|
Log-Analyse und Auswertung: Gvu trojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
06.09.2012, 16:45 | #1 | |
| Gvu trojaner Hallo, Vor einigen Wochen habe ich mir den gvu Trojaner eingefangen. Sobald der Laptop eine Internetverbindung hat wird nur noch die Zahlungsaufforderung angezeigt, die Webcam schaltet sich ein usw. Ich habe Windows 7 64bit. Die Logdateien mit OTL und Defogger habe ich erstellt. Ich hoffe mir kann bald jemand helfen das wieder loszuwerden. Da der Trojaner aber schon länger als 30 Tage auf dem Laptop ist weiß ich nicht ob die OTL Log mit Quick Scan überhaupt aussagekräftig ist. Trotzdem hier die OTL Log Datei: OTL Logfile: Code:
ATTFilter OTL logfile created on: 9/4/2012 4:45:49 PM - Run 1 OTL by OldTimer - Version 3.2.60.0 Folder = C:\Users\Wagner\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.97 Gb Total Physical Memory | 2.42 Gb Available Physical Memory | 61.14% Memory free 7.93 Gb Paging File | 6.30 Gb Available in Paging File | 79.47% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 149.05 Gb Total Space | 47.33 Gb Free Space | 31.76% Space Free | Partition Type: NTFS Drive D: | 134.39 Gb Total Space | 134.31 Gb Free Space | 99.94% Space Free | Partition Type: NTFS Drive E: | 4.38 Gb Total Space | 4.24 Gb Free Space | 96.96% Space Free | Partition Type: UDF Computer Name: WAGNER-PC | User Name: Wagner | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012/09/04 16:21:31 | 000,599,040 | ---- | M] (OldTimer Tools) -- C:\Users\Wagner\Desktop\OTL.exe PRC - [2012/03/04 17:02:36 | 000,307,824 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe PRC - [2012/02/10 11:28:06 | 000,240,408 | ---- | M] (Microsoft Corporation.) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe PRC - [2011/07/29 07:36:09 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2011/04/21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2011/04/21 07:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2011/01/17 18:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe PRC - [2011/01/17 18:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin PRC - [2009/09/22 16:34:11 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe PRC - [2009/07/24 19:32:50 | 001,593,344 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe PRC - [2009/07/24 02:13:38 | 000,306,232 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe PRC - [2009/07/23 02:58:46 | 000,017,976 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe PRC - [2009/07/16 19:07:54 | 000,178,744 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe PRC - [2009/07/07 20:20:56 | 008,493,624 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe PRC - [2009/06/19 19:29:42 | 000,105,016 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe PRC - [2009/06/19 19:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe PRC - [2009/06/16 02:30:42 | 000,084,536 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe PRC - [2009/05/19 00:58:38 | 000,305,720 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe PRC - [2009/04/20 20:09:30 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe PRC - [2008/12/23 02:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe PRC - [2008/10/19 15:30:02 | 000,222,456 | ---- | M] () -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe PRC - [2008/08/14 06:00:08 | 000,113,208 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe PRC - [2008/08/14 05:59:56 | 000,301,624 | ---- | M] () -- C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe PRC - [2008/07/19 04:52:16 | 000,104,936 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe PRC - [2007/08/08 09:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe ========== Modules (No Company Name) ========== MOD - [2012/07/15 15:32:45 | 000,196,096 | ---- | M] () -- C:\Users\Wagner\AppData\Local\Temp\fest0r_ot.exe MOD - [2012/06/16 00:15:06 | 014,325,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\517358eb2fd962a942dd1ea6afc5b93e\PresentationFramework.ni.dll MOD - [2012/06/16 00:14:26 | 012,218,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\e9d0ba41128f363f2390c7e630129c2b\PresentationCore.ni.dll MOD - [2012/05/11 22:06:29 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\fc626095c194be137bceb219934b06a7\PresentationFramework.Aero.ni.dll MOD - [2012/05/11 22:03:24 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\b68fdf2c95b93fc5006a092c11eed07c\WindowsBase.ni.dll MOD - [2012/05/11 22:02:44 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll MOD - [2012/05/11 22:02:02 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll MOD - [2011/05/31 12:53:40 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll MOD - [2009/11/03 16:51:42 