Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Incredi Toolbar Trojaner, zweiter Laptop

Incredi Toolbar Trojaner, zweiter Laptop


Plagegeister aller Art und deren Bekämpfung: Incredi Toolbar Trojaner, zweiter Laptop

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 27.08.2012, 15:58   #1
c_zett
 
Incredi Toolbar Trojaner, zweiter Laptop - Standard

Incredi Toolbar Trojaner, zweiter Laptop


Hallo,
leider befindet sich auch auf einem zweiten Laptop die Incredi Toolbar. Wahrscheinlich mit einem Download des Adobe Readers aus unbekannter Quelle auf den Rechner gezogen (ist nicht mein Rechner und angeblich hat niemand den Adobe Reader runtergeladen, aber es würde zeitlich passen ).
Habe, nach Angaben in diesem Forum, auch hier den adwCleaner laufen lassen, einen Scan mit Malewarebytes (Funde in Quarantäne verschoben) durchgeführt, den defogger (Fehlermeldung) und OTL laufen lassen.
Wie gehts es jetzt weiter?
Hoffentlich war auch hier bis jetzt alles richtig und vielen Dank schon einmal für die Hilfe!!
Anbei die Logfiles und hier die OTL-Datei:

OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 27.08.2012 16:36:49 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Admin\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,91 Gb Total Physical Memory | 2,69 Gb Available Physical Memory | 68,79% Memory free
7,81 Gb Paging File | 6,50 Gb Available in Paging File | 83,19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283,39 Gb Total Space | 188,33 Gb Free Space | 66,46% Space Free | Partition Type: NTFS
Drive D: | 14,41 Gb Total Space | 2,34 Gb Free Space | 16,21% Space Free | Partition Type: NTFS
Drive E: | 99,34 Mb Total Space | 92,75 Mb Free Space | 93,37% Space Free | Partition Type: FAT32
Drive F: | 465,76 Gb Total Space | 255,81 Gb Free Space | 54,92% Space Free | Partition Type: NTFS
 
Computer Name: SARAH-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 360 Days
 
========== Processes (SafeList) ==========
 
PRC - File not found -- 
PRC - [2012.08.27 16:32:54 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Downloads\OTL.exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2010.11.20 14:17:00 | 000,302,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\cmd.exe
PRC - [2010.05.21 00:52:06 | 011,312,128 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2010.05.21 00:52:04 | 011,318,784 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2010.02.24 12:41:16 | 000,088,576 | ---- | M] (ZTE) -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\mcserver.exe
PRC - [2010.01.26 12:35:46 | 000,215,552 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\dbus-daemon.exe
PRC - [2010.01.26 12:35:42 | 000,031,232 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\db_daemon.exe
PRC - [2010.01.26 12:35:36 | 000,043,008 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\gconfd-2.exe
PRC - [2010.01.15 14:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009.10.06 00:08:42 | 000,210,216 | ---- | M] (CyberLink) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
PRC - [2009.04.17 10:09:46 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2006.04.18 05:00:00 | 000,102,400 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.05.04 15:36:28 | 000,970,752 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2010.02.28 09:28:44 | 000,089,600 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\itapi.dll
MOD - [2010.02.28 09:28:38 | 000,054,272 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\coder.dll
MOD - [2010.02.28 09:28:36 | 000,043,008 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\audio.dll
MOD - [2010.02.28 09:28:34 | 000,025,088 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\log.dll
MOD - [2010.02.24 12:41:04 | 000,034,304 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\libctlsvr.dll
MOD - [2010.01.26 12:35:46 | 000,215,552 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\dbus-daemon.exe
MOD - [2010.01.26 12:35:42 | 000,031,232 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\db_daemon.exe
MOD - [2010.01.26 12:35:36 | 000,043,008 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\gconfd-2.exe
MOD - [2010.01.26 12:35:34 | 000,055,808 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\libgconfbackend-xml.dll
MOD - [2010.01.26 12:35:20 | 000,157,696 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\libgconf-2.dll
MOD - [2010.01.26 12:35:06 | 000,594,432 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\dbus-1.dll
MOD - [2010.01.26 12:34:04 | 000,341,504 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\sqlite3.dll
MOD - [2009.10.06 00:08:38 | 000,931,112 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll
MOD - [2009.08.20 13:35:48 | 007,745,536 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
MOD - [2009.08.20 13:35:46 | 002,121,728 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
MOD - [2009.08.20 13:35:46 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
MOD - [2009.03.28 09:19:06 | 000,080,688 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\zlib1.dll
MOD - [2008.05.06 13:50:00 | 000,971,776 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\libxml2.dll
MOD - [2007.09.09 17:07:00 | 000,151,552 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\libexpat.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.09.21 22:49:10 | 000,240,640 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\stacsv64.exe -- (STacSV)
SRV:64bit: - [2009.07.08 14:49:02 | 000,030,520 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv)
SRV:64bit: - [2009.03.02 23:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\AESTSr64.exe -- (AESTFilters)
SRV - [2012.07.20 19:02:18 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.09.21 22:49:10 | 000,240,640 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\STacSV64.exe -- (STacSV)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.06.06 02:07:28 | 000,250,616 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2009.04.17 10:09:46 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.03.02 23:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\AESTSr64.exe -- (AESTFilters)
SRV - [2009.02.22 13:00:00 | 000,129,584 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\SysWOW64\ezsvc7.dll -- (ezSharedSvc)
SRV - [2006.04.18 05:00:00 | 000,102,400 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE -- (EPSON_PM_RPCV4_01)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.09.07 03:04:00 | 002,755,072 | ---- | M] (Novatek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvtcam.sys -- (DCamUSBNovatek)
DRV:64bit: - [2009.12.15 04:46:38 | 000,039,552 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tcpipBM.sys -- (tcpipBM)
DRV:64bit: - [2009.12.15 04:46:30 | 000,016,512 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\BMLoad.sys -- (BMLoad)
DRV:64bit: - [2009.11.24 03:49:44 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:64bit: - [2009.11.24 03:49:44 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:64bit: - [2009.11.24 03:49:44 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:64bit: - [2009.11.24 03:49:44 | 000,011,776 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter)
DRV:64bit: - [2009.10.31 06:16:04 | 000,084,584 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2009.10.24 03:53:38 | 000,291,328 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.09.21 22:49:10 | 000,500,736 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009.09.21 20:47:14 | 001,484,800 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.09.03 10:24:20 | 007,369,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.08 14:49:08 | 000,030,008 | ---- | M] (Hewlett-Packard) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpdskflt.sys -- (hpdskflt)
DRV:64bit: - [2009.07.08 14:48:50 | 000,041,272 | ---- | M] (Hewlett-Packard) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelerometer.sys -- (Accelerometer)
DRV:64bit: - [2009.06.10 23:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009.06.10 23:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009.06.10 23:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009.06.10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009.06.10 22:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.05.25 05:57:42 | 000,243,760 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)
DRV:64bit: - [2009.04.29 09:48:32 | 000,018,432 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV:64bit: - [2008.07.24 12:04:34 | 000,115,328 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2009.09.27 14:47:24 | 000,021,624 | -H-- | M] (DeviceVM, Inc.) [Kernel | System | Running] -- C:\SPLASH.SYS\config\dvmio.sys -- (DVMIO)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [1999.10.13 15:19:20 | 000,012,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\USBSCAN.SYS -- (usbscan)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {39EFC090-4DE4-4FE1-B32F-F2DBE6893280}
IE:64bit: - HKLM\..\SearchScopes\{39EFC090-4DE4-4FE1-B32F-F2DBE6893280}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
IE - HKLM\..\SearchScopes,DefaultScope = {39EFC090-4DE4-4FE1-B32F-F2DBE6893280}
IE - HKLM\..\SearchScopes\{39EFC090-4DE4-4FE1-B32F-F2DBE6893280}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
IE - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.t-online.de/"
FF - prefs.js..extensions.enabledItems: ff-bmboc@bytemobile.com:4.2.2
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.0.900
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.0.900
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.5.0.8013
FF - prefs.js..extensions.enabledItems: toolbar@web.de:1.7.5
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX OVS Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_34: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.4: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\addon [2010.02.02 15:19:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011.01.03 01:15:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011.01.03 01:15:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 19:02:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.21 17:56:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.12.19 14:04:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2011.12.19 14:04:41 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 19:02:18 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.21 17:56:26 | 000,000,000 | ---D | M]
 
