Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Cyber Crime Intvestigation Trojaner

Cyber Crime Intvestigation Trojaner


Log-Analyse und Auswertung: Cyber Crime Intvestigation Trojaner

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 01.09.2012, 13:19   #1
Mittag
 
Cyber Crime Intvestigation Trojaner - Standard

Cyber Crime Intvestigation Trojaner


Hallo,

mich hat der Cyber Crime Investigation Trojaner auch erwischt. Ich hab die empfohlenen Scans mit Malware und OTL durchgführt:

Malware:
Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.09.01.02

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7601.17514
*** :: LENI [Administrator]

Schutz: Deaktiviert

01.09.2012 13:11:22
mbam-log-2012-09-01 (13-11-22).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 409552
Laufzeit: 36 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 7
C:\Windows\KMService.exe (RiskWare.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\***\AppData\Local\Temp\roper0dun.exe (Exploit.Drop.GS) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\DxVersion.dll (Spyware.OnlineGames) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Stiderc.dll (Spyware.OnlineGames) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\TUSqlDB32.dll (Spyware.OnlineGames) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\UnRar.dll (Spyware.OnlineGames) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
OTL:
Code:
ATTFilter
OTL logfile created on: 01.09.2012 14:13:39 - Run 3
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Geladen
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
1,86 Gb Total Physical Memory | 0,70 Gb Available Physical Memory | 37,34% Memory free
3,73 Gb Paging File | 2,72 Gb Available in Paging File | 72,93% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 252,81 Gb Total Space | 187,52 Gb Free Space | 74,18% Space Free | Partition Type: NTFS
Drive D: | 30,33 Gb Total Space | 29,42 Gb Free Space | 97,02% Space Free | Partition Type: NTFS
 
Computer Name: LENI | User Name: *** | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - File not found -- 
PRC - [2012.08.31 21:23:42 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012.07.03 13:46:42 | 000,973,488 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.08.31 21:23:42 | 002,242,528 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012.01.24 10:40:47 | 008,527,008 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
MOD - [2011.03.15 08:13:46 | 004,254,560 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2010.12.14 15:39:14 | 000,036,160 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\Windows\SysNative\uxtuneup.dll -- (UxTuneUp)
SRV - [2012.08.31 21:23:42 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.01.04 14:32:36 | 000,718,888 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010.12.14 15:42:40 | 002,019,648 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\Program Files (x86)\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc)
SRV - [2010.12.14 15:39:10 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\Windows\SysWOW64\uxtuneup.dll -- (UxTuneUp)
SRV - [2010.04.07 07:23:00 | 001,800,808 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2010.01.15 14:41:30 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2003.04.18 20:06:26 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\srvany.exe -- (KMService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011.11.01 11:07:26 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)
DRV:64bit: - [2011.11.01 11:07:26 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev)
DRV:64bit: - [2011.11.01 11:07:24 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys -- (nmwcdnsux64)
DRV:64bit: - [2011.11.01 11:07:24 | 000,027,136 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc)
DRV:64bit: - [2011.11.01 11:07:24 | 000,019,968 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd)
DRV:64bit: - [2011.11.01 11:07:24 | 000,012,800 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdnsucx64.sys -- (nmwcdnsucx64)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.12.25 20:01:06 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 12:43:57 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
DRV:64bit: - [2010.08.25 20:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.03.10 12:23:48 | 000,300,592 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)
DRV:64bit: - [2010.02.26 10:32:14 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2010.02.24 05:31:42 | 000,215,040 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vm331avs.sys -- (vm331avs)
DRV:64bit: - [2010.02.22 12:03:44 | 000,075,304 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2010.02.03 00:38:30 | 000,271,872 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2010.01.15 20:08:34 | 000,039,008 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LhdX64.sys -- (LHDmgr)
DRV:64bit: - [2010.01.15 14:22:08 | 000,538,136 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.12.14 14:46:56 | 001,573,888 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.10.19 02:40:50 | 000,028,176 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AcpiVpc.sys -- (ACPIVPC)
DRV:64bit: - [2009.09.10 15:31:56 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2009.07.24 15:52:14 | 000,114,560 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbdev.sys -- (hwusbdev)
DRV:64bit: - [2009.07.16 14:14:14 | 000,220,672 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64)
DRV:64bit: - [2009.06.10 22:34:36 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.08.28 12:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV - [2010.11.29 20:27:40 | 000,011,856 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=112558&tt=280612_5_&babsrc=HP_ss&mntrId=72abb1190000000000007ee400cfab52
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=112558&tt=280612_5_&babsrc=SP_ss&mntrId=72abb1190000000000007ee400cfab52
IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search/web?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://search.babylon.com/?affID=112558&tt=280612_5_&babsrc=HP_ss&mntrId=72abb1190000000000007ee400cfab52"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: {64161300-e22b-11db-8314-0800200c9a66}:0.9.6.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?affID=112558&tt=280612_5_&babsrc=KW_ss&mntrId=72abb1190000000000007ee400cfab52&q="
FF - prefs.js..network.proxy.http: "10.253.0.253"
FF - prefs.js..network.proxy.http_port: 318
FF - prefs.js..network.proxy.type: 4
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fe_8.0@nokia.com: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_8.0 [2012.01.30 11:44:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.31 21:23:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.25 19:37:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\te_9.0@nokia.com: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0 [2012.01.30 11:44:13 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.31 21:23:43 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.25 19:37:58 | 000,000,000 | ---D | M]
 
