| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: iexplore.exe Prozess öffnet sich immer wieder. (Kein Fenster)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
28.11.2011, 19:51
| #1 |
 |  iexplore.exe Prozess öffnet sich immer wieder. (Kein Fenster) Hey Ho Community! Ich habe mich nun, da ich zu meinem Problem auch nach langer Suche nichts Brauchbares finden konnte, hier registriert und hoffe, dass mir hier weitergeholfen wird. Das Problem ist, dass seit etwas längerer Zeit beim Systemstart der iexplore.exe Prozess mitgestartet wird. Wenn ich ihn schließe öffnet er sich (in unregelmäßigen Abständen) wieder neu. Es wird übrigens nie ein Fenster angezeigt. Malwarebytes haut dann immer die Meldung "Ein bösartiger Vorgang wurde gestoppt. Ausgehend von: iexplore" (oder so ähnlich) raus. Antivir findet nichts, Malwarebytes findet nichts und PC Safe Doctor findet auch nichts. Kennt jemand das Problem oder noch viel besser, eine Lösung? OTL Logs (nach Anleitung von http://www.trojaner-board.de/69886-a...-beachten.html) : OTL.txt OTL Logfile: Code:
ATTFilter OTL logfile created on: 28.11.2011 20:03:39 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\bigMAIK\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,14 Gb Available Physical Memory | 53,53% Memory free 8,00 Gb Paging File | 5,90 Gb Available in Paging File | 73,76% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 458,87 Gb Total Space | 204,59 Gb Free Space | 44,59% Space Free | Partition Type: NTFS Drive D: | 458,87 Gb Total Space | 313,75 Gb Free Space | 68,37% Space Free | Partition Type: NTFS Computer Name: KOMPUTA | User Name: bigMAIK | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.11.28 20:00:21 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\bigMAIK\Desktop\OTL.exe PRC - [2011.11.05 08:10:35 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2011.10.01 01:37:03 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2011.08.03 12:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe PRC - [2011.08.03 02:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2011.06.30 15:34:20 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2011.04.27 13:14:07 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2010.11.22 22:52:46 | 000,718,072 | ---- | M] (Tunngle.net GmbH) -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe PRC - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe PRC - [2010.11.04 13:53:03 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.01.07 23:51:02 | 000,380,928 | ---- | M] (Spigot, Inc.) -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe PRC - [2009.10.07 00:47:22 | 000,125,464 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe PRC - [2009.09.10 14:42:46 | 000,305,448 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe PRC - [2009.09.10 14:42:30 | 000,349,480 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe PRC - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe PRC - [2009.08.27 16:09:10 | 001,253,376 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe PRC - [2009.08.18 08:27:26 | 000,629,280 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe PRC - [2009.08.12 23:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe PRC - [2009.07.04 02:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe PRC - [2008.06.03 15:18:08 | 000,066,560 | ---- | M] () -- C:\Windows\jwpen.exe PRC - [2008.01.02 11:04:20 | 001,552,384 | ---- | M] (D-Link) -- C:\Program Files (x86)\D-Link\AirPlus XtremeG DWL-G122\AirGCFG.exe PRC - [2007.01.19 10:49:26 | 000,049,152 | ---- | M] (Wireless Service) -- C:\Program Files (x86)\ANI\ANIWZCS2 Service\ANIWZCSdS.exe PRC - [2007.01.19 10:49:04 | 000,049,152 | ---- | M] (Wireless Service) -- C:\Program Files (x86)\ANI\ANIWZCS2 Service\WZCSLDR2.exe ========== Modules (No Company Name) ========== MOD - [2011.11.05 08:10:35 | 001,989,592 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2011.08.03 02:31:28 | 000,255,592 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll MOD - [2009.08.18 08:31:22 | 000,163,840 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyHook.dll MOD - [2009.08.18 08:27:26 | 000,629,280 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe MOD - [2007.08.20 16:41:12 | 000,233,472 | ---- | M] () -- C:\Windows\SysWOW64\WlanApp.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2011.10.12 15:11:48 | 000,094,992 | ---- | M] (SANDBOXIE L.T.D) [Auto | Running] -- C:\Program Files\Sandboxie\SbieSvc.exe -- (SbieSvc) SRV:64bit: - [2009.10.30 13:27:44 | 000,036,168 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysNative\uxtuneup.dll -- (UxTuneUp) SRV:64bit: - [2009.10.07 00:47:10 | 000,191,000 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcS64) SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:64bit: - [2009.07.04 02:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service) SRV:64bit: - [2009.04.19 16:34:48 | 000,625,184 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) SRV:64bit: - [2009.04.19 16:34:48 | 000,207,904 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp) SRV - [2011.10.01 01:37:03 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.08.03 12:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2011.08.03 02:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2011.08.02 14:56:58 | 000,411,432 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2011.06.30 15:34:20 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.04.27 13:14:07 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.11.22 22:52:46 | 000,718,072 | ---- | M] (Tunngle.net GmbH) [Auto | Running] -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe -- (TunngleService) SRV - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service) SRV - [2010.10.19 19:11:03 | 000,607,048 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag) SRV - [2010.03.26 15:03:32 | 000,040,960 | ---- | M] () [Auto | Running] -- C:\Users\bigMAIK\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer) SRV - [2010.03.21 11:09:44 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2010.01.07 23:51:02 | 000,380,928 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe -- (Application Updater) SRV - [2009.10.30 13:33:44 | 001,353,544 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc) SRV - [2009.10.30 13:27:34 | 000,030,024 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysWOW64\uxtuneup.dll -- (UxTuneUp) SRV - [2009.09.10 14:42:46 | 000,305,448 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService) SRV - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service) SRV - [2009.08.27 16:09:10 | 001,253,376 | ---- | M] (MAGIX AG) [Unknown | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs) SRV - [2009.08.25 18:38:06 | 000,935,208 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2009.08.12 23:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008.08.15 04:46:20 | 000,284,016 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe -- (Adobe Version Cue CS4) SRV - [2008.08.07 10:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) SRV - [2008.06.03 15:18:08 | 000,066,560 | ---- | M] () [Auto | Running] -- C:\Windows\jwpen.exe -- (HWSuperPowerTablet) SRV - [2007.01.19 10:49:26 | 000,049,152 | ---- | M] (Wireless Service) [Auto | Running] -- C:\Program Files (x86)\ANI\ANIWZCS2 Service\ANIWZCSdS.exe -- (ANIWZCSdService) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.10.12 15:11:44 | 000,157,824 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Running] -- C:\Program Files\Sandboxie\SbieDrv.sys -- (SbieDrv) DRV:64bit: - [2011.08.31 17:00:50 | 000,025,416 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2011.07.21 11:11:10 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011.07.21 11:11:09 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011.05.10 10:41:27 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2011.05.10 07:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.07.12 19:36:10 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2010.07.09 14:47:29 | 000,828,912 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd) DRV:64bit: - [2009.10.07 00:45:50 | 000,030,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LVPr2M64.sys -- (LVPr2Mon) DRV:64bit: - [2009.10.07 00:45:50 | 000,030,232 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVPr2M64.sys -- (LVPr2M64) DRV:64bit: - [2009.09.16 08:02:42 | 000,031,232 | ---- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901t.sys -- (tap0901t) TAP-Win32 Adapter V9 (Tunngle) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 21:35:38 | 000,707,072 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr7364.sys -- (netr7364) DRV:64bit: - [2009.06.10 21:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.06.02 12:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk) DRV:64bit: - [2009.06.02 12:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter) DRV:64bit: - [2009.06.02 12:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ) DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009.05.06 00:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr) DRV:64bit: - [2009.05.06 00:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper) DRV:64bit: - [2009.05.01 00:01:34 | 000,327,576 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64) DRV:64bit: - [2009.04.30 23:55:56 | 002,755,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LV302V64.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI) DRV:64bit: - [2009.04.30 23:55:46 | 000,015,896 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lv302a64.sys -- (lvpepf64) DRV:64bit: - [2009.04.30 06:06:58 | 000,339,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET) DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi) DRV:64bit: - [2008.12.15 21:01:40 | 000,035,840 | ---- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BVRPMPR5a64.SYS -- (BVRPMPR5a64) DRV:64bit: - [2008.07.26 15:26:34 | 000,050,072 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVUSBS64.sys -- (LVUSBS64) DRV:64bit: - [2008.06.27 07:51:10 | 000,088,632 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\adfs.sys -- (adfs) DRV:64bit: - [2008.01.15 20:51:08 | 000,445,440 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Dr71WU.sys -- (RT73) DRV:64bit: - [2007.03.26 10:17:00 | 000,008,320 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HWDrawing.sys -- (VHWDrawing) DRV:64bit: - [2007.02.06 12:19:32 | 000,022,528 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Gt680x.sys -- (GT680x) DRV:64bit: - [2006.12.28 00:00:00 | 000,460,800 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fwlanusb.sys -- (FWLANUSB) DRV:64bit: - [2006.12.28 00:00:00 | 000,014,120 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject) DRV - [2010.12.30 10:54:06 | 000,034,736 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\RKHit.sys -- (RkHit) DRV - [2009.10.14 06:24:44 | 000,011,856 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2008.04.29 18:27:24 | 000,013,856 | ---- | M] () [Kernel | System | Running] -- C:\Program Files (x86)\i-Menu\hugoio64.sys -- (hugoio64) DRV - [2006.07.24 15:05:00 | 000,005,632 | ---- | M] () [File_System | System | Stopped] -- C:\Windows\SysWow64\drivers\StarOpen.sys -- (StarOpen) DRV - [2005.12.13 09:38:20 | 000,048,128 | ---- | M] (Alpha Networks Inc.) [Kernel | Auto | Stopped] -- c:\Windows\SysWOW64\ANIO64.sys -- (ANIO) DRV - [2002.07.17 14:20:32 | 000,084,832 | ---- | M] (Adaptec) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ASPI32.SYS -- (ASPI) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360310ln07974780l75bh4l1q366 IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360310ln07974780l75bh4l1q366 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360310ln07974780l75bh4l1q366 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360310ln07974780l75bh4l1q366 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360310ln07974780l75bh4l1q366 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/ IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files (x86)\Search Settings\SearchSettings.dll (Spigot, Inc.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local;*.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://google.com/" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}:1.4.14 FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.6 FF - prefs.js..extensions.enabledItems: fbdislike@doweb.fr:1.2.3 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6 FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.67.0 FF - prefs.js..extensions.enabledItems: battlefieldplay4free@ea.com:1.0.53.2 FF - prefs.js..extensions.enabledItems: {0471d3b0-a403-11df-981c-0800200c9a66}:0.921 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.6&q=" FF - prefs.js..network.proxy.http: "83.137.26.25" FF - prefs.js..network.proxy.http_port: 8080 FF - prefs.js..network.proxy.socks: "localhost" FF - prefs.js..network.proxy.socks_port: 9050 FF - prefs.js..network.proxy.socks_remote_dns: true FF - prefs.js..network.proxy.ssl: "localhost" FF - prefs.js..network.proxy.ssl_port: 9666 FF - prefs.js..network.proxy.type: 0 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=0.80.0: C:\Program Files (x86)\Battlelog Web Plugins\0.80.