[2010.09.06 10:11:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions
[2012.08.27 11:37:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\h2r0ta3x.default\extensions
[2012.08.21 12:56:50 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\h2r0ta3x.default\extensions\2020Player_IKEA@2020Technologies.com
[2012.08.10 18:03:43 | 000,000,853 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h2r0ta3x.default\searchplugins\11-suche.xml
[2012.08.10 18:03:43 | 000,002,209 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h2r0ta3x.default\searchplugins\englische-ergebnisse.xml
[2012.08.10 18:03:43 | 000,010,506 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h2r0ta3x.default\searchplugins\gmx-suche.xml
[2012.08.10 18:03:43 | 000,002,368 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h2r0ta3x.default\searchplugins\lastminute.xml
[2012.08.10 18:03:42 | 000,005,489 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h2r0ta3x.default\searchplugins\webde-suche.xml
[2012.08.20 07:22:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.10.17 21:06:29 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.08.20 07:22:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}
[2010.02.02 15:19:02 | 000,000,000 | ---D | M] (Bytemobile Optimization Client) -- C:\PROGRAM FILES (X86)\T-MOBILE\INTERNETMANAGER_Z\BIN\ADDON
[2012.08.10 18:03:28 | 000,526,409 | ---- | M] () (No name found) -- C:\USERS\ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\H2R0TA3X.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI
[2012.07.20 19:02:18 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.05.06 17:55:34 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.05.06 17:55:34 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.05.06 17:55:34 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.05.06 17:55:34 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.05.06 17:55:34 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.05.06 17:55:34 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider:  ()
CHR - default_search_provider: search_url = 
CHR - default_search_provider: suggest_url = 
CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.0.900_0\
CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.0.900_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe (EasyBits Software AS)
O4 - HKLM..\Run: [HPCam_Menu] c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-589288160-1231635108-1947154641-1003..\Run: [Adobe Reader Synchronizer] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-21-589288160-1231635108-1947154641-1003..\Run: [EPSON Stylus DX6000 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBIE.EXE /FU "C:\Users\Admin\AppData\Local\Temp\E_S4308.tmp" /EF "HKCU" File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0
O7 - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O7 - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe File not found
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe File not found
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab (Java Plug-in 1.6.0_34)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab (Java Plug-in 1.6.0_34)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab (Java Plug-in 1.6.0_34)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{953717A1-2C9D-44DC-A3FF-E0BDBBB3B29B}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll (EasyBits Software Corp.)
O28 - HKLM ShellExecuteHooks: UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 360 Days ==========
 