[2010.12.25 14:32:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2012.08.19 21:56:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\k6py0rwx.default\extensions
[2010.12.25 20:01:29 | 000,002,059 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\k6py0rwx.default\searchplugins\daemon-search.xml
[2012.03.18 17:37:03 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.12.25 15:13:52 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2012.08.19 21:56:39 | 000,276,167 | ---- | M] () (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K6PY0RWX.DEFAULT\EXTENSIONS\{64161300-E22B-11DB-8314-0800200C9A66}.XPI
[2012.08.31 21:23:42 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.01.10 20:17:58 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.12.09 19:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012.06.26 19:39:07 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.28 22:25:49 | 000,002,352 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2012.08.31 21:23:41 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.26 19:39:07 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.26 19:39:07 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.26 19:39:07 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.26 19:39:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.04.10 22:02:49 | 000,001,929 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost 
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com 
O1 - Hosts: 127.0.0.1 adobeereg.com 
O1 - Hosts: 127.0.0.1 activate.adobe.com 
O1 - Hosts: 127.0.0.1 practivate.adobe.com 
O1 - Hosts: 127.0.0.1 ereg.adobe.com 
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com 
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com 
O1 - Hosts: 127.0.0.1 wip3.adobe.com 
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com 
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com 
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com 
O1 - Hosts: 127.0.0.1 3dns.adobe.com 
O1 - Hosts: 127.0.0.1 3dns-1.adobe.com 
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com 
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com 
O1 - Hosts: 127.0.0.1 3dns-4.adobe.com 
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com 
O1 - Hosts: 127.0.0.1 adobe-dns-1.adobe.com 
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com 
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com 
O1 - Hosts: 127.0.0.1 adobe-dns-4.adobe.com 
O1 - Hosts: 127.0.0.1 adobe-dns-5.adobe.com 
O1 - Hosts: 127.0.0.1 activate.adobe.de 
O1 - Hosts: 15 more lines...
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [OnekeyStudio] C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe (Lenovo)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [331BigDog] C:\Program Files (x86)\USB Camera\VM331_STI.EXE (Vimicro)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [MuteSync] C:\PROGRA~2\Lenovo\LENOVO~1\MuteSync.exe (Lenovo)
O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [UCam_Menu] c:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKLM..\Run: [YouCam Mirror Tray icon] c:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe (CyberLink Corp.)
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [NokiaSuite.exe] C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe (Nokia)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 10.5.1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{76F4F7C5-D765-4890-9092-72C1E89A4375}: DhcpNameServer = 10.0.0.138
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{010685fc-688f-11e1-8cdf-c80aa9cceb48}\Shell - "" = AutoRun
O33 - MountPoints2\{010685fc-688f-11e1-8cdf-c80aa9cceb48}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{1b4ad9ea-7165-11e0-bdc2-c80aa9cceb48}\Shell - "" = AutoRun
O33 - MountPoints2\{1b4ad9ea-7165-11e0-bdc2-c80aa9cceb48}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{2f0c00f6-4305-11e0-8d45-c80aa9cceb48}\Shell - "" = AutoRun