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2009/11/03 16:51:26 | 000,039,712 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\ASL.dll MOD - [2009/07/24 19:32:50 | 001,593,344 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe MOD - [2009/07/23 02:58:46 | 000,017,976 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe MOD - [2008/08/28 01:32:36 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll MOD - [2008/06/09 18:55:08 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll MOD - [1996/12/14 00:00:00 | 000,022,016 | ---- | M] () -- C:\Windows\SysWOW64\DOCOBJ.DLL ========== Services (SafeList) ========== SRV:64bit: - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV:64bit: - [2009/09/15 22:21:58 | 000,359,552 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysNative\FBAgent.exe -- (AFBAgent) SRV:64bit: - [2009/08/22 11:37:45 | 000,917,768 | ---- | M] (Trend Micro Inc.) [On_Demand | Stopped] -- C:\Program Files\Trend Micro\Internet Security\TmProxy.exe -- (TmProxy) SRV:64bit: - [2009/08/22 11:37:45 | 000,570,632 | ---- | M] (Trend Micro Inc.) [On_Demand | Stopped] -- C:\Program Files\Trend Micro\BM\TMBMSRV.exe -- (TMBMServer) SRV:64bit: - [2009/08/22 11:03:13 | 000,838,528 | ---- | M] (Trend Micro Inc.) [Auto | Running] -- C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe -- (SfCtlCom) SRV:64bit: - [2009/07/14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV:64bit: - [2007/08/08 09:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv) SRV - [2012/06/15 00:17:46 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012/02/10 11:28:06 | 000,240,408 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe -- (BBUpdate) SRV - [2012/02/10 11:28:06 | 000,193,816 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe -- (BBSvc) SRV - [2011/07/29 07:36:09 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011/04/21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009/09/11 03:09:28 | 000,109,184 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\ASUS\AI Recovery\ServiceSimple2.exe -- (ASUSRDVDService) SRV - [2009/07/24 02:13:38 | 000,306,232 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe -- (FastBootAgent) SRV - [2009/06/16 02:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService) SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008/10/19 15:30:02 | 000,222,456 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service) SRV - [2007/12/17 15:00:00 | 000,163,840 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE -- (EPSON_EB_RPCV4_01) SRV - [2007/01/11 15:02:00 | 000,126,464 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE -- (EPSON_PM_RPCV4_01) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012/03/01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011/07/29 07:36:10 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011/07/29 07:36:10 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011/04/13 15:05:46 | 000,023,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nuidfltr.sys -- (NuidFltr) DRV:64bit: - [2011/04/13 15:04:38 | 000,045,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64) DRV:64bit: - [2011/04/12 13:01:38 | 000,052,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d) DRV:64bit: - [2011/03/11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011/03/11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010/09/23 00:36:48 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:64bit: - [2010/08/25 20:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2010/01/21 02:03:10 | 000,027,648 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64diag.sys -- (UsbDiag) DRV:64bit: - [2010/01/21 02:03:08 | 000,033,280 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64modem.sys -- (USBModem) DRV:64bit: - [2010/01/21 02:03:06 | 000,017,920 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64bus.sys -- (usbbus) DRV:64bit: - [2009/10/05 17:34:00 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2009/08/28 20:42:52 | 000,049,152 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2009/08/23 05:08:10 | 000,056,320 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1E62x64.sys -- (L1E) DRV:64bit: - [2009/08/22 11:38:33 | 001,883,152 | ---- | M] (Trend Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vsapint.sys -- (vsapint) DRV:64bit: - [2009/08/22 11:38:33 | 000,258,064 | ---- | M] (Trend Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tmxpflt.sys -- (tmxpflt) DRV:64bit: - [2009/08/22 11:38:33 | 000,107,536 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tmtdi.sys -- (tmtdi) DRV:64bit: - [2009/08/22 11:38:33 | 000,042,000 | ---- | M] (Trend Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tmpreflt.sys -- (tmpreflt) DRV:64bit: - [2009/07/20 11:29:39 