19 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\usbhub.sys.mui [2011.10.06 00:04:19 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\serial.sys.mui [2011.10.06 00:04:19 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ohci1394.sys.mui [2011.10.06 00:04:19 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\1394ohci.sys.mui [2011.10.06 00:04:19 | 000,011,776 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui [2011.10.06 00:04:19 | 000,011,776 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui [2011.10.06 00:04:19 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\i8042prt.sys.mui [2011.10.06 00:04:19 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\acpi.sys.mui [2011.10.06 00:04:19 | 000,009,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\battc.sys.mui [2011.10.06 00:04:19 | 000,008,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pci.sys.mui [2011.10.06 00:04:19 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\IPMIDrv.sys.mui [2011.10.06 00:04:19 | 000,005,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\sermouse.sys.mui [2011.10.06 00:04:19 | 000,005,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\kbdclass.sys.mui [2011.10.06 00:04:19 | 000,004,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mouclass.sys.mui [2011.10.06 00:04:19 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\wacompen.sys.mui [2011.10.06 00:04:19 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\vhdmp.sys.mui [2011.10.06 00:04:19 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\vdrvroot.sys.mui [2011.10.06 00:04:19 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\tpm.sys.mui [2011.10.06 00:04:19 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\isapnp.sys.mui [2011.10.06 00:04:19 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\hdaudbus.sys.mui [2011.10.06 00:04:19 | 000,003,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\parport.sys.mui [2011.10.06 00:04:19 | 000,003,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ataport.sys.mui [2011.10.06 00:04:19 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\umbus.sys.mui [2011.10.06 00:04:19 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mssmbios.sys.mui [2011.10.06 00:04:19 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mouhid.sys.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\vwifibus.sys.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ULIAGPKX.SYS.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\UAGP35.SYS.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\NV_AGP.SYS.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\MTConfig.sys.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\kbdhid.sys.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\GAGP30KX.SYS.mui [2011.10.06 00:04:19 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\AGP440.sys.mui [2011.10.06 00:04:19 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\wd.sys.mui [2011.10.06 00:04:19 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\disk.sys.mui [2011.10.06 00:04:19 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\cdrom.sys.mui [2011.10.06 00:04:19 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\amdide.sys.mui [2011.10.06 00:04:18 | 000,051,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\tcpip.sys.mui [2011.10.06 00:04:18 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mpio.sys.mui [2011.10.06 00:04:18 | 000,008,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bthport.sys.mui [2011.10.06 00:04:18 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\UMDF\de-DE\WUDFUsbccidDriver.dll.mui [2011.10.06 00:04:18 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\msdsm.sys.mui [2011.10.06 00:04:18 | 000,004,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pcmcia.sys.mui [2011.10.06 00:04:18 | 000,004,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bthpan.sys.mui [2011.10.06 00:04:18 | 000,004,096 | ---- | M] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui [2011.10.06 00:04:18 | 000,003,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\portcls.sys.mui [2011.10.06 00:04:18 | 000,003,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\HdAudio.sys.mui [2011.10.06 00:04:18 | 000,003,584 | ---- | M] (ATI Technologies Inc.) -- C:\Windows\SysNative\drivers\de-DE\atikmdag.sys.mui [2011.10.06 00:04:18 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\serscan.sys.mui [2011.10.06 00:04:18 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\rndismpx.sys.mui [2011.10.06 00:04:18 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\rndismp6.sys.mui [2011.10.06 00:04:18 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\hidbth.sys.mui [2011.10.06 00:04:18 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pnpmem.sys.mui [2011.10.06 00:04:18 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\Dot4usb.sys.mui [2011.10.06 00:04:18 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\BTHUSB.SYS.mui [2011.10.06 00:04:18 | 000,002,560 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui [2011.10.06 00:04:18 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ws2ifsl.sys.mui [2011.10.06 00:04:18 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bthenum.sys.mui [2011.10.06 00:04:14 | 000,016,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pacer.sys.mui [2011.10.06 00:04:12 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bfe.dll.mui [2011.10.06 00:04:12 | 000,003,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\modem.sys.mui [2011.10.06 00:04:11 | 000,003,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ipnat.sys.mui [2011.10.06 00:04:10 | 000,016,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\afd.sys.mui [2011.10.06 00:04:10 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\volmgrx.sys.mui [2011.10.06 00:04:09 | 000,072,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ntfs.sys.mui [2011.10.06 00:04:09 | 000,009,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\tunnel.sys.mui [2011.10.06 00:04:09 | 000,007,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\luafv.sys.mui [2011.10.06 00:04:09 | 000,005,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\ndiscap.sys.mui [2011.10.06 00:04:09 | 000,005,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\rdbss.sys.mui [2011.10.06 00:04:09 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\srv.sys.mui [2011.10.06 00:04:09 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\scfilter.sys.mui [2011.10.06 00:04:07 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ndisuio.sys.mui [2011.10.06 00:04:07 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\partmgr.sys.mui [2011.10.06 00:04:07 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mountmgr.sys.mui [2011.10.06 00:04:06 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\RNDISMP.sys.mui [2011.10.06 00:04:05 | 000,051,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\tcpip.sys.mui [2011.10.06 00:04:05 | 000,005,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ndiscap.sys.mui [2011.10.06 00:04:05 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\scfilter.sys.mui [2011.10.06 00:04:04 | 