| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/ATRAPS.GEN/GEN2 entfernenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
| |
08.07.2012, 18:06
| #1 |
| |  TR/ATRAPS.GEN/GEN2 entfernen Hallo erstmal danke für evtel Hilfe die ich von euch bekomme ich habe heut morgen meinen PC (Windows 7 64 Bit) als Admin gestartet und einen Virenscan ausgefürt es kam nach ca 5 min diese Meldung TR/ATRAPS:GEN C:/Users/Niron/App Data/Local/ef467794-C566-b99f-8712-b2dc1b-98482c}/n Ich wusste das es ein Trojaner ist. Wollte Firewall einstellen geht aber nicht mehr... Felhercode 0x80070424 Ich habe dann euer Forum gefunden mir Mailwarebyte heruntergeladen und einen Vollständigen scan gemacht hier die Log File: Malwarebytes Anti-Malware (Test) 1.61.0.1400 www.malwarebytes.org Datenbank Version: v2012.07.08.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 niron :: NIRON-PC [Administrator] Schutz: Aktiviert 08.07.2012 16:55:17 mbam-log-2012-07-08 (18-41-59).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 608596 Laufzeit: 1 Stunde(n), 40 Minute(n), 30 Sekunde(n) Infizierte Speicherprozesse: 1 C:\Users\niron\AppData\Local\Temp\DAT4F38.tmp.exe (Trojan.FakeAlert) -> 3928 -> Keine Aktion durchgeführt. Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|DAT4F38.tmp.exe (Trojan.FakeAlert) -> Daten: C:\Users\niron\AppData\Local\Temp\DAT4F38.tmp.exe -> Keine Aktion durchgeführt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 11 C:\Casino\EuroGrand Casino\_SetupCasino_944428_de.exe (PUP.Casino) -> Keine Aktion durchgeführt. C:\Users\niron\Desktop\KIONOFILME NEU\CORE10k.EXE (Dont.Steal.Our.Software) -> Keine Aktion durchgeführt. C:\Users\niron\Desktop\KIONOFILME NEU\keygen.exe (Malware.Packer) -> Keine Aktion durchgeführt. C:\Users\niron\Downloads\ophcrack-win32-installer-3.3.1.exe (PSWTool.OphCrack) -> Keine Aktion durchgeführt. C:\Users\niron\Downloads\SetupCasino_944428_de.exe (PUP.Casino) -> Keine Aktion durchgeführt. C:\Users\niron\Downloads\SoftonicDownloader_fuer_anno-2070(1).exe (PUP.ToolbarDownloader) -> Keine Aktion durchgeführt. C:\Users\niron\Downloads\SoftonicDownloader_fuer_anno-2070(2).exe (PUP.ToolbarDownloader) -> Keine Aktion durchgeführt. C:\Users\niron\Downloads\SoftonicDownloader_fuer_anno-2070(3).exe (PUP.ToolbarDownloader) -> Keine Aktion durchgeführt. C:\Users\niron\Downloads\SoftonicDownloader_fuer_anno-2070.exe (PUP.ToolbarDownloader) -> Keine Aktion durchgeführt. C:\Users\niron\Downloads\SoftonicDownloader_fuer_google-translator.exe (PUP.ToolbarDownloader) -> Keine Aktion durchgeführt. C:\Users\niron\AppData\Local\Temp\DAT4F38.tmp.exe (Trojan.FakeAlert) -> Keine Aktion durchgeführt. (Ende) OTL scan hane ich auch gemach hier die Log File OTL logfile created on: 08.07.2012 18:47:49 - Run 1 OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\niron\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,01 Gb Available Physical Memory | 50,28% Memory free 7,99 Gb Paging File | 5,79 Gb Available in Paging File | 72,47% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 451,07 Gb Total Space | 102,97 Gb Free Space | 22,83% Space Free | Partition Type: NTFS Computer Name: NIRON-PC | User Name: niron | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.07.08 17:53:27 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\niron\Downloads\OTL.exe PRC - [2012.07.08 09:57:04 | 000,044,544 | ---- | M] (HLBS Tech (P) Limited) -- C:\Users\niron\AppData\Local\Temp\DAT4F38.tmp.exe PRC - [2012.07.07 08:31:12 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2012.05.08 09:10:02 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.05.08 09:10:02 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2012.05.08 09:10:02 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe PRC - [2011.08.17 09:28:14 | 003,120,448 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe PRC - [2011.04.23 22:17:26 | 001,994,936 | ---- | M] (Sensible Vision ) -- C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayAlert.exe PRC - [2011.04.23 22:17:26 | 000,098,488 | ---- | M] (Sensible Vision ) -- C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayMon.exe PRC - [2011.04.23 22:17:08 | 002,412,728 | ---- | M] (Sensible Vision ) -- C:\Program Files (x86)\Sensible Vision\Fast Access\FAService.exe PRC - [2011.04.22 12:09:11 | 001,496,528 | ---- | M] (TrueCrypt Foundation) -- C:\Programme\TrueCrypt\TrueCrypt.exe PRC - [2010.12.09 13:22:52 | 010,043,392 | ---- | M] (Gembird Europe B.V.) -- C:\Program Files (x86)\Gembird\Power Manager\pm.exe PRC - [2010.09.30 14:00:28 | 000,253,264 | ---- | M] () -- C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe PRC - [2010.08.20 22:53:08 | 000,689,472 | ---- | M] (SoftThinks SAS) -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe PRC - [2010.07.05 17:12:00 | 000,544,768 | ---- | M] (Oberon Media ) -- C:\Program Files (x86)\GamesBar\SearchEngineProtection.exe ========== Modules (No Company Name) ========== MOD - [2012.07.07 08:31:12 | 002,042,848 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2012.06.16 16:57:32 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll MOD - [2012.06.16 16:57:26 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll MOD - [2012.05.14 15:31:07 | 000,025,600 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\2ec98ab0193d64e95b7d09d094deed97\Accessibility.ni.dll MOD - [2012.05.14 15:30:54 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll MOD - [2012.05.14 15:30:51 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll MOD - [2012.05.14 15:30:50 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll MOD - [2012.05.14 15:30:35 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll MOD - [2012.05.11 09:01:37 | 008,797,856 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll MOD - [2011.04.23 22:18:10 | 000,100,208 | ---- | M] () -- C:\Windows\SysWOW64\FAIEExtension.dll MOD - [2011.04.23 22:17:32 | 000,062,136 | ---- | M] () -- C:\Windows\SysWOW64\FAib.dll MOD - [2011.04.23 22:16:44 | 000,250,552 | ---- | M] () -- C:\Windows\SysWOW64\FACrashRpt.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2011.12.14 13:23:22 | 000,035,648 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Windows\SysNative\uxtuneup.dll -- (UxTuneUp) SRV:64bit: - [2010.09.22 10:51:08 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2010.02.02 21:13:10 | 000,048,128 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE -- (wltrysvc) SRV - [2012.07.07 08:31:12 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.05.08 09:10:02 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.05.08 09:10:02 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.12.14 13:23:34 | 002,123,584 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc) SRV - [2011.12.14 13:23:22 | 000,028,992 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Windows\SysWOW64\uxtuneup.dll -- (UxTuneUp) SRV - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2011.04.23 22:17:08 | 002,412,728 | ---- | M] (Sensible Vision ) [Auto | Running] -- C:\Program Files (x86)\Sensible Vision\Fast Access\FAService.exe -- (FAService) SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2010.09.30 14:00:28 | 000,253,264 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe -- (UI Assistant Service) SRV - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.08.26 09:40:26 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2010.08.26 09:31:23 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist) SRV - [2010.08.20 22:53:08 | 000,689,472 | ---- | M] (SoftThinks SAS) [Auto | Running] -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe -- (SftService) SRV - [2010.07.06 04:22:30 | 000,007,168 | ---- | M] (Microsoft) [Auto | Running] -- C:\Programme\Dell\OSD\DellOSDservice.exe -- (DellOSDservice) SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.09.18 11:54:20 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor8.0) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2007.05.31 17:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm) SRV - [2007.05.31 17:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.05.08 09:10:02 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.05.08 09:10:02 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.03.08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.11.27 17:51:01 | 000,271,424 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2011.10.11 15:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.10.01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:64bit: - [2011.10.01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:64bit: - [2011.10.01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:64bit: - [2011.10.01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:64bit: - [2011.04.22 12:09:14 | 000,230,352 | ---- | M] (TrueCrypt Foundation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt) DRV:64bit: - [2011.03.21 13:22:06 | 000,452,200 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2011.02.14 02:42:36 | 000,028,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64diag.sys -- (UsbDiag) DRV:64bit: - [2011.02.14 02:42:30 | 000,034,816 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64modem.sys -- (USBModem) DRV:64bit: - [2011.02.14 02:42:28 | 000,017,920 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64bus.sys -- (usbbus) DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone) DRV:64bit: - [2010.12.17 00:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV:64bit: - [2010.12.07 14:23:02 | 000,034,304 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandmodem64.sys -- (ANDModem) DRV:64bit: - [2010.12.07 14:23:00 | 000,027,648 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lganddiag64.sys -- (AndDiag) DRV:64bit: - [2010.12.07 14:23:00 | 000,027,136 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandgps64.sys -- (AndGps) DRV:64bit: - [2010.12.07 14:22:58 | 000,019,456 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandbus64.sys -- (Andbus) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.03 02:29:42 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt) DRV:64bit: - [2010.11.03 02:29:41 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt) DRV:64bit: - [2010.09.22 11:22:42 | 007,883,264 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2010.09.22 10:14:48 | 000,285,696 