O33 - MountPoints2\{2f0c00f6-4305-11e0-8d45-c80aa9cceb48}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5c3617c8-4655-11e0-8e62-c80aa9cceb48}\Shell - "" = AutoRun
O33 - MountPoints2\{5c3617c8-4655-11e0-8e62-c80aa9cceb48}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{dcf61add-40e4-11e0-96b9-c80aa9cceb48}\Shell - "" = AutoRun
O33 - MountPoints2\{dcf61add-40e4-11e0-96b9-c80aa9cceb48}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.01 13:10:16 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2012.09.01 13:10:00 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[2012.09.01 13:10:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.09.01 13:10:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.09.01 13:10:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.31 21:40:07 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.08.30 12:10:31 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Zu drucken
[2010.12.14 15:44:54 | 000,922,944 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\WinStyler.exe
[2010.12.14 15:44:54 | 000,528,192 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\PerformanceOptimizer.exe
[2010.12.14 15:44:54 | 000,488,768 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\StartupOptimizer.exe
[2010.12.14 15:44:54 | 000,211,264 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\LiveOptimizer.exe
[2010.12.14 15:44:54 | 000,163,648 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUAutoUpdateCheck.exe
[2010.12.14 15:44:54 | 000,127,808 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\Report.exe
[2010.12.14 15:44:54 | 000,113,984 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TurboConfig.exe
[2010.12.14 15:44:54 | 000,059,712 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TURatingSynch.exe
[2010.12.14 15:44:52 | 001,132,864 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\SilentUpdater.exe
[2010.12.14 15:44:46 | 000,256,320 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\UpdateWizard.exe
[2010.12.14 15:44:46 | 000,253,760 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\UninstallManager.exe
[2010.12.14 15:44:46 | 000,191,296 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\Undelete.exe
[2010.12.14 15:44:46 | 000,085,824 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUMessages.exe
[2010.12.14 15:44:44 | 000,439,616 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\cmNetwork.bpl
[2010.12.14 15:44:44 | 000,394,048 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\cmSystem.bpl
[2010.12.14 15:44:44 | 000,271,680 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\SystemInformation.exe
[2010.12.14 15:44:44 | 000,214,848 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUInstallHelper.exe
[2010.12.14 15:44:44 | 000,104,256 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\SystemControl.exe
[2010.12.14 15:44:44 | 000,059,712 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\cmWizards.bpl
[2010.12.14 15:44:42 | 000,584,512 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\OneClick.exe
[2010.12.14 15:44:42 | 000,337,216 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\cmDisplay.bpl
[2010.12.14 15:44:42 | 000,317,248 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\StartUpManager.exe
[2010.12.14 15:44:42 | 000,135,488 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\Shredder.exe
[2010.12.14 15:44:42 | 000,044,352 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\cmCommon.bpl
[2010.12.14 15:44:40 | 000,325,952 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\ProgramDeactivator.exe
[2010.12.14 15:44:40 | 000,298,816 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\RegistryEditor.exe
[2010.12.14 15:44:40 | 000,289,088 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\RegistryCleaner.exe