000,041,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ndis.sys.mui [2011.10.06 00:04:04 | 000,005,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\fltmgr.sys.mui [2011.10.06 00:04:04 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\wdf01000.sys.mui [2011.10.06 00:04:02 | 000,044,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\http.sys.mui [2011.10.06 00:04:02 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\bfe.dll.mui [2011.10.06 00:04:02 | 000,016,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\pacer.sys.mui [2011.10.06 00:04:02 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\scsiport.sys.mui [2011.10.05 23:58:26 | 000,000,896 | ---- | M] () -- C:\Windows\MOD01SET74000N0006.XML [2011.10.05 14:30:13 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.10.05 14:30:13 | 000,643,866 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.10.05 14:30:13 | 000,607,190 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.10.05 14:30:13 | 000,126,394 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.10.05 14:30:13 | 000,103,568 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.10.05 14:25:17 | 000,000,211 | RHS- | M] () -- C:\Preload.rev [2011.10.05 14:25:17 | 000,000,168 | ---- | M] () -- C:\Windows\WisLangCode.ini [2011.10.05 14:22:44 | 000,052,953 | ---- | M] () -- C:\Windows\SysWow64\license.rtf [2011.10.05 14:22:44 | 000,052,953 | ---- | M] () -- C:\Windows\SysNative\license.rtf ========== Files Created - No Company Name ========== [2011.10.06 12:12:08 | 000,001,812 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2011.10.06 12:02:56 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.10.06 09:13:13 | 000,002,609 | ---- | C] () -- C:\Users\Public\Desktop\eBay.lnk [2011.10.06 09:12:51 | 000,001,174 | ---- | C] () -- C:\Users\Public\Desktop\Acer Zubehör Shop.lnk [2011.10.06 08:43:17 | 000,002,569 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office PowerPoint Viewer 2007.lnk [2011.10.06 08:42:15 | 000,001,193 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works-Start.lnk [2011.10.06 07:58:27 | 000,001,845 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk [2011.10.06 07:58:12 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt [2011.10.06 07:47:54 | 000,000,033 | ---- | C] () -- C:\Windows\0 [2011.10.06 07:47:19 | 000,000,089 | ---- | C] () -- C:\Windows\LManager.UNI [2011.10.06 07:46:45 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll [2011.10.06 07:46:45 | 000,200,704 | ---- | C] () -- C:\Windows\PLFSetI.exe [2011.10.06 07:46:45 | 000,020,480 | ---- | C] () -- C:\Windows\USB_VIDEO_REG.exe [2011.10.06 07:46:45 | 000,008,362 | ---- | C] () -- C:\Windows\Suyin.reg [2011.10.06 07:46:45 | 000,000,323 | ---- | C] () -- C:\Windows\PidList.ini [2011.10.06 07:45:04 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf [2011.10.06 07:43:58 | 000,008,252 | ---- | C] () -- C:\Windows\SysNative\drivers\RtConvEQ.DAT [2011.10.06 07:43:58 | 000,001,112 | ---- | C] () -- C:\Windows\SysNative\drivers\RtHdatEx.dat [2011.10.06 07:43:58 | 000,000,520 | ---- | C] () -- C:\Windows\SysNative\drivers\RTEQEX2.dat [2011.10.06 07:43:58 | 000,000,520 | ---- | C] () -- C:\Windows\SysNative\drivers\RTEQEX1.dat [2011.10.06 07:43:58 | 000,000,520 | ---- | C] () -- C:\Windows\SysNative\drivers\RTEQEX0.dat [2011.10.06 07:43:58 | 000,000,008 | ---- | C] () -- C:\Windows\SysNative\drivers\rtkhdaud.dat [2011.10.06 00:05:41 | 000,643,866 | ---- | C] () -- C:\Windows\SysNative\perfh007.dat [2011.10.06 00:05:41 | 000,295,922 | ---- | C] () -- C:\Windows\SysNative\perfi007.dat [2011.10.06 00:05:41 | 000,126,394 | ---- | C] () -- C:\Windows\SysNative\perfc007.dat [2011.10.06 00:05:41 | 000,038,104 | ---- | C] () -- C:\Windows\SysNative\perfd007.dat [2011.10.05 23:58:26 | 000,000,896 | ---- | C] () -- C:\Windows\MOD01SET74000N0006.XML [2011.10.05 23:58:07 | 000,004,283 | RHS- | C] () -- C:\Patch.rev [2011.10.05 23:57:22 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\1025_Acer_Acer_Aspire 7540.mrk [2011.10.05 23:57:22 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\drivers\1025_Acer_Acer_Aspire 7540.mrk [2011.10.05 23:56:31 | 000,219,120 | ---- | C] () -- C:\Windows\SysWow64\atiumdva.cap [2011.10.05 23:56:31 | 000,219,120 | ---- | C] () -- C:\Windows\SysNative\atiumd6a.cap [2011.10.05 23:56:31 | 000,000,481 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.10.05 23:56:31 | 000,000,481 | ---- | C] () -- C:\Windows\SysNative\atipblag.dat [2011.10.05 23:56:30 | 000,332,288 | ---- | C] () -- C:\Windows\SysNative\ATIODE.exe [2011.10.05 23:56:30 | 000,197,654 | ---- | C] () -- C:\Windows\SysNative\atiicdxx.dat [2011.10.05 23:56:30 | 000,051,200 | ---- | C] () -- C:\Windows\SysNative\ATIODCLI.exe [2011.10.05 23:56:30 | 000,018,333 | ---- | C] () -- C:\Windows\atiogl.xml [2011.10.05 23:56:15 | 000,000,201 | ---- | C] () -- C:\Windows\USER.XML [2011.10.05 23:43:24 | 000,001,667 | ---- | C] () -- C:\Windows\WPatchProgress.ini [2011.10.05 14:28:03 | 000,001,443 | ---- | C] () -- C:\Users\Staeps\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2011.10.05 14:28:03 | 000,001,409 | ---- | C] () -- C:\Users\Staeps\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk [2011.10.05 14:26:09 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\McDefragTask.job [2011.10.05 14:26:01 | 000,000,320 | ---- | C] () -- C:\Windows\tasks\McQcTask.job [2011.10.05 14:10:58 | 3219,922,944 | -HS- | C] () -- C:\hiberfil.sys [2009.08.22 08:01:04 | 000,872,448 | ---- | C] () -- C:\Windows\iconv.dll [2009.08.22 08:01:04 | 000,743,424 | ---- | C] () -- C:\Windows\libxml2.dll [2009.08.22 08:01:02 | 000,000,193 | ---- | C] () -- C:\Windows\Prelaunch.ini [2009.08.22 08:01:02 | 000,000,168 | ---- | C] () -- C:\Windows\WisLangCode.ini [2009.08.22 08:01:02 | 000,000,147 | ---- | C] () -- C:\Windows\WisPriority.ini [2009.08.22 07:08:58 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 23:59:36 | 000,982,196 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin [2009.07.13 23:59:36 | 000,139,824 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin [2009.07.13 23:59:36 | 000,097,448 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin [2009.07.13 23:59:35 | 000,417,344 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin [2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat ========== Alternate Data Streams ========== @Alternate Data Stream - 368 bytes -> C:\WinRE{33875bcb0-c571-4ac4-9d2d-87796275a886}:$WIMMOUNTDATA < End of report > |
|
07.10.2011, 07:03
| #4 |
| | Google Suchbegriffe werden falsch weitergeleitet OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 07.10.2011 07:19:59 - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Users\Staeps\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,41 Gb Available Physical Memory | 60,31% Memory free
7,99 Gb Paging File | 5,89 Gb Available in Paging File | 73,73% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 230,52 Gb Total Space | 200,45 Gb Free Space | 86,95% Space Free | Partition Type: NTFS
Computer Name: STAEPS-PC | User Name: Staeps | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~3\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~3\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96F70DF8-160F-4F9C-9B9E-2A9B439B4EB9}" = Broadcom Gigabit NetLink Controller
