| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: spyhunter, widgi toolbar, spigot....was tue ich am Besten?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
01.01.2012, 17:46
| #1 |
 |  spyhunter, widgi toolbar, spigot....was tue ich am Besten? Aloha und ein gutes neues Jahr an alle! Mir war heut langweilig und nachdem ich ein paar nicht mehr benötigte Programme deinstalliert hatte, meine iTunes Mediathek umgezogen hatte, bin ich mit stolzgeschwellter Brust daran gegangen, den Rechner weiter aufzuräumen. Ich fand unter den Autostartprogrammen die WidgiToolbar, die wohl eine etwas harmlose Form einer Spyware darstellt (ß) Nichtdestotrotz ....googleln und siehe da - es gibt es Programm, das das Ding beseitigt - spyhunter. Bis dahin kann ich meine Aktionen noch auf gestern/heute Nacht schieben, jetzt wirds nur noch blöd. In einem Zwischendind zwischen Panik und Blödheit flugs den Spiojäger heruntergeladen, installiert und siehe da - 431 Funde - Heureka. Weg mit dem Zeug - da sei allerdings der schnöde Mammon vor- erst wenn ich ca 30 € löhnte, könnte ich die Schadsoftware entfernen. Erneut SPYWARE googeln - uupps - das ist ja u.U. gar nicht so witzig. Also als Erstes Spybot S&D aktualisiert, drüber laufen lassen, ein harmloser Fund (nein - leider kein LOG). Nun habe ich mich mit Malwarebytes, OTL ausgerüstet, will aber nicht wie ein Verrückter posten (vor allem nicht mit meinem Rechnernamen, kann man das bei OTL ändern?). Konkret: Ich sehe nach einem Neustart des WIn 7 Rechners (Avira AntiVir Personal) keinerlei Verlangsamung usw. Aber: Als ich Spyware deinstallieren wollte, wurde ich "gehindert". Ein Programm vom Hersteller der Software- Enigma- meinte ständig - ich solle doch kaufen,dann gings auch mit der Deinstallatinon. Eine "sichtbare" exe ist in den Programmdateien nimmer, aber der Rest ist nicht deinstalliert. Ich finde aber in den Programmordnern, in der Systemsteuerung installierter Software etc. "Spuren von spyhunter, SPIGOT (habe einst pdfForge installiert, dann aber wieder deinstalliert, nutze jetzt anderen pdfcreator) und dieser ominösen WidgiToolbar. Ich nutze meinen/unserern Rechner um zwei ipods zu befüllen, zu surfen, online zu shoppen, auch online zu banken etc. Wie soll ich konkret vorgehen. Sorry für die etwas vage Beschreibung, stehe aber Gewehr bei Fuß, wenn ich Euch beim Helfen helfen kann. Meine Kenntnisse beschränken sich eher auf die eines erfahrenenen Handlangers. Danke RS ....pardon habe nun doch - nach eingehenderem Studium der "Was ist als Erstes zu tum-Regeln" ein Paar Dinge gepostet: AV-Scan-Report Avira AntiVir Personal Erstellungsdatum der Reportdatei: Sonntag, 1. Januar 2012 18:15 Es wird nach 3000859 Virenstämmen gesucht. Das Programm läuft als uneingeschränkte Vollversion. Online-Dienste stehen zur Verfügung. Lizenznehmer : Avira AntiVir Personal - Free Antivirus Seriennummer : 0000149996-ADJIE-0000001 Plattform : Windows 7 x64 Windowsversion : (plain) [6.1.7600] Boot Modus : Normal gebootet Benutzername : RSST Computername : RSST-PC Versionsinformationen: BUILD.DAT : 10.2.0.704 35934 Bytes 28.09.2011 13:14:00 AVSCAN.EXE : 10.3.0.7 484008 Bytes 02.07.2011 18:20:29 AVSCAN.DLL : 10.0.5.0 57192 Bytes 02.07.2011 18:20:29 LUKE.DLL : 10.3.0.5 45416 Bytes 02.07.2011 18:20:30 LUKERES.DLL : 10.0.0.0 13672 Bytes 14.01.2010 09:59:47 AVSCPLR.DLL : 10.3.0.7 119656 Bytes 02.07.2011 18:20:30 AVREG.DLL : 10.3.0.9 88833 Bytes 15.07.2011 18:36:55 VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 07:05:36 VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 11:03:16 VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 10:58:23 VBASE003.VDF : 7.11.19.171 2048 Bytes 20.12.2011 10:58:48 VBASE004.VDF : 7.11.19.172 2048 Bytes 20.12.2011 10:58:50 VBASE005.VDF : 7.11.19.173 2048 Bytes 20.12.2011 10:58:58 VBASE006.VDF : 7.11.19.174 2048 Bytes 20.12.2011 10:58:59 VBASE007.VDF : 7.11.19.175 2048 Bytes 20.12.2011 10:59:00 VBASE008.VDF : 7.11.19.176 2048 Bytes 20.12.2011 10:59:02 VBASE009.VDF : 7.11.19.177 2048 Bytes 20.12.2011 10:59:02 VBASE010.VDF : 7.11.19.178 2048 Bytes 20.12.2011 10:59:03 VBASE011.VDF : 7.11.19.179 2048 Bytes 20.12.2011 10:59:04 VBASE012.VDF : 7.11.19.180 2048 Bytes 20.12.2011 10:59:05 VBASE013.VDF : 7.11.19.217 182784 Bytes 22.12.2011 10:59:08 VBASE014.VDF : 7.11.19.255 148480 Bytes 24.12.2011 15:59:12 VBASE015.VDF : 7.11.20.29 164352 Bytes 27.12.2011 15:59:15 VBASE016.VDF : 7.11.20.70 180224 Bytes 29.12.2011 