[2010.12.14 15:44:40 | 000,227,136 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\ShortcutCleaner.exe
[2010.12.14 15:44:40 | 000,173,376 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\RegistryDefrag.exe
[2010.12.14 15:44:40 | 000,168,256 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\RescueCenter.exe
[2010.12.14 15:44:40 | 000,137,024 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\RegWiz.exe
[2010.12.14 15:44:40 | 000,131,904 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\RepairWizard.exe
[2010.12.14 15:44:40 | 000,015,680 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\RegistryDefragHelper.exe
[2010.12.14 15:44:38 | 001,049,920 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\Integrator.exe
[2010.12.14 15:44:38 | 000,347,968 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\ProcessManager.exe
[2010.12.14 15:44:38 | 000,140,096 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\OneClickStarter.exe
[2010.12.14 15:44:38 | 000,033,088 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\PMLauncher.exe
[2010.12.14 15:44:36 | 000,241,984 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TuneUpSystemStatusCheck.exe
[2010.12.14 15:44:36 | 000,238,912 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\DriveDefrag.exe
[2010.12.14 15:44:34 | 000,630,592 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TuningWizard.bpl
[2010.12.14 15:44:34 | 000,416,576 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\DiskExplorer.exe
[2010.12.14 15:44:34 | 000,307,008 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\RegCleaner.bpl
[2010.12.14 15:44:34 | 000,120,640 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\DiskDoctor.exe
[2010.12.14 15:44:34 | 000,064,320 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUIEInstVer.bpl
[2010.12.14 15:44:32 | 000,642,368 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUTMSComponents.bpl
[2010.12.14 15:44:32 | 000,600,384 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\VirtualTreesR.bpl
[2010.12.14 15:44:32 | 000,577,856 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\EmbeddedWebBrowser_D2006.bpl
[2010.12.14 15:44:32 | 000,352,064 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\AppInitialization.bpl
[2010.12.14 15:44:32 | 000,201,536 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUDiskCleanerClass.bpl
[2010.12.14 15:44:32 | 000,182,592 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\CommonForms.bpl
[2010.12.14 15:44:32 | 000,042,816 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TuApplications.bpl
[2010.12.14 15:44:30 | 000,423,232 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\SysInfo.bpl
[2010.12.14 15:44:30 | 000,098,112 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUApps.bpl
[2010.12.14 15:44:28 | 000,871,232 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\dxRibbonD12.bpl
[2010.12.14 15:44:28 | 000,438,080 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\VisControls.bpl
[2010.12.14 15:44:28 | 000,369,472 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\Traces.bpl
[2010.12.14 15:44:28 | 000,229,696 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\ProgramRating.bpl
[2010.12.14 15:44:28 | 000,142,656 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUIcoEngineerDirTree.bpl
[2010.12.14 15:44:28 | 000,109,888 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\Internet.bpl
[2010.12.14 15:44:28 | 000,101,696 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUShredder.bpl
[2010.12.14 15:44:28 | 000,080,704 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\HexEdit.bpl
[2010.12.14 15:44:28 | 000,054,592 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\Indicators.bpl
[2010.12.14 15:44:28 | 000,038,720 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\Charts.bpl
[2010.12.14 15:44:26 | 001,119,552 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\dxBarD12.bpl