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@thrixxx.com/WebLaunch: C:\Program Files (x86)\thriXXX\WebLaunch\Binaries\npWebLaunch.dll File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@virtools.com/3DviaPlayer: C:\Program Files (x86)\Virtools\3D Life Player\npvirtools.dll (Dassault Systèmes) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@thrixxx.com/WebLaunch: C:\Program Files (x86)\thriXXX\WebLaunch\Binaries\npWebLaunch.dll File not found FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\bigMAIK\AppData\Roaming\5038 FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.26 17:40:14 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.11.26 17:40:14 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\bigMAIK\AppData\Roaming\5038 [2010.09.03 21:34:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\bigMAIK\AppData\Roaming\mozilla\Extensions [2011.11.13 21:41:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\bigMAIK\AppData\Roaming\mozilla\Firefox\Profiles\uftdsmax.default\extensions [2011.03.25 13:56:26 | 000,000,000 | ---D | M] (Fire.fm) -- C:\Users\bigMAIK\AppData\Roaming\mozilla\Firefox\Profiles\uftdsmax.default\extensions\{6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3} [2011.11.11 15:26:50 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\bigMAIK\AppData\Roaming\mozilla\Firefox\Profiles\uftdsmax.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2011.10.15 13:52:50 | 000,000,000 | ---D | M] (Cookies Manager+) -- C:\Users\bigMAIK\AppData\Roaming\mozilla\Firefox\Profiles\uftdsmax.default\extensions\{bb6bc1bb-f824-4702-90cd-35e2fb24f25d} [2011.11.13 21:41:55 | 000,000,000 | ---D | M] (BitDefender QuickScan) -- C:\Users\bigMAIK\AppData\Roaming\mozilla\Firefox\Profiles\uftdsmax.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2011.03.18 14:38:41 | 000,000,000 | ---D | M] (Battlefield Heroes Updater) -- C:\Users\bigMAIK\AppData\Roaming\mozilla\Firefox\Profiles\uftdsmax.default\extensions\battlefieldheroespatcher@ea.com [2011.03.22 14:26:17 | 000,000,000 | ---D | M] (Battlefield Play4Free) -- C:\Users\bigMAIK\AppData\Roaming\mozilla\Firefox\Profiles\uftdsmax.default\extensions\battlefieldplay4free@ea.com [2011.03.25 13:56:25 | 000,000,000 | ---D | M] (Personas) -- C:\Users\bigMAIK\AppData\Roaming\mozilla\Firefox\Profiles\uftdsmax.default\extensions\personas@christopher.beard [2011.06.05 10:40:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\bigMAIK\AppData\Roaming\mozilla\Firefox\Profiles\yatq4guh.default\extensions [2011.04.27 13:44:39 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\bigMAIK\AppData\Roaming\mozilla\Firefox\Profiles\yatq4guh.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2011.11.23 22:20:32 | 000,000,950 | ---- | M] () -- C:\Users\bigMAIK\AppData\Roaming\Mozilla\Firefox\Profiles\uftdsmax.default\searchplugins\icqplugin-1.xml [2011.05.15 00:11:04 | 000,000,656 | ---- | M] () -- C:\Users\bigMAIK\AppData\Roaming\Mozilla\Firefox\Profiles\uftdsmax.default\searchplugins\icqplugin-2.xml [2011.06.24 19:11:25 | 000,000,950 | ---- | M] () -- C:\Users\bigMAIK\AppData\Roaming\Mozilla\Firefox\Profiles\uftdsmax.default\searchplugins\icqplugin-3.xml [2011.08.09 14:15:58 | 000,000,950 | ---- | M] () -- C:\Users\bigMAIK\AppData\Roaming\Mozilla\Firefox\Profiles\uftdsmax.default\searchplugins\icqplugin-4.xml [2011.05.14 17:15:53 | 000,001,056 | ---- | M] () -- C:\Users\bigMAIK\AppData\Roaming\Mozilla\Firefox\Profiles\uftdsmax.default\searchplugins\icqplugin.xml [2011.11.11 15:41:42 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions () (No name found) -- C:\USERS\BIGMAIK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UFTDSMAX.DEFAULT\EXTENSIONS\{C36177C0-224A-11DA-8CD6-0800200C9A91}.XPI () (No name found) -- C:\USERS\BIGMAIK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UFTDSMAX.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2011.11.05 08:10:35 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.04.14 04:08:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010.07.12 17:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2006.08.09 11:16:08 | 000,030,408 | ---- | M] ( ) -- C:\Program Files (x86)\mozilla firefox\plugins\npWebLaunch.dll [2011.11.05 04:38:54 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.11.05 04:32:18 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011.11.05 04:38:54 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.11.05 04:38:54 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.11.05 04:38:54 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011.11.05 04:38:54 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.03.21 11:06:46 | 000,000,857 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 activate.adobe.com O2:64bit: - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 9\DLLx64\SnagitBHO64.dll (TechSmith Corporation) O2 - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitBHO.dll (TechSmith Corporation) O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll () O2 - BHO: (SearchSettings Class) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files (x86)\Search Settings\SearchSettings.dll (Spigot, Inc.) O3:64bit: - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 9\DLLx64\SnagitIEAddin64.dll (TechSmith Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll () O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitIEAddin.dll (TechSmith Corporation) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.) O4:64bit: - HKLM..\Run: [Ocs_SM] C:\Users\bigMAIK\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Adobe_ID0ENQBO] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD) O4 - HKLM..\Run: [ANIWZCS2Service] C:\Program Files (x86)\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Wireless Service) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [D-Link AirPlus XtremeG DWL-G122] C:\Program Files (x86)\D-Link\AirPlus XtremeG DWL-G122\AirGCFG.exe (D-Link) O4 - HKLM..\Run: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe () O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [pcsafedoctor.exe] C:\Program Files (x86)\PCSafeDoctor\pcsafedoctor.exe () O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.) O4 - HKCU..