| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: abnow.com, dauer Bluescreen, was kann ich noch machenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
27.02.2012, 15:23
| #1 |
 |  abnow.com, dauer Bluescreen, was kann ich noch machen Hallo Board! Hab mir wohl einen Trojaner/Virus namens abnow.com eingefangen. Bin echt verzweifelt! Schreibe an dem Rechner gerade meine Dissertation. PC nur noch im Bluescreen. Rechner: Laptop; Acer Aspire Timeline, I3, System: Win7 64bit home premium Hinweis:Kein CD-laufwerk vorhanden wichtigsten Dateien teilweise per Dropbox gesichert Alles ging schnell. beim googeln bin ich immer auf abnow.com gelandet. Erst nur Firefox, dann auch IE. Habe dann den Hinweis auf eine Software gefunden. Endet auf "...Doctor" (grünes Icon in der Taskleiste). Installiert und laufen lassen. Hat in allen drei angezeigten Gebieten etwas gefunden. Das war jeweils mit "leichte Gefahrenstufe" gekennzeichnet. Beim Systemscan habe ich kurz auf Pause gedrückt. 2 Minuten später BlueScreen. seither fährt sich der Rechner hoch. Passwort für Win eingeben. Kurze Ladezeit und wieder Bluescreen. Abgesicherter Modus ebenfalls. Was kann und muss ich tun Leute? Meine Prioritäten: Priorität 1 = Datensicherung (Dissertation, Mails/Outlook, sonstige Dateien) Priorität 2 = System wieder zum laufen bringen. Kann mir jemand von euch Könnern helfen? Was kann ich tun? Muss ich mir sorgen um Passwörter etc. machen (OnlineShopping, -Banking)? Habt vielen vielen Danke für jede Art von Hinweis, Hilfe und und und... Wenn noch Infos notwendig sind, bitte sagen - ich werde mein bestes tun. Danke! Grüße Maggus |
|
27.02.2012, 15:31
| #2 |
| /// Malwareteam    | abnow.com, dauer Bluescreen, was kann ich noch machen Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen. Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst. Ich bedanke mich für deine Geduld  Gruß, PsYcHoTiC
__________________ |
|
27.02.2012, 15:37
| #3 |
| | abnow.com, dauer Bluescreen, was kann ich noch machen Danke für deine schnelle Antwort! Das bringt mich schon mal ein wenig runter. Bin gerade fix und alle.
__________________ |
|
27.02.2012, 18:12
| #4 |
| /// Malwareteam | abnow.com, dauer Bluescreen, was kann ich noch machenMein Name ist Marius und ich werde dir bei deinem Problem helfen. Eines vorneweg: Hinweis: Wir können hier nie dafür garantieren, dass wir sämtliche Reste von Schadsoftware gefunden haben. Eine Formatierung ist meist der schnellere und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass du clean bist. Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden.
Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. Schritt 1: FRST Downloade dir bitte Farbar's Recovery Scan Tool x64 und speichere diese auf einen USB Stick. Schließe den USB Stick an das infizierte System an Du musst das System nun in die System Reparatur Option booten. Über den Boot Manager
Mit Windows CD/DVD
Wähle in den Reparaturoptionen Eingabeaufforderung
__________________ Kein Asylrecht für Trojaner!  Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! |
|
27.02.2012, 19:52
| #5 |
| | abnow.com, dauer Bluescreen, was kann ich noch machen Danke für die Anleitung. Ich habe versucht diese auszuführen. Der Code der Auswertung folgt unten. Einmal mehr ein großes DANKE vorab. Folgendes kann ich für die Beschreibung ergänzen:
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool Version: 27-02-2012 Ran by SYSTEM at 27-02-2012 19:45:31 Running from F:\ Windows 7 Home Premium (X64) OS Language: German Standard The current controlset is ControlSet001 ========================== Registry (Whitelisted) ============= HKLM\...\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-22] (Alcor Micro Corp.) HKLM\...\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [x] HKLM\...\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe [166424 2010-04-21] (Intel Corporation) HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [391192 2010-04-21] (Intel Corporation) HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [413720 2010-04-21] (Intel Corporation) HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [9996320 2010-01-19] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3 [877600 2010-01-19] (Realtek Semiconductor) HKLM\...\Run: [AtherosBtStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" [585376 2010-05-25] (Atheros Commnucations) HKLM\...\Run: [AthBtTray] "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe" [354464 2010-05-25] (Atheros Commnucations) HKLM\...\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe [345648 2010-03-08] (Alps Electric Co., Ltd.) HKLM\...\Run: [Acer ePower Management] C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [496160 2010-02-02] (Acer Incorporated) HKLM\...\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2306448 2010-07-21] (Microsoft Corporation) HKLM\...\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent [x] HKLM\...\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE [x] HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [1680976 2010-10-28] (Logitech, Inc.) HKLM\...\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2399632 2011-04-13] (Microsoft Corporation) HKLM-x32\...\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k [260608 2010-03-08] (NewTech Infosystems, Inc.) HKLM-x32\...\Run: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d [201512 2009-12-24] (Egis Technology Inc.) HKLM-x32\...\Run: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" [401192 2009-12-24] (Egis Technology Inc.) HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2010-04-20] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [960080 2010-05-25] (Dritek System Inc.) HKLM-x32\...\Run: [MDS_Menu] "C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso" UpdateWithCreateOnce "Software\CyberLink\MediaShow Espresso\5.6" [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [ArcadeMovieService] "C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe" [124136 2010-04-23] (CyberLink Corp.) HKLM-x32\...\Run: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup [30192 2010-12-07] (Google) HKLM-x32\...\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [31072 2008-10-25] (Microsoft Corporation) HKLM-x32\...\Run: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start [63360 2010-12-08] (DivX, LLC) HKLM-x32\...\Run: [Win7PDF] C:\Program Files\PDF Printer for Windows 7\PDF.exe [x] HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated) HKLM-x32\...\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW [1259376 2011-07-28] () HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-11-01] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2011-06-09] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2011-10-24] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-12-07] (Apple Inc.) HKLM-x32\...\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe [220744 2011-12-16] (Geek Software GmbH) HKLM-x32\...\Run: [ISTray] "C:\Program Files (x86)\PC Tools\PC Tools Security\pctsGui.exe" /hideGUI [2659768 2012-01-11] (PC Tools) HKU\wilogs\...\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s [929168 2011-11-08] (Samsung) HKU\wilogs\...\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [3508624 2011-11-08] (Samsung Electronics Co., Ltd.) HKU\wilogs\...\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21392 2011-11-08] () HKU\wilogs\...\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59240 2011-11-11] (Apple Inc.) HKU\wilogs\...\Run: [Copernic Desktop Search - Home] "C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe" /tray [1648600 2011-11-22] (Copernic Inc.) HKU\wilogs\...\Run: [Remote Control Editor] "C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe" [x] HKU\wilogs\...\Winlogon: [Shell] C:\Users\wilogs\AppData\Local\f1be3786\X [38912 2012-02-26] () HKLM\...\Runonce: [*WerKernelReporting] %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [x] Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation) Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 AppInit_DLLs: SubSystems: [Windows] ==> ZeroAccess ==================== Services (Whitelisted) ====== 2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [47776 2010-05-25] (Atheros Commnucations) 2 Bonjour Service; "C:\Program Files\Bonjour\mDNSResponder.exe" [462184 2011-08-30] (Apple Inc.) 2 Browser Defender Update Service; "C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe" [546768 2012-01-16] (Threat Expert Ltd.) 2 crystalaps; \\.\globalrootC:\Windows\system32\svchost.exe -k netsvcs [27136 2009-07-13] (Microsoft Corporation) 2 DsiWMIService; C:\Program Files (x86)\Launch Manager\dsiwmis.exe [325200 2010-05-25] (Dritek System Inc.) 2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [820768 2010-02-02] (Acer Incorporated) 3 GoogleDesktopManager-051210-111108; "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" [30192 2010-12-07] (Google) 2 GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated) 3 LBTServ; C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe [357456 2010-10-28] (Logitech, Inc.) 2 lvtuner; C:\Windows\System32\msftpsvc.dll [5120 2009-07-13] (Iomega) 2 lxcg_device; \\.\globalrootC:\Windows\system32\svchost.exe -k netsvcs [27136 2009-07-13] (Microsoft Corporation) 3 Microsoft Office Groove Audit Service; "C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe" [65888 2008-10-25] (Microsoft Corporation) 2 NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [250368 2010-03-08] (NewTech Infosystems, Inc.) 2 RichVideo; "C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe" [244904 2010-02-03] () 2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-29] (Acer Incorporated) 2 sdAuxService; C:\Program Files (x86)\PC Tools\PC Tools Security\pctsAuxs.exe [402336 2012-01-11] (PC Tools) 2 sdCoreService; C:\Program Files (x86)\PC Tools\PC Tools Security\pctsSvc.exe [1117624 2012-01-11] (PC Tools) 2 UNS; "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe" [2320920 2010-03-03] (Intel Corporation) ========================== Drivers (Whitelisted) ============= 3 amdkmdag; C:\Windows\System32\DRIVERS\atipmdag.sys [6406144 2010-04-21] (ATI Technologies Inc.) 3 AthBTPort; C:\Windows\System32\DRIVERS\btath_flt.sys [38248 2010-05-20] (Atheros) 3 ATHDFU; C:\Windows\System32\Drivers\AthDfu.sys [55336 2010-05-20] (Windows (R) Win 7 DDK provider) 3 BTATH_A2DP; C:\Windows\System32\drivers\btath_a2dp.sys [294760 2010-05-20] (Atheros) 3 BTATH_BUS; C:\Windows\System32\DRIVERS\btath_bus.sys [32296 2010-05-20] (Atheros) 3 BTATH_HCRP; C:\Windows\System32\DRIVERS\btath_hcrp.sys [202792 2010-05-20] (Atheros) 3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [52584 2010-05-20] (Atheros) 3 BTATH_RCP; C:\Windows\System32\DRIVERS\btath_rcp.sys [156392 2010-05-20] (Atheros) 3 BtFilter; C:\Windows\System32\DRIVERS\btfilter.sys [264040 2010-05-25] (Atheros) 3 CYDTV_SRV; C:\Windows\System32\drivers\cydtv.sys [576480 2010-07-13] ( ) 3 intelkmd; C:\Windows\System32\DRIVERS\igdpmd64.sys [10322848 2010-04-21] (Intel Corporation) 3 LHidFilt; C:\Windows\System32\DRIVERS\LHidFilt.Sys [63568 2010-08-24] (Logitech, Inc.) 3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [57936 2010-08-24] (Logitech, Inc.) 3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2011-08-02] (Apple Inc.) 3 PCTBD; C:\Windows\System32\Drivers\PCTBD64.sys [70760 2011-09-28] (PC Tools) 0 PCTCore; C:\Windows\System32\drivers\PCTCore64.sys [367912 2011-11-14] (PC Tools) 0 pctDS; C:\Windows\System32\drivers\pctDS64.sys [453896 2011-12-01] (PC Tools) 0 pctEFA; C:\Windows\System32\drivers\pctEFA64.sys [1096688 2011-12-01] (PC Tools) 1 PCTSD; C:\Windows\System32\Drivers\PCTSD64.sys [230952 2012-01-11] (PC Tools) ========================== NetSvcs (Whitelisted) =========== NETSVC: smbusp NETSVC: lvtuner ============ One Month Created Files and Folders ============== 2012-02-27 07:03 - 2012-02-27 07:03 - 0278224 ____A C:\Windows\Minidump\022712-73757-01.dmp 2012-02-27 07:00 - 2012-02-27 07:00 - 0278224 ____A C:\Windows\Minidump\022712-54303-01.dmp 2012-02-27 06:57 - 2012-02-27 06:57 - 0270472 ____A C:\Windows\Minidump\022712-52712-01.dmp 2012-02-27 06:54 - 2012-02-27 06:54 - 0278280 ____A C:\Windows\Minidump\022712-56269-01.dmp 2012-02-27 06:51 - 2012-02-27 06:51 - 0278280 ____A C:\Windows\Minidump\022712-50123-01.dmp 2012-02-27 05:20 - 2012-02-27 05:20 - 0278448 ____A C:\Windows\Minidump\022712-18548-01.dmp 2012-02-27 05:16 - 2012-02-27 05:16 - 0270472 ____A C:\Windows\Minidump\022712-28532-01.dmp 2012-02-27 05:14 - 2012-02-27 05:14 - 0278448 ____A C:\Windows\Minidump\022712-18142-01.dmp 2012-02-27 05:12 - 2012-02-27 05:12 - 0278448 ____A C:\Windows\Minidump\022712-28204-01.dmp 2012-02-27 04:46 - 2012-02-27 04:46 - 0002251 ____A C:\Users\Public\Desktop\PC Tools Spyware Doctor.lnk 2012-02-27 04:46 - 2012-02-27 04:46 - 0000000 ____D C:\Program Files (x86)\PC Tools 2012-02-27 04:46 - 2012-01-16 07:28 - 2246608 ____A (Threat Expert Ltd.) C:\Windows\PCTBDCore.dll 2012-02-27 04:46 - 2012-01-16 07:28 - 1681360 ____A (Threat Expert Ltd.) C:\Windows\PCTBDRes.dll 2012-02-27 04:46 - 2012-01-16 07:28 - 0767952 ____A C:\Windows\BDTSupport.dll 2012-02-27 04:46 - 2012-01-16 07:28 - 0149456 ____A (PC Tools) C:\Windows\SGDetectionTool.dll 2012-02-27 04:46 - 2012-01-11 07:19 - 0092896 ____A (PC Tools) C:\Windows\System32\Drivers\pctplsg64.sys 2012-02-27 04:46 - 2012-01-11 07:17 - 0014776 ____A (PC Tools) C:\Windows\System32\Drivers\pctBTFix64.sys 2012-02-27 04:46 - 2012-01-11 07:14 - 0339608 ____A (PC Tools) C:\Windows\System32\Drivers\pctgntdi64.sys 2012-02-27 04:46 - 2012-01-11 07:14 - 0145432 ____A (PC Tools) C:\Windows\System32\Drivers\pctwfpfilter64.sys 2012-02-27 04:46 - 2011-09-28 04:14 - 0070760 ____A (PC Tools) C:\Windows\System32\Drivers\PCTBD64.sys 2012-02-27 04:46 - 2011-05-17 06:47 - 0003488 ____A C:\Windows\UDB.zip 2012-02-27 04:46 - 2010-08-20 01:50 - 0000882 ____A C:\Windows\RegSDImport.xml 2012-02-27 04:46 - 2010-01-22 00:44 - 0000879 ____A C:\Windows\RegISSImport.xml 2012-02-27 04:46 - 2008-11-26 03:08 - 0000131 ____A C:\Windows\IDB.zip 2012-02-27 04:44 - 2012-02-27 04:44 - 1768896 ____A C:\Windows\System32\Drivers\Cat.DB 2012-02-27 04:44 - 2012-01-11 07:19 - 0230952 ____A (PC Tools) C:\Windows\System32\Drivers\PCTSD64.sys 2012-02-27 04:44 - 2011-12-01 07:07 - 1096688 ____A (PC Tools) C:\Windows\System32\Drivers\pctEFA64.sys 2012-02-27 04:44 - 2011-12-01 07:07 - 0453896 ____A (PC Tools) C:\Windows\System32\Drivers\pctDS64.sys 2012-02-27 04:44 - 2011-11-14 06:12 - 0367912 ____A (PC Tools) C:\Windows\System32\Drivers\PCTCore64.sys 2012-02-27 04:43 - 2012-02-27 04:46 - 0000000 ____D C:\Users\All Users\PC Tools 2012-02-27 04:43 - 2012-02-27 04:46 - 0000000 ____D C:\ProgramData\PC Tools 2012-02-27 04:43 - 2012-02-27 04:43 - 0002601 ____A C:\Users\wilogs\Desktop\sd9setup[1].exe.lnk 2012-02-27 04:43 - 2012-02-27 04:43 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\TestApp 2012-02-27 03:55 - 2012-02-27 03:55 - 0438158 ____A C:\Users\wilogs\Desktop\LAH_Dispo_Direkt_V2.docx 2012-02-27 02:13 - 2012-02-27 02:25 - 0719836 ____A C:\Users\wilogs\Desktop\Sortiment Screenshots.pptx 2012-02-27 00:01 - 2012-02-27 00:01 - 0000000 __SHD C:\Windows\System32\%APPDATA% 2012-02-26 23:58 - 2012-02-27 07:03 - 0000000 __ASH C:\Windows\System32\dds_log_trash.cmd 2012-02-26 23:53 - 2012-02-26 23:56 - 0000000 __SHD C:\Users\wilogs\AppData\Local\f1be3786 2012-02-24 01:48 - 2012-02-24 01:48 - 4226142 ____A C:\Users\wilogs\Downloads\Somebody That I Used to Know - Walk off the Earth (Gotye - Cover).mp3 2012-02-24 01:47 - 2012-02-24 01:47 - 3999065 ____A C:\Users\wilogs\Downloads\Radio 538 Gotye - Somebody That I Used To Know (Jeroen Nieuwenhuize remix).mp4.mp3 2012-02-24 01:47 - 2012-02-24 01:47 - 3906278 ____A C:\Users\wilogs\Downloads\Gotye Ft. Kimbra - Somebody That I Used To Know ( Dimenson Vocal House Remix 2012 ).mp3 2012-02-24 01:46 - 2012-02-24 01:46 - 3907532 ____A C:\Users\wilogs\Downloads\Gotye- Somebody That I Used To Know feat. Kimbra 720p.mp3 2012-02-23 08:33 - 2012-02-23 08:33 - 0010948 ____A C:\Users\wilogs\Downloads\keyword_ideas_20120223_0833808.csv 2012-02-23 01:28 - 2012-02-23 01:28 - 0179788 ____A C:\Users\wilogs\Desktop\JS_Diss_Kapitel_4.3.pdf 2012-02-23 01:27 - 2012-02-23 01:27 - 0461065 ____A C:\Users\wilogs\Desktop\JS_Diss_Kapitel_4.2.pdf 2012-02-22 01:59 - 2012-02-22 01:59 - 0001156 ____A C:\Users\wilogs\Downloads\vorlage-koederseite.zip 2012-02-21 11:13 - 2012-01-04 01:59 - 14164480 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2012-02-21 11:13 - 2012-01-04 01:58 - 0509952 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll 2012-02-21 11:13 - 2012-01-04 01:03 - 12868096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2012-02-21 11:13 - 2012-01-04 01:03 - 0442880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll 2012-02-21 11:13 - 2012-01-02 22:24 - 0515584 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl 2012-02-21 11:13 - 2012-01-02 21:44 - 0478208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl 2012-02-21 11:04 - 2012-01-13 20:02 - 3143168 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-02-21 11:04 - 2011-12-27 19:59 - 0499200 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys 2012-02-21 11:04 - 2011-11-16 23:17 - 0152432 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys 2012-02-21 11:04 - 2011-11-16 23:17 - 0095088 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys 2012-02-21 11:04 - 2011-11-16 23:15 - 0460296 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys 2012-02-21 11:04 - 2011-11-16 23:12 - 0395776 ____A (Microsoft Corporation) C:\Windows\System32\webio.dll 2012-02-21 11:04 - 2011-11-16 23:11 - 0136192 ____A (Microsoft Corporation) C:\Windows\System32\sspicli.dll 2012-02-21 11:04 - 2011-11-16 23:11 - 0028672 ____A (Microsoft Corporation) C:\Windows\System32\sspisrv.dll 2012-02-21 11:04 - 2011-11-16 23:11 - 0028160 ____A (Microsoft Corporation) C:\Windows\System32\secur32.dll 2012-02-21 11:04 - 2011-11-16 23:10 - 0340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll 2012-02-21 11:04 - 2011-11-16 23:08 - 1446912 ____A (Microsoft Corporation) C:\Windows\System32\lsasrv.dll 2012-02-21 11:04 - 2011-11-16 23:05 - 0031232 ____A (Microsoft Corporation) C:\Windows\System32\lsass.exe 2012-02-21 11:04 - 2011-11-16 21:39 - 0314368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll 2012-02-21 11:04 - 2011-11-16 21:39 - 0224768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2012-02-21 11:04 - 2011-11-16 21:39 - 0022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2012-02-21 11:04 - 2011-11-16 21:35 - 0096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2012-02-21 11:04 - 2011-10-25 21:22 - 1572864 ____A (Microsoft Corporation) C:\Windows\System32\quartz.dll 2012-02-21 11:04 - 2011-10-25 21:22 - 0366592 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll 2012-02-21 11:04 - 2011-10-25 21:19 - 0043520 ____A (Microsoft Corporation) C:\Windows\System32\csrsrv.dll 2012-02-21 11:04 - 2011-10-25 20:28 - 1328640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll 2012-02-21 11:04 - 2011-10-25 20:28 - 0514560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll 2012-02-21 11:01 - 2011-12-16 00:42 - 0634368 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll 2012-02-21 11:01 - 2011-12-15 23:59 - 0690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll 2012-02-21 11:01 - 2011-10-14 22:25 - 0723456 ____A (Microsoft Corporation) C:\Windows\System32\EncDec.dll 2012-02-21 11:01 - 2011-10-14 21:48 - 0534528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\EncDec.dll 2012-02-21 11:00 - 2011-12-16 00:45 - 1501184 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-02-21 11:00 - 2011-12-16 00:45 - 1197568 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-02-21 11:00 - 2011-12-16 00:45 - 0134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-02-21 11:00 - 2011-12-16 00:42 - 9335296 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-02-21 11:00 - 2011-12-16 00:42 - 1026560 ____A (Microsoft Corporation) C:\Windows\System32\mstime.dll 2012-02-21 11:00 - 2011-12-16 00:42 - 0703488 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2012-02-21 11:00 - 2011-12-16 00:42 - 0097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-02-21 11:00 - 2011-12-16 00:42 - 0082944 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll 2012-02-21 11:00 - 2011-12-16 00:41 - 0064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-02-21 11:00 - 2011-12-16 00:41 - 0057856 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll 2012-02-21 11:00 - 2011-12-16 00:40 - 2458624 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-02-21 11:00 - 2011-12-16 00:40 - 12372480 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-02-21 11:00 - 2011-12-16 00:40 - 0445952 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll 2012-02-21 11:00 - 2011-12-16 00:40 - 0256000 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll 2012-02-21 11:00 - 2011-12-16 00:40 - 0247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-02-21 11:00 - 2011-12-16 00:38 - 0012288 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe 2012-02-21 11:00 - 2011-12-16 00:02 - 1230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2012-02-21 11:00 - 2011-12-16 00:02 - 0981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2012-02-21 11:00 - 2011-12-16 00:02 - 0132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2012-02-21 11:00 - 2011-12-15 23:59 - 5999104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2012-02-21 11:00 - 2011-12-15 23:59 - 0606208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll 2012-02-21 11:00 - 2011-12-15 23:59 - 0599552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2012-02-21 11:00 - 2011-12-15 23:59 - 0067072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2012-02-21 