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2010.07.15 01:17:58 | 000,033,792 | ---- | M] (Nuvoton Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nuviocir_win7_x64.sys -- (nuviocir) DRV:64bit: - [2010.04.07 15:57:08 | 000,073,784 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2010.04.07 15:57:08 | 000,028,728 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.03.24 08:13:00 | 000,371,072 | ---- | M] (AVerMedia TECHNOLOGIES, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AVerPola.sys -- (AVerPola) DRV:64bit: - [2010.03.10 09:33:52 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie) AMD PCI Express (3GIO) DRV:64bit: - [2010.02.18 10:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64) DRV:64bit: - [2010.02.08 01:41:48 | 000,038,512 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFEHashRIPEMD.sys -- (FreeOTFEHashRIPEMD) DRV:64bit: - [2010.02.08 01:41:48 | 000,035,440 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFECypherTwofish_ltc.sys -- (FreeOTFECypherTwofish_ltc) DRV:64bit: - [2010.02.08 01:41:48 | 000,034,928 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFEHashWhirlpool.sys -- (FreeOTFEHashWhirlpool) DRV:64bit: - [2010.02.08 01:41:48 | 000,029,296 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFEHashSHA.sys -- (FreeOTFEHashSHA) DRV:64bit: - [2010.02.08 01:41:48 | 000,026,224 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFEHashTiger.sys -- (FreeOTFEHashTiger) DRV:64bit: - [2010.02.08 01:41:48 | 000,022,640 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFEHashMD.sys -- (FreeOTFEHashMD) DRV:64bit: - [2010.02.08 01:41:46 | 000,060,016 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFECypherDES.sys -- (FreeOTFECypherDES) DRV:64bit: - [2010.02.08 01:41:46 | 000,035,952 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFECypherSerpent_Gladman.sys -- (FreeOTFECypherSerpent_Gladman) DRV:64bit: - [2010.02.08 01:41:46 | 000,034,928 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFECypherCAST6_Gladman.sys -- (FreeOTFECypherCAST6_Gladman) DRV:64bit: - [2010.02.08 01:41:46 | 000,030,832 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFECypherMARS_Gladman.sys -- (FreeOTFECypherMARS_Gladman) DRV:64bit: - [2010.02.08 01:41:46 | 000,029,296 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFECypherRC6_ltc.sys -- (FreeOTFECypherRC6_ltc) DRV:64bit: - [2010.02.08 01:41:44 | 000,050,800 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFECypherAES_ltc.sys -- (FreeOTFECypherAES_ltc) DRV:64bit: - [2010.02.08 01:41:44 | 000,038,512 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFE.sys -- (FreeOTFE) DRV:64bit: - [2010.02.08 01:41:44 | 000,034,928 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFECypherCAST5.sys -- (FreeOTFECypherCAST5) DRV:64bit: - [2010.02.08 01:41:44 | 000,027,760 | ---- | M] (Sarah Dean) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\FreeOTFECypherBlowfish.sys -- (FreeOTFECypherBlowfish) DRV:64bit: - [2010.02.02 21:13:10 | 000,047,632 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF) WinPcap Packet Driver (NPF) DRV:64bit: - [2010.02.02 21:13:08 | 000,022,520 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcm42rly.sys -- (BCM42RLY) DRV:64bit: - [2010.02.02 21:13:08 | 000,020,984 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcmvwl64.sys -- (BcmVWL) DRV:64bit: - [2010.02.02 21:13:06 | 003,058,168 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX) DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k) DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea) DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k) DRV:64bit: - [2009.10.29 19:28:24 | 000,011,776 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx) DRV:64bit: - [2009.07.09 10:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.01.19 20:32:22 | 000,334,344 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11) DRV:64bit: - [2008.09.25 02:36:14 | 000,238,848 | ---- | M] (Sensible Vision ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\facap.sys -- (FACAP) DRV:64bit: - [2006.11.01 19:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr) DRV:64bit: - [2004.06.06 22:42:38 | 000,045,952 | ---- | M] (Bo Brantén) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\filedisk.sys -- (FileDisk) DRV - [2011.10.31 17:22:10 | 000,011,856 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE:64bit: - HKLM\..\SearchScopes\{0CA04ACA-C314-41C8-B095-16E4CAB84C62}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=113&systemid=406&sr=0&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com IE - HKLM\..