\Run: [SandboxieControl] C:\Program Files\Sandboxie\SbieCtrl.exe (SANDBOXIE L.T.D) O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\bigMAIK\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm () O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\bigMAIK\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm () O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Windows\SysNative\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Windows\SysNative\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000017 - C:\Windows\SysNative\nvLsp64.dll (NVIDIA) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000018 - C:\Windows\SysNative\nvLsp64.dll (NVIDIA) O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWOW64\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWOW64\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWOW64\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWOW64\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWOW64\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWOW64\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\SysWOW64\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\SysWOW64\nvLsp.dll (NVIDIA) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0A5D6079-07FA-4F5D-99F0-DD2A67E61445}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5A4F0A5F-8EA0-44EA-AF9A-AB6E3FBD2D6E}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8477CD2D-06AD-440B-852C-AA13688F4E3A}: DhcpNameServer = 7.254.254.254 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BCD83214-550A-4056-B62B-8396D69A4339}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D84B7ECD-6D9A-4417-97F9-7D47F3F5FB73}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E13D317E-A9D9-41AE-BFCD-88145D6E0CB5}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\gopher - No CLSID value found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKCU Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\WB: DllName - (C:\PROGRA~2\Stardock\OBJECT~1\WINDOW~1\fast64.dll) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - C:\PROGRA~2\COMMON~1\Stardock\MCPCore.dll (Stardock) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - Deskscapes - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{5d9291e8-6996-11e0-b930-e04056f75123}\Shell - "" = AutoRun O33 - MountPoints2\{5d9291e8-6996-11e0-b930-e04056f75123}\Shell\AutoRun\command - "" = K:\MI.exe O33 - MountPoints2\{71e49a4c-9186-11df-85e1-00262d202946}\Shell - "" = AutoRun O33 - MountPoints2\{71e49a4c-9186-11df-85e1-00262d202946}\Shell\AutoRun\command - "" = F:\setup.exe O33 - MountPoints2\{740cdd67-31c3-11df-aa95-00262d202946}\Shell - "" = AutoRun O33 - MountPoints2\{740cdd67-31c3-11df-aa95-00262d202946}\Shell\AutoRun\command - "" = K:\pushinst.exe O33 - MountPoints2\{b2bca298-8b60-11df-8fcb-00262d202946}\Shell - "" = AutoRun O33 - MountPoints2\{b2bca298-8b60-11df-8fcb-00262d202946}\Shell\AutoRun\command - "" = F:\Autorun.exe O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {26249626-BD1E-AB1D-0360-727BE6B68FE1} - Themes Setup ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {B85E2B51-8132-82CC-0DDA-281D9C340AE1} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {371AAA85-7EF6-6936-DDAB-4CA7B80F1D82} - Browser Customizations ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll (TuneUp Software) MsConfig:64bit - StartUpFolder: C:^Users^bigMAIK^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk - C:\PROGRA~2\Xfire\Xfire.exe - (Xfire Inc.) MsConfig:64bit - StartUpReg: APSDaemon - hkey= - key= - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) MsConfig:64bit - StartUpReg: Artisteer Loader - hkey= - key= - C:\Windows\artisteer.exe (Extensoft ) MsConfig:64bit - StartUpReg: BackupManagerTray - hkey= - key= - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.) MsConfig:64bit - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () MsConfig:64bit - StartUpReg: EgisTecLiveUpdate - hkey= - key= - C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.) MsConfig:64bit - StartUpReg: HWTablet KeyPlus - hkey= - key= - C:\Windows\SysWOW64\HWKeyPlus.exe () MsConfig:64bit - StartUpReg: HWTablet Service - hkey= - key= - C:\Windows\SysWOW64\HWTabTray.exe () MsConfig:64bit - StartUpReg: LogitechQuickCamRibbon - hkey= - key= - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe () MsConfig:64bit - StartUpReg: NortonOnlineBackupReminder - hkey= - key= - C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe (Symantec Corporation) MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.) MsConfig:64bit - StartUpReg: SearchSettings - hkey= - key= - C:\Program Files (x86)\Search Settings\SearchSettings.exe (Spigot, Inc.) MsConfig:64bit - StartUpReg: SwitchBoard - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) MsConfig:64bit - StartUpReg: VeohPlugin - hkey= - key= - C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks) MsConfig:64bit - State: "startup" - Reg Error: Key error. CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.11.28 20:00:29 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\bigMAIK\Desktop\OTL.exe [2011.11.28 18:31:03 | 000,000,000 | ---D | C] -- C:\Users\bigMAIK\Desktop\TheNamesRil3y [2011.11.28 17:38:58 | 000,000,000 | ---D | C] -- C:\Users\bigMAIK\Desktop\illum [2011.11.27 18:50:15 | 000,000,000 | ---D | C] -- C:\AdobeTemp [2011.11.26 15:04:20 | 000,000,000 | ---D | C] -- D:\Documents\VideoReDo [2011.11.26 15:04:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VideoReDoTVSuite4 [2011.11.26 15:03:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PCSafeDoctor [2011.11.26 15:02:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PCSafeDoctor [2011.11.22 13:36:08 | 000,000,000 | ---D | C] -- C:\Users\bigMAIK\Desktop\FallonArts [2011.11.21 17:43:41 | 000,000,000 | ---D | C] -- C:\Users\bigMAIK\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2011.11.19 22:39:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime [2011.11.19 22:35:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2011.11.19 22:34:40 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2011.11.18 16:37:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free FLV Converter [2011.11.18 14:53:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth [2011.11.16 19:00:20 | 000,000,000 | ---D | C] -- C:\Users\bigMAIK\Desktop\tex [2011.11.14 16:42:45 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed [2011.11.13 21:42:06 | 000,000,000 | ---D | C] -- C:\Users\bigMAIK\AppData\Roaming\QuickScan [2011.11.13 21:41:53 | 000,038,229 | ---- | C] (Generic) -- C:\Windows\SysWow64\drivers\StMp3Rec.sys [2011.11.13 21:41:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iPod [2011.11.13 21:41:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iPod [2011.11.11 