"{BADFD936-E907-C666-A6E1-3C04C06E4260}" = ATI Catalyst Install Manager
"{C3199A20-E216-102C-04B0-8F9FF608A8E1}" = ccc-utility64
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{EE5BE032-86BA-4A2B-4CB0-556156B45FEA}" = ATI AVIVO64 Codecs
"LSI Soft Modem" = LSI HDA Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00303EC0-EE53-4934-A606-E9B98A96E026}" = CCC Help German
"{046BFB05-BC7F-01A4-C199-B49640D2AD0F}" = Catalyst Control Center Graphics Full New
"{064C45D3-880F-D130-554A-91043413BCEE}" = CCC Help Thai
"{08C12672-6B9B-F155-B060-D375A020B656}" = CCC Help Chinese Traditional
"{090EFBB9-1196-5391-3637-64CAAC5E982B}" = CCC Help Hungarian
"{119B7481-0216-40D2-A5CC-C3E1F461ECC1}" = Windows Live Fotogalerie
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{14272C6B-36D4-FB95-B95B-ADB1C2A7F029}" = CCC Help Italian
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1D535E4B-4D8D-FD55-AD08-125C8C4117D3}" = ccc-core-static
"{1DC4A8CA-F9B1-F762-2448-0A72B36E1E12}" = CCC Help Korean
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{309BBBEE-F25E-0105-6DB1-B668958C9D37}" = CCC Help Polish
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{3EDFC198-8ACC-A6C1-6991-35A80EC9A002}" = CCC Help English
"{42ED876C-C635-EF22-F4CD-620DC799CDDD}" = Catalyst Control Center Localization All
"{47826EF1-5634-D2E7-0C39-E356B8207676}" = CCC Help Turkish
"{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}" = Junk Mail filter update
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail
"{5C93667C-8802-F818-DE66-5E16996D6074}" = CCC Help Japanese
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{6140FD34-61AF-2EE7-3E9F-C0D26E532617}" = CCC Help Finnish
"{62F7DA7E-CCCB-439C-A760-00C3926E761F}" = Microsoft Works
"{68301905-2DEA-41CE-A4D4-E8B443B099BA}" = MyWinLocker
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{7760D94E-B1B5-40A0-9AA0-ABF942108755}" = Acer Crystal Eye Webcam
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{82809116-D1EE-443C-AE31-F19E709DDF7A}" = AMD USB Filter Driver
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}" = Chicken Invaders 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}" = Granny In Paradise
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112662477}" = Merriam Websters Spell Jam
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}" = Amazonia
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}" = Heroes of Hellas
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}" = Dream Day First Home
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114803710}" = Star Defender 4
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}" = Dairy Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}" = Farm Frenzy 2
"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger
"{8568FE6D-9769-A751-11D5-5AC7F6B698C2}" = CCC Help Russian
"{890E6592-0998-3C7A-2DB4-A29381485DA5}" = CCC Help Spanish
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B999A44-8314-493B-877E-A1DA5B54D9B8}" = Catalyst Control Center - Branding
"{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1" = Acer GameZone Console
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0017-0407-0000-0000000FF1CE}" = Microsoft Office SharePoint Designer MUI (German) 2007
"{90120000-0017-0407-0000-0000000FF1CE}_OMUI.de-de_{0B9EAEAC-F271-45DC-BDCB-06ABEEF19825}" = Microsoft Office SharePoint Designer 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_OMUI.de-de_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_OMUI.de-de_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002A-0407-1000-0000000FF1CE}_OMUI.de-de_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_OMUI.de-de_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0100-0407-0000-0000000FF1CE}" = Microsoft Office O MUI (German) 2007
"{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0101-0407-0000-0000000FF1CE}" = Microsoft Office X MUI (German) 2007
"{90120000-0101-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91E04CA7-0B13-4F8C-AA4D-2A573AC96D19}" = Windows Live Essentials
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{96A39248-6496-075F-BD29-E99333354958}" = CCC Help French
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{9978DB94-91EE-8D32-354E-F54A99051A37}" = Catalyst Control Center Core Implementation
"{A14A9BB0-7284-D33A-C5D8-DFD773843484}" = Catalyst Control Center Graphics Full Existing
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A391AF4E-D4D4-D295-19FC-FF6C2DB74169}" = CCC Help Portuguese
"{AAF89271-2594-468D-B578-96B2E30C41C4}" = eBay Worldwide
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.1 MUI
"{B02C36FE-3C50-CD6B-6469-4A2F8D90DB3B}" = CCC Help Dutch
"{B4E92469-CC2A-3AB0-E45A-F4C20F8C86C6}" = CCC Help Chinese Standard
"{B77CD8C3-7DB4-8339-0E2F-EEB8DFCABCBC}" = CCC Help Norwegian
"{BF2433BA-ACC4-6DA5-047E-B2D95FE8ECDA}" = CCC Help Greek
"{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}" = Norton Online Backup
"{CD0F9E16-4E3F-2369-9D67-9A0B84362D0A}" = Catalyst Control Center InstallProxy
"{D332D9A9-C8C7-67C6-D5B5-6A0088AB4CF5}" = CCC Help Czech
"{E0A6AD5F-CFAF-63ED-5C31-6E94B271A4C8}" = Catalyst Control Center Graphics Light
"{E41CF65A-72A1-143E-1B4E-1E570C6AD4EC}" = CCC Help Danish
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{ED636101-1959-4360-8BF7-209436E7DEE4}" = Windows Live Sync
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FC1FFB3D-0FD9-0746-31EF-3AD987574BE8}" = CCC Help Swedish
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"avast" = avast! Free Antivirus
"GridVista" = Acer GridVista
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Identity Card" = Identity Card
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.2.1300
"MSC" = McAfee SecurityCenter
"OMUI.de-de" = Microsoft Office Language Pack 2007 - German/Deutsch
"WinLiveSuite_Wave3" = Windows Live Essentials
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 06.10.2011 03:13:14 | Computer Name = Staeps-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\AVAST
Software\Avast\AvastUI.exe". Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 06.10.2011 03:44:47 | Computer Name = Staeps-PC | Source = McLogEvent | ID = 5051
Description = Ein Thread in Vorgang C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe brauchte
länger als 90000 ms, um eine Anfrage auszuführen. Der Vorgang wird beendet. Thread-ID:
5316 (0x14c4) Thread-Adresse: 0x0000000076F9FEFA Thread-Nachricht: Build VSCORE.14.0.0.433
/ 5301.4018 Object being scanned = \Device\HarddiskVolume3\Program Files\McAfee\VirusScan\Mcshield.exe
by C:\Program Files\AVAST Software\Avast\AvastSvc.exe 4(0)(0) 4(0)(0) 7200(0)(0)
7595(0)(0) 7005(0)(0) 7004(0)(0) 5006(0)(0) 5004(0)(0)
Error - 06.10.2011 04:05:13 | Computer Name = Staeps-PC | Source = Microsoft-Windows-CAPI2 | ID = 4101
Description = Fehler bei der automatischen Aktualisierung des Drittanbieterstammzertifikats
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/9FAD91A6CE6AC6C50047C44EC9D4A50D92D84979.crt>.
Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung zurückgegeben. .