[2012.08.27 11:44:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2012.08.27 11:44:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.27 11:44:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.27 11:44:18 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.27 11:44:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.23 10:27:23 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\Euro-Gewinner und Verlierer,index-Dateien
[2012.08.20 07:22:02 | 000,157,680 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2012.08.20 07:22:02 | 000,149,488 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2012.08.20 07:22:02 | 000,149,488 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2012.08.15 21:11:18 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\german-wings_170812Itinerary-Dateien
[2012.08.15 08:09:15 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2012.08.15 08:09:15 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2012.08.15 08:09:15 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe
[2012.08.15 08:09:11 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[2012.08.15 08:09:10 | 000,911,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.08.15 08:09:10 | 000,609,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.08.15 08:09:09 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.08.15 08:09:08 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
[2012.08.15 08:09:08 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll
[2012.08.15 08:09:08 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll
[2012.08.15 08:08:50 | 000,735,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.08.15 08:08:50 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.08.15 08:08:50 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.08.15 08:08:50 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.08.15 08:08:50 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.08.15 08:08:49 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.08.15 08:08:49 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.08.15 08:08:40 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
[2012.08.09 20:50:12 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\Hockenheimring
[2012.08.09 12:20:25 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Video Downloader
[2012.08.09 12:19:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\vGrabber-software
[2012.08.09 12:19:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Incredibar.com
[2012.08.04 23:09:18 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\index.php-Dateien
[2012.07.18 21:02:10 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Logitech
[2012.07.17 12:43:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
[2012.07.11 10:08:15 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2012.07.11 10:08:15 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2012.07.11 10:08:04 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012.07.11 10:08:01 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2012.07.11 10:08:01 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2012.07.06 10:00:06 | 000,000,000 | --SD | C] -- C:\Users\Admin\Documents\Eigene Datenquellen
[2012.06.19 18:23:23 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2012.06.19 18:23:23 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2012.06.19 18:23:22 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2012.06.19 18:23:10 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2012.06.19 18:23:10 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2012.06.19 18:23:10 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2012.06.19 18:23:02 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2012.06.19 18:23:02 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2012.06.13 08:02:42 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll
[2012.06.13 08:02:42 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll
[2012.06.13 08:02:42 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe
[2012.06.13 08:02:32 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.06.13 08:02:29 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.06.13 08:02:28 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.06.13 08:02:24 | 003,216,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll
[2012.06.13 08:02:19 | 001,462,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.06.13 08:02:18 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.06.06 20:59:42 | 001,070,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCTL.OCX
[2012.05.21 17:56:26 | 000,477,168 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\npdeployJava1.dll
[2012.05.17 19:49:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012.05.17 19:47:47 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2012.05.17 19:47:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2012.05.10 17:25:50 | 001,544,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2012.05.06 17:55:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.05.06 17:55:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.04.13 19:46:01 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll
[2012.04.13 19:46:01 | 000,023,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\fs_rec.sys
[2012.04.13 19:45:59 | 000,220,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.04.09 11:23:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.03.29 10:50:24 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Rovio
[2012.03.29 10:50:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rovio
[2012.03.29 10:50:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rovio
[2012.03.29 10:31:52 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.03.29 10:31:47 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012.03.29 10:29:56 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\WinRAR
[2012.03.14 08:23:43 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll
[2012.03.14 08:23:43 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll
[2012.03.05 08:04:42 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Media Player Classic
[2012.02.16 20:09:21 | 000,509,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll
[2012.02.16 20:09:17 | 000,515,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\timedate.cpl
[2012.02.16 20:09:16 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl
[2012.02.16 20:09:02 | 000,634,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msvcrt.dll
[2012.02.15 19:38:33 | 000,000,000 | ---D | C] -- C:\Users\Admin\4.0
[2012.02.15 19:38:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\.tfo4
[2012.02.12 18:45:23 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\elsterformular
[2012.02.12 18:44:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular
[2012.02.12 18:44:50 | 000,000,000 | ---D | C] -- C:\ProgramData\elsterformular
[2012.02.12 18:44:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ElsterFormular
[2012.01.31 15:56:58 | 001,447,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2012.01.31 15:56:57 | 000,395,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll
[2012.01.31 15:56:57 | 000,314,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\webio.dll
[2012.01.31 15:56:57 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
[2012.01.31 15:56:56 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
[2012.01.31 15:56:56 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
[2012.01.11 18:44:55 | 001,572,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll
[2012.01.11 18:44:55 | 001,328,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll
[2012.01.11 18:44:55 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll
[2012.01.11 18:44:54 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll
[2012.01.11 18:44:37 | 001,731,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2012.01.11 18:44:24 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\packager.dll
[2012.01.11 18:44:24 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\packager.dll
[2011.12.21 18:10:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
[2011.12.21 18:08:39 | 000,008,704 | ---- | C] (SEIKO EPSON CORP.) -- C:\Windows\SysNative\E_GCINST.DLL
[2011.12.21 18:08:38 | 000,126,976 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\E_ILMBIE.DLL
[2011.12.21 18:08:37 | 000,086,528 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\E_IBCBBIE.DLL
[2011.12.21 18:07:46 | 000,000,000 | ---D | C] -- C:\ProgramData\EPSON
[2011.12.19 14:45:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OLYMPUS CAMEDIA
[2011.12.19 14:04:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime, olympus
[2011.12.15 08:29:15 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2011.12.15 08:28:32 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2011.12.15 08:28:31 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2011.12.10 01:00:13 | 000,000,000 | ---D | C] -- C:\Users\Admin\.jordan
[2011.12.09 20:13:08 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Arbeitsbeispiele
[2011.12.06 17:02:25 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\OneNote-Notizbücher
[2011.11.29 12:50:17 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011.11.23 14:20:57 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2011.10.31 22:07:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\DivX
[2011.10.28 23:04:33 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Apps
[2011.10.17 21:06:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.10.13 07:30:32 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisdecd.dll
[2011.10.13 07:30:32 | 000,108,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisrndr.ax
[2011.10.13 07:30:32 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisrndr.ax
[2011.10.13 07:30:31 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll
[2011.10.13 07:30:31 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSNP.ax
[2011.10.13 07:30:30 | 000,104,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Mpeg2Data.ax
[2011.10.13 07:30:29 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSNP.ax
[2011.10.13 07:30:29 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Mpeg2Data.ax
[2011.10.13 07:30:28 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSDvbNP.ax
[2011.10.13 07:30:28 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSDvbNP.ax
[2011.10.13 07:30:24 | 000,331,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleacc.dll
[2011.10.13 07:30:23 | 000,861,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
[2011.10.05 22:07:40 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
 