16:10:14 | 000,000,000 | ---D | C] -- C:\Users\bigMAIK\AppData\Roaming\Malwarebytes [2011.11.11 16:09:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.11.11 16:09:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.11.11 16:09:51 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.11.11 16:09:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.11.06 02:42:03 | 000,000,000 | ---D | C] -- C:\Users\bigMAIK\AppData\Roaming\xUAs [2011.11.06 02:27:44 | 000,000,000 | ---D | C] -- C:\Users\bigMAIK\AppData\Roaming\xmldm [2011.10.30 19:37:06 | 000,000,000 | ---D | C] -- C:\Users\bigMAIK\Tracing [2011.10.30 18:27:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi [2009.10.17 03:04:41 | 000,036,136 | ---- | C] (Oberon Media) -- C:\ProgramData\FullRemove.exe [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\bigMAIK\AppData\Roaming\*.tmp files -> C:\Users\bigMAIK\AppData\Roaming\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.11.28 20:04:17 | 000,009,696 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.11.28 20:04:17 | 000,009,696 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.11.28 20:03:49 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.11.28 20:03:49 | 000,696,832 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.11.28 20:03:49 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.11.28 20:03:49 | 000,148,128 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.11.28 20:03:49 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.11.28 20:02:36 | 000,002,192 | ---- | M] () -- C:\Windows\Sandboxie.ini [2011.11.28 20:00:21 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\bigMAIK\Desktop\OTL.exe [2011.11.28 19:56:52 | 000,003,116 | ---- | M] () -- C:\Windows\HWTablet.bin [2011.11.28 19:56:23 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.11.28 19:56:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.11.28 19:56:09 | 3220,082,688 | -HS- | M] () -- C:\hiberfil.sys [2011.11.28 19:55:29 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\Access.dat [2011.11.28 19:54:15 | 000,000,188 | ---- | M] () -- C:\Users\bigMAIK\defogger_reenable [2011.11.28 19:51:01 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.11.28 19:05:30 | 000,280,736 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2011.11.28 19:05:30 | 000,280,736 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.11.28 19:02:23 | 000,215,128 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2011.11.28 18:29:59 | 552,997,592 | ---- | M] () -- C:\Users\bigMAIK\Desktop\TheNamesRil3y.avi [2011.11.28 16:51:22 | 000,000,007 | ---- | M] () -- C:\Windows\SysWow64\ANIWZCSUSERNAME [2011.11.27 20:20:12 | 000,000,406 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for bigMAIK.job [2011.11.27 16:22:35 | 000,001,456 | ---- | M] () -- C:\Users\bigMAIK\AppData\Local\Adobe Für Web speichern 12.0 Prefs [2011.11.27 14:32:13 | 000,023,448 | ---- | M] () -- C:\Users\bigMAIK\Desktop\montage.veg [2011.11.27 14:32:07 | 000,079,208 | ---- | M] () -- C:\Users\bigMAIK\Desktop\Montage.aep [2011.11.27 13:41:55 | 045,189,613 | ---- | M] () -- C:\Users\bigMAIK\Desktop\montage_final.wmv [2011.11.27 13:15:05 | 1459,848,288 | ---- | M] () -- C:\Users\bigMAIK\Desktop\Montage.avi [2011.11.27 02:14:46 | 028,106,046 | ---- | M] () -- C:\Users\bigMAIK\Desktop\homepage layout.psd [2011.11.27 01:33:55 | 000,768,651 | ---- | M] () -- C:\Users\bigMAIK\Desktop\stancorepoetry.jpg [2011.11.27 01:33:35 | 024,399,248 | ---- | M] () -- C:\Users\bigMAIK\Desktop\StancorePoetry.psd [2011.11.27 00:04:01 | 000,415,345 | ---- | M] () -- C:\Users\bigMAIK\Desktop\RMGFX avatar.jpg [2011.11.27 00:03:51 | 019,198,747 | ---- | M] () -- C:\Users\bigMAIK\Desktop\RMGFX avatar.psd [2011.11.26 15:03:18 | 000,000,022 | ---- | M] () -- C:\Windows\tpcsd [2011.11.26 15:03:01 | 000,001,059 | ---- | M] () -- C:\Users\bigMAIK\Desktop\pcsafedoctor.lnk [2011.11.25 18:41:52 | 000,813,336 | ---- | M] () -- C:\Users\bigMAIK\Desktop\Unbenannt-2.jpg [2011.11.21 18:01:46 | 000,000,132 | ---- | M] () -- C:\Users\bigMAIK\AppData\Roaming\Adobe PNG Format CS5 Prefs [2011.11.21 16:13:53 | 000,007,609 | ---- | M] () -- C:\Users\bigMAIK\AppData\Local\resmon.resmoncfg [2011.11.21 16:11:39 | 005,028,776 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.11.19 22:34:24 | 000,395,869 | ---- | M] () -- C:\Users\bigMAIK\Desktop\RMGFX.c4d [2011.11.19 22:34:01 | 169,314,537 | ---- | M] () -- C:\Users\bigMAIK\Desktop\RMGFX.mov [2011.11.17 16:58:00 | 000,110,320 | ---- | M] () -- C:\Users\bigMAIK\Desktop\Meteors.png [2011.11.16 22:30:37 | 003,476,079 | R--- | M] () -- C:\Users\bigMAIK\Desktop\ARCONA COMES - NEMO.mp3 [2011.11.16 16:10:46 | 010,139,813 | ---- | M] () -- C:\Users\bigMAIK\Desktop\can + textures.c4d [2011.11.16 06:58:57 | 001,456,959 | ---- | M] () -- C:\Users\bigMAIK\Desktop\Gschichte Russland.jpg [2011.11.16 06:58:36 | 003,734,792 | ---- | M] () -- C:\Users\bigMAIK\Desktop\Gschichte Russland.psd [2011.11.15 21:54:08 | 000,374,823 | ---- | M] () -- C:\Users\bigMAIK\Desktop\kalawa.c4d [2011.11.15 16:09:42 | 000,000,448 | ---- | M] () -- C:\ProgramData\gVYAYojT4NsdeL [2011.11.15 16:06:42 | 000,000,288 | ---- | M] () -- C:\ProgramData\~gVYAYojT4NsdeL [2011.11.15 16:06:42 | 000,000,216 | ---- | M] () -- C:\ProgramData\~gVYAYojT4NsdeLr [2011.11.14 18:55:14 | 000,197,256 | ---- | M] () -- C:\Windows\SysWow64\mlfcache.dat [2011.11.06 03:26:41 | 000,000,234 | ---- | M] () -- C:\Users\bigMAIK\AppData\Roaming\blckdom.res [2011.11.04 12:17:56 | 000,311,296 | ---- | M] (FLV.com) -- C:\Windows\SysWow64\TubeFinder.exe [2011.11.04 00:31:53 | 000,901,589 | ---- | M] () -- C:\Users\bigMAIK\Desktop\Particles.wmv [2011.11.01 02:00:05 | 000,012,288 | ---- | M] () -- C:\Users\bigMAIK\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\bigMAIK\AppData\Roaming\*.tmp files -> C:\Users\bigMAIK\AppData\Roaming\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.11.28 19:54:14 | 000,000,188 | ---- | C] () -- C:\Users\bigMAIK\defogger_reenable [2011.11.28 18:28:21 | 552,997,592 | ---- | C] () -- C:\Users\bigMAIK\Desktop\TheNamesRil3y.avi [2011.11.27 13:40:30 | 045,189,613 | ---- | C] () -- C:\Users\bigMAIK\Desktop\montage_final.wmv [2011.11.27 13:17:25 | 000,079,208 | ---- | C] () -- C:\Users\bigMAIK\Desktop\Montage.aep [2011.11.27 13:16:55 | 000,023,448 | ---- | C] () -- C:\Users\bigMAIK\Desktop\montage.veg [2011.11.27 13:10:44 | 1459,848,288 | ---- | C] () -- C:\Users\bigMAIK\Desktop\Montage.avi [2011.11.27 01:33:52 | 000,768,651 | ---- | C] () -- C:\Users\bigMAIK\Desktop\stancorepoetry.jpg [2011.11.27 