Error - 06.10.2011 05:52:49 | Computer Name = Staeps-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\AVAST
Software\Avast\AvastUI.exe". Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 06.10.2011 06:02:58 | Computer Name = Staeps-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\AVAST
Software\Avast\AvastUI.exe". Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 06.10.2011 06:15:21 | Computer Name = Staeps-PC | Source = McLogEvent | ID = 5051
Description = Ein Thread in Vorgang C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe brauchte
länger als 90000 ms, um eine Anfrage auszuführen. Der Vorgang wird beendet. Thread-ID:
4188 (0x105c) Thread-Adresse: 0x0000000076F9FEFA Thread-Nachricht: Build VSCORE.14.0.0.433
/ 5400.1158 Object being scanned = \Device\HarddiskVolume3\Users\Staeps\AppData\Roaming\Microsoft\Windows\IETldCache\Low\index.dat
by C:\Program Files (x86)\Internet Explorer\iexplore.exe 4(0)(0) 4(0)(0) 7200(0)(0)
7595(0)(0) 7005(0)(0) 7004(0)(0) 5006(0)(0) 5004(0)(0)
Error - 06.10.2011 09:07:13 | Computer Name = Staeps-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\AVAST
Software\Avast\AvastUI.exe". Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 07.10.2011 01:09:57 | Computer Name = Staeps-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\AVAST
Software\Avast\AvastUI.exe". Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 07.10.2011 01:15:41 | Computer Name = Staeps-PC | Source = MsiInstaller | ID = 11935
Description =
Error - 07.10.2011 01:16:40 | Computer Name = Staeps-PC | Source = MsiInstaller | ID = 11935
Description =
[ System Events ]
Error - 07.10.2011 01:07:28 | Computer Name = Staeps-PC | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 07.10.2011 01:08:32 | Computer Name = Staeps-PC | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 07.10.2011 01:08:32 | Computer Name = Staeps-PC | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 07.10.2011 01:10:17 | Computer Name = Staeps-PC | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 07.10.2011 01:10:17 | Computer Name = Staeps-PC | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 07.10.2011 01:14:00 | Computer Name = Staeps-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x800f0902 fehlgeschlagen: Kumulatives Sicherheitsupdate für Internet Explorer
8 für Windows 7 für x64-Systeme (KB2559049)
Error - 07.10.2011 01:18:27 | Computer Name = Staeps-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
Windows Search erreicht.
Error - 07.10.2011 01:18:27 | Computer Name = Staeps-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht
gestartet: %%1053
Error - 07.10.2011 01:27:26 | Computer Name = Staeps-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
Windows Search erreicht.
Error - 07.10.2011 01:27:26 | Computer Name = Staeps-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht
gestartet: %%1053
< End of report >
|
|
07.10.2011, 09:36
| #5 |
| /// Malware-holic | Google Suchbegriffe werden falsch weitergeleitetCombofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde! Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
07.10.2011, 11:34
| #6 |
| | Google Suchbegriffe werden falsch weitergeleitet Combofix Logfile: Code:
ATTFilter ComboFix 11-10-07.03 - Staeps 07.10.2011 12:15:53.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.4094.2854 [GMT 2:00]
ausgeführt von:: c:\users\Staeps\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\google\common\google updater\googleupdaterservice.exe
c:\windows\msxml4-KB973688-enu.LOG
c:\windows\Temp\log.txt
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-09-07 bis 2011-10-07 ))))))))))))))))))))))))))))))
.
.
2011-10-07 10:22 . 2011-10-07 10:22 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F2DF78CE-2E11-481D-8AFB-77D5B5EE45B3}\offreg.dll
2011-10-07 10:20 . 2011-10-07 10:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-10-07 06:57 . 2011-09-21 07:00 9049936 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F2DF78CE-2E11-481D-8AFB-77D5B5EE45B3}\mpengine.dll
2011-10-07 06:30 . 2011-10-07 09:44 -------- d-----w- C:\1eb07a628ceae919023ee1b8e5d640
2011-10-07 06:29 . 2009-11-25 10:47 99176 ----a-w- c:\windows\SysWow64\PresentationHostProxy.dll
2011-10-07 06:29 . 2009-11-25 10:47 297808 ----a-w- c:\windows\SysWow64\mscoree.dll
2011-10-07 06:29 . 2009-11-25 10:47 295264 ----a-w- c:\windows\SysWow64\PresentationHost.exe
2011-10-07 06:29 . 2009-11-25 10:47 49472 ----a-w- c:\windows\SysWow64\netfxperf.dll
2011-10-07 06:29 . 2009-11-25 10:47 48960 ----a-w- c:\windows\system32\netfxperf.dll
2011-10-07 06:29 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll
2011-10-07 06:29 . 2009-11-25 10:47 109912 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2011-10-07 06:29 . 2009-11-25 10:47 444752 ----a-w- c:\windows\system32\mscoree.dll
2011-10-07 06:29 . 2009-11-25 10:47 320352 ----a-w- c:\windows\system32\PresentationHost.exe
2011-10-07 06:29 . 2009-11-25 10:47 1942856 ----a-w- c:\windows\system32\dfshim.dll
2011-10-07 05:24 . 2011-10-07 05:24 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2011-10-06 10:11 . 2011-10-07 09:21 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-10-06 10:02 . 2011-10-06 10:02 -------- d-----w- c:\programdata\Malwarebytes
2011-10-06 10:02 . 2011-08-31 15:00 25416 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-10-06 07:13 . 2011-10-06 07:13 -------- d-----w- c:\program files (x86)\OEM
2011-10-06 07:12 . 2011-10-06 07:12 -------- d-----w- c:\programdata\ATI
2011-10-06 06:33 . 2006-11-29 11:06 4398360 ----a-w- c:\windows\system32\d3dx9_32.dll
2011-10-06 06:33 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\SysWow64\d3dx9_32.dll
2011-10-06 06:31 . 2011-10-06 06:31 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition
2011-10-06 06:29 . 2011-10-06 06:29 -------- d-----w- c:\program files (x86)\Microsoft
2011-10-06 06:28 . 2011-10-06 06:28 -------- d-----w- c:\program files (x86)\Windows Live SkyDrive
2011-10-06 06:27 . 2011-10-06 06:35 -------- d-----w- c:\program files (x86)\Windows Live
2011-10-06 06:24 . 2011-10-06 06:24 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
2011-10-06 06:15 . 2011-10-06 06:15 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8
2011-10-06 06:04 . 2011-10-06 06:04 -------- d-----w- C:\BOOK
2011-10-06 06:03 . 2009-08-03 20:34 82432 ----a-w- c:\windows\SysWow64\msxml4r.dll