========== Files - Modified Within 360 Days ==========
 
[2012.08.27 16:32:26 | 000,023,024 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.27 16:32:26 | 000,023,024 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.27 16:31:38 | 000,000,000 | ---- | M] () -- C:\Users\Admin\defogger_reenable
[2012.08.27 16:29:21 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.27 16:29:21 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.27 16:29:21 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.27 16:29:21 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.27 16:29:21 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.27 16:25:16 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.27 16:25:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.27 16:24:57 | 3144,839,168 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.27 15:47:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.27 11:44:20 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.23 10:27:25 | 000,162,693 | ---- | M] () -- C:\Users\Admin\Desktop\Euro-Gewinner und Verlierer,index.htm
[2012.08.22 07:51:46 | 000,002,340 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.08.16 10:47:24 | 000,454,416 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.15 21:11:19 | 000,040,849 | ---- | M] () -- C:\Users\Admin\Desktop\german-wings_170812Itinerary.aspx
[2012.08.12 11:05:15 | 000,549,791 | ---- | M] () -- C:\Users\Admin\Desktop\fragebogen_stud_fks-medien.pdf
[2012.08.12 09:51:17 | 000,056,593 | ---- | M] () -- C:\Users\Admin\Desktop\PA-StudInfo6_BA-MA-Diplomverfahren-09-Masterdatei.pdf
[2012.08.12 09:50:26 | 000,037,333 | ---- | M] () -- C:\Users\Admin\Desktop\PA07_Zulassung_Bachelorarbeit.pdf
[2012.08.12 09:49:49 | 000,110,349 | ---- | M] () -- C:\Users\Admin\Desktop\Formulare_K_Bachelor.pdf
[2012.08.09 12:20:25 | 000,001,999 | ---- | M] () -- C:\Users\Admin\Desktop\Video Downloader.lnk
[2012.08.04 23:09:20 | 000,023,939 | ---- | M] () -- C:\Users\Admin\Desktop\index.php.htm
[2012.08.04 18:13:43 | 000,035,441 | ---- | M] () -- C:\Users\Admin\Documents\Caro_Ruecksendung_SIMKarte.rtf
[2012.08.03 16:17:57 | 000,000,766 | ---- | M] () -- C:\Users\Admin\Documents\Amtsgericht_Hildesheim_Beschluss.rtf
[2012.07.30 16:00:55 | 000,030,284 | ---- | M] () -- C:\Users\Admin\Desktop\99080404-1.jpg
[2012.07.26 12:14:54 | 003,652,322 | ---- | M] () -- C:\Users\Admin\Documents\hockenheimring.xps
[2012.07.26 12:09:56 | 003,575,754 | ---- | M] () -- C:\Users\Admin\Documents\hockenheim.xps
[2012.07.26 09:13:15 | 001,432,361 | ---- | M] () -- C:\Users\Admin\Desktop\2012-07-22 15.44.56.jpg
[2012.07.24 18:43:11 | 000,575,270 | ---- | M] () -- C:\Users\Admin\Desktop\IMG_0829.JPG
[2012.07.19 03:31:20 | 000,477,168 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\npdeployJava1.dll
[2012.07.19 03:31:15 | 000,473,072 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2012.07.19 03:26:11 | 000,157,680 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2012.07.19 03:26:05 | 000,149,488 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2012.07.19 03:25:54 | 000,149,488 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2012.07.09 17:31:01 | 000,045,581 | ---- | M] () -- C:\Users\Admin\Documents\Telefonat_Frau _Ela_   03.07.2012.rtf
[2012.07.06 21:42:50 | 000,041,788 | ---- | M] () -- C:\Users\Admin\Documents\Wasabi2.xps
[2012.07.06 21:17:49 | 011,883,918 | ---- | M] () -- C:\Users\Admin\Documents\_Wasabi.rtf
[2012.07.06 15:32:06 | 000,048,645 | ---- | M] () -- C:\Users\Admin\Documents\Wasabi_II.xps
[2012.07.06 15:32:06 | 000,048,645 | ---- | M] () -- C:\Users\Admin\Documents\Wasabi.xps
[2012.07.06 15:29:07 | 000,119,155 | ---- | M] () -- C:\Users\Admin\Documents\II.xpsSarah
[2012.07.06 15:26:17 | 000,119,155 | ---- | M] () -- C:\Users\Admin\Documents\SarahABI.xps
[2012.07.06 10:02:20 | 000,163,921 | ---- | M] () -- C:\Users\Admin\Documents\umsaetze_visa1.2.6.7..pdf
[2012.07.05 00:16:43 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
[2012.07.05 00:13:27 | 000,059,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll
[2012.07.04 23:14:34 | 000,041,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.27 09:06:35 | 000,134,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.06.27 09:03:32 | 000,097,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.06.27 09:03:29 | 000,735,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.06.27 09:02:41 | 000,247,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.06.27 07:53:05 | 000,132,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.06.27 07:51:30 | 000,067,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.06.27 07:50:44 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.06.20 08:46:15 | 000,034,792 | ---- | M] () -- C:\Users\Admin\Documents\reise_andere_formular.pdf
[2012.06.17 15:44:45 | 040,337,496 | ---- | M] () -- C:\Users\Admin\Documents\Danksagung_2_Dokument.rtf
[2012.06.16 07:16:04 | 000,609,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.06.16 07:15:56 | 000,911,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.06.16 06:26:37 | 000,717,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.06.06 20:59:42 | 001,070,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCTL.OCX