12:22:27 VBASE017.VDF : 7.11.20.71 2048 Bytes 29.12.2011 12:22:27 VBASE018.VDF : 7.11.20.72 2048 Bytes 29.12.2011 12:22:28 VBASE019.VDF : 7.11.20.73 2048 Bytes 29.12.2011 12:22:28 VBASE020.VDF : 7.11.20.74 2048 Bytes 29.12.2011 12:22:30 VBASE021.VDF : 7.11.20.75 2048 Bytes 29.12.2011 12:22:32 VBASE022.VDF : 7.11.20.76 2048 Bytes 29.12.2011 12:22:32 VBASE023.VDF : 7.11.20.77 2048 Bytes 29.12.2011 12:22:32 VBASE024.VDF : 7.11.20.78 2048 Bytes 29.12.2011 12:22:33 VBASE025.VDF : 7.11.20.79 2048 Bytes 29.12.2011 12:22:33 VBASE026.VDF : 7.11.20.80 2048 Bytes 29.12.2011 12:22:33 VBASE027.VDF : 7.11.20.81 2048 Bytes 29.12.2011 12:22:33 VBASE028.VDF : 7.11.20.82 2048 Bytes 29.12.2011 12:22:34 VBASE029.VDF : 7.11.20.83 2048 Bytes 29.12.2011 12:22:34 VBASE030.VDF : 7.11.20.84 2048 Bytes 29.12.2011 12:22:34 VBASE031.VDF : 7.11.20.97 132608 Bytes 30.12.2011 12:27:18 Engineversion : 8.2.8.18 AEVDF.DLL : 8.1.2.2 106868 Bytes 29.10.2011 07:46:24 AESCRIPT.DLL : 8.1.3.95 479612 Bytes 29.12.2011 12:22:45 AESCN.DLL : 8.1.7.2 127349 Bytes 24.11.2010 19:17:42 AESBX.DLL : 8.2.4.5 434549 Bytes 02.12.2011 17:13:35 AERDL.DLL : 8.1.9.15 639348 Bytes 10.09.2011 18:44:10 AEPACK.DLL : 8.2.15.1 770423 Bytes 17.12.2011 03:16:08 AEOFFICE.DLL : 8.1.2.25 201084 Bytes 31.12.2011 12:27:31 AEHEUR.DLL : 8.1.3.14 4260216 Bytes 31.12.2011 12:27:30 AEHELP.DLL : 8.1.18.0 254327 Bytes 29.10.2011 07:46:11 AEGEN.DLL : 8.1.5.17 405877 Bytes 08.12.2011 19:20:51 AEEMU.DLL : 8.1.3.0 393589 Bytes 24.11.2010 19:17:34 AECORE.DLL : 8.1.24.3 201079 Bytes 29.12.2011 12:22:35 AEBB.DLL : 8.1.1.0 53618 Bytes 24.04.2010 09:09:53 AVWINLL.DLL : 10.0.0.0 19304 Bytes 14.01.2010 09:59:10 AVPREF.DLL : 10.0.3.2 44904 Bytes 02.07.2011 18:20:29 AVREP.DLL : 10.0.0.10 174120 Bytes 27.05.2011 02:30:45 AVARKT.DLL : 10.0.26.1 255336 Bytes 02.07.2011 18:20:29 AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 02.07.2011 18:20:29 SQLITE3.DLL : 3.6.19.0 355688 Bytes 28.01.2010 10:57:53 AVSMTP.DLL : 10.0.0.17 63848 Bytes 16.03.2010 13:38:54 NETNT.DLL : 10.0.0.0 11624 Bytes 19.02.2010 12:40:55 RCIMAGE.DLL : 10.0.0.35 2589544 Bytes 02.07.2011 18:20:29 RCTEXT.DLL : 10.0.64.0 98664 Bytes 02.07.2011 18:20:29 Konfiguration für den aktuellen Suchlauf: Job Name..............................: Suche nach Rootkits und aktiver Malware Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\PROFILES\rootkit.avp Protokollierung.......................: standard Primäre Aktion........................: interaktiv Sekundäre Aktion......................: ignorieren Durchsuche Masterbootsektoren.........: ein Durchsuche Bootsektoren...............: ein Durchsuche aktive Programme...........: ein Laufende Programme erweitert..........: ein Durchsuche Registrierung..............: ein Suche nach Rootkits...................: ein Integritätsprüfung von Systemdateien..: aus Optimierter Suchlauf..................: ein Datei Suchmodus.......................: Alle Dateien Durchsuche Archive....................: ein Rekursionstiefe einschränken..........: aus Archiv Smart Extensions...............: ein Abweichende Archivtypen...............: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox, +ISO 9660, Makrovirenheuristik...................: ein Dateiheuristik........................: vollständig Abweichende Gefahrenkategorien........: +PCK,+PFS,+SPR, Beginn des Suchlaufs: Sonntag, 1. Januar 2012 18:15 Der Suchlauf nach versteckten Objekten wird begonnen. HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows CE Services\symboliclinkvalue [HINWEIS] Der Registrierungseintrag ist nicht sichtbar. Der Suchlauf über gestartete Prozesse wird begonnen: Durchsuche Prozess 'avscan.exe' - '71' Modul(e) wurden durchsucht Durchsuche Prozess 'avcenter.exe' - '102' Modul(e) wurden durchsucht Durchsuche Prozess 'plugin-container.exe' - '74' Modul(e) wurden durchsucht Durchsuche Prozess 'firefox.exe' - '132' Modul(e) wurden durchsucht Durchsuche Prozess 'ArcCon.ac' - '62' Modul(e) wurden durchsucht Durchsuche Prozess 'iTunesHelper.exe' - '68' Modul(e) wurden durchsucht Durchsuche Prozess 'ACDaemon.exe' - '45' Modul(e) wurden durchsucht Durchsuche Prozess 'hpwuschd2.exe' - '20' Modul(e) wurden durchsucht Durchsuche Prozess 'avgnt.exe' - '65' Modul(e) wurden durchsucht Durchsuche Prozess 'IAAnotif.exe' - '39' Modul(e) wurden durchsucht Durchsuche Prozess 'SDWinSec.exe' - '48' Modul(e) wurden durchsucht Durchsuche Prozess 'IAANTMon.exe' - '36' Modul(e) wurden durchsucht