01:33:31 | 024,399,248 | ---- | C] () -- C:\Users\bigMAIK\Desktop\StancorePoetry.psd [2011.11.27 00:01:58 | 019,198,747 | ---- | C] () -- C:\Users\bigMAIK\Desktop\RMGFX avatar.psd [2011.11.27 00:01:45 | 000,415,345 | ---- | C] () -- C:\Users\bigMAIK\Desktop\RMGFX avatar.jpg [2011.11.26 15:03:18 | 000,000,022 | ---- | C] () -- C:\Windows\tpcsd [2011.11.26 15:03:01 | 000,001,059 | ---- | C] () -- C:\Users\bigMAIK\Desktop\pcsafedoctor.lnk [2011.11.26 15:02:55 | 000,034,736 | ---- | C] () -- C:\Windows\SysWow64\drivers\RKHit.sys [2011.11.25 18:52:43 | 028,106,046 | ---- | C] () -- C:\Users\bigMAIK\Desktop\homepage layout.psd [2011.11.25 18:41:50 | 000,813,336 | ---- | C] () -- C:\Users\bigMAIK\Desktop\Unbenannt-2.jpg [2011.11.19 22:34:24 | 000,395,869 | ---- | C] () -- C:\Users\bigMAIK\Desktop\RMGFX.c4d [2011.11.19 22:33:57 | 169,314,537 | ---- | C] () -- C:\Users\bigMAIK\Desktop\RMGFX.mov [2011.11.17 16:59:35 | 000,110,320 | ---- | C] () -- C:\Users\bigMAIK\Desktop\Meteors.png [2011.11.16 22:30:23 | 003,476,079 | R--- | C] () -- C:\Users\bigMAIK\Desktop\ARCONA COMES - NEMO.mp3 [2011.11.16 19:00:19 | 010,139,813 | ---- | C] () -- C:\Users\bigMAIK\Desktop\can + textures.c4d [2011.11.15 21:54:08 | 000,374,823 | ---- | C] () -- C:\Users\bigMAIK\Desktop\kalawa.c4d [2011.11.15 16:06:42 | 000,000,288 | ---- | C] () -- C:\ProgramData\~gVYAYojT4NsdeL [2011.11.15 16:06:42 | 000,000,216 | ---- | C] () -- C:\ProgramData\~gVYAYojT4NsdeLr [2011.11.15 16:06:38 | 000,000,448 | ---- | C] () -- C:\ProgramData\gVYAYojT4NsdeL [2011.11.13 16:47:48 | 001,456,959 | ---- | C] () -- C:\Users\bigMAIK\Desktop\Gschichte Russland.jpg [2011.11.13 16:36:56 | 003,734,792 | ---- | C] () -- C:\Users\bigMAIK\Desktop\Gschichte Russland.psd [2011.11.06 02:27:52 | 000,000,234 | ---- | C] () -- C:\Users\bigMAIK\AppData\Roaming\blckdom.res [2011.11.04 00:30:19 | 000,901,589 | ---- | C] () -- C:\Users\bigMAIK\Desktop\Particles.wmv [2011.10.15 13:43:29 | 000,002,192 | ---- | C] () -- C:\Windows\Sandboxie.ini [2011.10.13 21:29:40 | 000,042,392 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll [2011.09.28 18:53:30 | 000,151,608 | ---- | C] () -- C:\Windows\UTP.exe [2011.08.03 02:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.07.10 21:56:23 | 000,000,132 | ---- | C] () -- C:\Users\bigMAIK\AppData\Roaming\Adobe BMP Format CS5 Prefs [2011.07.10 20:59:13 | 000,094,208 | ---- | C] () -- C:\Windows\SysWow64\WinTab32.dll [2011.07.10 20:59:13 | 000,077,824 | ---- | C] () -- C:\Windows\SysWow64\jwusbchk32.dll [2011.07.10 20:59:13 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\JWKey.dll [2011.07.10 20:59:13 | 000,066,560 | ---- | C] () -- C:\Windows\jwpen.exe [2011.07.10 20:59:13 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\HWKeyPlus.exe [2011.07.10 20:59:13 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\JWPen.dll [2011.07.10 20:59:13 | 000,028,672 | ---- | C] () -- C:\Windows\HWCkPenT.dll [2011.07.10 20:59:13 | 000,013,824 | ---- | C] () -- C:\Windows\DevInst.exe [2011.07.10 20:59:13 | 000,011,264 | ---- | C] () -- C:\Windows\HWDevInst.exe [2011.07.10 20:59:13 | 000,003,116 | ---- | C] () -- C:\Windows\HWTablet.bin [2011.07.10 20:59:12 | 000,184,320 | ---- | C] () -- C:\Windows\SysWow64\HWTabTray.exe [2011.07.09 15:51:21 | 000,001,593 | ---- | C] () -- C:\Windows\Barcgen.INI [2011.06.29 14:37:56 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2011.06.05 10:45:08 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE [2011.05.07 12:59:04 | 000,925,184 | ---- | C] () -- C:\Windows\expstart.exe [2011.04.19 20:31:02 | 000,000,003 | ---- | C] () -- C:\Windows\treeskp.sys [2011.04.19 20:31:02 | 000,000,003 | ---- | C] () -- C:\Windows\sbacknt.bin [2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.03.30 17:44:17 | 000,000,458 | ---- | C] () -- C:\Users\bigMAIK\AppData\Roaming\Poladroid prefs.plist [2011.03.03 17:28:42 | 008,434,776 | ---- | C] () -- C:\Users\bigMAIK\AppData\Roaming\BlackOpsMP.exe [2011.02.13 15:12:45 | 000,007,609 | ---- | C] () -- C:\Users\bigMAIK\AppData\Local\resmon.resmoncfg [2011.01.28 19:29:03 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll [2011.01.28 19:29:03 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini [2011.01.27 12:40:06 | 000,165,376 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [2011.01.27 12:40:05 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini [2011.01.27 12:40:04 | 000,810,496 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2011.01.27 12:40:04 | 000,183,808 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2011.01.27 12:40:04 | 000,080,896 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2011.01.02 12:49:51 | 000,000,000 | ---- | C] () -- C:\Windows\WB.ini [2010.12.29 02:11:48 | 000,001,456 | ---- | C] () -- C:\Users\bigMAIK\AppData\Local\Adobe Für Web speichern 12.0 Prefs [2010.12.28 13:21:40 | 000,007,852 | ---- | C] () -- C:\Windows\SysWow64\mcdmsg7.dll [2010.12.24 01:27:19 | 000,000,022 | -HS- | C] () -- C:\Users\bigMAIK\AppData\Roaming\Sys6925.Config Collection.sys [2010.12.24 01:27:19 | 000,000,022 | -HS- | C] () -- C:\Windows\Sys3390 SettingsCollection.bin [2010.12.22 15:28:42 | 000,000,132 | ---- | C] () -- C:\Users\bigMAIK\AppData\Roaming\Adobe PNG Format CS5 Prefs [2010.12.06 15:46:57 | 002,337,865 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2010.11.21 17:26:24 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat [2010.11.13 23:58:49 | 000,017,408 | ---- | C] () -- C:\Users\bigMAIK\AppData\Local\WebpageIcons.db [2010.10.19 09:54:50 | 000,000,088 | -HS- | C] () -- C:\ProgramData\.zreglib [2010.10.16 04:18:48 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe [2010.10.15 13:50:38 | 000,012,288 | ---- | C] () -- C:\Users\bigMAIK\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.10.06 14:01:10 | 000,001,025 | ---- | C] () -- C:\Windows\SysWow64\sysprs7.dll [2010.10.06 14:01:10 | 000,001,025 | ---- | C] () -- C:\Windows\SysWow64\clauth2.dll [2010.10.06 14:01:10 | 000,001,025 | ---- | C] () -- C:\Windows\SysWow64\clauth1.dll [2010.10.06 14:01:10 | 000,000,205 | ---- | C] () -- C:\Windows\SysWow64\lsprst7.dll [2010.10.06 14:01:10 | 000,000,073 | ---- | C] () -- C:\Windows\SysWow64\ssprs.dll [2010.10.06 14:01:10 | 000,000,021 | ---- | C] () -- C:\Windows\SurCode.INI [2010.09.26 20:48:13 | 000,000,000 | ---- | C] () -- C:\Windows\MusicEditor.INI [2010.09.17 18:18:28 | 000,000,028 | ---- | C] () -- C:\Windows\Robota.INI [2010.09.16 20:04:32 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll [2010.09.11 06:29:46 | 000,000,579 | ---- | C] () -- C:\Windows\qtracker.INI [2010.08.14 01:13:43 | 001,590,298 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.08.11 23:24:56 | 000,122,880 | ---- | C] () -- C:\Windows\UnGins.exe [2010.07.24 16:42:57 | 000,036,868 | ---- | C] () -- C:\Program Files (x86)\uninst-Particular.exe [2010.07.23 18:39:16 | 000,000,008 | ---- | C] () -- C:\Windows\SysWow64\F73859.bin [2010.07.23 18:35:16 | 000,000,008 | ---- | C] () -- C:\Windows\SysWow64\e9243f.bin [2010.07.17 19:20:11 | 000,043,520 | ---- | C] () -- C:\Windows\SysWow64\CmdLineExt03.dll [2010.07.10 18:28:17 | 000,065,536 | ---- | C] () -- C:\Windows\IFinst27.exe [2010.06.03 18:23:29 | 000,338,944 | ---- | C] () -- C:\Windows\SysWow64\Lffpx7.dll [2010.06.03 18:23:29 | 000,118,784 | ---- | C] () -- C:\Windows\SysWow64\Lfkodak.dll [2010.06.03 18:23:25 | 000,000,484 | ---- | C] () -- C:\Windows\SysWow64\A2NMiniDrv.ini [2010.06.03 13:05:01 | 000,000,000 | ---- | C] () -- C:\Windows\Watch.INI [2010.05.20 20:32:28 | 000,000,579 | ---- | C] () -- C:\Windows\eReg.dat [2010.05.06 19:52:45 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2010.05.06 19:52:36 | 000,280,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2010.04.07 21:20:02 | 000,233,472 | ---- | C] () -- C:\Windows\SysWow64\WlanApp.dll [2010.04.07 21:20:02 | 000,049,152 | ---- | C] () -- C:\Windows\SysWow64\JJAKEn.dll [2010.04.05 17:02:13 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\GkSui18.EXE [2010.03.29 07:28:09 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys [2010.03.21 10:57:40 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2010.03.21 10:55:39 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt [2010.03.20 22:41:25 | 000,197,256 | ---- | C] () -- C:\Windows\SysWow64\mlfcache.dat [2010.03.20 19:01:07 | 000,000,056 | ---- | C] () -- C:\Windows\SysWow64\ezsidmv.dat [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat [2007.06.27 16:13:51 | 000,516,096 | ---- | C] () -- C:\Windows\SysWow64\RegisterDialog.dll ========== LOP Check ========== [2011.07.10 17:10:51 | 000,000,000 | -HSD | M] -- C:\Users\bigMAIK\AppData\Roaming\.# [2011.11.02 15:39:58 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\.minecraft [2010.04.10 13:37:54 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\AbelCam [2011.02.01 17:03:07 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Activision [2010.12.07 13:37:55 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Amazon [2011.09.23 20:34:23 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Artisteer [2011.06.29 14:47:08 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Ashampoo [2010.06.04 11:28:00 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\avidemux [2010.07.10 18:51:49 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Bump Technologies, Inc [2011.11.21 17:43:41 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2010.09.22 15:32:31 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\CoSoSys [2010.03.19 21:15:38 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\DAEMON Tools Lite [2010.04.02 14:17:07 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\DAZ 3D [2011.04.12 13:51:55 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1 [2011.04.19 13:49:14 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\DVDVideoSoft [2010.10.16 23:55:58 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\DVDVideoSoftIEHelpers [2010.04.30 21:31:26 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\FileSubmit [2011.10.20 19:26:02 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\FileZilla [2010.03.29 07:53:41 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\FreeFLVConverter [2010.10.28 18:30:32 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\FreeMoviesToDVD [2010.08.11 23:03:53 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\FVSTemp [2010.09.12 17:15:48 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\FVZilla [2010.03.17 14:20:44 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\GameConsole [2011.02.07 23:38:55 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\GetRightToGo [2011.07.10 14:09:44 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\go [2011.11.28 20:01:58 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\ICQ [2010.11.20 09:59:19 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\IFViewer [2011.05.11 16:41:32 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\ImgBurn [2011.02.08 13:15:05 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\jp.clockmaker.IconGeneratorPro [2010.03.28 15:24:33 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Leadertech [2010.08.08 01:29:19 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\LolClient [2010.09.28 14:59:16 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\MAGIX [2011.10.15 21:14:22 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\MAXON [2010.06.06 21:33:23 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\McLoad [2010.11.06 17:24:05 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Need for Speed World [2010.06.11 19:51:35 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\New Technology Studio [2010.03.26 15:03:32 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\OCS [2011.09.15 12:59:28 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\OpenOffice.org [2010.03.26 15:03:37 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Opera [2011.11.06 15:21:51 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Origin [2011.09.17 23:31:26 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Peganza [2011.09.24 14:14:55 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\PO-MOtion [2010.05.09 13:27:07 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Publish Providers [2011.04.13 19:59:21 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\PunkBuster [2011.11.24 19:35:03 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\QuickScan [2011.10.30 21:28:09 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\replacer [2011.05.14 17:00:33 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Samsung [2010.05.21 19:41:12 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\SharePod [2010.10.19 09:54:57 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\SlySoft [2011.02.10 20:15:57 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Sony [2010.05.09 19:02:33 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Sony Creative Software [2011.08.12 10:39:36 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Spesoft Audio Converter [2010.10.17 16:20:22 