\SearchScopes\{3D130274-3B83-4F4E-A288-DB2B31B26E44}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=113&systemid=406&sr=0&q={searchTerms} IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8 IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/ IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\SearchScopes\{1F7F28D0-B10C-4930-ACEC-115479C25885}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms} IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\SearchScopes\{36377DD7-B3EB-42f5-986F-680BAF59BA9D}: "URL" = hxxp://start.iplay.com/searchresults.aspx?o=chrome&q={searchTerms} IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GZAZ_deDE400 IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={F64FC190-2EA6-4979-A586-B267F7D2F5BC}&mid=228ae0c41e0d47d1a65555626d9b0819-91919f049da9cb6c1f5d7661cd1e80cfbe35fdab&lang=de&ds=tt014&pr=sa&d=2011-12-16 16:02:34&v=8.0.0.34&sap=dsp&q={searchTerms} IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=113&systemid=406&sr=0&q={searchTerms} IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}: "URL" = hxxp://toolbar.ask.com/toolbarv/askRedirect?gct=&gc=1&q={searchTerms}&crm=1&toolbar=VZ2 IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-flv IE - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Google" FF - prefs.js..browser.search.defaultthis.engineName: "softonic-de3 Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.order.1: "Search Results" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.searchqu.com/406" FF - prefs.js..extensions.enabledItems: linkuryfirefoxremoteplugin@linkury.com:1.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.11.3.15590 FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.3.5.20110120033202 FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=113&systemid=406&sr=0&q=" FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll (Oberon-Media ) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.4: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fassoxpcom@sensiblevision.com: C:\Program Files (x86)\Sensible Vision\Fast Access\xpcom_fasso\ [2011.05.28 19:23:22 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.07 08:31:12 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.03.17 17:32:38 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.07 08:31:12 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.03.17 17:32:38 | 000,000,000 | ---D | M] [2010.10.05 14:00:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\niron\AppData\Roaming\Mozilla\Extensions [2012.07.04 09:53:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\extensions [2010.10.04 20:01:00 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2012.05.18 08:39:07 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2012.04.02 12:31:50 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012.06.29 13:20:02 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2011.05.22 19:47:31 | 000,000,000 | ---D | M] ("Ask Toolbar for Firefox") -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2012.05.04 13:32:53 | 000,000,000 | ---D | M] (Browser Companion Helper) -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\extensions\bbrs_002@blabbers.com [2011.05.10 07:13:49 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\extensions\engine@conduit.com [2012.05.18 08:32:58 | 000,000,000 | ---D | M] (softonic.com) -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\extensions\ffxtlbra@softonic.com [2012.03.17 17:32:38 | 000,000,000 | ---D | M] (loadtbs) -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\extensions\software@loadtubes.com [2009.03.18 14:57:25 | 000,000,681 | ---- | M] () -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\searchplugins\ask.xml [2011.12.16 17:02:26 | 000,003,741 | ---- | M] () -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\searchplugins\avg-secure-search.xml [2010.12.08 16:47:52 | 000,000,927 | ---- | M] () -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\searchplugins\conduit.xml [2012.07.06 19:55:54 | 000,000,950 | ---- | M] () -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\searchplugins\icqplugin-1.xml [2011.01.09 17:03:47 | 000,000,950 | ---- | M] () -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\searchplugins\icqplugin-2.xml [2010.10.13 17:13:09 | 000,001,056 | ---- | M] () -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\searchplugins\icqplugin.xml [2011.12.26 21:24:15 | 000,005,604 | ---- | M] () -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\searchplugins\Linkury Smartbar Search.xml [2009.03.21 08:29:18 | 000,001,632 | ---- | M] () -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\searchplugins\live-search.xml [2011.12.29 22:10:03 | 000,002,519 | ---- | M] () -- C:\Users\niron\AppData\Roaming\Mozilla\Firefox\Profiles\utmrz7is.default\searchplugins\Search_Results.xml [2012.05.08 09:12:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2012.02.13 09:20:56 | 000,709,293 | ---- | M] () (No name found) -- C:\USERS\NIRON\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UTMRZ7IS.