11:00 - 2011-12-15 23:59 - 0064512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2012-02-21 11:00 - 2011-12-15 23:58 - 2072576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2012-02-21 11:00 - 2011-12-15 23:58 - 10991104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2012-02-21 11:00 - 2011-12-15 23:58 - 0381440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2012-02-21 11:00 - 2011-12-15 23:58 - 0185856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2012-02-21 11:00 - 2011-12-15 23:58 - 0176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2012-02-21 11:00 - 2011-12-15 23:58 - 0048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2012-02-21 11:00 - 2011-12-15 23:58 - 0044544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2012-02-21 11:00 - 2011-12-15 23:56 - 0012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2012-02-21 11:00 - 2011-12-15 23:26 - 0482816 ____A (Microsoft Corporation) C:\Windows\System32\html.iec 2012-02-21 11:00 - 2011-12-15 22:49 - 0386048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2012-02-21 11:00 - 2011-12-15 22:43 - 1638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-02-21 11:00 - 2011-12-15 22:15 - 1638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2012-02-21 11:00 - 2011-11-16 23:14 - 1739160 ____A (Microsoft Corporation) C:\Windows\System32\ntdll.dll 2012-02-21 11:00 - 2011-11-16 21:41 - 1292592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2012-02-21 11:00 - 2011-11-04 21:17 - 0002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll 2012-02-21 11:00 - 2011-11-04 20:30 - 0002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2012-02-21 10:58 - 2011-11-19 07:07 - 0077312 ____A (Microsoft Corporation) C:\Windows\System32\packager.dll 2012-02-21 10:58 - 2011-11-19 06:06 - 0067072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll 2012-02-21 09:28 - 2012-02-21 09:28 - 0272191 ____A C:\Users\wilogs\Desktop\JS_Diss_Kapitel_4 1.pdf 2012-02-19 02:43 - 2012-02-19 04:09 - 0000000 ____D C:\Users\wilogs\Desktop\Besuchermatrix_Bilder 2012-02-19 02:06 - 2012-02-19 02:06 - 0141619 ____A C:\Users\wilogs\Downloads\mod_super_login_J1.7_J2.5_v2.5.0.zip 2012-02-19 01:22 - 2012-02-19 01:30 - 4510449 ____A C:\Users\wilogs\Downloads\jsn_epic_docs(1).zip 2012-02-19 00:42 - 2012-02-19 00:42 - 1389328 ____A C:\Users\wilogs\Downloads\com_jce_2021.zip 2012-02-19 00:38 - 2012-02-19 00:38 - 0017578 ____A C:\Users\wilogs\Downloads\plg_extravote.zip 2012-02-19 00:28 - 2012-02-19 00:28 - 0811287 ____A C:\Users\wilogs\Downloads\jsn_epic_pro_unlimited_j2.5_4.3.0_install.zip 2012-02-18 02:22 - 2012-02-21 05:43 - 0017232 ____A C:\Users\wilogs\Desktop\Stoff_Ausschuss_Verschrottung.docx 2012-02-17 03:11 - 2012-02-17 03:11 - 0000000 ____D C:\Users\wilogs\Downloads\BoxofBundles01 2012-02-17 01:56 - 2012-02-17 02:55 - 216698241 ____A C:\Users\wilogs\Downloads\BoxofBundles01.zip 2012-02-16 12:12 - 2012-02-16 12:13 - 0755197 ____A (ErstenWare ) C:\Users\wilogs\Downloads\signcrtr.exe 2012-02-16 11:31 - 2012-02-16 12:04 - 0010866 ____A C:\Users\wilogs\Desktop\Qualitative_Kennzahlen.xlsx 2012-02-16 04:22 - 2012-02-16 04:22 - 0077159 ____A C:\Users\wilogs\Desktop\Musterartikel-für-die-redaktionelle-Einbindung-bei-Publishern.pdf 2012-02-16 03:39 - 2012-02-21 01:48 - 0000000 ____D C:\Users\wilogs\Desktop\Bewertung Monetär 2012-02-15 23:41 - 2012-02-15 23:41 - 0003177 ____A C:\Users\wilogs\Downloads\press9-joomla.zip 2012-02-15 23:33 - 2012-02-15 23:44 - 170203312 ____A C:\Users\wilogs\Downloads\VideoSpin_2_0_Setup_2_.exe 2012-02-15 10:19 - 2012-02-15 10:19 - 0002636 ____A C:\Users\wilogs\Downloads\hider_plugin_content_v1_51.zip 2012-02-15 05:36 - 2012-02-15 05:36 - 0029463 ____A C:\Users\wilogs\Downloads\readlesstext_1.5(1).zip 2012-02-15 05:33 - 2012-02-15 05:33 - 0039388 ____A C:\Users\wilogs\Downloads\readlesstext_1.5.zip 2012-02-15 04:43 - 2012-02-15 04:43 - 2187836 ____A C:\Users\wilogs\Downloads\com_pinme_pinboard_3.1.4.zip 2012-02-14 08:52 - 2012-02-14 08:52 - 0118063 ____A C:\Users\wilogs\Downloads\com_rsmonials_153_J15.zip 2012-02-14 08:52 - 2012-02-14 08:52 - 0006244 ____A C:\Users\wilogs\Downloads\mod_rsmonialscroller_1532_J15.zip 2012-02-14 08:52 - 2012-02-14 08:52 - 0004122 ____A C:\Users\wilogs\Downloads\mod_rsmonials_1531_J15.zip 2012-02-14 08:50 - 2012-02-14 08:50 - 0018921 ____A C:\Users\wilogs\Downloads\plg_extravote_15.zip 2012-02-14 08:36 - 2012-02-14 08:36 - 0003095 ____A C:\Users\wilogs\Downloads\plgSearchReviews_3.0.12_final.zip 2012-02-14 08:35 - 2012-02-14 08:35 - 0625919 ____A C:\Users\wilogs\Downloads\com_simple_review-3.0.9_final_joomla1.5_1.6.zip 2012-02-14 08:35 - 2012-02-14 08:35 - 0005339 ____A C:\Users\wilogs\Downloads\mod_simple_review_latest-3.0.5_final_joomla1.5_1.6.zip 2012-02-14 03:47 - 2012-02-15 00:06 - 0035506 ____A C:\Users\wilogs\Downloads\keyword_ideas_20120214_0347353.csv 2012-02-11 07:40 - 2012-02-11 07:40 - 0040181 ____A C:\Users\wilogs\Downloads\Fotolia_33589002_XS.jpg 2012-02-11 07:26 - 2012-02-11 07:26 - 0010591 ____A C:\Users\wilogs\Downloads\Mustersiegel_2.jpg 2012-02-11 07:23 - 2012-02-11 07:23 - 0004924 ____A C:\Users\wilogs\Downloads\Mustersiegel.jpg 2012-02-09 06:24 - 2012-02-09 06:24 - 0013806 ____A C:\Users\wilogs\Documents\hs_err_pid6692.log 2012-02-07 12:03 - 2012-02-27 06:54 - 0857890 ____A C:\Windows\ntbtlog.txt 2012-02-07 12:03 - 2012-02-07 12:03 - 0922360 ____A C:\Windows\Minidump\020712-15802-01.dmp 2012-02-06 22:15 - 2012-02-06 22:15 - 0000165 ___AH C:\Users\wilogs\Desktop\~$Beschreibung_Bewertung.pptx 2012-02-05 00:12 - 2012-02-05 00:12 - 0044571 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Kontoauszug_Nr._1.pdf 2012-02-05 00:12 - 2012-02-05 00:12 - 0044499 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Kontoauszug_Nr._4.pdf 2012-02-05 00:11 - 2012-02-05 00:11 - 0037894 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._10.pdf 2012-02-05 00:11 - 2012-02-05 00:11 - 0037879 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Mitteilung_Nr._7.pdf 2012-02-05 00:11 - 2012-02-05 00:11 - 0037767 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._9.pdf 2012-02-05 00:11 - 2012-02-05 00:11 - 0037751 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._8.pdf 2012-02-05 00:11 - 2012-02-05 00:11 - 0037708 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Mitteilung_Nr._5.pdf 2012-02-05 00:11 - 2012-02-05 00:11 - 0037479 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._11.pdf 2012-02-05 00:11 - 2012-02-05 00:11 - 0037471 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Mitteilung_Nr._6.pdf 2012-01-28 00:52 - 2012-02-27 07:03 - 0000000 ____D C:\Windows\Minidump 2012-01-28 00:52 - 2012-01-28 00:52 - 1056600 ____A C:\Windows\Minidump\012812-36847-01.dmp 2012-01-28 00:51 - 2012-02-27 07:03 - 341535227 ____A C:\Windows\MEMORY.DMP 2012-01-28 00:48 - 2012-01-28 00:48 - 0000165 ___AH C:\Users\wilogs\Desktop\~$Microsoft Office PowerPoint-Präsentation (neu).pptx ============ 3 Months Modified Files and Folders ============= 2012-02-27 19:45 - 2012-02-27 19:45 - 0000000 ____D C:\FRST 2012-02-27 07:03 - 2012-02-27 07:03 - 0278224 ____A C:\Windows\Minidump\022712-73757-01.dmp 2012-02-27 07:03 - 2012-02-26 23:58 - 0000000 __ASH C:\Windows\System32\dds_log_trash.cmd 2012-02-27 07:03 - 2012-01-28 00:52 - 0000000 ____D C:\Windows\Minidump 2012-02-27 07:03 - 2012-01-28 00:51 - 341535227 ____A C:\Windows\MEMORY.DMP 2012-02-27 07:03 - 2009-07-13 21:08 - 0000006 ___AH C:\Windows\Tasks\SA.DAT 2012-02-27 07:03 - 2009-07-13 20:51 - 0136381 ____A C:\Windows\setupact.log 2012-02-27 07:02 - 2010-09-16 08:44 - 2960461824 __ASH C:\hiberfil.sys 2012-02-27 07:00 - 2012-02-27 07:00 - 0278224 ____A C:\Windows\Minidump\022712-54303-01.dmp 2012-02-27 06:57 - 2012-02-27 06:57 - 0270472 ____A C:\Windows\Minidump\022712-52712-01.dmp 2012-02-27 06:54 - 2012-02-27 06:54 - 0278280 ____A C:\Windows\Minidump\022712-56269-01.dmp 2012-02-27 06:54 - 2012-02-07 12:03 - 0857890 ____A C:\Windows\ntbtlog.txt 2012-02-27 06:51 - 2012-02-27 06:51 - 0278280 ____A C:\Windows\Minidump\022712-50123-01.dmp 2012-02-27 05:23 - 2010-12-07 06:30 - 0000043 ____A C:\Users\Public\Documents\AtherosServiceConfig.ini 2012-02-27 05:20 - 2012-02-27 05:20 - 0278448 ____A C:\Windows\Minidump\022712-18548-01.dmp 2012-02-27 05:16 - 2012-02-27 05:16 - 0270472 ____A C:\Windows\Minidump\022712-28532-01.dmp 2012-02-27 05:14 - 2012-02-27 05:14 - 0278448 ____A C:\Windows\Minidump\022712-18142-01.dmp 2012-02-27 05:12 - 2012-02-27 05:12 - 0278448 ____A C:\Windows\Minidump\022712-28204-01.dmp 2012-02-27 05:08 - 2010-09-16 08:51 - 1684466 ____A C:\Windows\WindowsUpdate.log 2012-02-27 04:54 - 2010-12-07 16:10 - 0000000 ____D C:\Users\wilogs\AppData\Local\CrashDumps 2012-02-27 04:50 - 2011-10-30 16:15 - 0000000 ____D C:\Users\wilogs\AppData\Local\E60B6EBC-B67B-440A-96ED-0C586EB6C24E.aplzod 2012-02-27 04:49 - 2010-12-07 07:22 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\Dropbox 2012-02-27 04:46 - 2012-02-27 04:46 - 0002251 ____A C:\Users\Public\Desktop\PC Tools Spyware Doctor.lnk 2012-02-27 04:46 - 2012-02-27 04:46 - 0000000 ____D C:\Program Files (x86)\PC Tools 2012-02-27 04:46 - 2012-02-27 04:43 - 0000000 ____D C:\Users\All Users\PC Tools 2012-02-27 04:46 - 2012-02-27 04:43 - 0000000 ____D C:\ProgramData\PC Tools 2012-02-27 04:44 - 2012-02-27 04:44 - 1768896 ____A C:\Windows\System32\Drivers\Cat.DB 2012-02-27 04:43 - 2012-02-27 04:43 - 0002601 ____A C:\Users\wilogs\Desktop\sd9setup[1].exe.lnk 2012-02-27 04:43 - 2012-02-27 04:43 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\TestApp 2012-02-27 04:08 - 2010-12-07 13:49 - 0000000 ____D C:\Users\All Users\boost_interprocess 2012-02-27 04:08 - 2010-12-07 13:49 - 0000000 ____D C:\ProgramData\boost_interprocess 2012-02-27 04:05 - 2012-01-24 11:43 - 0000000 ____D C:\Windows\tessdata 2012-02-27 03:55 - 2012-02-27 03:55 - 0438158 ____A C:\Users\wilogs\Desktop\LAH_Dispo_Direkt_V2.docx 2012-02-27 02:33 - 2009-07-13 20:45 - 0017600 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-02-27 02:33 - 2009-07-13 20:45 - 0017600 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-02-27 02:27 - 2010-12-07 07:24 - 0000000 ___RD C:\Users\wilogs\Documents\My Dropbox 2012-02-27 02:26 - 2010-05-10 15:15 - 0040788 ____A C:\Windows\PFRO.log 2012-02-27 02:25 - 2012-02-27 02:13 - 0719836 ____A C:\Users\wilogs\Desktop\Sortiment Screenshots.pptx 2012-02-27 01:40 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\NDF 2012-02-27 00:09 - 2009-07-13 18:34 - 0001398 _RASH C:\Windows\System32\Drivers\etc\hosts 2012-02-27 00:01 - 2012-02-27 00:01 - 0000000 __SHD C:\Windows\System32\%APPDATA% 2012-02-26 23:57 - 2011-07-01 06:13 - 0414368 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2012-02-26 23:56 - 2012-02-26 23:53 - 0000000 __SHD C:\Users\wilogs\AppData\Local\f1be3786 2012-02-26 23:06 - 2011-05-28 01:24 - 0000000 ____D C:\Users\wilogs\AppData\Local\Paint.NET 2012-02-24 22:59 - 2010-12-07 13:50 - 0000000 ____D C:\Users\wilogs\Documents\Bluetooth Folder 2012-02-24 03:03 - 2010-12-07 15:03 - 0001016 ____A C:\Users\wilogs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk 2012-02-24 03:03 - 2010-12-07 15:01 - 0000669 ____A C:\Windows\wininit.ini 2012-02-24 01:48 - 2012-02-24 01:48 - 4226142 ____A C:\Users\wilogs\Downloads\Somebody That I Used to Know - Walk off the Earth (Gotye - Cover).mp3 2012-02-24 01:47 - 2012-02-24 01:47 - 3999065 ____A C:\Users\wilogs\Downloads\Radio 538 Gotye - Somebody That I Used To Know (Jeroen Nieuwenhuize remix).mp4.mp3 2012-02-24 01:47 - 2012-02-24 01:47 - 3906278 ____A C:\Users\wilogs\Downloads\Gotye Ft. Kimbra - Somebody That I Used To Know ( Dimenson Vocal House Remix 2012 ).mp3 2012-02-24 01:46 - 2012-02-24 01:46 - 3907532 ____A C:\Users\wilogs\Downloads\Gotye- Somebody That I Used To Know feat. Kimbra 720p.mp3 2012-02-23 14:46 - 2010-12-07 07:05 - 0000000 ___RD C:\Users\wilogs\Desktop\Privat 2012-02-23 13:20 - 2010-12-07 07:14 - 0000000 ___RD C:\wilogs 2012-02-23 08:33 - 2012-02-23 08:33 - 0010948 ____A C:\Users\wilogs\Downloads\keyword_ideas_20120223_0833808.csv 2012-02-23 01:28 - 2012-02-23 01:28 - 0179788 ____A C:\Users\wilogs\Desktop\JS_Diss_Kapitel_4.3.pdf 2012-02-23 01:27 - 2012-02-23 01:27 - 0461065 ____A C:\Users\wilogs\Desktop\JS_Diss_Kapitel_4.2.pdf 2012-02-22 01:59 - 2012-02-22 01:59 - 0001156 ____A C:\Users\wilogs\Downloads\vorlage-koederseite.zip 2012-02-21 21:50 - 2010-12-07 06:28 - 0000174 ___SH C:\Users\wilogs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2012-02-21 21:44 - 2009-07-13 20:45 - 0412992 ____A C:\Windows\System32\FNTCACHE.DAT 2012-02-21 12:01 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\SysWOW64\de-DE 2012-02-21 12:01 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\de-DE 2012-02-21 09:28 - 2012-02-21 09:28 - 0272191 ____A C:\Users\wilogs\Desktop\JS_Diss_Kapitel_4 1.pdf 2012-02-21 05:43 - 2012-02-18 02:22 - 0017232 ____A C:\Users\wilogs\Desktop\Stoff_Ausschuss_Verschrottung.docx 2012-02-21 01:48 - 2012-02-16 03:39 - 0000000 ____D C:\Users\wilogs\Desktop\Bewertung Monetär 2012-02-21 01:20 - 2010-12-07 07:43 - 0011539 ____A C:\Users\wilogs\gsview64.ini 2012-02-19 04:09 - 2012-02-19 02:43 - 0000000 ____D C:\Users\wilogs\Desktop\Besuchermatrix_Bilder 2012-02-19 02:06 - 2012-02-19 02:06 - 0141619 ____A C:\Users\wilogs\Downloads\mod_super_login_J1.7_J2.5_v2.5.0.zip 2012-02-19 01:30 - 2012-02-19 01:22 - 4510449 ____A C:\Users\wilogs\Downloads\jsn_epic_docs(1).zip 2012-02-19 00:42 - 2012-02-19 00:42 - 1389328 ____A C:\Users\wilogs\Downloads\com_jce_2021.zip 2012-02-19 00:38 - 2012-02-19 00:38 - 0017578 ____A C:\Users\wilogs\Downloads\plg_extravote.zip 2012-02-19 00:28 - 2012-02-19 00:28 - 0811287 ____A C:\Users\wilogs\Downloads\jsn_epic_pro_unlimited_j2.5_4.3.0_install.zip 2012-02-18 09:38 - 2010-12-07 07:36 - 0000000 ____D C:\Program Files (x86)\Mozilla Firefox 2012-02-17 12:47 - 2010-09-16 18:39 - 0644328 ____A C:\Windows\System32\perfh007.dat 2012-02-17 12:47 - 2010-09-16 18:39 - 0126574 ____A C:\Windows\System32\perfc007.dat 2012-02-17 12:47 - 2009-07-13 21:13 - 1473532 ____A C:\Windows\System32\PerfStringBackup.INI 2012-02-17 03:11 - 2012-02-17 03:11 - 0000000 ____D C:\Users\wilogs\Downloads\BoxofBundles01 2012-02-17 02:55 - 2012-02-17 01:56 - 216698241 ____A C:\Users\wilogs\Downloads\BoxofBundles01.zip 2012-02-16 12:13 - 2012-02-16 12:12 - 0755197 ____A (ErstenWare ) C:\Users\wilogs\Downloads\signcrtr.exe 2012-02-16 12:04 - 2012-02-16 11:31 - 0010866 ____A C:\Users\wilogs\Desktop\Qualitative_Kennzahlen.xlsx 2012-02-16 04:22 - 2012-02-16 04:22 - 0077159 ____A C:\Users\wilogs\Desktop\Musterartikel-für-die-redaktionelle-Einbindung-bei-Publishern.pdf 2012-02-16 03:42 - 2012-01-05 12:21 - 0018271 ____A C:\Users\wilogs\Desktop\Diss_Timer.xlsx 2012-02-15 23:44 - 2012-02-15 23:33 - 170203312 ____A C:\Users\wilogs\Downloads\VideoSpin_2_0_Setup_2_.exe 2012-02-15 23:41 - 2012-02-15 23:41 - 0003177 ____A C:\Users\wilogs\Downloads\press9-joomla.zip 2012-02-15 10:19 - 2012-02-15 10:19 - 0002636 ____A C:\Users\wilogs\Downloads\hider_plugin_content_v1_51.zip 2012-02-15 05:36 - 2012-02-15 05:36 - 0029463 ____A C:\Users\wilogs\Downloads\readlesstext_1.5(1).zip 2012-02-15 05:33 - 2012-02-15 05:33 - 0039388 ____A C:\Users\wilogs\Downloads\readlesstext_1.5.zip 2012-02-15 04:43 - 2012-02-15 04:43 - 2187836 ____A C:\Users\wilogs\Downloads\com_pinme_pinboard_3.1.4.zip 2012-02-15 00:06 - 2012-02-14 03:47 - 0035506 ____A C:\Users\wilogs\Downloads\keyword_ideas_20120214_0347353.csv 2012-02-14 08:52 - 2012-02-14 08:52 - 0118063 ____A C:\Users\wilogs\Downloads\com_rsmonials_153_J15.zip 2012-02-14 08:52 - 2012-02-14 08:52 - 0006244 ____A C:\Users\wilogs\Downloads\mod_rsmonialscroller_1532_J15.zip 2012-02-14 08:52 - 2012-02-14 08:52 - 0004122 ____A C:\Users\wilogs\Downloads\mod_rsmonials_1531_J15.zip 2012-02-14 08:50 - 2012-02-14 08:50 - 0018921 ____A C:\Users\wilogs\Downloads\plg_extravote_15.zip 2012-02-14 08:36 - 2012-02-14 08:36 - 0003095 ____A C:\Users\wilogs\Downloads\plgSearchReviews_3.0.12_final.zip 2012-02-14 08:35 - 2012-02-14 08:35 - 0625919 ____A C:\Users\wilogs\Downloads\com_simple_review-3.0.9_final_joomla1.5_1.6.zip 2012-02-14 08:35 - 2012-02-14 08:35 - 0005339 ____A C:\Users\wilogs\Downloads\mod_simple_review_latest-3.0.5_final_joomla1.5_1.6.zip 2012-02-13 12:02 - 2011-02-17 22:24 - 0000000 ____D C:\Users\wilogs\AppData\Local\ElevatedDiagnostics 2012-02-11 10:23 - 2010-12-07 23:10 - 0000326 ____A C:\Windows\EasyCT.INI 2012-02-11 07:40 - 2012-02-11 07:40 - 0040181 ____A C:\Users\wilogs\Downloads\Fotolia_33589002_XS.jpg 2012-02-11 07:26 - 2012-02-11 07:26 - 0010591 ____A C:\Users\wilogs\Downloads\Mustersiegel_2.jpg 2012-02-11 07:23 - 2012-02-11 07:23 - 0004924 ____A C:\Users\wilogs\Downloads\Mustersiegel.jpg 2012-02-09 06:24 - 2012-02-09 06:24 - 0013806 ____A C:\Users\wilogs\Documents\hs_err_pid6692.log 2012-02-07 12:03 - 2012-02-07 12:03 - 0922360 ____A C:\Windows\Minidump\020712-15802-01.dmp 2012-02-06 22:15 - 2012-02-06 22:15 - 0000165 ___AH C:\Users\wilogs\Desktop\~$Beschreibung_Bewertung.pptx 2012-02-05 00:12 - 2012-02-05 00:12 - 0044571 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Kontoauszug_Nr._1.pdf 2012-02-05 00:12 - 2012-02-05 00:12 - 0044499 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Kontoauszug_Nr._4.pdf 2012-02-05 00:11 - 2012-02-05 00:11 - 0037894 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._10.pdf 2012-02-05 00:11 - 2012-02-05 00:11 - 0037879 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Mitteilung_Nr._7.pdf 2012-02-05 00:11 - 2012-02-05 00:11 - 0037767 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._9.pdf 2012-02-05 00:11 - 2012-02-05 00:11 - 0037751 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._8.pdf 2012-02-05 00:11 - 2012-02-05 00:11 - 0037708 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Mitteilung_Nr._5.pdf 2012-02-05 00:11 - 2012-02-05 00:11 - 0037479 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._11.pdf 2012-02-05 00:11 - 2012-02-05 00:11 - 0037471 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Mitteilung_Nr._6.pdf 2012-01-29 23:35 - 2011-04-21 11:58 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\Canon 2012-01-28 20:10 - 2010-12-07 07:17 - 0279656 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe 2012-01-28 00:52 - 2012-01-28 00:52 - 1056600 ____A C:\Windows\Minidump\012812-36847-01.dmp 2012-01-28 00:48 - 2012-01-28 00:48 - 0000165 ___AH C:\Users\wilogs\Desktop\~$Microsoft Office PowerPoint-Präsentation (neu).pptx 2012-01-26 15:41 - 2010-12-07 23:03 - 54585368 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2012-01-25 11:52 - 2012-01-25 11:52 - 0016627 ____A C:\Users\wilogs\Downloads\Gewinnspiel_original_Foto.jpg 2012-01-25 11:42 - 2012-01-25 11:42 - 0016154 ____A C:\Users\wilogs\Downloads\Umfragen_Gewinnspiel.jpg 2012-01-24 11:42 - 2012-01-24 11:42 - 0159757 ____A (Free OCR) C:\Users\wilogs\Downloads\freeocr.exe 2012-01-24 10:59 - 2010-12-07 07:27 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\Skype 2012-01-24 10:38 - 2010-12-07 08:05 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\skypePM 2012-01-24 10:38 - 2010-12-07 07:27 - 0000000 ___RD C:\Program Files (x86)\Skype 2012-01-24 10:38 - 2010-12-07 07:27 - 0000000 ____D C:\Users\All Users\Skype 2012-01-24 10:38 - 2010-12-07 07:27 - 0000000 ____D C:\ProgramData\Skype 2012-01-23 23:23 - 2011-12-23 10:41 - 0000000 ____D C:\Users\wilogs\Desktop\A5 Anschaffung 2012-01-23 08:14 - 2011-11-11 06:21 - 0000000 ____D C:\Users\wilogs\Desktop\2011_11_15_I-VK-42_Inhalte 2012-01-19 23:32 - 2012-01-19 23:32 - 0002787 ____A C:\Users\wilogs\Downloads\mod_amazon_banner_1.5.zip 2012-01-19 23:32 - 2012-01-19 23:32 - 0002787 ____A C:\Users\wilogs\Downloads\mod_amazon_banner_1.5(1).zip 2012-01-19 22:45 - 2012-01-19 22:40 - 0000000 ___RD C:\Users\wilogs\Desktop\Bibliothek 2012-01-16 07:28 - 2012-02-27 04:46 - 2246608 ____A (Threat Expert Ltd.) C:\Windows\PCTBDCore.dll 2012-01-16 07:28 - 2012-02-27 04:46 - 1681360 ____A (Threat Expert Ltd.) C:\Windows\PCTBDRes.dll 2012-01-16 07:28 - 2012-02-27 04:46 - 0767952 ____A C:\Windows\BDTSupport.dll 2012-01-16 07:28 - 2012-02-27 04:46 - 0149456 ____A (PC Tools) C:\Windows\SGDetectionTool.dll 2012-01-13 20:02 - 2012-02-21 11:04 - 3143168 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-01-11 23:32 - 2012-01-11 23:32 - 0000000 ____D C:\Windows\System32\Macromed 2012-01-11 12:45 - 2012-01-11 12:45 - 12852642 ____A C:\Users\wilogs\Downloads\16-gesetze-napoleon-hill.zip 2012-01-11 07:19 - 2012-02-27 04:46 - 0092896 ____A (PC Tools) C:\Windows\System32\Drivers\pctplsg64.sys 2012-01-11 07:19 - 2012-02-27 04:44 - 0230952 ____A (PC Tools) C:\Windows\System32\Drivers\PCTSD64.sys 2012-01-11 07:17 - 2012-02-27 04:46 - 0014776 ____A (PC Tools) C:\Windows\System32\Drivers\pctBTFix64.sys 2012-01-11 07:14 - 2012-02-27 04:46 - 0339608 ____A (PC Tools) C:\Windows\System32\Drivers\pctgntdi64.sys 2012-01-11 07:14 - 2012-02-27 04:46 - 0145432 ____A (PC Tools) C:\Windows\System32\Drivers\pctwfpfilter64.sys 2012-01-09 23:38 - 2012-01-06 00:45 - 0001242 ____A C:\Users\wilogs\Desktop\iPhonePhotos.lnk 2012-01-09 23:37 - 2012-01-09 23:36 - 0002600 ____A C:\Users\wilogs\Desktop\Diss_Images_PDF.lnk 2012-01-09 23:35 - 2012-01-09 23:34 - 0002758 ____A C:\Users\wilogs\Desktop\Diss_Images_Orignal.lnk 2012-01-07 09:06 - 2010-12-29 05:05 - 0000034 ____A C:\Windows\cdplayer.ini 2012-01-07 08:56 - 2012-01-07 08:46 - 0000000 ____D C:\Users\wilogs\Desktop\zufall 2012-01-04 01:59 - 2012-02-21 11:13 - 14164480 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2012-01-04 01:58 - 2012-02-21 11:13 - 0509952 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll 2012-01-04 01:03 - 2012-02-21 11:13 - 12868096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2012-01-04 01:03 - 2012-02-21 11:13 - 0442880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll 2012-01-02 22:24 - 