Durchsuche Prozess 'TestHandler.exe' - '31' Modul(e) wurden durchsucht Durchsuche Prozess 'SeaPort.exe' - '50' Modul(e) wurden durchsucht Durchsuche Prozess 'AppleMobileDeviceService.exe' - '63' Modul(e) wurden durchsucht Durchsuche Prozess 'avguard.exe' - '69' Modul(e) wurden durchsucht Durchsuche Prozess 'ACService.exe' - '24' Modul(e) wurden durchsucht Durchsuche Prozess 'aavus.exe' - '41' Modul(e) wurden durchsucht Durchsuche Prozess 'sched.exe' - '49' Modul(e) wurden durchsucht Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen: Die Registry wurde durchsucht ( '155' Dateien ). Der Suchlauf über die ausgewählten Dateien wird begonnen: Beginne mit der Suche in 'C:' <System> Ende des Suchlaufs: Sonntag, 1. Januar 2012 19:17 Benötigte Zeit: 1:01:52 Stunde(n) Der Suchlauf wurde vollständig durchgeführt. 34444 Verzeichnisse wurden überprüft 765947 Dateien wurden geprüft 0 Viren bzw. unerwünschte Programme wurden gefunden 0 Dateien wurden als verdächtig eingestuft 0 Dateien wurden gelöscht 0 Viren bzw. unerwünschte Programme wurden repariert 0 Dateien wurden in die Quarantäne verschoben 0 Dateien wurden umbenannt 0 Dateien konnten nicht durchsucht werden 765947 Dateien ohne Befall 17572 Archive wurden durchsucht 0 Warnungen 1 Hinweise 463011 Objekte wurden beim Rootkitscan durchsucht 1 Versteckte Objekte wurden gefunden _________________________________________________________________ OTL-scanOTL Logfile: Code:
ATTFilter OTL logfile created on: 1/1/2012 7:27:36 PM - Run 3 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\RSST\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 5.97 Gb Total Physical Memory | 3.96 Gb Available Physical Memory | 66.43% Memory free 11.93 Gb Paging File | 9.97 Gb Available in Paging File | 83.54% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 60.00 Gb Total Space | 19.24 Gb Free Space | 32.07% Space Free | Partition Type: NTFS Drive D: | 403.75 Gb Total Space | 375.75 Gb Free Space | 93.07% Space Free | Partition Type: NTFS Computer Name: RSST-PC | User Name: RSST | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012/01/01 16:58:23 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\RSST\Desktop\OTL.exe PRC - [2011/12/08 01:36:42 | 000,421,736 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\iTunesHelper.exe PRC - [2011/12/03 13:12:22 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2011/07/02 19:20:29 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2011/04/27 18:02:29 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2010/10/30 21:46:16 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2010/10/27 18:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe PRC - [2010/08/25 10:27:44 | 000,309,824 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac PRC - [2010/03/18 10:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe PRC - [2009/06/05 03:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2009/06/05 03:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe PRC - [2009/02/19 14:46:26 | 000,341,264 | ---- | M] (Fujitsu Technology Solutions) -- C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe PRC - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- D:\Neu installierte Programme\Spybot - Search & Destroy\SDWinSec.exe PRC - [2008/10/24 16:35:44 | 000,128,296 | ---- | M] () -- D:\Steuer-Spar-Erklaerung 2010 von Bild\AAVUpdateManager\aavus.exe ========== Modules (No Company Name) ========== MOD - [2011/12/03 13:12:21 | 001,989,592 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2011/11/01 23:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011/11/01 23:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011/06/06 20:40:55 | 006,271,136 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2009/07/14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV:64bit: - [2009/07/01 18:54:02 | 000,864,032 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins) SRV - [2011/12/14 13:13:28 | 000,748,440 | ---- | M] (Spigot, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe -- (Application Updater) SRV - [2011/07/02 19:20:29 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011/04/27 18:02:29 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010/03/18 10:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon) SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009/06/05 03:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON) Intel(R) SRV - [2009/02/19 14:46:26 | 