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI [2012.07.07 08:31:12 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.02.19 11:46:48 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2012.02.15 16:48:02 | 000,378,880 | ---- | M] (InfiniAd GmbH) -- C:\Program Files (x86)\mozilla firefox\plugins\npmieze.dll [2012.07.07 08:31:10 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.12.20 10:02:19 | 000,003,768 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml [2012.07.07 08:31:10 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2007.07.26 14:05:16 | 000,001,329 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\crawlersrch.xml [2012.07.07 08:31:10 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.11.16 10:19:29 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml [2012.07.07 08:31:10 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.12.29 22:10:03 | 000,002,519 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml [2011.01.09 17:03:41 | 000,001,456 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\WebSearchober16871788.xml [2012.07.07 08:31:10 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.07 08:31:10 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Search Results (Enabled) CHR - default_search_provider: search_url = hxxp://dts.search-results.com/sr?src=crb&appid=113&systemid=406&sr=0&q={searchTerms} CHR - default_search_provider: suggest_url = CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.168\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll CHR - plugin: Microsoft Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.168\pdf.dll CHR - plugin: Chrome NaCl (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.168\ppGoogleNaClPluginChrome.dll CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.168\gears.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npLegitCheckPlugin.dll CHR - plugin: Oberon com adapter (Enabled) = C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.53\npGoogleUpdate3.dll CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin O1 HOSTS File: ([2011.03.20 11:28:44 | 000,001,101 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 gosredirector.ea.com O1 - Hosts: 127.0.0.1 blazeserver.blazeemu.org O1 - Hosts: 127.0.0.1 gosgvaprod-qos01.ea.com O1 - Hosts: 127.0.0.1 gosiadprod-qos01.ea.com O1 - Hosts: 127.0.0.1 gossjcprod-qos01.ea.com O1 - Hosts: 127.0.0.1 demangler.ea.com O1 - Hosts: 127.0.0.1 vmp.tools.gos.ea.com O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Face recognition web login for FastAccess) - {DA5BCE70-D057-4D63-943D-5F3927EC59F1} - C:\Program Files (x86)\Sensible Vision\Fast Access\x64\FAIESSO.dll (Sensible Vision ) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll () O2 - BHO: (GamesBarBHO Class) - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Program Files (x86)\GamesBar\2.0.1.78\oberontb.dll (Oberon Media Ltd.) O2 - BHO: (Face recognition web login for FastAccess) - {DA5BCE70-D057-4D63-943D-5F3927EC59F1} - C:\Program Files (x86)\Sensible Vision\Fast Access\FAIESSO.dll (Sensible Vision ) O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (GamesBar) - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files (x86)\GamesBar\2.0.1.78\oberontb.dll (Oberon Media Ltd.) O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll () O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3 - HKLM\..\Toolbar: (loadtbs) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - C:\Users\niron\AppData\Roaming\loadtbs\toolbar.dll (InfiniAd GmbH) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4:64bit: - HKLM..\Run: [DellStage] C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe () O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [AccuWeatherWidget] C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe () O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [FAStartup] File not found O4 - HKLM..\Run: [FATrayAlert] C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayMon.exe (Sensible Vision ) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [Power Manager] C:\Program Files (x86)\Gembird\Power Manager\pm.exe (Gembird Europe B.V.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-860910577-2939734836-3634675174-1000..\Run: [DAT4F38.tmp.exe] C:\Users\niron\AppData\Local\Temp\DAT4F38.tmp.exe (HLBS Tech (P) Limited) O4 - HKU\S-1-5-21-860910577-2939734836-3634675174-1000..\Run: [SearchEngineProtection] C:\Program Files (x86)\GamesBar\SearchEngineProtection.exe (Oberon Media ) O4 - HKU\S-1-5-21-860910577-2939734836-3634675174-1000..\Run: [TrueCrypt] C:\Program Files\TrueCrypt\TrueCrypt.exe (TrueCrypt Foundation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKU\S-1-5-21-860910577-2939734836-3634675174-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O9 - Extra 'Tools' menuitem : GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - Reg Error: Value error. File not found O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{93D8E386-E358-4975-92A3-94DDDC3380EC}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BC66EE88-F13C-4D4B-B72B-85B4A4DFF1BF}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E5AFBD89-003C-421E-8C8A-F68FDD5D30CD}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll) - File not found O20 - Winlogon\Notify\FastAccess: DllName - (C:\Program Files (x86)\Sensible Vision\Fast Access\FALogNot.dll) - C:\Program Files (x86)\Sensible Vision\Fast Access\FALogNot.dll () O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O27:64bit: - HKLM IFEO\taskmgr.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\PMLauncher.exe (TuneUp Software) O27 - HKLM IFEO\taskmgr.