| |
| |||||||
Log-Analyse und Auswertung: Verschlüsselungstrojaner TR/Matsnu.EB.24 per Email erhalten + 3 Erkennungsmuster Exploits EXP/JAVA.NWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
08.07.2012, 08:58
| #1 |
| |  Verschlüsselungstrojaner TR/Matsnu.EB.24 per Email erhalten + 3 Erkennungsmuster Exploits EXP/JAVA.N Liebes Team, ein Freund von mir hat mich darauf aufmerksam gemacht, dass er eine Email von mir mit einem schädlichen Anhang erhalten hat. Ich habe einen gmx-Account. Daraufhin habe ich folgende Schritte vorgenommen: 1| Antivir - Fundergebnisse AntiVir hat folgende Funde gepostet: Beginne mit der Suche in 'C:\' <Acer> C:\Users\Anke\AppData\Local\Microsoft\Windows Live Mail\Gmx (kruege dbe\Deleted Items\5A8E51DA-000003FC.eml [0] Archivtyp: MIME [HINWEIS] Die Datei wurde nach '5A8E51DA-000003FC.eml.VIR' umbenannt! --> Tabelle.zip [1] Archivtyp: ZIP --> Tabelle Abrechnung.zip [2] Archivtyp: ZIP --> Tabelle Abrechnung 11.06.2012 .com [FUND] Ist das Trojanische Pferd TR/Matsnu.EB.24 C:\Users\Anke\AppData\Local\Temp\jar_cache4249471924365276832.tmp [0] Archivtyp: ZIP [HINWEIS] Die Datei wurde nach 'jar_cache4249471924365276832.tmp.VIR' umbenannt! --> xmltree/armin.class [FUND] Enthält Erkennungsmuster des Exploits EXP/JAVA.Niabil.Gen --> xmltree/opkat.class [FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840 C:\Users\Anke\AppData\Local\Temp\jar_cache7979804730245930822.tmp [0] Archivtyp: ZIP [HINWEIS] Die Datei wurde nach 'jar_cache7979804730245930822.tmp.VIR' umbenannt! --> ropan.class [FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2011-3544.A.51 Beginne mit der Suche in 'Q:\' Der zu durchsuchende Pfad Q:\ konnte nicht geöffnet werden! Systemfehler [5]: Zugriff verweigert 2| Scan mit Malwarebytes Anti-Malware und Löschung alle Funde Habe gesehen, dass Seefuxx (http://www.trojaner-board.de/114700-...-erhalten.html) das selbe Problem hatte und bin seinem ersten Schritt gefolgt: Vollständiger Scan mit Malwarebytes Anti-Malware und Löschung aller Funde Malwarebytes Anti-Malware (Test) 1.61.0.1400 www.malwarebytes.org Datenbank Version: v2012.07.07.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 Anke :: MYACER [Administrator] Schutz: Aktiviert 07.07.2012 08:41:15 mbam-log-2012-07-07 (08-41-15).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 359234 Laufzeit: 1 Stunde(n), 18 Minute(n), 19 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 4 C:\Users\Anke\AppData\Local\Temp\ICReinstall_DownloadManagerSetup.exe (PUP.Adware.InstallCore) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Anke\AppData\Local\Temp\1n6q05v6.tmp\DownloadManagerSetup.exe (PUP.Adware.InstallCore) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Anke\AppData\Local\Temp\n7zuv616.tmp\etypesetup.exe (PUP.BundleInstaller.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Anke\Downloads\SoftonicDownloader_fuer_windows-live-movie-maker.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) 3| DeFogger - Emulatoren deaktivert und sind auch immer noch deaktivert Dann wurde es mir zu kompliziert bei der Vorgehensweise von Seefuxx und ich bin eure Schritte für alle Hilfesuchenden durchgegangen. 4| Oldtimer Scan 4.1| OTL Log OTL logfile created on: 07.07.2012 10:20:38 - Run 1 OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Anke\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,91 Gb Total Physical Memory | 2,40 Gb Available Physical Memory | 61,43% Memory free 7,81 Gb Paging File | 5,97 Gb Available in Paging File | 76,49% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 284,99 Gb Total Space | 218,16 Gb Free Space | 76,55% Space Free | Partition Type: NTFS Computer Name: MYACER | User Name: Anke | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.07.07 10:20:04 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Anke\Downloads\OTL.exe PRC - [2012.07.04 07:41:45 | 000,296,096 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe PRC - [2011.07.07 09:08:30 | 000,216,064 | ---- | M] (Geek Software GmbH) -- C:\Program Files (x86)\PDF24\pdf24.exe PRC - [2011.06.28 22:43:05 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2011.03.28 16:15:04 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2011.03.28 16:14:56 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.12.08 20:09:39 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe PRC - [2010.06.29 00:23:12 | 000,265,984 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe PRC - [2010.06.29 00:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe PRC - [2010.06.25 10:08:30 | 000,013,600 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe PRC - [2010.05.27 04:41:24 | 000,349,552 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe PRC - [2010.05.08 13:48:36 | 000,229,376 | ---- | M] () -- C:\ProgramData\DatacardService\DCService.exe PRC - [2010.05.08 13:48:26 | 000,241,664 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DatacardService\DCSHelper.exe PRC - [2010.03.25 12:00:28 | 000,124,136 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer\TouchPortal\Touch Movie\TouchMovieService.exe PRC - [2010.03.11 07:11:56 | 000,407,920 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe PRC - [2010.03.11 07:11:42 | 000,201,584 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe PRC - [2010.03.04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2010.03.04 05:16:04 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe PRC - [2010.02.09 20:57:46 | 000,704,032 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe PRC - [2010.02.08 18:23:54 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer\TouchPortal\TouchPortal\TouchPortalAnim.exe PRC - [2010.02.08 18:23:52 | 000,181,544 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer\TouchPortal\TouchPortal\TouchPortalAgent.exe PRC - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe PRC - [2010.01.29 06:07:26 | 000,870,992 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.EXE PRC - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe PRC - [2010.01.13 04:55:58 | 000,030,080 | ---- | M] () -- C:\Windows\snuvcdsm.exe PRC - [2009.11.06 19:22:52 | 002,584,576 | ---- | M] () -- C:\Program Files (x86)\STMicroelectronics\STScreenDetection\SDTabletPC.exe PRC - [2009.04.16 08:52:06 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe ========== Modules (No Company Name) ========== MOD - [2012.06.17 15:16:09 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll MOD - [2012.06.14 08:55:38 