[2012.06.06 08:02:54 | 001,133,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2012.06.06 07:03:06 | 000,805,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2012.06.03 00:19:46 | 000,038,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2012.06.03 00:19:42 | 000,057,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2012.06.03 00:19:42 | 000,044,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2012.06.03 00:19:23 | 000,701,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2012.06.03 00:15:31 | 002,622,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2012.06.03 00:15:08 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2012.06.02 15:19:42 | 000,186,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2012.06.02 15:15:12 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2012.06.02 07:44:21 | 000,307,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012.05.19 23:48:44 | 000,189,951 | ---- | M] () -- C:\Users\Admin\Documents\Unbenannt.jpg
[2012.05.14 07:26:34 | 000,956,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
[2012.05.05 10:36:55 | 000,503,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[2012.05.04 13:06:22 | 005,559,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.05.04 12:03:53 | 003,968,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.05.04 12:03:50 | 003,913,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.04.26 07:41:56 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll
[2012.04.26 07:41:55 | 000,149,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll
[2012.04.26 07:34:27 | 000,009,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe
[2012.04.24 07:37:37 | 000,140,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.04.24 07:37:36 | 001,462,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.04.07 14:31:40 | 003,216,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll
[2012.03.03 08:35:38 | 001,544,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\fs_rec.sys
[2012.03.01 08:38:27 | 000,220,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.03.01 08:33:50 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll
[2012.02.17 08:38:26 | 001,031,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll
[2012.02.17 07:34:22 | 000,826,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll
[2012.02.16 17:24:38 | 000,001,229 | ---- | M] () -- C:\Users\Public\Desktop\ElsterFormular.lnk
[2012.02.11 08:43:47 | 000,751,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2012.02.11 08:36:01 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\splwow64.exe
[2012.02.11 07:43:49 | 000,492,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2012.01.22 17:54:42 | 000,024,417 | ---- | M] () -- C:\Users\Admin\Documents\398012_281653041888125_157708834282547_701407_2029339452_n.jpg
[2012.01.15 00:40:00 | 009,617,757 | ---- | M] () -- C:\Users\Admin\Documents\doku_medienpraxis.pdf
[2012.01.04 12:44:20 | 000,509,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll
[2011.12.30 08:26:08 | 000,515,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\timedate.cpl
[2011.12.30 07:27:56 | 000,478,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl
[2011.12.21 01:04:57 | 000,001,359 | ---- | M] () -- C:\Users\Admin\Documents\Dokument4, Caro.rtf
[2011.12.21 00:09:14 | 000,002,894 | ---- | M] () -- C:\Users\Admin\Documents\Dokument 3, Korrektur Caro.rtf
[2011.12.19 14:45:32 | 000,001,231 | ---- | M] () -- C:\Users\Public\Desktop\CAMEDIA Master.lnk
[2011.12.19 14:04:57 | 000,054,156 | -H-- | M] () -- C:\Windows\QTFont.qfn
[2011.12.19 14:04:57 | 000,001,409 | ---- | M] () -- C:\Windows\QTFont.for
[2011.12.16 10:46:06 | 000,634,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcrt.dll
[2011.12.06 17:02:25 | 000,001,352 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
[2011.11.29 12:50:17 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011.11.23 18:44:37 | 000,543,264 | ---- | M] () -- C:\Users\Admin\Documents\Bewerbung, Lebenslauf, Carolin_Zlotos.pdf
[2011.11.23 18:36:40 | 000,319,581 | ---- | M] () -- C:\Users\Admin\Documents\Bewerbungsschreiben, Carolin_Zlotos.pdf
[2011.11.23 14:36:27 | 000,152,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msclmd.dll
[2011.11.23 14:36:26 | 000,175,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msclmd.dll
[2011.11.19 16:58:00 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\packager.dll
[2011.11.19 16:01:00 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\packager.dll
[2011.11.19 11:56:02 | 000,001,091 | ---- | M] () -- C:\Users\Admin\Desktop\Dokumente - Verknüpfung.lnk
[2011.11.17 08:41:18 | 001,731,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2011.11.17 08:35:28 | 000,395,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll
[2011.11.17 08:35:26 | 000,136,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
[2011.11.17 08:35:26 | 000,029,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
[2011.11.17 08:35:25 | 000,028,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
[2011.11.17 08:35:19 | 001,447,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2011.11.17 07:35:02 | 000,314,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\webio.dll
[2011.10.26 07:25:16 | 001,572,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll
[2011.10.26 07:25:15 | 000,366,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll
[2011.10.26 07:21:20 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2011.10.26 06:32:11 | 001,328,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll
[2011.10.26 06:32:11 | 000,514,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll
[2011.10.17 21:06:18 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.10.15 08:31:56 | 000,723,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2011.10.15 07:38:59 | 000,534,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2011.09.09 21:27:20 | 000,000,136 | ---- | M] () -- C:\Users\Admin\Desktop\Hearts - Verknüpfung.lnk
 