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\PMLauncher.exe (TuneUp Software) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{befdbd37-fa06-11df-a189-842b2b7fe1ea}\Shell - "" = AutoRun O33 - MountPoints2\{befdbd37-fa06-11df-a189-842b2b7fe1ea}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL E:\Start.hta O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\Autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.07.08 18:44:18 | 000,000,000 | ---D | C] -- C:\Users\niron\Desktop\Logfiles [2012.07.08 16:53:47 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Roaming\Malwarebytes [2012.07.08 16:53:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.07.08 16:53:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.07.08 16:53:41 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.07.08 16:53:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.07.08 09:56:21 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{5708FAA6-DA79-410C-86A3-EBE0BB4A362E} [2012.07.08 09:56:04 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{0FCB95B1-2159-4EA9-B57B-C935BEC843E4} [2012.07.07 08:31:36 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{F0048DEB-4C64-4FAF-A577-D32BDC5B961D} [2012.07.07 08:31:25 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{18E683F3-EDB1-49FA-852E-4A7A20EFA0B0} [2012.07.06 19:52:30 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{AD83ACD8-4240-410C-A2EF-70AEFD514B8E} [2012.07.06 19:52:19 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{7CB9A107-6D5E-4D6F-894E-28CD0CDEBBA2} [2012.07.05 21:07:59 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{365C2770-75EC-4334-B934-D3273DCDB881} [2012.07.05 21:07:49 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{F8DC2805-89ED-4830-8315-21C70D046C97} [2012.07.04 09:25:10 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{0D93C1A1-A377-48DE-8AEA-A870FB4CFE37} [2012.07.04 09:24:59 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{FE84A6FE-FE1F-4195-B23B-19DC7DC5EE88} [2012.07.03 09:18:20 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{C9A77CB9-2108-4E15-94B6-924BDDA08C14} [2012.07.03 09:17:59 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{3A91E90E-0C56-43AE-ADFB-E00766877040} [2012.07.02 21:17:35 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{D6080E5F-D24F-4A2F-8EB9-EF3797A9F592} [2012.07.02 21:17:25 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{D861ACB5-0F9B-46D7-B67B-A33AE9148D9C} [2012.06.29 16:25:55 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{2AEECF6A-9D6D-4289-A493-8B55236B612F} [2012.06.29 16:25:45 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{E5458F35-E084-4D1A-BD00-FFD221C4BA59} [2012.06.26 14:27:07 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{C7C6519D-47AE-4FE6-B25A-1431001308C0} [2012.06.26 14:26:51 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{B699280D-EE5F-43C4-B88C-34E8CE694D9C} [2012.06.23 12:24:50 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{C5212204-7E2C-4842-AB4D-44E7A7998B04} [2012.06.23 12:24:39 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{35E3CB9B-0589-4DCF-A42D-0B9063421637} [2012.06.22 13:20:06 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll [2012.06.22 13:20:06 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe [2012.06.22 13:20:06 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll [2012.06.22 13:20:01 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll [2012.06.22 13:20:01 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll [2012.06.22 13:20:01 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll [2012.06.22 13:19:57 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll [2012.06.22 13:19:57 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe [2012.06.22 13:18:20 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{3A140F11-9E92-4A24-BFB6-25242A938351} [2012.06.22 13:18:09 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{1BBE9FE8-531E-479E-9F16-8C9E55E2CAA9} [2012.06.21 10:07:09 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{B822119E-447D-4745-B80C-F611FDC0FB95} [2012.06.21 10:06:59 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{A17541CD-C268-417D-B6D7-1D9C4F006553} [2012.06.20 16:53:39 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{34BE0AF1-B41E-4C38-B8D5-64B0A9089A55} [2012.06.20 16:53:26 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{A8F21640-790A-4247-8229-038B197BD134} [2012.06.19 16:00:12 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{29448558-A7B0-4FA1-B705-4B112EDD1367} [2012.06.19 16:00:02 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{D44D4D70-49AE-4172-AC95-283077737A06} [2012.06.18 09:17:08 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{619F76AB-5D61-4FAD-BFBB-5600A33984C8} [2012.06.17 19:39:08 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{BCB60582-57C1-4C4F-89B0-5F6882645E1A} [2012.06.16 16:55:22 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{82C53E8F-4BC8-44B6-908C-2BF33159E3E6} [2012.06.13 11:11:03 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.06.13 11:11:03 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.06.13 11:11:03 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.06.13 11:11:03 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.06.13 11:11:02 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.06.13 11:11:02 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.06.13 