[2010.12.14 15:44:26 | 000,315,200 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\dxDockingD12.bpl
[2010.12.14 15:44:26 | 000,212,800 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\dxBarExtItemsD12.bpl
[2010.12.14 15:44:24 | 000,841,024 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\cxLibraryD12.bpl
[2010.12.14 15:44:24 | 000,726,848 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\dxSkinsCoreD12.bpl
[2010.12.14 15:44:24 | 000,058,688 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\dxGDIPlusD12.bpl
[2010.12.14 15:44:24 | 000,055,104 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\dxThemeD12.bpl
[2010.12.14 15:44:24 | 000,030,528 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\dxCoreD12.bpl
[2010.12.14 15:44:22 | 000,715,072 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\MSI_D6.bpl
[2010.12.14 15:44:22 | 000,706,368 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\MainControls.bpl
[2010.12.14 15:44:22 | 000,073,024 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUOperaClass.bpl
[2010.12.14 15:44:22 | 000,071,488 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\ehs_d6.bpl
[2010.12.14 15:44:22 | 000,066,368 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\SysControls.bpl
[2010.12.14 15:44:22 | 000,045,376 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\dxComnD12.bpl
[2010.12.14 15:44:22 | 000,030,016 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUSafariClass.bpl
[2010.12.14 15:44:20 | 000,505,664 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\Ics.bpl
[2010.12.14 15:44:20 | 000,488,256 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\Html.bpl
[2010.12.14 15:44:20 | 000,121,152 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\SchedAgent_2007.bpl
[2010.12.14 15:44:20 | 000,100,672 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\SmallUnits.bpl
[2010.12.14 15:44:20 | 000,074,560 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUShell.bpl
[2010.12.14 15:44:20 | 000,039,232 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUBase.bpl
[2010.12.14 15:44:20 | 000,023,360 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\IEControl.bpl
[2010.12.14 15:44:18 | 000,396,608 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\GR32_D6.bpl
[2010.12.14 15:44:18 | 000,376,640 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\DEC.bpl
[2010.12.14 15:44:18 | 000,352,064 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUCompression.bpl
[2010.12.14 15:44:18 | 000,297,792 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUKernel.bpl
[2010.12.14 15:44:18 | 000,139,584 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUBasic.bpl
[2010.12.14 15:44:18 | 000,135,488 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\aprdlgs60.bpl
[2010.12.14 15:44:18 | 000,062,272 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUTransl.bpl
[2010.12.14 15:44:18 | 000,053,568 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\XMLComponents.bpl
[2010.12.14 15:44:18 | 000,042,304 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TURar.bpl
[2010.12.14 15:44:16 | 000,459,072 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\ntrtl60.bpl
[2010.12.14 15:44:16 | 000,165,696 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\RegExp.bpl
[2010.12.14 15:43:58 | 000,177,472 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\MsStyles.dll
[2010.12.14 15:43:46 | 000,057,664 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUUUnInstallHelper.exe
[2010.12.14 15:43:40 | 000,034,624 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TURegOpt64.exe
[2010.12.14 15:43:36 | 000,216,896 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUAnalyzeInfo64.dll
[2010.12.14 15:43:20 | 000,179,008 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUAnalyzeInfo.dll
[2010.12.14 15:42:50 | 000,651,072 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUPSAPI.dll