2011-10-06 06:03 . 2009-08-03 20:34 44544 ----a-w- c:\windows\SysWow64\msxml4a.dll
2011-10-06 06:03 . 2009-08-03 20:34 1233920 ----a-w- c:\windows\SysWow64\msxml4.dll
2011-10-06 06:01 . 2011-10-06 06:01 -------- d-----w- c:\program files (x86)\Cyberlink
2011-10-06 05:58 . 2011-09-06 20:45 254400 ----a-w- c:\windows\system32\aswBoot.exe
2011-10-06 05:57 . 2011-10-07 09:35 -------- d-----w- c:\programdata\AVAST Software
2011-10-06 05:57 . 2011-10-06 05:57 -------- d-----w- c:\program files\AVAST Software
2011-10-06 05:54 . 2011-10-06 06:03 -------- d-----w- c:\program files (x86)\Acer Arcade Deluxe
2011-10-06 05:54 . 2011-10-06 06:01 -------- d-----w- c:\programdata\CyberLink
2011-10-06 05:47 . 2011-10-06 05:47 -------- d-----w- c:\program files (x86)\Launch Manager
2011-10-06 05:46 . 2009-07-24 16:08 1658880 ----a-w- c:\windows\Acer Crystal Eye webcam.EXE
2011-10-06 05:46 . 2009-07-24 13:44 8362 ----a-w- c:\windows\Suyin.reg
2011-10-06 05:46 . 2008-12-30 11:42 626688 ----a-w- c:\windows\Image.dll
2011-10-06 05:46 . 2008-07-29 17:29 200704 ----a-w- c:\windows\PLFSetI.exe
2011-10-06 05:46 . 2008-06-25 12:22 20480 ----a-w- c:\windows\USB_VIDEO_REG.exe
2011-10-06 05:45 . 2011-05-24 17:14 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-10-06 05:44 . 2011-10-06 05:44 -------- d-----w- c:\program files\Synaptics
2011-10-06 05:44 . 2011-10-06 05:44 -------- d-----w- c:\windows\SysWow64\RTCOM
2011-10-06 05:41 . 2011-10-06 05:41 -------- d-----w- c:\program files\ATI
2011-10-05 22:05 . 2011-10-05 22:05 -------- d-----w- c:\windows\de-DE
2011-10-05 22:05 . 2011-10-05 22:05 -------- d-----w- c:\windows\SysWow64\XPSViewer
2011-10-05 22:05 . 2011-10-05 22:05 -------- d-----w- c:\windows\SysWow64\wbem\de-DE
2011-10-05 22:05 . 2011-10-05 22:05 -------- d-----w- c:\windows\SysWow64\drivers\UMDF\de-DE
2011-10-05 22:05 . 2011-10-05 22:05 -------- d-----w- c:\windows\SysWow64\drivers\de-DE
2011-10-05 22:05 . 2011-10-05 22:05 -------- d-----w- c:\windows\SysWow64\de
2011-10-05 22:05 . 2011-10-05 22:05 -------- d-----w- c:\windows\SysWow64\0407
2011-10-05 22:05 . 2011-10-05 22:05 -------- d-----w- c:\windows\system32\drivers\UMDF\de-DE
2011-10-05 22:05 . 2011-10-05 22:05 -------- d-----w- c:\windows\system32\drivers\de-DE
2011-10-05 22:05 . 2011-10-05 22:05 -------- d-----w- c:\windows\system32\0407
2011-10-05 22:05 . 2011-10-05 22:05 -------- d-----w- c:\windows\system32\wbem\de-DE
2011-10-05 22:05 . 2011-10-05 22:05 -------- d-----w- c:\windows\system32\de
2011-10-05 22:04 . 2011-10-05 22:04 3584 ----a-w- c:\windows\system32\Spool\prtprocs\x64\de-DE\LXKPTPRC.DLL.mui
2011-10-05 21:55 . 2009-08-22 18:15 431104 ----a-w- c:\windows\WisMvImg.exe
2011-10-05 21:55 . 2009-08-04 13:52 159744 ----a-w- c:\windows\PatchFul.exe
2011-10-05 21:55 . 2009-02-13 08:33 249856 ----a-w- c:\windows\Wisi2Bat.exe
2011-10-05 21:55 . 2009-08-11 06:00 382976 ----a-w- c:\windows\WisGAPasx64.exe
2011-10-05 21:55 . 2009-05-25 18:27 335872 ----a-w- c:\windows\ParseModule_X64.exe
2011-10-05 21:55 . 2009-08-11 06:00 322048 ----a-w- c:\windows\WisGAPas.exe
2011-10-05 21:55 . 2009-05-25 18:27 225280 ----a-w- c:\windows\ParseModule_X86.exe
2011-10-05 12:31 . 2011-10-05 12:31 -------- d-----w- c:\program files\Common Files\ATI Technologies
2011-10-05 12:28 . 2011-10-06 05:42 -------- d-----w- c:\program files (x86)\ATI Technologies
2011-10-05 12:28 . 2011-10-05 12:28 -------- d-----w- c:\programdata\EgisTec
2011-10-05 12:14 . 2011-10-05 12:14 -------- d-----w- c:\program files\LSI SoftModem
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-05 22:04 . 2011-10-05 22:04 2560 ----a-w- c:\windows\SysWow64\drivers\de-DE\qwavedrv.sys.mui
2011-10-05 22:04 . 2011-10-05 22:04 5632 ----a-w- c:\windows\SysWow64\drivers\de-DE\ndiscap.sys.mui
2011-10-05 22:04 . 2011-10-05 22:04 2560 ----a-w- c:\windows\SysWow64\drivers\de-DE\scfilter.sys.mui
2011-10-05 22:04 . 2011-10-05 22:04 51712 ----a-w- c:\windows\SysWow64\drivers\de-DE\tcpip.sys.mui
2011-10-05 22:04 . 2011-10-05 22:04 29696 ----a-w- c:\windows\SysWow64\drivers\de-DE\bfe.dll.mui
2011-10-05 22:04 . 2011-10-05 22:04 16896 ----a-w- c:\windows\SysWow64\drivers\de-DE\pacer.sys.mui
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
2009-08-22 05:45 433648 ----a-w- c:\programdata\Partner\Partner.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-08-07 09:18 120104 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-08-22 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-08-21 261888]
"EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-02 98304]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-08-27 1194504]
"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-07-31 128296]
"PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-08-04 181480]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 0206131317979448mcinstcleanup;McAfee Application Installer Cleanup (0206131317979448);c:\users\Staeps\AppData\Local\Temp\020613~1.EXE [x]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432]
R3 Partner Service;Partner Service;c:\programdata\Partner\Partner.exe [2009-08-22 332272]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};Power Control [2011/10/06 08:02];c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl [2009-08-04 19:45 146928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-08-05 844320]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-06-04 1150496]
S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-08-07 311592]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-21 62720]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
2009-08-22 05:45 750064 ----a-w- c:\programdata\Partner\Partner64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-08-07 09:19 137512 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-08-07 349480]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-06 8060960]
"PLFSetI"="c:\windows\PLFSetI.exe" [2008-07-29 200704]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-08-05 828960]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7540&r=27361011i636l0318z165t58n1a67n
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7540&r=27361011i636l0318z165t58n1a67n
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
c:\windows\SysWOW64\ping.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-10-07 12:32:03 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2011-10-07 10:32
.