========== Files Created - No Company Name ==========
 
[2012.08.27 16:31:38 | 000,000,000 | ---- | C] () -- C:\Users\Admin\defogger_reenable
[2012.08.27 11:44:20 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.23 10:27:22 | 000,162,693 | ---- | C] () -- C:\Users\Admin\Desktop\Euro-Gewinner und Verlierer,index.htm
[2012.08.15 21:11:18 | 000,040,849 | ---- | C] () -- C:\Users\Admin\Desktop\german-wings_170812Itinerary.aspx
[2012.08.12 11:05:15 | 000,549,791 | ---- | C] () -- C:\Users\Admin\Desktop\fragebogen_stud_fks-medien.pdf
[2012.08.12 09:51:17 | 000,056,593 | ---- | C] () -- C:\Users\Admin\Desktop\PA-StudInfo6_BA-MA-Diplomverfahren-09-Masterdatei.pdf
[2012.08.12 09:50:26 | 000,037,333 | ---- | C] () -- C:\Users\Admin\Desktop\PA07_Zulassung_Bachelorarbeit.pdf
[2012.08.12 09:49:49 | 000,110,349 | ---- | C] () -- C:\Users\Admin\Desktop\Formulare_K_Bachelor.pdf
[2012.08.09 12:20:25 | 000,001,999 | ---- | C] () -- C:\Users\Admin\Desktop\Video Downloader.lnk
[2012.08.04 23:09:18 | 000,023,939 | ---- | C] () -- C:\Users\Admin\Desktop\index.php.htm
[2012.08.04 18:13:43 | 000,035,441 | ---- | C] () -- C:\Users\Admin\Documents\Caro_Ruecksendung_SIMKarte.rtf
[2012.08.03 16:04:30 | 000,000,766 | ---- | C] () -- C:\Users\Admin\Documents\Amtsgericht_Hildesheim_Beschluss.rtf
[2012.07.30 16:00:54 | 000,030,284 | ---- | C] () -- C:\Users\Admin\Desktop\99080404-1.jpg
[2012.07.26 12:14:41 | 003,652,322 | ---- | C] () -- C:\Users\Admin\Documents\hockenheimring.xps
[2012.07.26 12:09:41 | 003,575,754 | ---- | C] () -- C:\Users\Admin\Documents\hockenheim.xps
[2012.07.26 12:02:37 | 001,432,361 | ---- | C] () -- C:\Users\Admin\Desktop\2012-07-22 15.44.56.jpg
[2012.07.24 18:41:47 | 000,575,270 | ---- | C] () -- C:\Users\Admin\Desktop\IMG_0829.JPG
[2012.07.06 21:42:50 | 000,041,788 | ---- | C] () -- C:\Users\Admin\Documents\Wasabi2.xps
[2012.07.06 21:24:31 | 000,048,645 | ---- | C] () -- C:\Users\Admin\Documents\Wasabi_II.xps
[2012.07.06 15:32:05 | 000,048,645 | ---- | C] () -- C:\Users\Admin\Documents\Wasabi.xps
[2012.07.06 15:29:07 | 000,119,155 | ---- | C] () -- C:\Users\Admin\Documents\II.xpsSarah
[2012.07.06 15:26:16 | 000,119,155 | ---- | C] () -- C:\Users\Admin\Documents\SarahABI.xps
[2012.07.06 15:04:13 | 011,883,918 | ---- | C] () -- C:\Users\Admin\Documents\_Wasabi.rtf
[2012.07.06 10:56:16 | 000,045,581 | ---- | C] () -- C:\Users\Admin\Documents\Telefonat_Frau _Ela_   03.07.2012.rtf
[2012.07.06 09:57:15 | 000,163,921 | ---- | C] () -- C:\Users\Admin\Documents\umsaetze_visa1.2.6.7..pdf
[2012.06.20 08:46:15 | 000,034,792 | ---- | C] () -- C:\Users\Admin\Documents\reise_andere_formular.pdf
[2012.06.17 15:39:54 | 040,337,496 | ---- | C] () -- C:\Users\Admin\Documents\Danksagung_2_Dokument.rtf
[2012.05.19 23:48:26 | 000,189,951 | ---- | C] () -- C:\Users\Admin\Documents\Unbenannt.jpg
[2012.05.06 17:55:42 | 000,001,142 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.02.12 18:44:51 | 000,001,229 | ---- | C] () -- C:\Users\Public\Desktop\ElsterFormular.lnk
[2012.01.22 17:54:41 | 000,024,417 | ---- | C] () -- C:\Users\Admin\Documents\398012_281653041888125_157708834282547_701407_2029339452_n.jpg
[2012.01.15 00:54:09 | 009,617,757 | ---- | C] () -- C:\Users\Admin\Documents\doku_medienpraxis.pdf
[2012.01.06 15:45:24 | 002,783,175 | ---- | C] () -- C:\Users\Admin\Desktop\Meerschweinchen I 002.JPG
[2011.12.21 00:15:38 | 000,001,359 | ---- | C] () -- C:\Users\Admin\Documents\Dokument4, Caro.rtf
[2011.12.20 22:14:59 | 000,002,894 | ---- | C] () -- C:\Users\Admin\Documents\Dokument 3, Korrektur Caro.rtf
[2011.12.19 14:02:45 | 000,054,156 | -H-- | C] () -- C:\Windows\QTFont.qfn
[2011.12.19 14:02:45 | 000,001,409 | ---- | C] () -- C:\Windows\QTFont.for
[2011.12.12 10:23:34 | 001,851,875 | ---- | C] () -- C:\Users\Admin\Desktop\Juli1984-Ostern1985,0095.jpg
[2011.12.09 20:11:26 | 000,001,046 | ---- | C] () -- C:\Users\Admin\Documents\SF Launcher.lnk
[2011.12.09 20:05:40 | 000,001,046 | ---- | C] () -- C:\Users\Admin\Documents\SF Launcher_Diabearbeitungsprogramm.lnk
[2011.12.09 20:05:07 | 011,352,862 | ---- | C] () -- C:\Users\Admin\Documents\SFde-6.6.2r3(AFL).exe
[2011.12.06 17:02:25 | 000,001,352 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
[2011.11.23 18:43:32 | 000,543,264 | ---- | C] () -- C:\Users\Admin\Documents\Bewerbung, Lebenslauf, Carolin_Zlotos.pdf
[2011.11.23 18:36:40 | 000,319,581 | ---- | C] () -- C:\Users\Admin\Documents\Bewerbungsschreiben, Carolin_Zlotos.pdf
[2011.11.19 11:56:02 | 000,001,091 | ---- | C] () -- C:\Users\Admin\Desktop\Dokumente - Verknüpfung.lnk
[2011.09.09 21:27:20 | 000,000,136 | ---- | C] () -- C:\Users\Admin\Desktop\Hearts - Verknüpfung.lnk
[2011.03.31 09:53:14 | 000,178,176 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2011.03.31 09:53:14 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2011.03.31 09:53:10 | 000,881,664 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2011.03.31 09:53:10 | 000,205,824 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2011.03.31 09:53:08 | 000,085,504 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2010.11.24 19:49:07 | 001,164,210 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD0039.1
[2010.11.24 19:49:04 | 001,199,142 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD0039.JPG
[2010.11.24 19:49:03 | 002,211,482 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD0039.0