[2010.12.14 15:42:46 | 000,113,472 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUAutoReactivator64.exe
[2010.12.14 15:42:44 | 000,766,272 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TuneUpUtilitiesApp64.exe
[2010.12.14 15:42:40 | 002,019,648 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TuneUpUtilitiesService64.exe
[2010.12.14 15:39:54 | 000,595,776 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TUDefragBackend64.exe
[2010.12.14 15:39:30 | 000,028,480 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\SDShelEx-x64.dll
[2010.12.14 15:39:28 | 000,029,504 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\SDShelEx-win32.dll
[2010.12.14 15:39:24 | 000,023,872 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\DseShExt-x64.dll
[2010.12.14 15:39:22 | 000,025,920 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\DseShExt-x86.dll
[2010.12.14 15:39:18 | 000,025,920 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\authuitu-x64.dll
[2010.12.14 15:39:16 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\authuitu-x86.dll
[2010.12.14 15:39:14 | 000,036,160 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\uxtuneup-x64.dll
[2010.12.14 15:39:10 | 000,029,504 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\uxtuneup-x86.dll
[2010.12.14 15:39:06 | 000,011,584 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\tux64thk.exe
[2010.12.14 15:39:02 | 000,484,672 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\tulic.dll
[2010.11.29 20:27:40 | 000,011,856 | ---- | C] (TuneUp Software) -- C:\Program Files (x86)\TuneUpUtilitiesDriver64.sys
[2010.11.29 20:24:46 | 000,270,336 | ---- | C] (Embarcadero Technologies, Inc.) -- C:\Program Files (x86)\vclimg120.bpl
[2010.11.29 20:24:46 | 000,208,896 | ---- | C] (Embarcadero Technologies, Inc.) -- C:\Program Files (x86)\vclx120.bpl
[2010.11.29 20:24:46 | 000,042,816 | ---- | C] (TuneUp Software GmbH) -- C:\Program Files (x86)\AclUIHlp.dll
[2010.11.29 20:24:44 | 001,998,336 | ---- | C] (Embarcadero Technologies, Inc.) -- C:\Program Files (x86)\vcl120.bpl
[2010.11.29 20:24:44 | 001,098,752 | ---- | C] (Embarcadero Technologies, Inc.) -- C:\Program Files (x86)\rtl120.bpl
[2010.11.29 20:24:44 | 000,952,832 | ---- | C] (Embarcadero Technologies, Inc.) -- C:\Program Files (x86)\xmlrtl120.bpl
[2010.11.29 20:24:44 | 000,331,264 | ---- | C] (Embarcadero Technologies, Inc.) -- C:\Program Files (x86)\dbrtl120.bpl
[2010.11.29 20:24:44 | 000,278,016 | ---- | C] (Embarcadero Technologies, Inc.) -- C:\Program Files (x86)\vcldb120.bpl
[2010.11.29 20:24:44 | 000,012,288 | ---- | C] (TuneUp Software GmbH) -- C:\Program Files (x86)\ImgResTu.dat
[2 C:\windows\SysNative\*.tmp files -> C:\windows\SysNative\*.tmp -> ]
[1 C:\Users\***\Documents\*.tmp files -> C:\Users\***\Documents\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.01 13:05:23 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.09.01 13:05:17 | 1500,844,032 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.31 21:40:24 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.08.31 21:30:38 | 083,023,306 | ---- | M] () -- C:\ProgramData\nud0repor.pad
[2012.08.31 21:29:43 | 000,013,632 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.31 21:29:43 | 000,013,632 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.31 12:31:29 | 001,671,732 | ---- | M] () -- C:\windows\SysNative\perfh007.dat
[2012.08.31 12:31:29 | 000,920,804 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2012.08.31 12:31:29 | 000,453,708 | ---- | M] () -- C:\windows\SysNative\perfc007.dat
[2012.08.31 12:31:29 | 000,397,936 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2012.08.31 12:31:29 | 000,005,194 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2012.08.30 13:42:53 | 055,489,458 | ---- | M] () -- C:\Users\***\Desktop\Zu drucken.zip
[2012.08.28 15:50:59 | 000,708,300 | ---- | M] () -- C:\Users\***\Desktop\Booklet_Siegeshunger_13082012.pdf