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll MOD - [2012.05.14 07:16:17 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\635b3aec298ad5e8c903b2323d79cc5a\IAStorUtil.ni.dll MOD - [2012.05.12 23:05:32 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll MOD - [2012.05.12 23:03:59 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll MOD - [2012.05.12 23:03:50 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll MOD - [2012.05.12 23:03:43 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll MOD - [2012.05.12 23:03:39 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll MOD - [2012.05.12 23:03:23 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll MOD - [2010.12.09 04:45:07 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll MOD - [2010.12.08 20:09:39 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2010.06.29 00:20:54 | 000,465,576 | ---- | M] () -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll MOD - [2010.02.08 18:24:22 | 000,069,632 | ---- | M] () -- C:\Program Files (x86)\Acer\TouchPortal\TouchPortal\System\_PyTexturemap.pyd MOD - [2010.02.08 18:24:12 | 000,753,664 | ---- | M] () -- C:\Program Files (x86)\Acer\TouchPortal\TouchPortal\Koan\_bsddb.pyd MOD - [2010.02.08 18:24:12 | 000,655,360 | ---- | M] () -- C:\Program Files (x86)\Acer\TouchPortal\TouchPortal\Koan\_ssl.pyd MOD - [2010.02.08 18:24:12 | 000,081,920 | ---- | M] () -- C:\Program Files (x86)\Acer\TouchPortal\TouchPortal\Koan\_ctypes.pyd MOD - [2010.02.08 18:24:12 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\Acer\TouchPortal\TouchPortal\Koan\_socket.pyd MOD - [2010.02.08 18:24:10 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Acer\TouchPortal\TouchPortal\Koan\pyexpat.pyd MOD - [2010.01.13 04:55:58 | 000,030,080 | ---- | M] () -- C:\Windows\snuvcdsm.exe MOD - [2009.11.06 19:22:52 | 002,584,576 | ---- | M] () -- C:\Program Files (x86)\STMicroelectronics\STScreenDetection\SDTabletPC.exe ========== Win32 Services (SafeList) ========== SRV - [2012.06.22 21:20:20 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2011.06.28 22:43:05 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.06.21 19:12:30 | 000,341,296 | ---- | M] (Nitro PDF Software) [Auto | Running] -- C:\Programme\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe -- (NitroReaderDriverReadSpool2) SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2011.03.28 16:15:04 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.06.29 00:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc) SRV - [2010.06.25 10:08:30 | 000,952,096 | ---- | M] (Broadcom Corporation.) [On_Demand | Stopped] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins) SRV - [2010.05.27 04:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService) SRV - [2010.05.08 13:48:36 | 000,229,376 | ---- | M] () [Auto | Running] -- C:\ProgramData\DatacardService\DCService.exe -- (DCService.exe) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.03.04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R) SRV - [2010.02.26 19:57:52 | 000,841,248 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc) SRV - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe -- (RS_Service) SRV - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service) SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.10.01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:64bit: - [2011.10.01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:64bit: - [2011.10.01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:64bit: - [2011.10.01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:64bit: - [2011.06.28 22:43:06 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011.06.28 22:43:06 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.02.11 19:16:38 | 010,628,640 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.06.25 04:33:36 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:64bit: - [2010.06.25 04:13:18 | 000,342,056 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (btwampfl) DRV:64bit: - [2010.06.25 04:12:26 | 000,039,464 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap) DRV:64bit: - [2010.06.25 04:12:26 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid) DRV:64bit: - [2010.06.25 04:12:24 | 000,135,720 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt) DRV:64bit: - [2010.06.25 04:12:24 | 000,102,952 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio) DRV:64bit: - [2010.06.14 10:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TFsExDisk.sys -- (TFsExDisk) DRV:64bit: - [2010.04.27 04:25:20 | 000,172,104 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscdmdm.sys -- (sscdmdm) DRV:64bit: - [2010.04.27 04:25:20 | 000,136,264 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM) DRV:64bit: - [2010.04.27 04:25:20 | 000,019,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscdmdfl.sys -- (sscdmdfl) DRV:64bit: - [2010.04.09 15:24:32 | 000,076,288 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV:64bit: - [2010.04.07 17:05:00 | 000,250,368 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbnet.sys -- (ewusbnet) DRV:64bit: - [2010.03.25 10:08:46 | 000,120,704 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard) DRV:64bit: - [2010.03.20 11:56:56 | 000,114,560 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev) DRV:64bit: - [2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2010.01.13 04:56:18 | 001,806,592 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV:64bit: - [2009.11.24 18:58:54 | 000,021,864 | ---- | M] (ST Microelectronics) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\STHall.sys -- (STHall) DRV:64bit: - [2009.09.17 14:12:06 | 000,292,912 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2009.09.15 06:40:00 | 006,952,960 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) Intel(R) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.10 15:45:12 | 000,139,264 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.06.03 04:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk) DRV:64bit: - [2009.06.03 04:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter) DRV:64bit: - [2009.06.03 04:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ) DRV:64bit: - [2009.05.26 15:32:38 | 000,040,448 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor) DRV:64bit: - [2009.05.06 01:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr) DRV:64bit: - [2009.05.06 01:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper) DRV - [2010.06.14 10:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2009.03.26 05:16:08 | 000,025,608 | ---- | M] (Dritek System Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\DKbFltr.sys -- (DKbFltr) Dritek Keyboard Filter Driver (64-bit) DRV - [2006.07.24 17:05:00 | 000,005,632 | ---- | M] () [File_System | System | Stopped] -- C:\Windows\SysWow64\drivers\StarOpen.sys -- (StarOpen) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ [2010.09.14 13:18:04 | 000,000,000 | ---D | M] FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ [2010.09.14 13:18:04 | 000,000,000 | ---D | M] FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.5.109: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.5.109: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.5.109: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.5.109: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.5.109: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKLM\Software\MozillaPlugins\NitroPDF: C:\Program Files (x86)\Nitro PDF\Reader 2\npnitromozilla.dll ( ) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{C3949AC2-4B17-43ee-B4F1-D26B9D42404D}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012.07.04 07:42:19 | 000,000,000 | ---D | M] O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated) O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe () O4:64bit: - HKLM..\Run: [PLFSetL] C:\Windows\PLFSetL.exe (sonix) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [ScreenRotation] C:\Program Files (x86)\STMicroelectronics\STScreenDetection\SDTabletPC.exe () O4:64bit: - HKLM..\Run: [SNUVCDSM] C:\Windows\snuvcdsm.exe () O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.) O4 - HKLM..\Run: [CLTouchPortalAnim] C:\Program Files (x86)\Acer\TouchPortal\TouchPortal\TouchPortalAnim.exe (CyberLink Corp.) O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NPSStartup] File not found O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH) O4 - HKLM..\Run: [RemoteControl8] C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.) O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.) O4 - HKLM..\Run: [TkBellExe] c:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [TouchMovieService] C:\Program Files (x86)\Acer\TouchPortal\Touch Movie\TouchMovieService.exe (CyberLink Corp.) O4 - HKLM..\Run: [TouchPortalAgent] C:\Program Files (x86)\Acer\TouchPortal\TouchPortal\TouchPortalAgent.exe (CyberLink Corp.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Anke\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Anke\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{047C7C73-570F-4DAC-A731-D38698C1B4A1}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5E693BB8-7F5F-4CFE-990A-0D81265D8B6E}: NameServer = 193.189.244.225 193.189.244.206 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{77AEF758-B651-48FA-B2F3-3A657AB8B568}: NameServer = 193.189.244.225 193.189.244.206 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{99E73F3F-584B-46FC-B19F-6590C7FA6659}: NameServer = 193.189.244.225 193.189.244.206 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Acer\Acer VCM\Skype4COM.dll (Skype Technologies) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{5413421b-7d9d-11e0-896f-60eb699de18c}\Shell - "" = AutoRun O33 - MountPoints2\{5413421b-7d9d-11e0-896f-60eb699de18c}\Shell\AutoRun\command - "" = D:\AutoRun.exe O33 - MountPoints2\{5413422b-7d9d-11e0-896f-60eb699de18c}\Shell - "" = AutoRun O33 - MountPoints2\{5413422b-7d9d-11e0-896f-60eb699de18c}\Shell\AutoRun\command - "" = D:\AutoRun.exe O33 - MountPoints2\{9c069576-7e77-11e0-8d40-60eb699de18c}\Shell - "" = AutoRun O33 - MountPoints2\{9c069576-7e77-11e0-8d40-60eb699de18c}\Shell\AutoRun\command - "" = D:\AutoRun.exe O33 - MountPoints2\{ba5d7373-2fb8-11e1-bdbd-f07bcbf7729d}\Shell - "" = AutoRun O33 - MountPoints2\{ba5d7373-2fb8-11e1-bdbd-f07bcbf7729d}\Shell\AutoRun\command - "" = E:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.07.07 08:49:22 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{69850C95-33C8-4A4B-94FC-89A55DBBDC96} [2012.07.07 08:49:09 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{75248AFE-BDCD-4997-BC67-7C5B8A7B88C8} [2012.07.07 08:39:12 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Roaming\Malwarebytes [2012.07.07 08:38:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.07.07 08:38:22 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.07.07 08:38:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.07.06 20:48:55 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{DA3A1705-D194-4F4C-B278-A7310B3224D9} [2012.07.06 20:48:43 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{B0F03BDA-1FD2-4048-9951-566FFB2866FF} [2012.07.05 23:50:15 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{0205AA8E-FC89-4442-9609-1E9B14B21F95} [2012.07.05 23:50:02 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{07F18357-31F5-403D-9F2E-7DA1B748CF24} [2012.07.05 07:36:58 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{48C80FCF-F3C2-439C-BE23-2CF7A20A66DA} [2012.07.05 07:36:47 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{BE3E39DD-51FE-493F-BB40-695ACBFE499B} [2012.07.04 20:07:43 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{B2A8AA5D-92A6-4A36-AC1D-FDFC4212809B} [2012.07.04 07:42:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\xing shared [2012.07.04 07:41:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealNetworks [2012.07.03 21:58:07 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{B1531ADE-49F2-453B-99D0-F96A270CA24C} [2012.07.03 21:57:42 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{7E0E08AB-0ED8-4FB2-8B2D-2F43FC24505E} [2012.07.02 08:38:04 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{E952DE68-6B0F-4BD5-AA28-92952464A8FA} [2012.07.02 08:37:53 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{44236B4E-60FB-4C89-A8BE-51E47E442D96} [2012.07.01 20:37:37 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{8583B3C4-FED7-4E2B-AA38-1A27A78E0E1F} [2012.07.01 20:37:26 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{C87E92B0-7F5F-49A6-86E9-782B83D7CB3E} [2012.07.01 08:37:09 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{97549E7C-3E19-4168-B5B2-029A28C2FBE9} [2012.07.01 08:36:02 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{0A511FAB-B4C4-41E2-A0B0-2A61627861D9} [2012.06.30 20:35:47 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{4B6E2CCA-33CE-444B-8608-5039B6E47D5F} [2012.06.30 20:35:36 