2012-02-21 11:13 - 0515584 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl 2012-01-02 21:44 - 2012-02-21 11:13 - 0478208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl 2011-12-30 12:06 - 2011-11-21 14:14 - 0000000 ____D C:\Program Files (x86)\Android 2011-12-30 12:00 - 2010-12-07 06:27 - 0000000 ____D C:\Users\wilogs\AppData\LocalLow 2011-12-30 11:58 - 2011-12-03 08:57 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\TerraTec 2011-12-27 19:59 - 2012-02-21 11:04 - 0499200 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys 2011-12-27 14:17 - 2011-12-27 14:16 - 17299192 ____A ({code:GDConstant|CompanyName} ) C:\Users\wilogs\Downloads\RecoverMyFiles-Setup-German.exe 2011-12-23 10:39 - 2011-05-16 04:11 - 0000000 ____D C:\Program Files (x86)\PDF24 2011-12-22 22:20 - 2009-07-13 21:08 - 0032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT 2011-12-21 04:29 - 2011-12-21 04:29 - 52580303 ____A C:\Users\wilogs\Downloads\Schatzkammer Gratistemplate.zip 2011-12-21 04:29 - 2011-12-21 04:29 - 2500346 ____A C:\Users\wilogs\Downloads\Gruene-Blaetter.zip 2011-12-19 03:22 - 2010-12-07 06:28 - 0109232 ____A C:\Users\wilogs\AppData\Local\GDIPFONTCACHEV1.DAT 2011-12-19 00:18 - 2010-12-07 08:34 - 0000000 ____D C:\Users\All Users\Microsoft Help 2011-12-19 00:18 - 2010-12-07 08:34 - 0000000 ____D C:\ProgramData\Microsoft Help 2011-12-19 00:15 - 2009-07-13 18:34 - 0000478 ____A C:\Windows\win.ini 2011-12-18 02:21 - 2011-12-18 02:21 - 0000000 ____D C:\Program Files\iTunes 2011-12-18 02:21 - 2011-12-18 02:21 - 0000000 ____D C:\Program Files\iPod 2011-12-18 02:21 - 2011-01-05 09:23 - 0000000 ____D C:\Program Files (x86)\iTunes 2011-12-18 02:18 - 2011-12-18 02:18 - 0000000 ____D C:\Program Files (x86)\QuickTime 2011-12-18 02:17 - 2011-01-11 13:32 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\Apple Computer 2011-12-16 00:45 - 2012-02-21 11:00 - 1501184 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2011-12-16 00:45 - 2012-02-21 11:00 - 1197568 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2011-12-16 00:45 - 2012-02-21 11:00 - 0134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2011-12-16 00:42 - 2012-02-21 11:01 - 0634368 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll 2011-12-16 00:42 - 2012-02-21 11:00 - 9335296 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2011-12-16 00:42 - 2012-02-21 11:00 - 1026560 ____A (Microsoft Corporation) C:\Windows\System32\mstime.dll 2011-12-16 00:42 - 2012-02-21 11:00 - 0703488 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2011-12-16 00:42 - 2012-02-21 11:00 - 0097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2011-12-16 00:42 - 2012-02-21 11:00 - 0082944 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll 2011-12-16 00:41 - 2012-02-21 11:00 - 0064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2011-12-16 00:41 - 2012-02-21 11:00 - 0057856 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll 2011-12-16 00:40 - 2012-02-21 11:00 - 2458624 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2011-12-16 00:40 - 2012-02-21 11:00 - 12372480 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2011-12-16 00:40 - 2012-02-21 11:00 - 0445952 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll 2011-12-16 00:40 - 2012-02-21 11:00 - 0256000 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll 2011-12-16 00:40 - 2012-02-21 11:00 - 0247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2011-12-16 00:38 - 2012-02-21 11:00 - 0012288 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe 2011-12-16 00:02 - 2012-02-21 11:00 - 1230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2011-12-16 00:02 - 2012-02-21 11:00 - 0981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2011-12-16 00:02 - 2012-02-21 11:00 - 0132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2011-12-15 23:59 - 2012-02-21 11:01 - 0690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll 2011-12-15 23:59 - 2012-02-21 11:00 - 5999104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2011-12-15 23:59 - 2012-02-21 11:00 - 0606208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll 2011-12-15 23:59 - 2012-02-21 11:00 - 0599552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2011-12-15 23:59 - 2012-02-21 11:00 - 0067072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2011-12-15 23:59 - 2012-02-21 11:00 - 0064512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2011-12-15 23:58 - 2012-02-21 11:00 - 2072576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2011-12-15 23:58 - 2012-02-21 11:00 - 10991104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2011-12-15 23:58 - 2012-02-21 11:00 - 0381440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2011-12-15 23:58 - 2012-02-21 11:00 - 0185856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2011-12-15 23:58 - 2012-02-21 11:00 - 0176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2011-12-15 23:58 - 2012-02-21 11:00 - 0048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2011-12-15 23:58 - 2012-02-21 11:00 - 0044544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2011-12-15 23:56 - 2012-02-21 11:00 - 0012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2011-12-15 23:26 - 2012-02-21 11:00 - 0482816 ____A (Microsoft Corporation) C:\Windows\System32\html.iec 2011-12-15 22:49 - 2012-02-21 11:00 - 0386048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2011-12-15 22:43 - 2012-02-21 11:00 - 1638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2011-12-15 22:15 - 2012-02-21 11:00 - 1638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2011-12-13 10:34 - 2011-12-13 10:34 - 0165156 ____A C:\Users\wilogs\Downloads\06leas.zip 2011-12-11 10:44 - 2011-12-11 10:44 - 3090412 ____A C:\Users\wilogs\Downloads\TheConradRangaliIslandTheOverWaterSpa2.jpg 2011-12-06 23:29 - 2011-12-06 23:29 - 0035707 ____A C:\Users\wilogs\Documents\qry_RTNR_Summe_1E_V1.xlsx 2011-12-05 12:39 - 2010-12-07 23:27 - 0000000 ___RD C:\Privat 2011-12-04 01:23 - 2011-12-04 01:23 - 0000664 ____A C:\Users\wilogs\Downloads\KD_Muenchen_neu.ini 2011-12-03 10:59 - 2011-12-03 10:59 - 0031114 ____A C:\Users\wilogs\Downloads\dvb-c_de_Landshut-I_KDG.conf 2011-12-03 10:59 - 2011-12-03 10:59 - 0023958 ____A C:\Users\wilogs\Downloads\lamedb 2011-12-03 10:59 - 2011-12-03 10:58 - 0014555 ____A C:\Users\wilogs\Downloads\export.zip 2011-12-03 10:59 - 2011-12-03 10:58 - 0007646 ____A C:\Users\wilogs\Downloads\export(1).zip 2011-12-03 10:47 - 2011-12-03 10:47 - 0117915 ____A C:\Users\wilogs\Downloads\Astra_DVB-S.chl 2011-12-03 09:04 - 2011-12-03 09:04 - 0000000 ____D C:\Program Files\Common Files\TerraTec 2011-12-03 09:04 - 2010-05-10 15:06 - 0000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2011-12-02 01:37 - 2011-11-22 22:49 - 0000000 ____D C:\Users\wilogs\Desktop\SD_Karte Save Arbeit 2011-12-01 07:07 - 2012-02-27 04:44 - 1096688 ____A (PC Tools) C:\Windows\System32\Drivers\pctEFA64.sys 2011-12-01 07:07 - 2012-02-27 04:44 - 0453896 ____A (PC Tools) C:\Windows\System32\Drivers\pctDS64.sys 2011-12-01 00:13 - 2011-12-01 00:12 - 0000000 ____D C:\Users\wilogs\Desktop\IEF71 ========================= Known DLLs (Whitelisted) ============ ========================= Bamital & volsnap Check ============ C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe [2011-06-30 13:33] - [2011-02-25 21:33] - 2614784 ____A (Microsoft Corporation) 2AF58D15EDC06EC6FDACCE1F19482BBF C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ========================= Memory info ====================== Percentage of memory in use: 18% Total physical RAM: 3764.43 MB Available physical RAM: 3063.81 MB Total Pagefile: 3762.57 MB Available Pagefile: 3054.18 MB Total Virtual: 8192 MB Available Virtual: 8191.9 MB ======================= Partitions ========================= 1 Drive c: (Festplatte) (Fixed) (Total:452.97 GB) (Free:333.54 GB) NTFS 2 Drive e: (PQSERVICE) (Fixed) (Total:12.7 GB) (Free:2.56 GB) NTFS ==>[System with boot components (obtained from reading drive)] 3 Drive f: (ACHTUNG_DIS) (Removable) (Total:1.87 GB) (Free:1.87 GB) FAT 4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS 5 Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] Datentr„ger ### Status Gr”áe Frei Dyn GPT --------------- ------------- ------- ------- --- --- Datentr„ger 0 Online 465 GB 0 B Datentr„ger 1 Online 1912 MB 0 B Datentr„gerpartitionierung wird beendet... ========================================================== Last Boot: 2012-02-21 07:36 ======================= End Of Log ========================== |
|
27.02.2012, 23:53
| #6 |
| /// Malwareteam | abnow.com, dauer Bluescreen, was kann ich noch machen Fix mit FRST Drücke bitte die  + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter SubSystems: [Windows] ==> ZeroAccess
C:\Users\wilogs\AppData\Local\f1be3786
__________________ --> abnow.com, dauer Bluescreen, was kann ich noch machen |
|
01.03.2012, 11:39
| #7 |
| | abnow.com, dauer Bluescreen, was kann ich noch machen Hallo Marius, ist dabei, hab ich nachträglich hinzugefügt. Danke Gruß |
|
01.03.2012, 13:04
| #8 |
| /// Malwareteam | abnow.com, dauer Bluescreen, was kann ich noch machen CF-Script Hinweis für Mitleser: Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen! Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von einem der folgenden Download-Spiegel neu herunter: BleepingComputer.com - ForoSpyware.comund speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)! Drücke die Windows + R Taste --> Notepad (hinein schreiben) --> OK Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument. Code:
ATTFilter ROOTKIT::
C:\Windows\system32\a016mgmt.dll
C:\Windows\system32\consrv.dll
C:\Windows\system32\knobserv.dll
C:\Windows\system32\rdsessmgr.dll
C:\Windows\assembly\tmp\loader.tlb
C:\Windows\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
DDS:
uStart Page = hxxp://www.searchqu.com//406
FIREFOX::
FF - ProfilePath - C:\Users\wilogs\AppData\Roaming\Mozilla\Firefox\Profiles\jsg11fbx.default\
FF - prefs.js: keyword.URL - hxxp://www.searchqu.com/web?src=ffb&appid=175&systemid=406&sr=0&q=
Wichtig:
__________________ Kein Asylrecht für Trojaner! Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! |
|
01.03.2012, 18:53
| #9 |
| | abnow.com, dauer Bluescreen, was kann ich noch machen Hallo Marius, wahnsinn was Ihr hier durchzieht! Sensationell. Hier also das Log von der erneuten Anwendung von Combofix zusammen mit CFScript.txt. Code:
ATTFilter ComboFix 12-03-01.01 - wilogs 01.03.2012 18:33:12.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3764.2228 [GMT 1:00]
ausgeführt von:: c:\users\wilogs\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\wilogs\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\wilogs\AppData\Local\Temp\b3ac04aa-9413-4ecb-ac45-ed44495e62a6\CliSecureRT.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-02-01 bis 2012-03-01 ))))))))))))))))))))))))))))))
.
.