000,341,264 | ---- | M] (Fujitsu Technology Solutions) [Auto | Running] -- C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler) SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- D:\Neu installierte Programme\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService) SRV - [2008/10/24 16:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- D:\Steuer-Spar-Erklaerung 2010 von Bild\AAVUpdateManager\aavus.exe -- (AAV UpdateService) SRV - [2007/05/31 10:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm) SRV - [2007/05/31 10:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011/08/02 17:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2011/07/02 19:20:30 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011/07/02 19:20:30 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011/03/11 07:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011/03/11 07:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010/06/23 09:10:56 | 000,344,680 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2010/04/01 10:13:36 | 001,100,320 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192se.sys -- (rtl8192se) DRV:64bit: - [2009/08/21 12:24:04 | 000,084,512 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009/07/14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009/07/14 01:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam) DRV:64bit: - [2009/07/14 01:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx) DRV:64bit: - [2009/07/14 00:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM) DRV:64bit: - [2009/07/01 11:46:58 | 000,052,264 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btusbflt.sys -- (btusbflt) DRV:64bit: - [2009/07/01 11:46:52 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio) DRV:64bit: - [2009/07/01 11:46:48 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt) DRV:64bit: - [2009/07/01 11:46:40 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid) DRV:64bit: - [2009/06/10 21:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009/06/05 02:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009/06/04 15:46:50 | 000,216,064 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR) DRV:64bit: - [2009/05/18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009/04/07 14:33:08 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap) DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=FTSA&bmod=EU01 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.ts.fujitsu.com/index2 [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ts.fujitsu.com/index2 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0B 77 1F 51 72 97 CA 01 [binary data] IE - HKCU\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\4.9\pdfforgeToolbarIE.dll (Spigot, Inc.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=302398&ilc=12" FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=302398&p=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\Firefox [2010/12/04 14:29:17 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011/05/10 12:07:14 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/12/03 13:12:23 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011/12/18 14:38:01 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2010/04/01 18:52:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\RSST\AppData\Roaming\mozilla\Extensions [2010/04/01 18:52:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\RSST\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2012/01/01 11:36:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\RSST\AppData\Roaming\mozilla\Firefox\Profiles\5k0bcngu.default\extensions [2011/12/29 15:26:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2011/12/29 15:26:53 | 000,000,000 | ---D | M] (Widgi Toolbar Platform) -- C:\PROGRAM FILES (X86)\COMMON FILES\SPIGOT\WTXPCOM [2011/12/29 15:26:53 | 000,000,000 | ---D | M] (pdfforge Toolbar) -- C:\PROGRAM FILES (X86)\PDFFORGE TOOLBAR\FF [2011/12/03 13:12:22 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011/11/23 13:01:06 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011/11/23 13:01:06 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011/11/23 13:01:06 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011/11/23 13:01:06 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011/11/23 13:01:06 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011/11/23 13:01:06 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009/06/10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Neu installierte Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\4.9\pdfforgeToolbarIE.dll (Spigot, Inc.) O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (@C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\4.9\pdfforgeToolbarIE.dll (Spigot, Inc.) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [iTunesHelper] C:\Program Files (x86)\iTunesHelper.exe (Apple Inc.) O4 - HKCU..\Run: [RegistryBooster] "C:\Program Files (x86)\Uniblue\RegistryBooster\launcher.exe" delay 20000 File not found O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] D:\Neu installierte Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html File not found O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html File not found O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Neu installierte Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Reg Error: Key error.) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{92A82E5E-23B7-411E-996B-D10405AE0190}: DhcpNameServer = 192.168.178.1 O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2012/01/01 15:18:54 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{55141733-5b0d-11de-9ace-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{55141733-5b0d-11de-9ace-806e6f6e6963}\Shell\AutoRun\command - "" = E:\start.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012/01/01 16:59:49 | 000,000,000 | ---D | C] -- C:\Users\RSST\AppData\Roaming\Malwarebytes [2012/01/01 16:59:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012/01/01 16:59:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012/01/01 16:59:42 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012/01/01 16:58:18 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\RSST\Desktop\OTL.exe [2012/01/01 15:18:37 | 000,000,000 | ---D | C] -- C:\sh4ldr [2012/01/01 15:18:37 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group [2011/12/29 15:26:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Application Updater [2011/12/29 15:26:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Spigot [2011/12/29 15:26:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\pdfforge Toolbar [2011/12/29 14:08:47 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2011/12/29 14:08:46 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll [2011/12/29 14:08:46 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll [2011/12/29 14:08:46 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2011/12/29 14:08:46 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll [2011/12/29 14:08:46 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll [2011/12/29 14:08:45 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec [2011/12/29 14:08:45 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec [2011/12/29 14:08:45 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2011/12/29 14:08:45 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2011/12/29 14:08:45 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2011/12/29 14:08:45 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2011/12/29 14:08:45 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2011/12/29 14:08:45 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe [2011/12/29 14:08:45 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe [2011/12/29 14:01:50 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll [2011/12/29 14:01:50 | 000,422,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll [2011/12/29 14:01:50 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll [2011/12/29 14:01:50 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe [2011/12/29 14:01:50 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll [2011/12/29 14:01:50 | 000,214,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll [2011/12/29 14:01:50 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe [2011/12/29 14:01:50 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll [2011/12/29 14:01:50 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll [2011/12/29 14:01:50 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll [2011/12/29 14:01:49 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll [2011/12/29 14:01:49 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll [2011/12/29 14:01:49 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll [2011/12/29 14:01:49 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll [2011/12/29 