Vor Suchlauf: 10 Verzeichnis(se), 211.142.250.496 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 210.604.400.640 Bytes frei
.
- - End Of File - - 58439BBEDFC0B3291C4911F4D4A1C0DB
|
|
07.10.2011, 11:55
| #7 |
| /// Malware-holic | Google Suchbegriffe werden falsch weitergeleitet poste mir mal einen GMER log bitte
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
09.10.2011, 18:28
| #8 |
| | Google Suchbegriffe werden falsch weitergeleitet also ich GMER heruntergeladen und durchgeführt. mir ist als erstes aufgefallen, dass ich im reiter rootkit/maleware nur services, registry und files auswählen kann, d.h. nicht wie bei der gmer-erklärung abgebildet. hab das programm paar mal laufen lassen. bei einigen versuchen hat GMER nichts gefunden. zwei mal wurden einige dateien angezeigt, jedoch ist der rechner zwischendurch abgestürzt. ich hab also keine gmar-log parat. was kann ich da machen? |
|
11.10.2011, 15:38
| #9 |
| /// Malware-holic | Google Suchbegriffe werden falsch weitergeleitet ich denke es wurde was angezeigt, ist GMER nicht bis zum ende gelaufen oder hast du einfach nur kein log gespeichert?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
14.10.2011, 12:44
| #10 |
| | Google Suchbegriffe werden falsch weitergeleitet GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-10-14 13:41:08
Windows 6.1.7600
Running: 5prt32v7.exe
---- Files - GMER 1.0.15 ----
File C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\VBE6.DLL (size mismatch) 2585592/2594632 bytes executable
File C:\Windows\winsxs\amd64_netfx-mscordacwks_b03f5f7f11d50a3a_6.1.7600.16789_none_b7fb3318aeb4335c 0 bytes
File C:\Windows\winsxs\amd64_netfx-mscordacwks_b03f5f7f11d50a3a_6.1.7600.16789_none_b7fb3318aeb4335c\mscordacwks.dll 1764184 bytes executable
File C:\Windows\winsxs\amd64_netfx-mscordacwks_b03f5f7f11d50a3a_6.1.7600.20935_none_a128e5e2c85fae7c 0 bytes
File C:\Windows\winsxs\amd64_netfx-mscordacwks_b03f5f7f11d50a3a_6.1.7600.20935_none_a128e5e2c85fae7c\mscordacwks.dll 1755480 bytes executable
File C:\Windows\winsxs\amd64_netfx-mscorjit_dll_b03f5f7f11d50a3a_6.1.7600.16789_none_4c3665acd8ffbf8f 0 bytes
File C:\Windows\winsxs\amd64_netfx-mscorjit_dll_b03f5f7f11d50a3a_6.1.7600.16789_none_4c3665acd8ffbf8f\mscorjit.dll 1576784 bytes executable
File C:\Windows\winsxs\amd64_netfx-mscorjit_dll_b03f5f7f11d50a3a_6.1.7600.20935_none_35641876f2ab3aaf 0 bytes
File C:\Windows\winsxs\amd64_netfx-mscorjit_dll_b03f5f7f11d50a3a_6.1.7600.20935_none_35641876f2ab3aaf\mscorjit.dll 1576272 bytes executable
File C:\Windows\winsxs\amd64_netfx-mscorwks_dll_b03f5f7f11d50a3a_6.1.7600.16789_none_bf371031d6b32789 0 bytes
File C:\Windows\winsxs\amd64_netfx-mscorwks_dll_b03f5f7f11d50a3a_6.1.7600.16789_none_bf371031d6b32789\mscorwks.dll 10007376 bytes executable
File C:\Windows\winsxs\amd64_netfx-mscorwks_dll_b03f5f7f11d50a3a_6.1.7600.20935_none_a864c2fbf05ea2a9 0 bytes
File C:\Windows\winsxs\amd64_netfx-mscorwks_dll_b03f5f7f11d50a3a_6.1.7600.20935_none_a864c2fbf05ea2a9\mscorwks.dll 9992528 bytes executable
File C:\Windows\winsxs\amd64_netfx-sos_dll_b03f5f7f11d50a3a_6.1.7600.16789_none_a0c97ad9a2a90f71 0 bytes
File C:\Windows\winsxs\amd64_netfx-sos_dll_b03f5f7f11d50a3a_6.1.7600.16789_none_a0c97ad9a2a90f71\SOS.dll 485192 bytes executable
File C:\Windows\winsxs\amd64_netfx-sos_dll_b03f5f7f11d50a3a_6.1.7600.20935_none_89f72da3bc548a91 0 bytes
File C:\Windows\winsxs\amd64_netfx-sos_dll_b03f5f7f11d50a3a_6.1.7600.20935_none_89f72da3bc548a91\SOS.dll 485192 bytes executable
File C:\Windows\winsxs\amd64_netfx-system.windows.forms_b03f5f7f11d50a3a_6.1.7600.16789_none_839c30727b0a1f18 0 bytes
File C:\Windows\winsxs\amd64_netfx-system.windows.forms_b03f5f7f11d50a3a_6.1.7600.16789_none_839c30727b0a1f18\System.Windows.Forms.dll 5025792 bytes executable
File C:\Windows\winsxs\amd64_netfx-system.windows.forms_b03f5f7f11d50a3a_6.1.7600.20935_none_6cc9e33c94b59a38 0 bytes
File C:\Windows\winsxs\amd64_netfx-system.windows.forms_b03f5f7f11d50a3a_6.1.7600.20935_none_6cc9e33c94b59a38\System.Windows.Forms.dll 5025792 bytes executable
File C:\Windows\winsxs\Manifests\amd64_5231e369c36646ea1a57b297f81e417f_31bf3856ad364e35_6.1.7600.20651_none_0345b45ee2329d91.manifest 705 bytes
File C:\Windows\winsxs\Manifests\amd64_0e3ba714ca84b5389c6e7b603fc58285_31bf3856ad364e35_6.1.7600.16535_none_2b1474fcbf66a684.manifest 705 bytes
File C:\Windows\winsxs\Manifests\amd64_cc7f0c77f5fd1e8b1acf07073e3ed92c_31bf3856ad364e35_6.1.7600.20651_none_197216561d672bcd.manifest 716 bytes
File C:\Windows\winsxs\Manifests\amd64_f713f8bbfeedef356d30161dcff6295c_31bf3856ad364e35_6.1.7600.16535_none_4b9c2e4901ed85c6.manifest 716 bytes
File C:\Windows\winsxs\msil_presentationframework_31bf3856ad364e35_6.1.7600.16542_none_76b62ec655328f6e 0 bytes
File C:\Windows\winsxs\msil_presentationframework_31bf3856ad364e35_6.1.7600.16542_none_76b62ec655328f6e\PresentationFramework.dll 5279744 bytes executable
File C:\Windows\winsxs\msil_presentationframework_31bf3856ad364e35_6.1.7600.20658_none_773afd616e52e333 0 bytes
File C:\Windows\winsxs\msil_presentationframework_31bf3856ad364e35_6.1.7600.20658_none_773afd616e52e333\PresentationFramework.dll 5279744 bytes executable
File C:\Windows\winsxs\msil_system.windows.forms_b77a5c561934e089_6.1.7600.16789_none_0572cb9effd6f83f 0 bytes
File C:\Windows\winsxs\msil_system.windows.forms_b77a5c561934e089_6.1.7600.16789_none_0572cb9effd6f83f\System.Windows.Forms.dll 5025792 bytes executable
File C:\Windows\winsxs\msil_system.windows.forms_b77a5c561934e089_6.1.7600.20935_none_eea07e691982735f 0 bytes
File C:\Windows\winsxs\msil_system.windows.forms_b77a5c561934e089_6.1.7600.20935_none_eea07e691982735f\System.Windows.Forms.dll 5025792 bytes executable
File C:\Windows\winsxs\Temp\PendingRenames\42b26021648acc01fa1600002803fc05.$$_syswow64_21ffbdd2a2dd92e0.cdf-ms 348708 bytes
File C:\Windows\winsxs\Temp\PendingRenames\c12c5721648acc01f81600002803fc05._0000000000000000.cdf-ms 556 bytes
File C:\Windows\winsxs\Temp\PendingRenames\c12c5721648acc01f91600002803fc05.$$.cdf-ms 3384 bytes
File C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7600.16772_none_4833ef7cd065b8b3 0 bytes