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr) DRV:64bit: - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009/07/14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009/07/09 10:11:31 | 001,222,144 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV:64bit: - [2009/06/19 12:59:08 | 000,017,408 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lgvmdm64.sys -- (LGVMODEM) DRV:64bit: - [2009/06/19 12:59:06 | 000,016,384 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lgbtpt64.sys -- (LgBttPort) DRV:64bit: - [2009/06/19 12:59:02 | 000,014,848 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lgbtbs64.sys -- (lgbusenum) DRV:64bit: - [2009/06/18 21:18:10 | 000,015,928 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\lullaby.sys -- (lullaby) DRV:64bit: - [2009/06/12 05:41:55 | 000,112,128 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD) DRV:64bit: - [2009/06/10 22:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH) DRV:64bit: - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009/06/05 12:15:55 | 001,806,400 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC) DRV:64bit: - [2009/06/04 12:54:35 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009/05/26 15:32:37 | 000,040,448 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor) DRV:64bit: - [2009/05/18 15:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009/05/13 03:07:19 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor) DRV:64bit: - [2008/05/24 02:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr) DRV:64bit: - [2007/07/24 20:11:32 | 000,014,904 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64) DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = hxxp://www.google.de/ IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{51A5A868-ADD7-A89B-8D44-D2809384E318}: "URL" = hxxp://www.hamsterstart.com/s/?q={searchTerms}&iesrc=IE-SearchBox&site=Yahoo&cfg=2-475-0-0 IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADFA_deDE448 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://google.de/" FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@logitech.com/HarmonyRemote,version=1.0.0: C:\Program Files (x86)\Logitech\Harmony Remote Driver\NprtHarmonyPlugin.dll (Logitech Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/07/11 20:55:38 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/07/11 20:56:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Wagner\AppData\Roaming\mozilla\Extensions [2012/07/14 23:16:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Wagner\AppData\Roaming\mozilla\Firefox\Profiles\nt0w93cz.default\extensions [2012/07/11 20:55:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012/06/15 00:19:07 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012/06/15 00:46:57 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012/06/15 00:46:56 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012/06/15 00:46:57 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012/06/15 00:46:57 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012/06/15 00:46:57 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012/06/15 00:46:56 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.) O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.) O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [UfSeAgnt.exe] C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe (Trend Micro Inc.) O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe (ASUS) O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe (ASUS) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe (ASUS) O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA) O4 - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKCU..\Run: [EPSON Stylus SX400 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEGE.EXE /FU "C:\Windows\TEMP\E_SE742.tmp" /EF "HKCU" File not found O4 - HKCU..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (Trend Micro Inc.) O4 - Startup: C:\Users\Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Users\Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk = File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Wagner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Wagner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Free YouTube Download - C:\Users\Wagner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Wagner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe (ICQ, LLC.