14:01:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll [2011/12/29 14:01:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll [2011/12/29 14:01:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll [2011/12/29 14:01:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll [2011/12/29 14:01:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll [2011/12/29 14:01:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll [2011/12/29 14:01:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll [2011/12/29 14:01:48 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe [2011/12/29 14:01:48 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll [2011/12/29 14:01:48 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll [2011/12/29 14:01:48 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll [2011/12/29 14:01:48 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll [2011/12/29 14:01:48 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll [2011/12/29 14:01:48 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll [2011/12/29 14:01:48 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll [2011/12/29 14:01:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll [2011/12/29 14:01:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll [2011/12/29 14:01:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll [2011/12/29 14:01:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll [2011/12/29 14:01:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll [2011/12/29 14:01:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll [2011/12/29 14:01:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll [2011/12/29 14:01:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll [2011/12/29 14:01:48 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe [2011/12/29 14:01:45 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisdecd.dll [2011/12/29 14:01:45 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll [2011/12/29 14:01:45 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSNP.ax [2011/12/29 14:01:45 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSNP.ax [2011/12/29 14:01:45 | 000,108,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisrndr.ax [2011/12/29 14:01:45 | 000,104,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Mpeg2Data.ax [2011/12/29 14:01:45 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisrndr.ax [2011/12/29 14:01:45 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSDvbNP.ax [2011/12/29 14:01:45 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Mpeg2Data.ax [2011/12/29 14:01:44 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSDvbNP.ax [2011/12/29 14:01:40 | 000,319,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbcjt32.dll [2011/12/29 14:01:40 | 000,212,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbctrac.dll [2011/12/29 14:01:40 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbctrac.dll [2011/12/29 14:01:40 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccp32.dll [2011/12/29 14:01:40 | 000,122,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccp32.dll [2011/12/29 14:01:40 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccu32.dll [2011/12/29 14:01:40 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccr32.dll [2011/12/29 14:01:40 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccu32.dll [2011/12/29 14:01:40 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccr32.dll [2011/12/29 14:01:39 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll [2011/12/29 14:01:38 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xmllite.dll [2011/12/29 14:00:02 | 005,507,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2011/12/29 14:00:01 | 003,957,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2011/12/29 14:00:00 | 003,902,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2011/12/29 13:59:53 | 002,566,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\esent.dll [2011/12/29 13:59:53 | 001,686,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\esent.dll [2011/12/29 13:59:53 | 000,187,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\storport.sys [2011/12/29 13:59:53 | 000,107,904 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\amdsata.sys [2011/12/29 13:59:53 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\fsutil.exe [2011/12/29 13:59:53 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\fsutil.exe [2011/12/29 13:59:53 | 000,027,008 