[2010.11.23 15:48:28 | 000,841,157 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD_UND_CLAUDIA0019.JPG
[2010.11.23 15:48:26 | 000,860,359 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD_UND_CLAUDIA0019.0
[2010.11.23 15:47:20 | 000,436,015 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD_UND_CLAUDIA0032.3
[2010.11.23 15:47:15 | 000,429,976 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD_UND_CLAUDIA0032.2
[2010.11.23 15:47:12 | 000,433,797 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD_UND_CLAUDIA0032.1
[2010.11.23 15:47:08 | 001,038,272 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD_UND_CLAUDIA0032.JPG
[2010.11.23 15:47:08 | 001,038,272 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD_UND_CLAUDIA0032.0
[2010.10.21 16:39:57 | 000,954,561 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHERV0093.JPG
[2010.10.21 16:39:54 | 001,126,731 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHERV0093.0
[2010.10.19 16:58:34 | 001,350,693 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCLAUDIA_UND_BERNHARD0022.JPG
[2010.10.16 23:30:21 | 002,191,509 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_II0028.JPG
[2010.10.16 22:19:52 | 001,535,510 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_II0013.JPG
[2010.10.16 10:45:56 | 001,124,921 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0084.JPG
[2010.10.16 10:45:54 | 001,433,261 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0084.0
[2010.10.16 10:40:12 | 001,377,885 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0050.JPG
[2010.10.16 10:40:10 | 001,740,620 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0050.0
[2010.10.15 11:35:25 | 001,306,410 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0019.JPG
[2010.10.15 11:35:23 | 001,417,403 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0019.0
[2010.10.15 11:32:41 | 001,699,093 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0069.JPG
[2010.10.15 11:32:39 | 002,169,717 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0069.0
[2010.10.15 11:32:03 | 001,627,020 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0059.JPG
[2010.10.15 11:32:01 | 001,602,851 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0059.0
[2010.10.15 11:26:55 | 001,559,904 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0077.JPG
[2010.10.15 11:26:53 | 001,210,538 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0077.0
[2010.10.13 17:07:22 | 001,196,642 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0007.JPG
[2010.10.12 08:39:19 | 002,050,757 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp1986_KORSIKA0135.JPG
[2010.10.12 08:36:54 | 001,730,500 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp1986_KORSIKA0137.JPG
[2010.10.11 21:23:32 | 001,900,148 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp1986_KORSIKA0111.JPG
[2010.10.11 11:54:24 | 001,014,872 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp28.09.'87_0008.JPG
[2010.10.11 11:54:23 | 001,210,324 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp28.09.'87_0008.0
[2010.10.11 11:53:07 | 001,262,893 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp1986_KORSIKA0033.JPG
[2010.10.11 11:53:05 | 001,527,371 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp1986_KORSIKA0033.0
[2010.10.11 11:51:05 | 001,498,053 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp1986_KORSIKA0040.JPG
[2010.10.11 11:43:37 | 001,639,225 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp1986_KORSIKA0007.JPG
[2010.10.10 19:27:36 | 001,378,170 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0108.JPG
[2010.10.10 19:27:34 | 001,541,825 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0108.0
[2010.10.10 19:25:01 | 001,380,154 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0109.JPG
[2010.10.10 19:24:59 | 001,430,216 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0109.0
[2010.10.10 18:58:30 | 001,748,900 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0096.JPG
[2010.10.10 18:52:38 | 000,010,496 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0091_navi.JPG
[2010.10.10 18:52:37 | 001,747,796 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0091.JPG
[2010.10.10 18:50:49 | 001,199,361 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0096.0
[2010.10.10 14:47:29 | 001,695,624 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpWEIHNACHTEN87_0020.JPG
[2010.10.10 10:33:39 | 001,960,139 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpWEIHNACHTEN87_0019.JPG
[2010.10.10 09:53:13 | 002,034,118 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpDEZEMBER_'870015.JPG
[2010.10.10 09:52:22 | 001,927,602 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpDEZEMBER_'870016.JPG
[2010.10.10 09:51:18 | 001,248,285 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpDEZEMBER_'870014.JPG
[2010.10.10 09:51:16 | 001,447,221 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpDEZEMBER_'870014.0
[2010.10.07 20:47:29 | 000,155,648 | ---- | C] () -- C:\Windows\SysWow64\daspi32u.dll
[2010.10.07 20:19:28 | 000,020,531 | -H-- | C] () -- C:\ProgramData\M33KI
[2010.09.15 18:27:21 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.09.06 10:04:05 | 000,193,664 | ---- | C] () -- C:\Windows\SysWow64\bmsdk.exe
[2010.09.06 10:04:05 | 000,002,960 | ---- | C] () -- C:\Windows\SysWow64\boc.ini
[2010.09.06 10:04:05 | 000,000,519 | ---- | C] () -- C:\Windows\SysWow64\bocinstall.ini