2012-03-01 17:39 . 2012-03-01 17:39 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-01 07:00 . 2012-03-01 07:00 -------- d-----w- c:\users\wilogs\AppData\Roaming\Malwarebytes
2012-03-01 06:59 . 2012-03-01 06:59 -------- d-----w- c:\programdata\Malwarebytes
2012-03-01 06:59 . 2012-03-01 06:59 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-03-01 06:59 . 2011-12-10 14:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-02-28 03:45 . 2012-02-28 14:41 -------- d-----w- C:\FRST
2012-02-27 12:46 . 2012-01-16 15:28 767952 ----a-w- c:\windows\BDTSupport.dll
2012-02-27 12:44 . 2012-01-11 15:19 230952 ----a-w- c:\windows\system32\drivers\PCTSD64.sys
2012-02-27 12:43 . 2012-02-27 12:46 -------- d-----w- c:\programdata\PC Tools
2012-02-27 12:43 . 2012-02-27 12:43 -------- d-----w- c:\users\wilogs\AppData\Roaming\TestApp
2012-02-21 19:13 . 2012-01-04 09:58 509952 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-21 19:13 . 2012-01-04 09:03 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll
2012-02-21 19:13 . 2012-01-03 06:24 515584 ----a-w- c:\windows\system32\timedate.cpl
2012-02-21 19:13 . 2012-01-03 05:44 478208 ----a-w- c:\windows\SysWow64\timedate.cpl
2012-02-21 19:01 . 2011-12-16 08:42 634368 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-21 19:01 . 2011-12-16 07:59 690688 ----a-w- c:\windows\SysWow64\msvcrt.dll
2012-02-21 19:01 . 2011-10-15 06:25 723456 ----a-w- c:\windows\system32\EncDec.dll
2012-02-21 19:01 . 2011-10-15 05:48 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2012-02-21 18:58 . 2011-11-19 15:07 77312 ----a-w- c:\windows\system32\packager.dll
2012-02-21 18:58 . 2011-11-19 14:06 67072 ----a-w- c:\windows\SysWow64\packager.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-27 07:57 . 2011-07-01 14:13 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-20 00:05 . 2012-02-25 11:15 8643640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{291F034F-141E-4BB6-8FCB-A99B491D1879}\mpengine.dll
2012-01-29 04:10 . 2010-12-07 15:17 279656 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-02-29_13.45.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2012-03-01 17:40 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-02-29 13:43 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-02-29 13:43 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-03-01 17:40 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-03-01 17:40 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-02-29 13:43 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-05-10 23:04 . 2012-03-01 17:42 67208 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-03-01 17:42 39696 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-12-07 14:29 . 2012-03-01 17:42 18146 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2602113849-1727216621-282029759-1001_UserData.bin
+ 2010-12-07 14:46 . 2012-03-01 16:16 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-12-07 14:46 . 2012-02-29 13:46 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-12-07 14:46 . 2012-03-01 16:16 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-12-07 14:46 . 2012-02-29 13:46 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-12-07 14:46 . 2012-02-29 13:46 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-12-07 14:46 . 2012-03-01 16:16 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-12-07 14:33 . 2012-02-29 13:46 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-12-07 14:33 . 2012-03-01 17:42 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-12-07 14:33 . 2012-03-01 17:42 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-12-07 14:33 . 2012-02-29 13:46 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2012-02-29 13:43 . 2012-02-29 13:43 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-03-01 17:40 . 2012-03-01 17:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-03-01 17:40 . 2012-03-01 17:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-02-29 13:43 . 2012-02-29 13:43 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-12-07 21:49 . 2012-03-01 10:16 373130 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2009-07-14 02:36 . 2012-02-29 13:26 610556 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-03-01 17:30 610556 c:\windows\system32\perfh009.dat
+ 2010-09-17 02:39 . 2012-03-01 17:30 647838 c:\windows\system32\perfh007.dat
- 2010-09-17 02:39 . 2012-02-29 13:26 647838 c:\windows\system32\perfh007.dat
- 2009-07-14 02:36 . 2012-02-29 13:26 104592 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2012-03-01 17:30 104592 c:\windows\system32\perfc009.dat
- 2010-09-17 02:39 . 2012-02-29 13:26 127584 c:\windows\system32\perfc007.dat
+ 2010-09-17 02:39 . 2012-03-01 17:30 127584 c:\windows\system32\perfc007.dat
- 2009-07-14 05:12 . 2012-02-27 08:02 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:12 . 2012-03-01 10:16 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2010-09-16 16:53 . 2012-02-29 13:43 131072 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-09-16 16:53 . 2012-03-01 17:40 131072 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-03-01 17:40 131072 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-02-29 13:43 131072 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-01-21 14:46 . 2012-02-29 13:42 229224 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2011-01-21 14:46 . 2012-03-01 17:39 229224 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2010-09-16 16:53 . 2012-03-01 17:40 2031616 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-09-16 16:53 . 2012-02-29 13:43 2031616 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 02:34 . 2012-02-27 10:39 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2012-03-01 09:58 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2011-11-08 929168]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2011-11-08 3508624]
"KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-11-08 21392]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2011-11-11 59240]
"Copernic Desktop Search - Home"="c:\program files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe" [2011-11-22 1648600]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-03-08 260608]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2009-12-25 201512]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2009-12-25 401192]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-04-21 98304]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-05-26 960080]
"MDS_Menu"="c:\program files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"ArcadeMovieService"="c:\program files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe" [2010-04-23 124136]
"Google Desktop Search"="c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" [2010-12-07 30192]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"DivX Download Manager"="c:\program files (x86)\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2011-12-16 220744]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
c:\users\wilogs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\wilogs\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-15 24246216]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files (x86)\Acer\Acer VCM\AcerVCM.exe [2010-9-16 704032]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"midi2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [x]
R3 CYDTV_SRV;cydtv Driver;c:\windows\system32\drivers\cydtv.sys [x]
R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2010-12-07 30192]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files (x86)\PC Tools\PC Tools Security\pctsAuxs.exe [2012-01-11 402336]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys [x]
S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys [x]
S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA64.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\Drivers\PCTSD64.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2010-05-25 47776]
S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files (x86)\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe [2012-01-16 546768]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-05-26 325200]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2010-02-02 820768]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-03-08 250368]
S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [2010-01-29 260640]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-07 2228008]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-03-03 2320920]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-28 243232]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 PCTBD;PC Tools Browser Defender Driver;c:\windows\system32\Drivers\PCTBD64.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\wilogs\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\wilogs\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\wilogs\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bluetooth Connection Assistant"="LBTWIZ.EXE -silent" [X]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-22 323584]
"mwlDaemon"="c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe" [BU]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-21 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-21 391192]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-21 413720]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-01-20 9996320]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-01-20 877600]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2010-05-25 585376]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2010-05-25 354464]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2010-03-09 345648]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2010-02-02 496160]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2010-07-21 2306448]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-06-12 134416]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1680976]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-04-13 2399632]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
smbusp
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.searchqu.com//406
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_3820&r=27361210h416l0498z135t6711k583
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: ihk-online-akademie.de\www
FF - ProfilePath - c:\users\wilogs\AppData\Roaming\Mozilla\Firefox\Profiles\jsg11fbx.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.wisedock.de/m.php?id=17717ada58c472ea9641bcffa2cff5809f8cb
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f7,08,c9,62,44,41,56,47,b8,a5,8e,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f7,08,c9,62,44,41,56,47,b8,a5,8e,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Cyberlink\Shared files\RichVideo.exe
c:\program files (x86)\Launch Manager\LMworker.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-03-01 18:49:38 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-03-01 17:49
ComboFix2.txt 2012-02-29 13:53
.