[2012.08.23 12:21:30 | 000,050,406 | ---- | M] () -- C:\Users\***\Desktop\Personalbogen_Boubachta.pdf
[2 C:\windows\SysNative\*.tmp files -> C:\windows\SysNative\*.tmp -> ]
[1 C:\Users\***\Documents\*.tmp files -> C:\Users\***\Documents\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.31 21:12:26 | 083,023,306 | ---- | C] () -- C:\ProgramData\nud0repor.pad
[2012.08.30 13:42:44 | 055,489,458 | ---- | C] () -- C:\Users\***\Desktop\Zu drucken.zip
[2012.08.28 15:50:59 | 000,708,300 | ---- | C] () -- C:\Users\***\Desktop\Booklet_Siegeshunger_13082012.pdf
[2012.08.23 12:21:28 | 000,050,406 | ---- | C] () -- C:\Users\***\Desktop\Personalbogen_Boubachta.pdf
[2012.05.26 16:34:47 | 000,316,928 | ---- | C] () -- C:\windows\SysWow64\hpcc3118.dll
[2012.01.25 17:27:53 | 000,437,358 | ---- | C] () -- C:\Users\***\Antworten[1].pdf
[2012.01.25 17:27:53 | 000,053,536 | ---- | C] () -- C:\Users\***\mögliche Prüfungsfragen.pdf
[2012.01.08 21:49:04 | 000,000,678 | ---- | C] () -- C:\Users\***\.jmf-resource
[2011.10.04 17:56:12 | 000,001,456 | ---- | C] () -- C:\Users\***\AppData\Local\Adobe Für Web speichern 12.0 Prefs
[2011.06.17 18:21:32 | 000,052,179 | ---- | C] () -- C:\Users\***\DSC_0100_640x428.jpg
[2011.06.17 18:21:32 | 000,027,625 | ---- | C] () -- C:\Users\***\DSC_0104_321x480.jpg
[2011.02.07 19:33:34 | 000,000,000 | ---- | C] () -- C:\windows\HPMProp.INI
[2010.12.29 16:57:41 | 000,008,192 | ---- | C] () -- C:\windows\SysWow64\srvany.exe
[2010.12.25 20:10:14 | 000,000,026 | ---- | C] () -- C:\Program Files (x86)\uninstmsmsg.ini
[2010.12.25 19:44:58 | 000,000,022 | ---- | C] () -- C:\Program Files\zipnew.dat
[2010.12.25 19:44:58 | 000,000,020 | ---- | C] () -- C:\Program Files\rarnew.dat
[2010.12.25 19:44:56 | 001,090,560 | ---- | C] () -- C:\Program Files\WinRAR.exe
[2010.12.25 19:44:56 | 000,398,336 | ---- | C] () -- C:\Program Files\Rar.exe
[2010.12.25 19:44:56 | 000,302,191 | ---- | C] () -- C:\Program Files\WinRAR.chm
[2010.12.25 19:44:56 | 000,262,656 | ---- | C] () -- C:\Program Files\UnRAR.exe
[2010.12.25 19:44:56 | 000,166,400 | ---- | C] () -- C:\Program Files\RarExt.dll
[2010.12.25 19:44:56 | 000,141,824 | ---- | C] () -- C:\Program Files\RarExt32.dll
[2010.12.25 19:44:56 | 000,130,560 | ---- | C] () -- C:\Program Files\Uninstall.exe
[2010.12.25 19:44:56 | 000,123,832 | ---- | C] () -- C:\Program Files\Default64.SFX
[2010.12.25 19:44:56 | 000,094,648 | ---- | C] () -- C:\Program Files\Zip64.SFX
[2010.12.25 19:44:56 | 000,094,183 | ---- | C] () -- C:\Program Files\WinCon64.SFX
[2010.12.25 19:44:56 | 000,093,184 | ---- | C] () -- C:\Program Files\Default.SFX
[2010.12.25 19:44:56 | 000,074,752 | ---- | C] () -- C:\Program Files\Zip.SFX
[2010.12.25 19:44:56 | 000,070,656 | ---- | C] () -- C:\Program Files\WinCon.SFX
[2010.12.25 19:44:56 | 000,048,786 | ---- | C] () -- C:\Program Files\winrar.lng
[2010.12.25 19:44:56 | 000,019,021 | ---- | C] () -- C:\Program Files\rar.lng
[2010.12.25 19:44:56 | 000,003,986 | ---- | C] () -- C:\Program Files\uninstall.lng
[2010.12.25 19:44:56 | 000,001,754 | ---- | C] () -- C:\Program Files\rarext.lng
[2010.12.25 19:44:55 | 000,003,978 | ---- | C] () -- C:\Program Files\Order.htm
[2010.12.25 19:44:55 | 000,001,679 | ---- | C] () -- C:\Program Files\Descript.ion
[2010.12.25 19:44:55 | 000,001,255 | ---- | C] () -- C:\Program Files\RarFiles.lst
[2010.12.25 19:44:55 | 000,000,718 | ---- | C] () -- C:\Program Files\Uninstall.lst
[2010.12.25 19:44:55 | 000,000,622 | ---- | C] () -- C:\Program Files\File_Id.diz
[2010.12.25 15:14:53 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.12.14 15:44:58 | 011,563,663 | ---- | C] () -- C:\Program Files (x86)\TUData.dat
[2010.12.14 15:38:24 | 000,000,309 | ---- | C] () -- C:\Program Files (x86)\TUProduct.dat
[2010.11.29 20:24:44 | 000,021,000 | ---- | C] () -- C:\Program Files (x86)\EngineerIPS.dll