< End of report >
--- --- ---
Geändert von c_zett (27.08.2012 um 16:00 Uhr) Grund: Textergänzungen

Alt 27.08.2012, 18:59   #2
t'john
/// Helfer-Team
 
Incredi Toolbar Trojaner, zweiter Laptop - Standard

Incredi Toolbar Trojaner, zweiter Laptop




1. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.
__________________

__________________
Alt 28.08.2012, 09:53   #3
c_zett
 
Incredi Toolbar Trojaner, zweiter Laptop - Standard

Incredi Toolbar Trojaner, zweiter Laptop


Hallo,
im Anhang die Logfiles von den zweiten Suchdurchläufen, nun wurde nichts mehr gefunden.
Lg
__________________
Alt 28.08.2012, 19:32   #4
t'john
/// Helfer-Team
 
Incredi Toolbar Trojaner, zweiter Laptop - Standard

Incredi Toolbar Trojaner, zweiter Laptop


Wo ist AdwCleaner[S1].txt ?
__________________
Mfg, t'john
Das TB unterstützen

Alt 28.08.2012, 20:35   #5
c_zett
 
Incredi Toolbar Trojaner, zweiter Laptop - Standard

Incredi Toolbar Trojaner, zweiter Laptop


Das ist im ersten Beitrag im angehängten Zip-Archiv mit drin.


Alt 29.08.2012, 02:54   #6
t'john
/// Helfer-Team
 
Incredi Toolbar Trojaner, zweiter Laptop - Standard

Incredi Toolbar Trojaner, zweiter Laptop




Sehr gut!


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________
--> Incredi Toolbar Trojaner, zweiter Laptop

Alt 30.08.2012, 12:14   #7
c_zett
 
Incredi Toolbar Trojaner, zweiter Laptop - Standard

Incredi Toolbar Trojaner, zweiter Laptop


Hier der Bericht, Funde sind in Quarantäne.

Alt 30.08.2012, 19:59   #8
t'john
/// Helfer-Team
 
Incredi Toolbar Trojaner, zweiter Laptop - Standard

Incredi Toolbar Trojaner, zweiter Laptop


Sehr gut!


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
  • Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.
Los geht's

  • Lade und starte Eset Smartinstaller
  • Haken setzen bei YES, I accept the Terms of Use.
  • Klick auf Start.
  • Haken setzen bei Remove found threads und Scan archives.
  • Klick auf Start.
  • Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Finish drücken.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset
__________________
Mfg, t'john
Das TB unterstützen

Alt 17.10.2012, 14:56   #9
t'john
/// Helfer-Team
 
Incredi Toolbar Trojaner, zweiter Laptop - Standard

Incredi Toolbar Trojaner, zweiter Laptop


Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.
__________________
Mfg, t'john
Das TB unterstützen

Antwort

Themen zu Incredi Toolbar Trojaner, zweiter Laptop
adobe, adwcleaner, autorun, bho, download, explorer, fehlermeldung, firefox, format, helper, home, incredi, microsoft, mozilla, neu, nvidia, olympus, plug-in, programme, realtek, registry, scan, security, senden, software, t-mobile, temp, trojaner, windows


« Polizei-Trojaner Österreich | Incredi Toolbar Trojaner »


Ähnliche Themen: Incredi Toolbar Trojaner, zweiter Laptop


  1. Incredi Mail und Flashplayer Probleme
    Alles rund um Windows - 26.07.2015 (17)
  2. Globaltrust wird Österreichs zweiter Zertifikate-Anbieter
    Nachrichten - 01.07.2015 (0)
  3. Wenn ich einen neuen Tab öffne, kommt ein zweiter
    Plagegeister aller Art und deren Bekämpfung - 15.04.2014 (9)
  4. Zweiter US-Einzelhändler prüft Hacker-Angriff
    Nachrichten - 11.01.2014 (0)
  5. Windows 7 - Interpol Trojaner (auf Admin Account, zweiter User benutzbar)
    Log-Analyse und Auswertung - 25.11.2013 (15)
  6. PayPal: Zweiter Faktor optional
    Nachrichten - 01.10.2013 (0)
  7. Des Dramas zweiter Teil: Warnung der Telekom vor Zeus/Zbot
    Plagegeister aller Art und deren Bekämpfung - 12.06.2013 (8)
  8. MyStart Incredi Toolbar eingefangen :(
    Log-Analyse und Auswertung - 31.01.2013 (10)
  9. Incredi Toolbar Trojaner
    Plagegeister aller Art und deren Bekämpfung - 17.10.2012 (8)
  10. Win XP - GVU Trojaner - Zweiter PC befallen
    Log-Analyse und Auswertung - 06.10.2012 (11)
  11. My Start incredi Entfernen
    Plagegeister aller Art und deren Bekämpfung - 05.10.2012 (12)
  12. Zweiter Trojaner nach nur 2 Tagen
    Plagegeister aller Art und deren Bekämpfung - 14.02.2011 (3)
  13. Zweiter Rechner ^^
    Log-Analyse und Auswertung - 22.07.2006 (1)
  14. zweiter Monitor (Fernseher)
    Alles rund um Windows - 28.03.2006 (2)
  15. zweiter Benutzer zum Surfen angelegt
    Antiviren-, Firewall- und andere Schutzprogramme - 09.02.2006 (1)
  16. ich bin am Ende: Netgear Router: zweiter PC bremst die Internetverbindung aus
    Plagegeister aller Art und deren Bekämpfung - 09.03.2005 (6)
  17. Lovesan/Blaster, zweiter Versuch...
    Plagegeister aller Art und deren Bekämpfung - 27.11.2003 (4)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Incredi Toolbar Trojaner, zweiter Laptop - Hallo, leider befindet sich auch auf einem zweiten Laptop die Incredi Toolbar. Wahrscheinlich mit einem Download des Adobe Readers aus unbekannter Quelle auf den Rechner gezogen (ist nicht mein Rechner - Incredi Toolbar Trojaner, zweiter Laptop...
Archiv
Du betrachtest: Incredi Toolbar Trojaner, zweiter Laptop auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131