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\amdxata.sys [2011/12/29 13:59:45 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll [2011/12/29 13:59:45 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll [2011/12/29 13:59:44 | 000,861,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll [2011/12/29 13:59:44 | 000,331,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleacc.dll [2011/12/21 01:33:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2011/12/21 01:33:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Plugins [2011/12/21 01:33:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunesHelper.Resources [2011/12/21 01:32:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes.Resources [2011/12/21 01:32:44 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2011/12/21 01:32:44 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2011/12/21 01:32:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CD Configuration [2011/12/21 01:30:15 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour [2011/12/21 01:30:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour [2011/12/20 23:33:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update [2011/12/20 21:26:50 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Audible [2011/12/20 21:26:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AudibleManager [2011/12/20 21:26:49 | 000,000,000 | ---D | C] -- C:\Users\RSST\Documents\Audible [2011/12/20 21:26:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audible [2011/12/18 19:00:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BILD-Steuer 2010 [2011/12/08 01:36:46 | 000,293,736 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\iTunesOutlookAddIn.dll [2011/12/08 01:36:42 | 000,421,736 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\iTunesHelper.exe [2011/12/08 01:36:42 | 000,403,304 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\iTunesAdmin.dll [2011/12/08 01:36:42 | 000,156,520 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\iTunesHelper.dll [2011/12/08 01:36:36 | 009,777,000 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\iTunes.exe [2011/12/08 01:36:32 | 020,864,360 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\iTunes.dll [2011/12/08 01:36:30 | 003,029,528 | ---- | C] (Gracenote, Inc.) -- C:\Program Files (x86)\gnsdk_dsp.dll [2011/12/08 01:36:30 | 000,797,208 | ---- | C] (Gracenote, Inc.) -- C:\Program Files (x86)\gnsdk_sdkmanager.dll [2011/12/08 01:36:30 | 000,281,112 | ---- | C] (Gracenote, Inc.) -- C:\Program Files (x86)\gnsdk_submit.dll [2011/12/08 01:36:30 | 000,240,152 | ---- | C] (Gracenote, Inc.) -- C:\Program Files (x86)\gnsdk_musicid.dll [2011/11/14 20:16:44 | 000,112,488 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\ITDetector.ocx [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/01/01 19:07:02 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012/01/01 18:59:55 | 000,050,477 | ---- | M] () -- C:\Users\RSST\Desktop\Defogger.exe [2012/01/01 16:59:44 | 000,000,825 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012/01/01 16:58:23 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\RSST\Desktop\OTL.exe [2012/01/01 16:55:49 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/01/01 16:55:49 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/01/01 16:52:33 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012/01/01 16:52:33 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012/01/01 16:52:33 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012/01/01 16:52:33 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012/01/01 16:52:33 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012/01/01 16:48:29 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012/01/01 16:47:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012/01/01 16:47:46 | 509,038,591 | -HS- | M] () -- C:\hiberfil.sys [2012/01/01 15:18:54 | 000,000,000 | ---- | M] () -- C:\autoexec.bat [2011/12/29 15:19:52 | 000,435,920 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011/12/29 15:00:08 | 000,001,147 | ---- | M] () -- C:\Users\RSST\Desktop\avira_antivir_personal_de - Verknüpfung.lnk [2011/12/27 17:26:09 | 000,001,766 | ---- | M] () -- C:\Windows\tasks\hpwebreg_CN07D1P02Y05HX.job [2011/12/21 01:33:26 | 000,001,688 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [2011/12/18 19:00:42 | 000,001,793 | ---- | M] () -- C:\Users\Public\Desktop\BILD-Steuer 2010.lnk [2011/12/10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011/12/08 01:36:46 | 000,293,736 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\iTunesOutlookAddIn.dll [2011/12/08 01:36:42 | 000,421,736 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\iTunesHelper.exe [2011/12/08 01:36:42 | 000,403,304 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\iTunesAdmin.dll [2011/12/08 01:36:42 | 000,156,520 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\iTunesHelper.dll [2011/12/08 01:36:36 | 009,777,000 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\iTunes.exe [2011/12/08 01:36:32 | 020,864,360 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\iTunes.dll [2011/12/08 01:36:30 | 003,029,528 | ---- | M] (Gracenote, Inc.) -- C:\Program Files (x86)\gnsdk_dsp.dll [2011/12/08 01:36:30 | 000,797,208 | ---- | M] (Gracenote, Inc.) -- C:\Program Files (x86)\gnsdk_sdkmanager.dll [2011/12/08 01:36:30 | 000,281,112 | ---- | M] (Gracenote, Inc.) -- C:\Program Files (x86)\gnsdk_submit.dll [2011/12/08 01:36:30 | 000,240,152 | ---- | M] (Gracenote, Inc.) -- C:\Program Files (x86)\gnsdk_musicid.dll [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/01/01 18:59:26 | 000,050,477 | ---- | C] () -- C:\Users\RSST\Desktop\Defogger.exe [2012/01/01 16:59:44 | 000,000,825 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012/01/01 15:18:54 | 000,000,000 | ---- | C] () -- C:\autoexec.bat [2011/12/29 15:00:08 | 000,001,147 | ---- | C] () -- C:\Users\RSST\Desktop\avira_antivir_personal_de - Verknüpfung.lnk [2011/12/21 01:33:26 | 000,001,688 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2011/12/18 19:00:42 | 000,001,793 | ---- | C] () -- C:\Users\Public\Desktop\BILD-Steuer 2010.lnk [2011/11/14 20:15:32 | 000,064,083 | ---- | C] () -- C:\Program Files (x86)\Acknowledgements.rtf [2011/07/25 13:47:36 | 000,000,000 | ---- | C] () -- C:\Users\RSST\AppData\Local\{6747AD8D-8366-40F5-9CED-F39C26A63F5F} [2011/06/01 21:04:09 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Screen Savers [2011/06/01 21:04:09 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Sci-Fi [2011/06/01 21:04:09 | 000,000,268 | RH-- | C] () -- C:\Users\RSST\AppData\Roaming\Sampler Files [2011/06/01 21:04:09 | 000,000,268 | RH-- | C] () -- C:\Users\RSST\AppData\Roaming\Sample Delay [2011/06/01 21:04:09 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT [2011/06/01 21:04:09 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT [2011/06/01 21:04:09 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT [2010/06/19 08:25:29 | 000,007,605 | ---- | C] () -- C:\Users\RSST\AppData\Local\Resmon.ResmonCfg [2009/07/30 12:49:22 | 000,040,448 | ---- | C] () -- C:\Windows\REGOBJ.DLL [2009/07/14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009/07/14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009/07/14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009/07/14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009/07/14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009/07/13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009/06/10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat [2008/10/07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\SysWow64\physxcudart_20.dll [2008/10/07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 1061 bytes -> C:\Users\RSST\Documents\preiswerte-lichtmaschinen.de _ Reklamationsformular.eml:OECustomProperty < End of report > Ich weiß ja nicht, obs eine Rolle spielt, aber die Gruppe [2011/12/29 15:26:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Application Updater [2011/12/29 15:26:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Spigot [2011/12/29 15:26:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\pdfforge Toolbar könnte am 29.12. während einer Session, in der ich versuchte den geschlossenen AVIRA Schirmwieder mal wieder zu öffnen (ging schliesslich über Windowsaktualisierungen) eingefangen worden sein. Wenn Ihr noch was braucht.... Schöne Grüße RS |
| Themen zu spyhunter, widgi toolbar, spigot....was tue ich am Besten? |
| alternate, antivir, avira, avira antivir, besten, eudora, googeln, google earth, gutes, itunes, kein log, log, malwarebytes, media, mozilla thunderbird, neues, neustart, nicht mehr, nt.dll, online, panik, pdfforge toolbar, personal, plug-in, programme, rechner, safer networking, sched.exe, shoppen, spuren, spybot, spyware, surfen, systemsteuerung, version=1.0, verweise, webcheck, win, ändern |
Baum-Darstellung