< End of report >
Was soll ich als nächsten Schritt tun?

Danke für eure Hilfe!

Alt 01.09.2012, 14:20   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Cyber Crime Intvestigation Trojaner - Standard

Cyber Crime Intvestigation Trojaner


Code:
ATTFilter
C:\Windows\KMService.exe (RiskWare.Tool.CK)
Ist ein Crack/Hack für die illegale Nutzung von Office 2010!

Siehe auch => http://www.trojaner-board.de/95393-c...-software.html

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support ohne jegliche Diskussion beenden.

Cracks/Keygens sind zu 99,9% gefährliche Schädlinge, mit denen man nicht spaßen sollte. Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf Anleitung zur kompletten Neuinstallation!!

Dass illegale Cracks und Keygens im Wesentlichen dazu dienen, Malware zu verbreiten ist kein Geheimnis und muss jedem klar sein!


In Zukunft Finger weg von: Softonic, Registry-Bereinigern und illegalem Zeugs Cracks/Keygens/Serials
__________________

__________________
Alt 04.09.2012, 16:36   #3
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Cyber Crime Intvestigation Trojaner - Standard

Cyber Crime Intvestigation Trojaner


Stellungnahme zu deiner Beitragsmeldung: Wir löschen nicht einfach so Beiträge

Siehe => http://www.trojaner-board.de/108422-...-anfragen.html
__________________
__________________
Alt 15.04.2013, 20:09   #4
Mittag
 
Cyber Crime Intvestigation Trojaner - Standard

Cyber Crime Intvestigation Trojaner


Hallo,
wäre es möglich meinen Namen aus dem Log zu entfernen (habe leider keine Edit Rechte auf meinen eigenen Beitrag)? Ich weiß, dass ich darauf beim posten achte hätte müssen, leider ist es nun mal passiert.
Ich wäre euch sehr dankbar.
Lg

Alt 15.04.2013, 20:33   #5
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Cyber Crime Intvestigation Trojaner - Standard

Cyber Crime Intvestigation Trojaner


Das muss der Admin machen, hab es weitergeleitet

__________________
Logfiles bitte immer in CODE-Tags posten

Antwort

Themen zu Cyber Crime Intvestigation Trojaner
.dll, administrator, adobe, autorun, babylon toolbar, babylontoolbar, bho, crime, cyber crime, document, explorer, firefox, format, helper, home, logfile, malware, mozilla, nvidia, plug-in, port, programme, realtek, registry, search the web, security, senden, software, spyware.onlinegames, temp, trojaner


« Ebay/Pricerunner Umleitung im Firefox | was bremst meinen pc so »


Ähnliche Themen: Cyber Crime Intvestigation Trojaner


  1. Cyber Crime Investigation Department trojaner
    Mülltonne - 01.11.2014 (1)
  2. OTL Log Auswertung nach Cyber Crime Investigation Trojaner
    Log-Analyse und Auswertung - 01.05.2013 (2)
  3. Cyber crime investigation department - Trojaner
    Log-Analyse und Auswertung - 13.01.2013 (13)
  4. polizei cyber crime investigation department trojaner
    Log-Analyse und Auswertung - 23.12.2012 (14)
  5. Cyber Crime Investigation Department-Trojaner
    Log-Analyse und Auswertung - 24.10.2012 (19)
  6. Cyber Crime Investigation Trojaner (Österreich)
    Log-Analyse und Auswertung - 18.10.2012 (5)
  7. Cyber Crime Investigation Department Trojaner
    Plagegeister aller Art und deren Bekämpfung - 07.10.2012 (13)
  8. Trojaner - Cyber Crime Investigation Department
    Plagegeister aller Art und deren Bekämpfung - 28.09.2012 (12)
  9. Trojaner: Cyber crime investigation department
    Plagegeister aller Art und deren Bekämpfung - 24.09.2012 (7)
  10. Trojaner: cyber crime investigation department
    Log-Analyse und Auswertung - 19.09.2012 (10)
  11. Trojaner - Cyber Crime Investigation Department Österreich
    Log-Analyse und Auswertung - 17.09.2012 (12)
  12. Cyber Crime Investigation Department Österreich - Trojaner
    Log-Analyse und Auswertung - 15.09.2012 (34)
  13. Cyber Crime Investigation Department Trojaner
    Log-Analyse und Auswertung - 06.09.2012 (12)
  14. cyber crime investigation departement trojaner
    Plagegeister aller Art und deren Bekämpfung - 04.09.2012 (3)
  15. Cyber Crime Investigation Department Trojaner
    Log-Analyse und Auswertung - 02.09.2012 (11)
  16. Paysafe cyber crime investigation Bundespolizei trojaner
    Plagegeister aller Art und deren Bekämpfung - 08.08.2012 (17)
  17. National Cyber Crime Unit BKA Trojaner
    Plagegeister aller Art und deren Bekämpfung - 23.01.2012 (1)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Cyber Crime Intvestigation Trojaner - Hallo, mich hat der Cyber Crime Investigation Trojaner auch erwischt. Ich hab die empfohlenen Scans mit Malware und OTL durchgführt: Malware: Code: Alles auswählen Aufklappen ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 - Cyber Crime Intvestigation Trojaner...
Archiv
Du betrachtest: Cyber Crime Intvestigation Trojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131