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\svBuilder [2011.07.10 14:06:20 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Template [2010.10.19 18:34:48 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\TuneUp Software [2011.08.05 23:45:19 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Tunngle [2010.05.12 23:06:27 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Ubisoft [2011.01.07 21:58:49 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\uTorrent [2010.09.25 01:15:30 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\VMLoad [2010.04.10 13:44:45 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\Windows Live Writer [2011.11.06 02:44:55 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\xmldm [2011.11.18 22:41:40 | 000,000,000 | ---D | M] -- C:\Users\bigMAIK\AppData\Roaming\xUAs [2011.07.05 21:32:00 | 000,000,490 | ---- | M] () -- C:\Windows\Tasks\At1.job [2011.09.30 11:52:18 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2010.03.17 13:52:36 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN [2011.11.27 18:50:39 | 000,000,000 | ---D | M] -- C:\AdobeTemp [2011.11.26 17:41:29 | 000,000,000 | ---D | M] -- C:\AIM [2010.04.05 20:04:39 | 000,000,000 | ---D | M] -- C:\AV_LOGS [2011.11.26 17:41:29 | 000,000,000 | ---D | M] -- C:\BearPaw 2448TA Plus [2006.10.10 00:09:24 | 000,000,000 | ---D | M] -- C:\book [2011.11.28 16:49:45 | 000,000,000 | -HSD | M] -- C:\Config.Msi [2010.03.18 15:48:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings [2010.03.17 13:50:59 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2011.11.26 17:41:28 | 000,000,000 | ---D | M] -- C:\Driver [2010.12.17 14:46:22 | 000,000,000 | ---D | M] -- C:\Fiaa [2011.01.28 19:29:57 | 000,000,000 | ---D | M] -- C:\LGP500 [2011.11.26 17:41:28 | 000,000,000 | ---D | M] -- C:\mcobj [2010.06.26 20:55:43 | 000,000,000 | ---D | M] -- C:\MoTemp [2010.10.04 17:29:03 | 000,000,000 | ---D | M] -- C:\My Music [2010.09.30 06:01:06 | 000,000,000 | ---D | M] -- C:\MyWinLockerData [2011.11.26 17:41:28 | 000,000,000 | ---D | M] -- C:\Netgear [2010.10.16 04:05:13 | 000,000,000 | ---D | M] -- C:\Nexon [2010.04.04 13:15:07 | 000,000,000 | ---D | M] -- C:\NVIDIA [2011.11.26 17:41:28 | 000,000,000 | ---D | M] -- C:\OEM [2011.11.26 17:41:22 | 000,000,000 | R--D | M] -- C:\ordner mit sachen drin [2011.11.26 17:41:22 | 000,000,000 | ---D | M] -- C:\Panel [2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs [2010.07.24 16:42:57 | 000,000,000 | ---D | M] -- C:\Presets [2011.11.26 17:40:00 | 000,000,000 | ---D | M] -- C:\Program Files [2011.11.26 18:28:09 | 000,000,000 | R--D | M] -- C:\Program Files (x86) [2011.11.26 18:28:18 | 000,000,000 | ---D | M] -- C:\ProgramData [2010.03.17 13:50:59 | 000,000,000 | -HSD | M] -- C:\Programme [2010.03.17 13:50:59 | 000,000,000 | -HSD | M] -- C:\Recovery [2011.10.15 13:43:53 | 000,000,000 | R--D | M] -- C:\Sandbox [2011.11.28 20:06:08 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.11.11 15:26:41 | 000,000,000 | ---D | M] -- C:\SystemData [2010.06.20 16:07:10 | 000,000,000 | ---D | M] -- C:\TEMP [2011.10.01 11:43:58 | 000,000,000 | R--D | M] -- C:\Users [2011.11.28 20:02:36 | 000,000,000 | ---D | M] -- C:\Windows [2011.04.28 01:22:02 | 000,000,000 | ---D | M] -- C:\world1 < %PROGRAMFILES%\*.exe > [2010.07.24 16:42:57 | 000,036,868 | ---- | M] () -- C:\Program Files (x86)\uninst-Particular.exe < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > [2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] < MD5 for: EXPLORER.EXE > [2011.02.26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe [2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\W7SOC\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe [2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe [2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2009.08.03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe [2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe [2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2011.05.07 00:42:16 | 000,000,000 | -H-- | M] () MD5=D41D8CD98F00B204E9800998ECF8427E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe [2011.02.26 07:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe [2009.08.03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe < MD5 for: REGEDIT.EXE > [2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe [2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe [2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe [2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe < MD5 for: USERINIT.EXE > [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < > ========== Alternate Data Streams ========== @Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:3440EB47 @Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:4D066AD2 @Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:66633281 @Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:5D7E5A8F @Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0888F409 @Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:05EE1EEF @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:E3C56885 @Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:FFA81E8F < End of report > Anhang 24771 --- --- --- Geändert von theBIGmaik (28.11.2011 um 20:46 Uhr) |
|
28.11.2011, 20:10
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  iexplore.exe Prozess öffnet sich immer wieder. (Kein Fenster) Bitte beachten => http://www.trojaner-board.de/95173-b...es-posten.html und http://www.trojaner-board.de/69886-a...-beachten.html
__________________ |
|
28.11.2011, 20:42
| #3 | |
| | iexplore.exe Prozess öffnet sich immer wieder. (Kein Fenster)Zitat:
Ich kam, Ich sah, Ich änderte. |
|
29.11.2011, 09:44
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | iexplore.exe Prozess öffnet sich immer wieder. (Kein Fenster) Ok  Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.12.2011, 21:39
| #5 | |
| | iexplore.exe Prozess öffnet sich immer wieder. (Kein Fenster) Den Eset Scan hab ich noch nicht gemacht. Zitat:
|
|
| Themen zu iexplore.exe Prozess öffnet sich immer wieder. (Kein Fenster) |
| adware, alternate, antivir, antivir guard, avg, avira, bho, bonjour, c:\windows\system32\rundll32.exe, converter, cs4/contributeieplugin.dll, desktop, excel, firefox, google, google earth, hijackthis, iexplore, iexplore.exe, internet, internet explorer, launch, locker, lws.exe, malware, monitor, mozilla, mp3, mywinlocker, object, plug-in, problem, prozess, required, security scan, server, software, updates, version=1.0, webcheck, windows |
Linear-Darstellung