File C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7600.16772_none_4833ef7cd065b8b3\dnsapi.dll 269824 bytes executable
File C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7600.16772_none_4833ef7cd065b8b3\dnscacheugc.exe 28672 bytes executable
File C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7600.20914_none_49006e49e950e0ac 0 bytes
File C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7600.20914_none_49006e49e950e0ac\dnsapi.dll 270336 bytes executable
File C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7600.20914_none_49006e49e950e0ac\dnscacheugc.exe 28672 bytes executable
File C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17570_none_4a184beecd8df1f1 0 bytes
File C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17570_none_4a184beecd8df1f1\dnsapi.dll 270336 bytes executable
File C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17570_none_4a184beecd8df1f1\dnscacheugc.exe 28672 bytes executable
File C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.21673_none_4aa4e997e6a8ddc0 0 bytes
File C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.21673_none_4aa4e997e6a8ddc0\dnsapi.dll 270336 bytes executable
File C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.21673_none_4aa4e997e6a8ddc0\dnscacheugc.exe 28672 bytes executable
File C:\Windows\winsxs\wow64_microsoft-windows-explorerframe_31bf3856ad364e35_6.1.7600.20743_none_297986f5dae1a449 0 bytes
File C:\Windows\winsxs\wow64_microsoft-windows-explorerframe_31bf3856ad364e35_6.1.7600.20743_none_297986f5dae1a449\ExplorerFrame.dll 1495552 bytes executable
File C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202 0 bytes
File C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe 2614272 bytes executable
File C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2 0 bytes
File C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe 2614272 bytes executable
File C:\Windows\winsxs\wow64_microsoft-windows-mfreadwrite_31bf3856ad364e35_6.1.7600.16597_none_1f96b871661c7fad 0 bytes
File C:\Windows\winsxs\wow64_microsoft-windows-mfreadwrite_31bf3856ad364e35_6.1.7600.16597_none_1f96b871661c7fad\mfreadwrite.dll 196608 bytes executable
File C:\Windows\winsxs\wow64_microsoft-windows-webio_31bf3856ad364e35_6.1.7600.16688_none_c336dca72cc24698 0 bytes
File C:\Windows\winsxs\wow64_microsoft-windows-webio_31bf3856ad364e35_6.1.7600.16688_none_c336dca72cc24698\webio.dll 314368 bytes executable
File C:\Windows\winsxs\wow64_microsoft-windows-webio_31bf3856ad364e35_6.1.7600.20817_none_c40b2a8245a8069b 0 bytes
File C:\Windows\winsxs\wow64_microsoft-windows-webio_31bf3856ad364e35_6.1.7600.20817_none_c40b2a8245a8069b\webio.dll 314368 bytes executable
File C:\Windows\winsxs\wow64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.7600.16723_none_c327aeaf713aedc3 0 bytes
File C:\Windows\winsxs\wow64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.7600.16723_none_c327aeaf713aedc3\winhttp.dll 350720 bytes executable
File C:\Windows\winsxs\wow64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.7600.20862_none_c3850b808a79e3fa 0 bytes
File C:\Windows\winsxs\wow64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.7600.20862_none_c3850b808a79e3fa\winhttp.dll 350720 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-activexproxy_31bf3856ad364e35_6.1.7600.20743_none_12976b2c649ce0d4 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-activexproxy_31bf3856ad364e35_6.1.7600.20743_none_12976b2c649ce0d4\actxprxy.dll 309760 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-c..nt-xpsrasterservice_31bf3856ad364e35_6.1.7600.16699_none_1a6cea128d590d1c 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-c..nt-xpsrasterservice_31bf3856ad364e35_6.1.7600.16699_none_1a6cea128d590d1c\XpsRasterService.dll 135168 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-c..nt-xpsrasterservice_31bf3856ad364e35_6.1.7600.20830_none_1b2e65b1a64e1e58 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-c..nt-xpsrasterservice_31bf3856ad364e35_6.1.7600.20830_none_1b2e65b1a64e1e58\XpsRasterService.dll 135168 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-d2d_31bf3856ad364e35_6.1.7600.16699_none_a76c73d5bd490765 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-d2d_31bf3856ad364e35_6.1.7600.16699_none_a76c73d5bd490765\d2d1.dll 739840 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-d2d_31bf3856ad364e35_6.1.7600.20830_none_a82def74d63e18a1 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-d2d_31bf3856ad364e35_6.1.7600.20830_none_a82def74d63e18a1\d2d1.dll 739840 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-directx-warp10_31bf3856ad364e35_6.1.7600.16699_none_ea3330f5b8046cb4 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-directx-warp10_31bf3856ad364e35_6.1.7600.16699_none_ea3330f5b8046cb4\d3d10warp.dll 1170944 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-directx-warp10_31bf3856ad364e35_6.1.7600.20830_none_eaf4ac94d0f97df0 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-directx-warp10_31bf3856ad364e35_6.1.7600.20830_none_eaf4ac94d0f97df0\d3d10warp.dll 1170944 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_8.0.7600.16723_none_cfb29bc2aef09389 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_8.0.7600.16723_none_cfb29bc2aef09389\urlmon.dll 1228288 bytes
File C:\Windows\winsxs\x86_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_8.0.7600.20862_none_d00ff893c82f89c0 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_8.0.7600.20862_none_d00ff893c82f89c0\urlmon.dll 1229312 bytes