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{BE12465E-A43C-48DC-9213-F9928A29E675} [2012.06.30 08:53:58 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte [2012.06.28 20:38:28 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{65A38DD1-0088-4A04-B129-F1F98377E48C} [2012.06.28 08:12:24 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{519363C5-EEDB-4395-B5E7-506251EDEC06} [2012.06.28 08:11:48 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{319597D7-688C-47E1-B624-9372DE6D1C38} [2012.06.27 20:11:31 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{E7A3A9A4-C3DC-49DD-9C72-8261DE181BC1} [2012.06.27 20:11:06 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{403B1940-3FA5-4F85-986B-9058D806D003} [2012.06.27 08:10:52 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{5DB0A1B3-CB3F-42D2-A057-FDABD701C927} [2012.06.27 08:10:41 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{6AE27AC2-A80C-4774-985F-9CDA149CD0A2} [2012.06.26 20:10:45 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{0BB53C8D-49B5-4A34-BEBD-E0553A64A3C1} [2012.06.26 07:33:57 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{2E6760FE-96CA-4ABC-8413-68BBF48952DB} [2012.06.26 07:33:54 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{84412938-E7F3-47CE-9E05-751C0740D1A5} [2012.06.25 19:13:24 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{31E3894F-3BD9-45B0-9BCE-C837520CBB3D} [2012.06.25 19:13:09 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{ADB216A6-65B5-41BA-AFEC-D6794FDB3B71} [2012.06.25 07:08:38 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{C0424B48-FDF2-4999-AF8E-31B87F35EDA3} [2012.06.25 07:08:20 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{824AB032-2311-4622-AE13-82F7A2AB91C1} [2012.06.24 16:29:27 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{09382A65-3724-467A-87FC-A71875A1A375} [2012.06.24 16:29:14 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{26E8EABA-560F-4684-9424-0971337DC82D} [2012.06.23 10:57:24 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{CDF87D7F-3271-4ADF-B56A-C391F84C2073} [2012.06.23 10:57:13 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{734A2597-3D62-46E1-841D-A5AF63D99E11} [2012.06.22 22:56:46 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{C762557B-676C-498A-B213-0E5B7DB9E665} [2012.06.22 22:56:35 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{3050F11B-6CFA-4551-A235-B035F5BC953E} [2012.06.22 10:48:41 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{F9F4B9F3-54A1-4CDB-8D90-4250B1B29817} [2012.06.21 22:43:07 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{B7A680DF-2E1B-4A74-85F7-537215EE355A} [2012.06.21 22:42:56 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{7341ADAE-B7C4-4681-A4AC-54274024AFB4} [2012.06.21 22:17:03 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll [2012.06.21 22:17:03 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe [2012.06.21 22:17:03 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll [2012.06.21 22:16:50 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll [2012.06.21 22:16:50 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll [2012.06.21 22:16:50 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll [2012.06.21 22:16:25 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll [2012.06.21 22:16:25 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe [2012.06.21 20:25:40 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{A8C24E87-9FDC-4BDD-B391-E185924BC13C} [2012.06.20 23:03:06 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{4621E4B7-8DB4-4C44-BEE8-0B62D4A0DF5A} [2012.06.20 23:02:55 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{70E3D37D-B038-49D6-8EB6-103A6FC3DC55} [2012.06.20 20:10:45 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{DD74E674-6D3A-4745-BB50-0046C09F31C7} [2012.06.20 07:29:18 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{77E98AEC-5498-4A93-A6A7-BEBC3A70DB8A} [2012.06.20 07:29:07 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{6E309352-366D-4EEF-9547-03C67D5A991D} [2012.06.19 19:22:27 | 000,719,872 | ---- | C] (Abysmal Software) -- C:\Windows\SysWow64\devil.dll [2012.06.19 19:22:27 | 000,369,152 | ---- | C] (The Public) -- C:\Windows\SysWow64\avisynth.dll [2012.06.19 19:22:27 | 000,070,656 | ---- | C] (www.helixcommunity.org) -- C:\Windows\SysWow64\yv12vfw.dll [2012.06.19 19:22:27 | 000,070,656 | ---- | C] (www.helixcommunity.org) -- C:\Windows\SysWow64\i420vfw.dll [2012.06.19 19:22:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AviSynth 2.5 [2012.06.19 19:21:57 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{B61C2B83-8C16-4542-979E-8C61F5D5CA56} [2012.06.19 19:21:45 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{EF636681-B64C-4B36-BEA0-87F235036EBC} [2012.06.19 19:20:29 | 000,327,749 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\SysWow64\drvc.dll [2012.06.19 19:20:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MVK AVI Converter [2012.06.19 19:20:28 | 000,216,064 | RHS- | C] (MONOGRAM Multimedia, s.r.o.) -- C:\Windows\SysWow64\nbDX.dll [2012.06.19 19:20:28 | 000,186,880 | RHS- | C] (RadLight) -- C:\Windows\SysWow64\RLOgg.ax [2012.06.19 19:20:28 | 000,163,328 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\flvDX.dll [2012.06.19 19:20:28 | 000,092,672 | RHS- | C] (RadLight) -- C:\Windows\SysWow64\RLVorbisDec.ax [2012.06.19 19:20:28 | 000,090,112 | RHS- | C] (-) -- C:\Windows\SysWow64\TTADSSplitter.ax [2012.06.19 19:20:28 | 000,090,112 | RHS- | C] (-) -- C:\Windows\SysWow64\TTADSDecoder.ax [2012.06.19 19:20:28 | 000,067,584 | RHS- | C] (RadLight, LLC) -- C:\Windows\SysWow64\RLTheoraDec.ax [2012.06.19 19:20:28 | 000,031,232 | RHS- | C] (Hans Mayerl) -- C:\Windows\SysWow64\msfDX.dll [2012.06.19 19:20:27 | 000,179,200 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\DiracSplitter.ax [2012.06.19 19:20:27 | 000,169,472 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\MatroskaDX.ax [2012.06.19 19:20:27 | 000,161,792 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\RealMediaDX.ax [2012.06.19 19:20:26 | 000,123,904 | RHS- | C] (CoreCodec) -- C:\Windows\SysWow64\AVCDX.ax [2012.06.19 19:20:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MVK AVI Converter [2012.06.19 19:19:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\eRightSoft [2012.06.19 19:12:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MKV Player [2012.06.19 19:12:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MKV Player [2012.06.18 21:43:18 