11:11:02 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012.06.13 11:11:02 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012.06.13 11:11:01 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.06.13 11:11:01 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.06.13 11:11:00 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012.06.13 11:11:00 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.06.13 11:11:00 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.06.13 11:07:03 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{DDF9AD14-7050-4625-AC20-7D2EBCE8A4EC} [2012.06.13 11:06:52 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{2C81E136-D5E7-40E8-9189-38F93CE1D922} [2012.06.13 11:04:48 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll [2012.06.13 11:04:48 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll [2012.06.13 11:04:48 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe [2012.06.13 11:04:45 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2012.06.13 11:04:44 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2012.06.13 11:04:44 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2012.06.13 11:04:36 | 003,216,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll [2012.06.13 11:04:29 | 001,462,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll [2012.06.13 11:04:28 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll [2012.06.11 16:05:45 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{4F2914AF-B4F8-4085-A345-6E30CD12C4F3} [2012.06.11 16:05:34 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{48825466-58DA-41A3-B82A-2DDB07B4B97D} [2012.06.10 15:05:20 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{8C32B57F-BCD4-4D72-9E58-E1A9A7B03E5E} [2012.06.10 15:05:09 | 000,000,000 | ---D | C] -- C:\Users\niron\AppData\Local\{2B969F27-BF78-40EB-80DE-EBD1D00D56B6} [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== File not found -- C:\Windows\SysNative\ [2012.07.08 18:09:02 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.07.08 16:57:33 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.08 16:57:33 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.08 16:56:11 | 001,556,518 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.07.08 16:56:11 | 000,674,746 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.07.08 16:56:11 | 000,633,536 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.07.08 16:56:11 | 000,140,052 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.07.08 16:56:11 | 000,114,520 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.07.08 16:53:42 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.08 16:50:38 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.07.08 16:50:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.08 16:50:07 | 3218,018,304 | -HS- | M] () -- C:\hiberfil.sys [2012.07.08 10:57:23 | 000,000,306 | RHS- | M] () -- C:\ProgramData\ntuser.pol [2012.07.08 09:58:01 | 000,328,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\services.exe [2012.07.03 09:10:43 | 000,002,376 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2012.06.16 16:52:47 | 000,276,528 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== File not found -- C:\Windows\SysNative\ [2012.07.08 16:53:42 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.08 09:57:14 | 000,001,696 | ---- | C] () -- C:\Windows\Installer\{ef467794-c566-b99f-8712-b2dc1b98482c}\U\00000001.@ [2012.01.11 08:56:33 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{ef467794-c566-b99f-8712-b2dc1b98482c}\@ [2012.01.11 08:56:33 | 000,002,048 | -HS- | C] () -- C:\Users\niron\AppData\Local\{ef467794-c566-b99f-8712-b2dc1b98482c}\@ [2011.08.11 18:31:27 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI [2011.08.07 19:47:37 | 000,006,144 | ---- | C] () -- C:\Users\niron\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.06.22 20:08:53 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll [2011.06.22 20:08:53 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini [2011.05.22 22:15:29 | 000,000,680 | RHS- | C] () -- C:\Users\niron\ntuser.pol [2011.05.22 22:15:15 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2011.04.23 22:18:10 | 000,100,208 | ---- | C] () -- C:\Windows\SysWow64\FAIEExtension.dll [2011.04.23 22:17:32 | 000,062,136 | ---- | C] () -- C:\Windows\SysWow64\FAib.dll [2011.04.23 22:16:44 | 000,250,552 | ---- | C] () -- C:\Windows\SysWow64\FACrashRpt.dll [2011.02.27 12:55:38 | 000,007,610 | ---- | C] () -- C:\Users\niron\AppData\Local\Resmon.ResmonCfg [2011.01.26 12:37:34 | 000,002,857 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2010.11.08 16:49:59 | 000,000,017 | ---- | C] () -- C:\Windows\SysWow64\shortcut_ex.dat [2010.11.03 03:55:02 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2010.10.07 21:36:06 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.10.05 15:15:25 | 001,583,200 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.08.26 02:13:57 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2010.07.13 19:45:07 | 051,662,336 | ---- | C] () -- C:\Users\niron\Steckbrief-Kätzchen.wps [2009.05.23 13:26:32 | 001,713,448 | ---- | C] () -- C:\Users\niron\Autorun.exe ========== LOP Check ========== [2011.12.18 00:00:09 | 000,000,000 | ---D | M] -- C:\Users\Besucher\AppData\Roaming\DAEMON Tools Pro [2012.05.12 17:32:08 | 000,000,000 | ---D | M] -- C:\Users\Besucher\AppData\Roaming\Fingertapps [2011.03.25 20:42:53 | 000,000,000 | ---D | M] -- C:\Users\Besucher\AppData\Roaming\SoftGrid Client [2011.12.18 00:05:04 | 000,000,000 | ---D | M] -- C:\Users\Besucher\AppData\Roaming\TuneUp Software [2011.03.25 18:19:15 | 000,000,000 | ---D | M] -- C:\Users\Besucher\AppData\Roaming\Windows Live Writer [2011.11.27 20:20:04 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\DAEMON Tools Pro [2012.04.10 19:35:34 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Fingertapps [2011.12.18 22:14:01 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\GetRightToGo [2011.12.10 08:05:33 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Nitro PDF [2011.04.18 20:21:18 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Reviversoft [2011.11.08 15:19:41 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Simply Super Software [2012.06.19 23:51:35 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\SoftGrid Client [2010.10.31 19:15:02 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Spyware Terminator [2011.05.22 21:41:55 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Template [2011.11.07 15:54:18 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\TuneUp Software [2011.11.13 21:41:36 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Windows Live Writer [2011.03.11 10:41:18 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\Ace [2012.05.06 19:54:10 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\BrowserCompanion [2011.11.12 14:26:27 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\Canneverbe Limited [2011.01.04 16:32:33 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\Command and Conquer 4 [2011.11.27 18:00:53 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\DAEMON Tools Pro [2011.11.02 17:38:21 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\Downloaded Installations [2011.12.29 22:10:31 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\DVDVideoSoft [2011.07.16 17:50:23 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\DVDVideoSoftIEHelpers [2012.04.09 12:39:23 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\Fingertapps [2010.10.30 20:31:46 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\FreeVideoConverter [2012.04.29 16:25:43 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\GetRightToGo [2012.03.17 17:32:38 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\loadtbs [2011.11.02 17:41:33 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\Nitro PDF [2011.01.09 16:26:02 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\Oberon Media [2011.11.12 14:26:03 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\OpenCandy [2011.11.09 13:17:26 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\Origin [2011.05.25 17:19:47 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\PCDr [2011.11.01 08:12:38 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\ProtectDisc [2011.04.19 10:03:58 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\Reviversoft [2011.10.25 11:12:08 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\Samsung [2012.06.23 12:36:53 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\SoftGrid Client [2010.10.04 20:00:08 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\Template [2010.10.05 15:16:11 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\TP [2011.11.01 17:34:34 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\Tropico 3 [2011.05.11 20:22:01 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\TrueCrypt [2011.11.07 21:30:58 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\TuneUp Software [2012.04.29 09:40:29 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\Ubisoft [2010.10.07 19:38:04 | 000,000,000 | ---D | M] -- C:\Users\niron\AppData\Roaming\Windows Live Writer [2011.04.18 19:59:44 | 000,000,000 | ---D | M] -- C:\Users\Ron Admin\AppData\Roaming\Command and Conquer 4 [2011.04.16 13:08:02 | 000,000,000 | ---D | M] -- C:\Users\Ron Admin\AppData\Roaming\PCDr [2011.04.18 20:09:54 | 000,000,000 | ---D | M] -- C:\Users\Ron Admin\AppData\Roaming\Reviversoft [2011.04.17 15:16:40 | 000,000,000 | ---D | M] -- C:\Users\Ron Admin\AppData\Roaming\SoftGrid Client [2012.05.06 16:02:01 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 108 bytes -> C:\ProgramData\Temp:CB0AACC9 < End of report > Sorry bin kein Computer Pro und brauch dringen Anleitung was ich machen kann ich möchte auch meine Daten behalten Kinderbilder, Doc. usw |
| Themen zu TR/ATRAPS.GEN/GEN2 entfernen |
| 0x8007042, adobe, alternate, antivir, avg, avira, bho, cid, desktop, entfernen, error, firefox, format, google earth, helper, heuristiks/extra, heuristiks/shuriken, home, log file, logfile, malware.packer, mozilla, plug-in, realtek, registry, rundll, searchqu toolbar, searchscopes, smartbar, software, spyware, super, tr/atraps.gen/gen2, trojaner, windows, windows 7 64 bit, winpcap packet driver, wlan |
Baum-Darstellung