Vor Suchlauf: 21 Verzeichnis(se), 356.738.220.032 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 356.534.947.840 Bytes frei
.
- - End Of File - - 4A6C445174A4C4D303D6F06D7E8AF636
|
|
02.03.2012, 00:13
| #10 |
| /// Malwareteam | abnow.com, dauer Bluescreen, was kann ich noch machen Schritt 1: CF-Script Hinweis für Mitleser: Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen! Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von einem der folgenden Download-Spiegel neu herunter: BleepingComputer.com - ForoSpyware.comund speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)! Drücke die Windows + R Taste --> Notepad (hinein schreiben) --> OK Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument. Code:
ATTFilter DDS::
uStart Page = hxxp://www.searchqu.com//406
FOLDER::
c:\users\wilogs\AppData\Local\Temp\b3ac04aa-9413-4ecb-ac45-ed44495e62a6
Wichtig:
Schritt 2: aswMBR Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
Schritt 3: MBAM Downloade Dir bitte Malwarebytes
Schritt 4: ESET ESET Online Scanner
__________________ Kein Asylrecht für Trojaner! Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! |
|
02.03.2012, 10:05
| #11 |
| | abnow.com, dauer Bluescreen, was kann ich noch machen Guten Morgen Marius! Deine Aufgabenliste habe ich wieder abgearbeitet. Nachfolgend die Logs Hinweis: Nach dem Scanen mit ESET und nachdem ich ESET lt. Anleitung geschlossen habe, kam ein Fenster zum Vorschein. Windows-Meldung. Programm (ESET) nicht richtig installiert. Noch einmal installieren und scannen? CF-Script Code:
ATTFilter ComboFix 12-03-01.02 - wilogs 02.03.2012 7:04.3.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3764.2280 [GMT 1:00]
ausgeführt von:: c:\users\wilogs\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\wilogs\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\wilogs\AppData\Local\Temp\b3ac04aa-9413-4ecb-ac45-ed44495e62a6
c:\users\wilogs\AppData\Local\Temp\b3ac04aa-9413-4ecb-ac45-ed44495e62a6\CliSecureRT.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-02-02 bis 2012-03-02 ))))))))))))))))))))))))))))))
.
.
2012-03-02 06:14 . 2012-03-02 06:14 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-01 07:00 . 2012-03-01 07:00 -------- d-----w- c:\users\wilogs\AppData\Roaming\Malwarebytes
2012-03-01 06:59 . 2012-03-01 06:59 -------- d-----w- c:\programdata\Malwarebytes
2012-03-01 06:59 . 2012-03-01 06:59 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-03-01 06:59 . 2011-12-10 14:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-02-28 03:45 . 2012-02-28 14:41 -------- d-----w- C:\FRST
2012-02-27 12:46 . 2012-01-16 15:28 767952 ----a-w- c:\windows\BDTSupport.dll
2012-02-27 12:44 . 2012-01-11 15:19 230952 ----a-w- c:\windows\system32\drivers\PCTSD64.sys
2012-02-27 12:43 . 2012-02-27 12:46 -------- d-----w- c:\programdata\PC Tools
2012-02-27 12:43 . 2012-02-27 12:43 -------- d-----w- c:\users\wilogs\AppData\Roaming\TestApp
2012-02-21 19:13 . 2012-01-04 09:58 509952 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-21 19:13 . 2012-01-04 09:03 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll
2012-02-21 19:13 . 2012-01-03 06:24 515584 ----a-w- c:\windows\system32\timedate.cpl
2012-02-21 19:13 . 2012-01-03 05:44 478208 ----a-w- c:\windows\SysWow64\timedate.cpl
2012-02-21 19:01 . 2011-12-16 08:42 634368 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-21 19:01 . 2011-12-16 07:59 690688 ----a-w- c:\windows\SysWow64\msvcrt.dll
2012-02-21 19:01 . 2011-10-15 06:25 723456 ----a-w- c:\windows\system32\EncDec.dll
2012-02-21 19:01 . 2011-10-15 05:48 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2012-02-21 18:58 . 2011-11-19 15:07 77312 ----a-w- c:\windows\system32\packager.dll
2012-02-21 18:58 . 2011-11-19 14:06 67072 ----a-w- c:\windows\SysWow64\packager.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-27 07:57 . 2011-07-01 14:13 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-20 00:05 . 2012-02-25 11:15 8643640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{291F034F-141E-4BB6-8FCB-A99B491D1879}\mpengine.dll
2012-01-29 04:10 . 2010-12-07 15:17 279656 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-02-29_13.45.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2012-03-02 06:15 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-02-29 13:43 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-02-29 13:43 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-03-02 06:15 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-03-02 06:15 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-02-29 13:43 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-05-10 23:04 . 2012-03-02 06:17 67638 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-03-02 06:17 39696 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-12-07 14:29 . 2012-03-02 06:17 18466 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2602113849-1727216621-282029759-1001_UserData.bin
+ 2010-12-07 14:46 . 2012-03-02 06:17 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-12-07 14:46 . 2012-02-29 13:46 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-12-07 14:46 . 2012-03-02 06:17 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-12-07 14:46 . 2012-02-29 13:46 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-12-07 14:46 . 2012-02-29 13:46 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-12-07 14:46 . 2012-03-02 06:17 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-12-07 14:33 . 2012-02-29 13:46 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-12-07 14:33 . 2012-03-02 06:17 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-12-07 14:33 . 2012-03-02 06:17 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-12-07 14:33 . 2012-02-29 13:46 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2012-02-29 13:43 . 2012-02-29 13:43 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-03-02 06:15 . 2012-03-02 06:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-03-02 06:15 . 2012-03-02 06:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-02-29 13:43 . 2012-02-29 13:43 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-12-07 21:49 . 2012-03-01 10:16 373130 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2009-07-14 02:36 . 2012-02-29 13:26 610556 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-03-01 17:52 610556 c:\windows\system32\perfh009.dat
+ 2010-09-17 02:39 . 2012-03-01 17:52 647838 c:\windows\system32\perfh007.dat
- 2010-09-17 02:39 . 2012-02-29 13:26 647838 c:\windows\system32\perfh007.dat
- 2009-07-14 02:36 . 2012-02-29 13:26 104592 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2012-03-01 17:52 104592 c:\windows\system32\perfc009.dat
- 2010-09-17 02:39 . 2012-02-29 13:26 127584 c:\windows\system32\perfc007.dat
+ 2010-09-17 02:39 . 2012-03-01 17:52 127584 c:\windows\system32\perfc007.dat
- 2009-07-14 05:12 . 2012-02-27 08:02 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:12 . 2012-03-02 05:56 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2010-09-16 16:53 . 2012-02-29 13:43 131072 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-09-16 16:53 . 2012-03-02 06:15 131072 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-03-02 06:15 131072 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-02-29 13:43 131072 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-01-21 14:46 . 2012-02-29 13:42 229224 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2011-01-21 14:46 . 2012-03-02 06:15 229224 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2010-09-16 16:53 . 2012-03-02 06:15 2031616 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-09-16 16:53 . 2012-02-29 13:43 2031616 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 02:34 . 2012-02-27 10:39 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2012-03-02 06:12 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2011-11-08 929168]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2011-11-08 3508624]
"KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-11-08 21392]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2011-11-11 59240]
"Copernic Desktop Search - Home"="c:\program files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe" [2011-11-22 1648600]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-03-08 260608]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2009-12-25 201512]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2009-12-25 401192]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-04-21 98304]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-05-26 960080]
"MDS_Menu"="c:\program files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"ArcadeMovieService"="c:\program files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe" [2010-04-23 124136]
"Google Desktop Search"="c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" [2010-12-07 30192]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"DivX Download Manager"="c:\program files (x86)\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2011-12-16 220744]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
c:\users\wilogs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\wilogs\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-15 24246216]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files (x86)\Acer\Acer VCM\AcerVCM.exe [2010-9-16 704032]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"midi2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]
R3 CYDTV_SRV;cydtv Driver;c:\windows\system32\drivers\cydtv.sys [x]
R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2010-12-07 30192]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files (x86)\PC Tools\PC Tools Security\pctsAuxs.exe [2012-01-11 402336]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys [x]
S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys [x]
S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA64.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\Drivers\PCTSD64.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2010-05-25 47776]
S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files (x86)\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe [2012-01-16 546768]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-05-26 325200]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2010-02-02 820768]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-03-08 250368]
S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [2010-01-29 260640]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-07 2228008]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-03-03 2320920]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-28 243232]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 PCTBD;PC Tools Browser Defender Driver;c:\windows\system32\Drivers\PCTBD64.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\wilogs\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\wilogs\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\wilogs\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bluetooth Connection Assistant"="LBTWIZ.EXE -silent" [X]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-22 323584]
"mwlDaemon"="c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe" [BU]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-21 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-21 391192]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-21 413720]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-01-20 9996320]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-01-20 877600]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2010-05-25 585376]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2010-05-25 354464]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2010-03-09 345648]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2010-02-02 496160]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2010-07-21 2306448]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-06-12 134416]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1680976]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-04-13 2399632]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
smbusp
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_3820&r=27361210h416l0498z135t6711k583
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: ihk-online-akademie.de\www
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\wilogs\AppData\Roaming\Mozilla\Firefox\Profiles\jsg11fbx.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.wisedock.de/m.php?id=17717ada58c472ea9641bcffa2cff5809f8cb
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f7,08,c9,62,44,41,56,47,b8,a5,8e,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f7,08,c9,62,44,41,56,47,b8,a5,8e,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Cyberlink\Shared files\RichVideo.exe
c:\program files (x86)\Launch Manager\LMworker.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-03-02 07:23:30 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-03-02 06:23
ComboFix2.txt 2012-03-01 17:49
ComboFix3.txt 2012-02-29 13:53
.