File C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7600.16723_none_1cb8776479f9ba1c 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7600.16723_none_1cb8776479f9ba1c\jsproxy.dll 48128 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7600.16723_none_1cb8776479f9ba1c\wininet.dll 981504 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7600.16723_none_1cb8776479f9ba1c\WininetPlugin.dll 68608 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-mfc42x_31bf3856ad364e35_6.1.7600.16778_none_f2f8fcc6b6d7733b 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-mfc42x_31bf3856ad364e35_6.1.7600.16778_none_f2f8fcc6b6d7733b\mfc42.dll 1137664 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-mfc42x_31bf3856ad364e35_6.1.7600.16778_none_f2f8fcc6b6d7733b\mfc42u.dll 1164288 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-mfc42x_31bf3856ad364e35_6.1.7600.20921_none_f3b1a90dcfd2d316 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-mfc42x_31bf3856ad364e35_6.1.7600.20921_none_f3b1a90dcfd2d316\mfc42.dll 1137664 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-mfc42x_31bf3856ad364e35_6.1.7600.20921_none_f3b1a90dcfd2d316\mfc42u.dll 1164288 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-mfc42x_31bf3856ad364e35_6.1.7601.17577_none_f4de5982b3fec5d0 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-mfc42x_31bf3856ad364e35_6.1.7601.17577_none_f4de5982b3fec5d0\mfc42.dll 1137664 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-mfc42x_31bf3856ad364e35_6.1.7601.17577_none_f4de5982b3fec5d0\mfc42u.dll 1164288 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-mfc42x_31bf3856ad364e35_6.1.7601.21680_none_f556245bcd2ad02a 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-mfc42x_31bf3856ad364e35_6.1.7601.21680_none_f556245bcd2ad02a\mfc42.dll 1137664 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-mfc42x_31bf3856ad364e35_6.1.7601.21680_none_f556245bcd2ad02a\mfc42u.dll 1164288 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7600.16699_none_ab72b03b72a35d83 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7600.16699_none_ab72b03b72a35d83\XpsPrint.dll 442880 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7600.16734_none_abae903772773451 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7600.16734_none_abae903772773451\XpsPrint.dll 442880 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7600.16779_none_ab8851f9729322c8 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7600.16779_none_ab8851f9729322c8\XpsPrint.dll 442880 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7600.20830_none_ac342bda8b986ebf 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7600.20830_none_ac342bda8b986ebf\XpsPrint.dll 442880 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7600.20875_none_ac0ded9c8bb45d36 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7600.20875_none_ac0ded9c8bb45d36\XpsPrint.dll 442880 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7600.20923_none_ac41fe8a8b8d9bfa 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7600.20923_none_ac41fe8a8b8d9bfa\XpsPrint.dll 442880 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7601.17537_none_ad97ee1b6f9aec42 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7601.17537_none_ad97ee1b6f9aec42\XpsPrint.dll 870912 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7601.17578_none_ad6daeb56fba755d 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7601.17578_none_ad6daeb56fba755d\XpsPrint.dll 870912 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7601.21636_none_ae208a9c88b972b5 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7601.21636_none_ae208a9c88b972b5\XpsPrint.dll 870912 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7601.21682_none_ade679d888e5990e 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7601.21682_none_ade679d888e5990e\XpsPrint.dll 870912 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-rasrtutils_31bf3856ad364e35_6.1.7600.16617_none_0d399fee4b938b9a 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-rasrtutils_31bf3856ad364e35_6.1.7600.16617_none_0d399fee4b938b9a\rtutils.dll 37376 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-rasrtutils_31bf3856ad364e35_6.1.7600.20738_none_0dae9d2b64c07c9d 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-rasrtutils_31bf3856ad364e35_6.1.7600.20738_none_0dae9d2b64c07c9d\rtutils.dll 37376 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-security-spp-wga_31bf3856ad364e35_6.1.7600.16723_none_ff66c6b2047a22cd 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-security-spp-wga_31bf3856ad364e35_6.1.7600.16723_none_ff66c6b2047a22cd\slwga.dll 14336 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-security-spp-wga_31bf3856ad364e35_6.1.7600.20862_none_ffc423831db91904 0 bytes
File C:\Windows\winsxs\x86_microsoft-windows-security-spp-wga_31bf3856ad364e35_6.1.7600.20862_none_ffc423831db91904\slwga.dll 14336 bytes executable
File C:\Windows\winsxs\x86_microsoft-windows-shell-comctl32-v5_31bf3856ad364e35_6.1.7600.16661_none_39841986393e7322 0 bytes
---- EOF - GMER 1.0.15 ----
|
|
24.10.2011, 12:38
| #11 |
| /// Malware-holic | Google Suchbegriffe werden falsch weitergeleitet sorry hab das irgendwie übersehen. wie läuft das gerät im moment?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
24.10.2011, 12:47
| #12 |
| | Google Suchbegriffe werden falsch weitergeleitet Das gerät läuft das eine mal ohne probleme, ein anderes mal startet das gerät nicht ins betriebsystem und versucht sich selber zu reparieren. das ganze ist mir ein rätsel |
|
24.10.2011, 12:52
| #13 |
| /// Malware-holic | Google Suchbegriffe werden falsch weitergeleitet hi, malware kann auch häufig schäden am system hinterlassen, die nur durch ein neu aufsetzen zu beheben sind, was in diesem fall, nach datenrettung wohl das beste währe. ich würde dir dabei helfen und erklären wie du das system in zukunft richtig absicherst.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
24.10.2011, 13:18
| #14 |
| | Google Suchbegriffe werden falsch weitergeleitet Wenn das die beste option ist, sehr gern. danke. die recovery-fkt. hab ich ja schon benutzt. meinst du den rechner vollständig leeren (mit 0 und 1 überschreiben) und dann neues BS draufspielen? wäre super, wenn du mir paar tipps gibst |
|
24.10.2011, 13:31
| #15 |
| /// Malware-holic | Google Suchbegriffe werden falsch weitergeleitet na eigendlich meinte ich mit recovery, hattest du die jetzt schon genutzt?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Google Suchbegriffe werden falsch weitergeleitet |
| 64-bit, ad.ad-srv, ad.yieldmanager, adfarm, avast, detected, falsch, fehler, fehlermeldung, festgestellt, google, herunterfahren, home, log, maleware, microsoft, neu, nicht möglich, notebook, problem, rechner, scan, seite, seiten, spyware, superantispyware, system, tradedoubler, win7, win7 64bit |
Linear-Darstellung