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{558FA3A3-4391-4F13-9441-EF097979A388} [2012.06.17 20:21:03 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{F02C785C-C917-4E47-9A85-278A4F2D1CBD} [2012.06.14 08:58:58 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\MpEngineStore [2012.06.14 08:58:08 | 000,000,000 | ---D | C] -- C:\b87f50818042ffcc25 [2012.06.14 07:19:39 | 000,918,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.06.14 07:19:38 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.06.14 07:19:14 | 000,735,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2012.06.14 07:19:08 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.06.14 07:19:07 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.06.14 07:19:05 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.06.14 07:19:05 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.06.14 07:19:03 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.06.14 07:19:03 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.06.14 07:19:01 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll [2012.06.14 07:19:01 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll [2012.06.14 07:19:01 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe [2012.06.14 07:18:46 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2012.06.14 07:18:44 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2012.06.14 07:18:43 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2012.06.14 07:18:36 | 003,216,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll [2012.06.14 07:18:29 | 001,462,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll [2012.06.14 07:18:28 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll [2012.06.14 01:32:58 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{805C512C-0E70-468D-ABC0-E64E6B0A6C03} [2012.06.13 10:42:35 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{E72EAF38-33AD-4554-9E4A-BFDDF135D0DD} [2012.06.12 21:55:55 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{629C9A0C-F05C-461E-94F4-517DE81CFCC9} [2012.06.12 20:27:09 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{C99CD2C7-66D9-4780-AD7C-FE3F9BBE23D5} [2012.06.12 08:00:43 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{8372B11B-FC61-4B15-A713-56D831B8D9A3} [2012.06.12 08:00:32 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{5403FC8B-F198-4AC8-931D-37327CB0F49F} [2012.06.11 20:00:37 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{EC7B401B-AA9F-4703-A8D7-13A18B20D046} [2012.06.10 21:49:52 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{7CA24AEC-273C-4FB6-9B9F-358DDD86E6D0} [2012.06.10 21:49:40 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{4EA005F2-BEE7-4C3D-8ADE-26AF1EFE7C84} [2012.06.10 09:37:30 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{5072F162-B69E-49EA-9C53-F89717C0405D} [2012.06.10 09:37:18 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{FDC59077-3C11-472E-8191-8C411478D2DB} [2012.06.09 21:37:04 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{B28CDFBC-041F-408D-9E2C-5DCA00C55C82} [2012.06.09 21:36:53 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{89463B1D-9069-4B42-8FD2-D96C10AAA3C5} [2012.06.09 09:19:52 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{187C2982-2F75-4D29-98BB-4967409AC8BF} [2012.06.09 09:19:39 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{D3998987-BF47-4AC1-88A2-E9440934A457} [2012.06.08 18:48:51 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{81047A0C-FFC0-40B6-B12C-4DAC07630436} [2012.06.08 18:48:25 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{A30B2A5D-9515-450A-85DC-C2436523F413} [2012.06.07 22:59:35 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{DDA8331D-8A35-4644-9787-54C38B200FD3} [2012.06.07 22:59:24 | 000,000,000 | ---D | C] -- C:\Users\Anke\AppData\Local\{C195752D-8377-42DA-B113-136CD3728E6C} [2 C:\Users\Anke\Desktop\*.tmp files -> C:\Users\Anke\Desktop\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.07.07 10:30:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\Acer Registration - Reminder Recall task.job [2012.07.07 10:18:49 | 000,000,000 | ---- | M] () -- C:\Users\Anke\defogger_reenable [2012.07.07 10:13:53 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.07 10:13:53 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.07 10:05:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.07 10:05:42 | 3144,867,840 | -HS- | M] () -- C:\hiberfil.sys [2012.07.07 10:02:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.07.07 08:38:26 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.07 08:33:17 | 000,001,149 | ---- | M] () -- C:\Users\Anke\Desktop\Continue Download Manager Installation.lnk [2012.07.04 07:42:36 | 000,001,132 | ---- | M] () -- C:\Users\Public\Desktop\RealPlayer.lnk [2012.07.04 07:42:11 | 000,198,864 | ---- | M] (RealNetworks, Inc.) -- C:\Windows\SysWow64\rmoc3260.dll [2012.07.04 07:41:53 | 000,006,656 | ---- | M] (RealNetworks, Inc.) -- C:\Windows\SysWow64\pndx5016.dll [2012.07.04 07:41:53 | 000,005,632 | ---- | M] (RealNetworks, Inc.) -- C:\Windows\SysWow64\pndx5032.dll [2012.07.04 07:41:48 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\Windows\SysWow64\pncrt.dll [2012.07.01 08:39:21 | 001,500,294 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.07.01 08:39:21 | 000,654,852 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.07.01 08:39:21 | 000,616,694 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.07.01 08:39:21 | 000,130,434 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.07.01 08:39:21 | 000,106,816 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.06.22 21:20:20 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.06.22 21:20:20 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.06.19 19:45:37 | 000,733,950 | ---- | M] () -- C:\Users\Anke\Desktop\Amazon.pdf [2012.06.17 15:11:02 | 000,274,464 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2 C:\Users\Anke\Desktop\*.tmp files -> C:\Users\Anke\Desktop\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.07.07 10:18:49 | 000,000,000 | ---- | C] () -- C:\Users\Anke\defogger_reenable [2012.07.07 08:38:26 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.07 08:33:17 | 000,001,149 | ---- | C] () -- C:\Users\Anke\Desktop\Continue Download Manager Installation.lnk [2012.07.04 07:42:36 | 000,001,132 | ---- | C] () -- C:\Users\Public\Desktop\RealPlayer.lnk [2012.06.19 19:45:43 | 000,733,950 | ---- | C] () -- C:\Users\Anke\Desktop\Amazon.pdf [2012.06.19 19:22:27 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2012.06.19 19:20:28 | 000,121,344 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.ax [2012.06.19 19:20:28 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll [2012.06.19 19:20:28 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\RLMPCDec.ax [2012.06.19 19:20:28 | 000,051,712 | RHS- | C] () -- C:\Windows\SysWow64\RLSpeexDec.ax [2012.06.19 19:20:27 | 000,175,104 | RHS- | C] () -- C:\Windows\SysWow64\CoreAAC.ax [2012.06.19 19:20:27 | 000,120,832 | RHS- | C] () -- C:\Windows\SysWow64\MPCDx.ax [2012.06.19 19:20:27 | 000,097,280 | RHS- | C] () -- C:\Windows\SysWow64\FLACDX.ax [2012.06.19 19:20:27 | 000,070,656 | RHS- | C] () -- C:\Windows\SysWow64\RLAPEDec.ax [2012.06.19 19:20:26 | 000,227,328 | RHS- | C] () -- C:\Windows\SysWow64\ac3DX.ax [2012.06.19 19:20:26 | 000,081,920 | RHS- | C] () -- C:\Windows\SysWow64\aac_parser.ax [2011.11.05 16:14:33 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt [2011.11.05 16:06:02 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys [2011.05.17 20:00:08 | 001,527,724 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.02.11 19:15:08 | 000,982,240 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin [2011.02.11 19:15:08 | 000,439,308 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin [2011.02.11 19:15:08 | 000,092,356 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin [2010.12.08 20:09:48 | 000,206,208 | ---- | C] () -- C:\Windows\PLFSetI.exe [2010.12.08 20:09:48 | 000,113,264 | ---- | C] () -- C:\Windows\FixUVC.exe [2010.12.08 20:09:48 | 000,000,302 | ---- | C] () -- C:\Windows\PidList_C.ini [2010.09.14 13:27:43 | 000,134,592 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin [2010.09.14 13:27:30 | 000,030,080 | ---- | C] () -- C:\Windows\snuvcdsm.exe [2010.09.14 13:27:30 | 000,000,378 | ---- | C] () -- C:\Windows\PidList.ini < End of report > 4.2| Extras Log OTL Extras logfile created on: 07.07.2012 10:20:38 - Run 1 OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Anke\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,91 Gb Total Physical Memory | 2,40 Gb Available Physical Memory | 61,43% Memory free 7,81 Gb Paging File | 5,97 Gb Available in Paging File | 76,49% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 284,99 Gb Total Space | 218,16 Gb Free Space | 76,55% Space Free | Partition Type: NTFS Computer Name: MYACER | User Name: Anke | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{05299FCD-EEA7-4564-9646-7A4B50752756}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{1253EC19-A2AC-416A-81EA-3C0AFABEC048}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{12F78E6B-2E91-4C8F-9029-E9D1B63D08A5}" = rport=138 | protocol=17 | dir=out | app=system | "{1BB4D86B-B630-480B-AB09-91222F0EBE9D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{1C23BE0C-1737-4844-9CE7-B28C5AB6A43D}" = lport=10243 | protocol=6 | dir=in | app=system | "{245F272D-D54A-482D-8BD7-B2297951CD0C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{2EEEE1F6-BFB8-46F3-A3E8-15A64B8514F8}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | "{358A6225-BB5C-4EBB-98F6-E3C383286507}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{38B4C599-8F43-4221-8953-558385D8F26B}" = rport=139 | protocol=6 | dir=out | app=system | "{3FFDC6B0-480C-47BF-AE94-F506F281CCEA}" = lport=139 | protocol=6 | dir=in | app=system | "{462DD1D9-E55F-4E31-935F-EEE655D117B3}" = lport=137 | protocol=17 | dir=in | app=system | "{46DAD30E-DAA4-4111-804D-197D10F753D3}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{4E4643C2-0301-4888-B371-34F44288FF7A}" = lport=445 | protocol=6 | dir=in | app=system | "{5456C46A-70AF-4A10-9483-82597F80CB99}" = lport=2869 | protocol=6 | dir=in | app=system | "{6FF3365B-4A67-4C3A-BEB2-808D992797E7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{75205922-C9F9-4DAC-8361-6E1150083FBD}" = rport=137 | protocol=17 | dir=out | app=system | "{7E7ACEEB-1524-4F5E-A72F-4EC6CDA62B0E}" = lport=138 | protocol=17 | dir=in | app=system | "{802F8D78-A9EA-4FCD-8872-5041F28041F7}" = rport=10243 | protocol=6 | dir=out | app=system | "{977A3575-D159-4475-9E41-07D43D4D5BE3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{9D64E61F-4CAF-42CC-8706-A174F4B4AE5C}" = rport=445 | protocol=6 | dir=out | app=system | "{9ED319B7-48A4-43E3-84BD-F2EAF18FEB89}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{A75C0AD6-BE0B-4888-98FF-E68C17B0D0C4}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{AA79188C-8923-471C-A168-D4247D4E1719}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{ABA8B9B6-04D6-44FE-8631-B2EDECC0D9CE}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | "{BCA0A5F3-15CA-4949-BD20-FE2B83633C4C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{BF5FB9E6-82C9-4F03-8055-91FD3A9F254A}" = lport=2869 | protocol=6 | dir=in | app=system | "{F4634903-23A2-4E12-999F-9E27B5950D84}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{040A4758-282A-4BDB-8022-FE42CA9B803C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{09B1D653-6DB4-49EE-AC6C-23A0F1A251DF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{15101BDB-5B0D-4217-8EA1-12EECFA6D554}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | "{1553A8F6-BA98-47BB-9D19-721EF6EBFBA5}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{15653D92-5632-4FE3-AD45-74ECCC8B0BD7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{2A6ABF25-9EA0-46B4-B0C5-FE94ADC172B9}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{316D3650-BCE3-46B5-91ED-263AB9E252EC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{31B55627-C75C-48A4-BDF9-2822DA8F82CD}" = dir=in | app=c:\program files (x86)\acer\touchportal\touchportal\pcmservice.exe | "{3E6E1518-3C57-4F92-B5B8-A7C7500532C0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{3F5ECA7E-3A6F-4011-89F6-5524EC6D811C}" = protocol=6 | dir=out | app=system | "{4248FE89-68F8-4FDC-80DC-4531F8D2458D}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | "{4A29CA3D-01AE-494E-99D8-3C7097F33B69}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{4B7F3B3A-9537-4323-8407-6FEF92FA5F3F}" = dir=in | app=c:\program files (x86)\acer\touchportal\touchportal\kernel\dmp\clbrowserengine.exe | "{4BAC63E0-E632-496C-A28B-812FA2055287}" = dir=in | app=c:\program files (x86)\acer\touchportal\touchportal\powercinema.exe | "{4FA3232D-B2BE-4E12-AF34-F8EE08490FAD}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{5E3114CB-7335-42F0-AB45-DCA3C71C67C3}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{6B6595B1-21B8-4A03-9EDE-6B168914A23A}" = dir=in | app=c:\program files (x86)\acer\touchportal\touch movie\touchmovie.exe | "{6F06E3CF-9B97-455B-945F-17644F9F7494}" = protocol=6 | dir=in | app=c:\program files (x86)\samsung\samsung new pc studio\npsasvr.exe | "{729E9AE8-2C8D-4DDC-B3A7-0F79BAD852FB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{73A59BD3-EBFD-4A44-8CD3-40DA1133F578}" = dir=in | app=c:\program files (x86)\acer\acer vcm\vc.exe | "{7A59C60B-81DE-4E23-9B30-D13AECB2652E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{7F8A02F0-2EAD-4F44-A1C1-814C29CA41B9}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | "{8688671F-6E27-48AA-9C76-F4A1BBFF27F0}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{8CEA5DC7-D1DE-431F-8C39-89F09F300C76}" = protocol=17 | dir=in | app=c:\program files (x86)\samsung\samsung new pc studio\npsasvr.exe | "{9208B6BE-9317-4554-A67A-89E425D6C9A7}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | "{92891B3D-0F74-44C0-8FBA-4413A1C3E104}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd8\powerdvd8.exe | "{930B21FA-FAB5-4A9F-9A0E-2974C04B3F7B}" = dir=in | app=c:\program files (x86)\acer\acer vcm\rs_service.exe | "{96FA1B72-6E31-412F-914E-AB0D6F6C4B0D}" = dir=in | app=c:\program files (x86)\acer\touchportal\touch movie\touchmovieservice.exe | "{99DD01BD-EFD2-42BC-99B7-E236FF56ECF3}" = protocol=17 | dir=in | app=c:\program files (x86)\samsung\samsung new pc studio\npsvsvr.exe | "{9A431BFF-DA46-4EA7-83D9-D4EC8FE9D179}" = protocol=6 | dir=in | app=c:\program files (x86)\samsung\samsung new pc studio\npsvsvr.exe | "{B3F6DCA0-5617-4504-8D8C-4A45128D28AC}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | "{C2B08BCC-6025-4350-BBCC-D54D1DF5749B}" = dir=in | app=c:\program files (x86)\acer\touchportal\touchportal\kernel\dms\clmsservice.exe | "{C2F0B4B3-A8BA-4F99-B414-B10576603E9F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{CEA1CEAA-BDFD-4802-A435-6513CE7CCDAA}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{E0E2B1F2-5714-4179-9551-00298F2A0C46}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{E24ADC1D-0E03-42B6-9CED-64BFDE85FCE0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{F935B153-8308-4C96-83F7-95EDF05192F9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant "{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}" = Shredder "{3DA00A00-C3E9-4064-B62C-CAD25EAF0B6A}" = Nitro PDF Reader 2 "{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}" = WIDCOMM Bluetooth Software "{6ACE7F46-FACE-4125-AE86-672F4F2A6A28}" = Virtual Earth 3D (Beta) "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010 "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones "{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit "HDMI" = Intel(R) Graphics Media Accelerator Driver "KONICA MINOLTA magicolor 2430DL" = KONICA MINOLTA magicolor 2430DL "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Samsung Mobile phone USB driver Drive" = Samsung Mobile phone USB driver Drive Software "SynTPDeinstKey" = Synaptics Pointing Device Driver [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer "{0D7CD0D9-4A88-4A63-8F91-3F4E8F371768}" = MyWinLocker "{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime "{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker "{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger "{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources "{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions "{219AA9C3-E1F9-4C99-A41C-7988C1A67143}" = STScreenDetection "{243AD385-8C58-4D49-BF54-8E7F809E0A96}" = Acer TouchPortal "{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 29 "{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com "{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1 "{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger "{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver "{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1 "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery "{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery "{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack "{3898934B-05AE-41CD-96BE-70DA9BFBCE1F}" = Microsoft XNA Framework Redistributable 3.0 "{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management "{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack "{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic "{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update "{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management "{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 3.3.0 "{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform "{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT "{8FF90DB8-6DED-44A3-B182-244FEC09012F}" = Microsoft Touch Pack for Windows 7 "{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker "{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010 "{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR "{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common "{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5 "{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer "{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer "{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.4.6 MUI "{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie "{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail "{B906C11A-D193-4143-9FA7-E2EE8A5A8F21}" = Acer Touch Movie "{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = SUPER © v2012.build.51 (April 7, 2012) Version v2012.build.51 "{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder "{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common "{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail "{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform "{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}" = Acer Crystal Eye webcam Ver:1.1.188.706 "{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64 "{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform "{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10 "{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker "{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger "{E5EABF66-F9C4-430C-B97D-3CF28A58D50B}" = Alcor Micro USB Card Reader "{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support "{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center "{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials "{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials "Acer Screensaver" = Acer ScreenSaver "Acer Welcome Center" = Welcome Center "Adobe AIR" = Adobe AIR "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "Free WMA to MP3 Converter_is1" = Free WMA to MP3 Converter 1.16 "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.15.1228 "GridVista" = Acer GridVista "Identity Card" = Identity Card "InstallShield_{243AD385-8C58-4D49-BF54-8E7F809E0A96}" = Acer TouchPortal "InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager "InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite "InstallShield_{E5EABF66-F9C4-430C-B97D-3CF28A58D50B}" = Alcor Micro USB Card Reader "LManager" = Launch Manager "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400 "MKV Player_is1" = MKV Player 2.0.1 "Mobile Partner" = Mobile Partner "Office14.Click2Run" = Microsoft Office Klick-und-Los 2010 "RealPlayer 15.0" = RealPlayer "WinLiveSuite" = Windows Live Essentials ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Lernfortschrittskontrollen" = Lernfortschrittskontrollen ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 07.04.2012 13:26:53 | Computer Name = MyAcer | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: WebKit2WebProcess.exe, Version: 7534.54.16.5, Zeitstempel: 0x4f581cb2 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x076e2f5d ID des fehlerhaften Prozesses: 0xd78 Startzeit der fehlerhaften Anwendung: 0x01cd1226e8d32053 Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Safari\Apple Application Support\WebKit2WebProcess.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: dd80ac49-80d6-11e1-ac8c-f07bcbf7729d Error - 08.04.2012 14:03:03 | Computer Name = MyAcer | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: WebKit2WebProcess.exe, Version: 7534.54.16.5, Zeitstempel: 0x4f581cb2 Name des fehlerhaften Moduls: NPSWF32.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4f39baa5 Ausnahmecode: 0xc0000005 Fehleroffset: 0x67ecd559 ID des fehlerhaften Prozesses: 0x4e18 Startzeit der fehlerhaften Anwendung: 0x01cd158dc1fa7c9d Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Safari\Apple Application Support\WebKit2WebProcess.exe Pfad des fehlerhaften Moduls: NPSWF32.dll Berichtskennung: 159a52f8-81a5-11e1-ac8c-f07bcbf7729d Error - 09.04.2012 12:52:01 | Computer Name = MyAcer | Source = SideBySide | ID = 16842815 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" in Zeile 3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig. Error - 10.04.2012 16:30:36 | Computer Name = MyAcer | Source = SideBySide | ID = 16842815 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" in Zeile 3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig. Error - 13.04.2012 14:58:50 | Computer Name = MyAcer | Source = Microsoft-Windows-RestartManager | ID = 10006 Description = Die Anwendung oder der Dienst "Windows Live Mail" konnte nicht heruntergefahren werden. Error - 13.04.2012 14:59:02 | Computer Name = MyAcer | Source = Microsoft-Windows-RestartManager | ID = 10006 Description = Die Anwendung oder der Dienst "Windows Search" konnte nicht heruntergefahren werden. Error - 14.04.2012 04:10:16 | Computer Name = MyAcer | Source = SideBySide | ID = 16842815 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" in Zeile 3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig. Error - 15.04.2012 05:38:25 | Computer Name = MyAcer | Source = SideBySide | ID = 16842815 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" in Zeile 3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig. Error - 17.04.2012 18:14:51 | Computer Name = MyAcer | Source = CVHSVC | ID = 100 Description = Nur zur Information. (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt. Error - 18.04.2012 09:28:38 | Computer Name = MyAcer | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: WebKit2WebProcess.exe, Version: 7534.54.16.5, Zeitstempel: 0x4f581cb2 Name des fehlerhaften Moduls: Safari.dll, Version: 7534.54.16.6, Zeitstempel: 0x4f594be1 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0023ba70 ID des fehlerhaften Prozesses: 0x125c Startzeit der fehlerhaften Anwendung: 0x01cd1a177c628f1a Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Safari\Apple Application Support\WebKit2WebProcess.exe Pfad des fehlerhaften Moduls: C:\Program Files (x86)\Safari\Safari.dll Berichtskennung: 674db93f-895a-11e1-bdef-f07bcbf7729d [ System Events ] Error - 14.03.2012 03:47:52 | Computer Name = MyAcer | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: cdrom StarOpen Error - 14.03.2012 16:20:08 | Computer Name = MyAcer | Source = Application Popup | ID = 1060 Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten. Error - 14.03.2012 16:20:38 | Computer Name = MyAcer | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: cdrom StarOpen Error - 14.03.2012 16:21:58 | Computer Name = MyAcer | Source = WMPNetworkSvc | ID = 866300 Description = Error - 15.03.2012 01:04:07 | Computer Name = MyAcer | Source = Application Popup | ID = 1060 Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten. Error - 15.03.2012 01:04:39 | Computer Name = MyAcer | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: cdrom StarOpen Error - 15.03.2012 14:44:07 | Computer Name = MyAcer | Source = DCOM | ID = 10010 Description = Error - 15.03.2012 14:44:40 | Computer Name = MyAcer | Source = Application Popup | ID = 1060 Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten. Error - 15.03.2012 14:45:49 | Computer Name = MyAcer | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: cdrom StarOpen Error - 16.03.2012 13:03:38 | Computer Name = MyAcer | Source = Application Popup | ID = 1060 Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten. < End of report > Ich wäre euch für eure Hilfe und die Anweisung der nächsten Schritte, so dass ich meine 4 Funde los werde, sehr dankbar! Viele Grüße Anke |
| Themen zu Verschlüsselungstrojaner TR/Matsnu.EB.24 per Email erhalten + 3 Erkennungsmuster Exploits EXP/JAVA.N |
| antivir, autorun, avira, bho, continue, converter, desktop, device driver, email, error, failed, firefox, flash player, heuristiks/extra, heuristiks/shuriken, home, icreinstall, install.exe, launch, locker, logfile, microsoft office starter 2010, mp3, mywinlocker, plug-in, popup, problem, progressive, pup.adware.installcore, pup.bundleinstaller.somoto, realtek, registry, richtlinie, rundll, scan, searchscopes, security, software, super, svchost.exe, windows, wma |
Baum-Darstellung