Vor Suchlauf: 21 Verzeichnis(se), 360.256.086.016 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 359.823.138.816 Bytes frei
.
- - End Of File - - 21B2E68DCF364C12BBE9B7B12D26B420
aswMBR Code:
ATTFilter aswMBR version 0.9.9.1649 Copyright(c) 2011 AVAST Software
Run date: 2012-03-02 07:25:17
-----------------------------
07:25:17.017 OS Version: Windows x64 6.1.7600
07:25:17.017 Number of processors: 4 586 0x2505
07:25:17.017 ComputerName: WILOGS13ZOLL UserName: wilogs
07:25:21.760 Initialize success
07:26:44.072 AVAST engine defs: 12030101
07:27:59.077 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
07:27:59.092 Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3
07:27:59.092 Disk 0 MBR read successfully
07:27:59.108 Disk 0 MBR scan
07:27:59.108 Disk 0 Windows VISTA default MBR code
07:27:59.108 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 13000 MB offset 2048
07:27:59.139 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 26626048
07:27:59.155 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 463838 MB offset 26830848
07:27:59.170 Disk 0 scanning C:\Windows\system32\drivers
07:28:17.641 Service scanning
07:28:47.093 Modules scanning
07:28:47.109 Disk 0 trace - called modules:
07:28:47.140 ntoskrnl.exe CLASSPNP.SYS disk.sys PCTCore64.sys iaStor.sys hal.dll
07:28:47.156 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8005239060]
07:28:47.156 3 CLASSPNP.SYS[fffff88001d0a43f] -> nt!IofCallDriver -> [0xfffffa80050c3cf0]
07:28:47.171 5 PCTCore64.sys[fffff880013a1f38] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0xfffffa8004fb1050]
07:28:49.231 AVAST engine scan C:\Windows
07:28:54.659 AVAST engine scan C:\Windows\system32
07:28:54.862 File: C:\Windows\system32\a016mgmt.dll **INFECTED** Win64:Sirefef-E [Trj]
07:29:04.004 File: C:\Windows\system32\consrv.dll **INFECTED** Win32:Sirefef-JQ [Trj]
07:29:25.813 File: C:\Windows\system32\knobserv.dll **INFECTED** Win64:Sirefef-E [Trj]
07:29:50.819 File: C:\Windows\system32\rdsessmgr.dll **INFECTED** Win64:Sirefef-E [Trj]
07:32:34.044 File: C:\Windows\assembly\tmp\loader.tlb **SUSPICIOUS**
07:32:34.090 File: C:\Windows\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6} **SUSPICIOUS**
07:32:35.260 AVAST engine scan C:\Windows\system32\drivers
07:32:49.035 AVAST engine scan C:\Users\wilogs
07:54:53.981 AVAST engine scan C:\ProgramData
07:58:03.057 Scan finished successfully
08:00:03.162 Disk 0 MBR has been saved successfully to "D:\MBR.dat"
08:00:03.177 The log file has been saved successfully to "D:\aswMBR.txt"
MBAM Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.60.1.1000 www.malwarebytes.org Datenbank Version: v2012.03.02.01 Windows 7 x64 NTFS Internet Explorer 8.0.7600.16385 wilogs :: WILOGS13ZOLL [Administrator] Schutz: Aktiviert 02.03.2012 08:06:29 mbam-log-2012-03-02 (08-06-29).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 190591 Laufzeit: 3 Minute(n), 27 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) ESET Code:
ATTFilter C:\FRST\Quarantine\msftpsvc.dll Win64/Sirefef.W trojan
C:\FRST\Quarantine\f1be3786\X Win64/Sirefef.Q trojan
C:\FRST\Quarantine\f1be3786\U\800000cf.@ Win64/Sirefef.U trojan
C:\Qoobox\Quarantine\C\Windows\mstray.exe.vir Win32/Wukill.B worm
C:\Qoobox\Quarantine\C\Windows\Mstray1.exe.vir Win32/Wukill.B worm
C:\Users\wilogs\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\91490a2-43cd760a Java/Exploit.Agent.NAO trojan
C:\Users\wilogs\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\74d83b85-147d2ef1 multiple threats
|
|
04.03.2012, 19:44
| #12 |
| | abnow.com, dauer Bluescreen, was kann ich noch machen Hallo Marius! So, nachfolgend die nächsten Logfiles. Dir einen schönen Sonntag Abend bzw. einen guten Start in die neue Woche. Gruß Maggus aswMBR Code:
ATTFilter aswMBR version 0.9.9.1649 Copyright(c) 2011 AVAST Software
Run date: 2012-03-04 08:46:52
-----------------------------
08:46:52.908 OS Version: Windows x64 6.1.7600
08:46:52.908 Number of processors: 4 586 0x2505
08:46:52.909 ComputerName: WILOGS13ZOLL UserName: wilogs
08:46:53.734 Initialize success
08:46:57.342 AVAST engine defs: 12030301
08:47:36.169 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
08:47:36.174 Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3
08:47:36.188 Disk 0 MBR read successfully
08:47:36.192 Disk 0 MBR scan
08:47:36.199 Disk 0 Windows VISTA default MBR code
08:47:36.203 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 13000 MB offset 2048
08:47:36.228 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 26626048
08:47:36.239 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 463838 MB offset 26830848
08:47:36.265 Disk 0 scanning C:\Windows\system32\drivers
08:47:47.422 Service scanning
08:48:07.181 Modules scanning
08:48:07.198 Disk 0 trace - called modules:
08:48:07.241 ntoskrnl.exe CLASSPNP.SYS disk.sys PCTCore64.sys iaStor.sys hal.dll
08:48:07.577 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8005259060]
08:48:07.586 3 CLASSPNP.SYS[fffff88001c9f43f] -> nt!IofCallDriver -> [0xfffffa80050e5b30]
08:48:07.596 5 PCTCore64.sys[fffff880012e6f38] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0xfffffa8004fd4050]
08:48:09.282 AVAST engine scan C:\Windows
08:48:14.953 AVAST engine scan C:\Windows\system32
08:55:54.215 AVAST engine scan C:\Windows\system32\drivers
09:00:25.451 AVAST engine scan C:\Users\wilogs
09:28:59.119 AVAST engine scan C:\ProgramData
09:30:53.560 Scan finished successfully
09:33:58.807 Disk 0 MBR has been saved successfully to "C:\Users\wilogs\Desktop\MBR.dat"
09:33:58.812 The log file has been saved successfully to "C:\Users\wilogs\Desktop\aswMBR.txt"
MBAM Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.60.1.1000 www.malwarebytes.org Datenbank Version: v2012.03.04.02 Windows 7 x64 NTFS Internet Explorer 8.0.7600.16385 wilogs :: WILOGS13ZOLL [Administrator] Schutz: Aktiviert 04.03.2012 09:42:17 mbam-log-2012-03-04 (09-42-17).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 191539 Laufzeit: 4 Minute(n), 34 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) ESET Code:
ATTFilter C:\FRST\Quarantine\91490a2-43cd760a Java/Exploit.Agent.NAO trojan
C:\FRST\Quarantine\a016mgmt.dll Win64/Sirefef.W trojan
C:\FRST\Quarantine\consrv.dll Win64/Sirefef.G trojan
C:\FRST\Quarantine\knobserv.dll Win64/Sirefef.W trojan
C:\FRST\Quarantine\msftpsvc.dll Win64/Sirefef.W trojan
C:\FRST\Quarantine\rdsessmgr.dll Win64/Sirefef.W trojan
C:\FRST\Quarantine\f1be3786\X Win64/Sirefef.Q trojan
C:\FRST\Quarantine\f1be3786\U\800000cf.@ Win64/Sirefef.U trojan
C:\Qoobox\Quarantine\C\Windows\mstray.exe.vir Win32/Wukill.B worm
C:\Qoobox\Quarantine\C\Windows\Mstray1.exe.vir Win32/Wukill.B worm
|
|
03.03.2012, 19:03
| #13 |
| /// Malwareteam | abnow.com, dauer Bluescreen, was kann ich noch machen Fix mit FRST Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Windows\system32\a016mgmt.dll
C:\Windows\system32\consrv.dll
C:\Windows\system32\knobserv.dll
C:\Windows\system32\rdsessmgr.dll
C:\Windows\assembly\tmp\loader.tlb
C:\Windows\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
C:\Users\wilogs\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\91490a2-43cd760a
C:\Users\wilogs\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\74d83b85-147d2ef1
__________________ Kein Asylrecht für Trojaner! Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! |
|
03.03.2012, 20:37
| #14 |
| | abnow.com, dauer Bluescreen, was kann ich noch machen Hallo Marius! Nachfolgend das Fixlog zu FRST64.exe Code:
ATTFilter Fix result of Farbar Recovery Scan Tool (FRST written by farbar) Version: 27-02-2012
Ran by SYSTEM at 2012-03-03 20:29:34 R:3
Running from F:\
==============================================
C:\Windows\system32\a016mgmt.dll moved successfully.
C:\Windows\system32\consrv.dll moved successfully.
C:\Windows\system32\knobserv.dll moved successfully.
C:\Windows\system32\rdsessmgr.dll moved successfully.
C:\Windows\assembly\tmp\loader.tlb moved successfully.
C:\Windows\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6} moved successfully.
C:\Users\wilogs\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\91490a2-43cd760a moved successfully.
C:\Users\wilogs\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\74d83b85-147d2ef1 not found.
==== End of Fixlog ====
Gruß Maggus |
|
03.03.2012, 22:02
| #15 |
| /// Malwareteam | abnow.com, dauer Bluescreen, was kann ich noch machen Hallo maggus, fein! Dann machen wir mal weiter! Schritt 1: aswMBR Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
Schritt 2: MBAM Downloade Dir bitte Malwarebytes
Schritt 3: ESET Drücke die Windows- und die R-Taste gleichzeitig. Schreibe folgendes in die Textbox: Code:
ATTFilter "C:\Program Files\ESET\ESET Online Scanner\OnlineScannerApp.exe"
Gruß
__________________ Kein Asylrecht für Trojaner! Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! |
|
| Themen zu abnow.com, dauer Bluescreen, was kann ich noch machen |
| abnow, abnow.com, acer, acer aspire, angezeigte, bluescreen, board, booten, dateien, datensicherung, firefox, home, icon, infos, installiert, kurze, laptop, leute, modus, namens, onlineshopping, passwort, passwörter, rechner, sicherung, software, taskleiste, trojaner/virus, win, win7, win7 64bit |
Hybrid-Darstellung