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A6D0840E-BA6F-4335-B10E-BFEEB9D860E5}: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{390b2a34-8f82-11e0-bff2-90e6ba4d7d2a}\Shell - "" = AutoRun O33 - MountPoints2\{390b2a34-8f82-11e0-bff2-90e6ba4d7d2a}\Shell\AutoRun\command - "" = F:\iStudio.exe O33 - MountPoints2\{92bb09b5-4400-11df-9588-90e6ba4d7d2a}\Shell - "" = AutoRun O33 - MountPoints2\{92bb09b5-4400-11df-9588-90e6ba4d7d2a}\Shell\AutoRun\command - "" = F:\USBAutoRun.exe O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\USBAutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012/09/04 16:32:40 | 000,599,040 | ---- | C] (OldTimer Tools) -- C:\Users\Wagner\Desktop\OTL.exe [2012/09/04 16:22:48 | 000,000,000 | ---D | C] -- C:\Users\Wagner\AppData\Local\{9D015897-6A04-4622-9D2F-277661C0207C} [2008/08/12 06:45:20 | 000,155,648 | ---- | C] (ASUS) -- C:\Program Files (x86)\Common Files\MSIactionall.dll ========== Files - Modified Within 30 Days ========== [2012/09/04 16:33:27 | 000,000,000 | ---- | M] () -- C:\Users\Wagner\defogger_reenable [2012/09/04 16:28:26 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/09/04 16:28:26 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/09/04 16:21:31 | 000,599,040 | ---- | M] (OldTimer Tools) -- C:\Users\Wagner\Desktop\OTL.exe [2012/09/04 16:20:34 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012/09/04 16:20:32 | 000,050,477 | ---- | M] () -- C:\Users\Wagner\Desktop\Defogger.exe [2012/09/04 16:20:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012/09/04 16:19:54 | 3193,765,888 | -HS- | M] () -- C:\hiberfil.sys ========== Files Created - No Company Name ========== [2012/09/04 16:33:27 | 000,000,000 | ---- | C] () -- C:\Users\Wagner\defogger_reenable [2012/09/04 16:32:38 | 000,050,477 | ---- | C] () -- C:\Users\Wagner\Desktop\Defogger.exe [2012/07/15 15:32:46 | 004,503,728 | ---- | C] () -- C:\ProgramData\to_r0tsef.pad [2011/06/18 16:20:14 | 000,000,166 | ---- | C] () -- C:\Windows\WLP.ini [2011/05/07 22:01:34 | 000,017,234 | ---- | C] () -- C:\Users\Wagner\Qualimodus_wJB_11.pdf [2010/06/13 17:51:43 | 003,128,366 | ---- | C] () -- C:\Users\Wagner\Flyer_2011[1]UNI.pdf [2009/11/13 23:05:46 | 000,010,752 | ---- | C] () -- C:\Users\Wagner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/04/08 19:31:56 | 000,106,496 | ---- | C] () -- C:\Program Files (x86)\Common Files\CPInstallAction.dll [2008/05/22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files (x86)\Common Files\banner.jpg ========== LOP Check ========== [2011/05/30 22:41:20 | 000,000,000 | ---D | M] -- C:\Users\Wagner\AppData\Roaming\AnvSoft [2009/12/13 13:48:18 | 000,000,000 | ---D | M] -- C:\Users\Wagner\AppData\Roaming\Atari [2011/09/03 17:17:24 | 000,000,000 | ---D | M] -- C:\Users\Wagner\AppData\Roaming\DVDVideoSoft [2011/05/30 21:41:52 | 000,000,000 | ---D | M] -- C:\Users\Wagner\AppData\Roaming\DVDVideoSoftIEHelpers [2012/02/22 22:02:59 | 000,000,000 | ---D | M] -- C:\Users\Wagner\AppData\Roaming\EPSON [2011/05/31 13:41:48 | 000,000,000 | ---D | M] -- C:\Users\Wagner\AppData\Roaming\HamsterSoft [2010/07/26 20:09:28 | 000,000,000 | ---D | M] -- C:\Users\Wagner\AppData\Roaming\ICQ [2009/12/13 13:47:34 | 000,000,000 | ---D | M] -- C:\Users\Wagner\AppData\Roaming\Leadertech [2010/04/25 20:05:06 | 000,000,000 | ---D | M] -- C:\Users\Wagner\AppData\Roaming\LG Electronics [2011/05/31 12:54:17 | 000,000,000 | ---D | M] -- C:\Users\Wagner\AppData\Roaming\OpenOffice.org [2011/07/02 16:28:34 | 000,000,000 | ---D | M] -- C:\Users\Wagner\AppData\Roaming\PeaZip [2011/06/23 12:56:35 | 000,000,000 | ---D | M] -- C:\Users\Wagner\AppData\Roaming\Wildlife Park 2 [2011/10/05 15:25:05 | 000,000,000 | ---D | M] -- C:\Users\Wagner\AppData\Roaming\Windows Live Writer [2010/04/09 20:00:51 | 000,000,000 | -H-D | M] -- C:\Users\Wagner\AppData\Roaming\{D94BA408-F110-488B-A65E-3AE7945F79E6} [2012/06/05 18:42:46 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Hier noch die Defogger Log: Zitat:
Vielen Dank schonmal |
06.09.2012, 19:53 | #2 |
/// Helfer-Team | Gvu trojanerDie Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen. Diese Nacheinander abarbeiten und die 4 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen. Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern mede dies bitte. 1. Schritt Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL MOD - [2012/07/15 15:32:45 | 000,196,096 | ---- | M] () -- C:\Users\Wagner\AppData\Local\Temp\fest0r_ot.exe IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{51A5A868-ADD7-A89B-8D44-D2809384E318}: "URL" = http://www.hamsterstart.com/s/?q={searchTerms}&iesrc=IE-SearchBox&site=Yahoo&cfg=2-475-0-0 IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADFA_deDE448 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - prefs.js..browser.startup.homepage: "http://google.de/" FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O4 - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found O4 - Startup: C:\Users\Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk = File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{390b2a34-8f82-11e0-bff2-90e6ba4d7d2a}\Shell - "" = AutoRun O33 - MountPoints2\{390b2a34-8f82-11e0-bff2-90e6ba4d7d2a}\Shell\AutoRun\command - "" = F:\iStudio.exe O33 - MountPoints2\{92bb09b5-4400-11df-9588-90e6ba4d7d2a}\Shell - "" = AutoRun O33 - MountPoints2\{92bb09b5-4400-11df-9588-90e6ba4d7d2a}\Shell\AutoRun\command - "" = F:\USBAutoRun.exe O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\USBAutoRun.exe [2012/06/15 00:46:57 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012/06/15 00:46:56 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012/06/15 00:46:57 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012/06/15 00:46:57 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012/06/15 00:46:57 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012/06/15 00:46:56 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml [2012/09/04 16:22:48 | 000,000,000 | ---D | C] -- C:\Users\Wagner\AppData\Local\{9D015897-6A04-4622-9D2F-277661C0207C} [2012/07/15 15:32:46 | 004,503,728 | ---- | C] () -- C:\ProgramData\to_r0tsef.pad :Files C:\ProgramData\*.exe C:\ProgramData\TEMP C:\Users\Wagner\AppData\Local\{*} C:\Users\Wagner\AppData\Local\Temp\*.exe C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk ipconfig /flushdns /c :Commands [purity] [emptytemp]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen! 2. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.danach: 3. Schritt Downloade Dir bitte AdwCleaner auf deinen Desktop.
4. Schritt
__________________ |
09.09.2012, 22:02 | #3 |
| Gvu trojaner Hallo,
__________________Vielen Dank. Hier die OTL Log: Code:
ATTFilter All processes killed ========== OTL ========== Releasing module C:\Users\Wagner\AppData\Local\Temp\fest0r_ot.exe C:\Users\Wagner\AppData\Local\Temp\fest0r_ot.exe moved successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{51A5A868-ADD7-A89B-8D44-D2809384E318}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51A5A868-ADD7-A89B-8D44-D2809384E318}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found. HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! Prefs.js: "hxxp://google.de/" removed from browser.startup.homepage Prefs.js: 0 removed from network.proxy.type Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully. 64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found. 64bit-Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ deleted successfully. C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Setwallpaper deleted successfully. C:\Users\Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully. 64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ not found. Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. 64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully. 64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully! Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{390b2a34-8f82-11e0-bff2-90e6ba4d7d2a}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{390b2a34-8f82-11e0-bff2-90e6ba4d7d2a}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{390b2a34-8f82-11e0-bff2-90e6ba4d7d2a}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{390b2a34-8f82-11e0-bff2-90e6ba4d7d2a}\ not found. File F:\iStudio.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{92bb09b5-4400-11df-9588-90e6ba4d7d2a}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92bb09b5-4400-11df-9588-90e6ba4d7d2a}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{92bb09b5-4400-11df-9588-90e6ba4d7d2a}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92bb09b5-4400-11df-9588-90e6ba4d7d2a}\ not found. File F:\USBAutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found. File F:\USBAutoRun.exe not found. C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml moved successfully. C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml moved successfully. C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml moved successfully. C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml moved successfully. C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml moved successfully. C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml moved successfully. C:\Users\Wagner\AppData\Local\{9D015897-6A04-4622-9D2F-277661C0207C} folder moved successfully. C:\ProgramData\to_r0tsef.pad moved successfully. ========== FILES ========== File\Folder C:\ProgramData\*.exe not found. C:\ProgramData\Temp\{C59C179C-668D-49A9-B6EA-0121CCFC1243} folder moved successfully. C:\ProgramData\Temp\{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41} folder moved successfully. C:\ProgramData\Temp\{40BF1E83-20EB-11D8-97C5-0009C5020658} folder moved successfully. C:\ProgramData\Temp folder moved successfully. C:\Users\Wagner\AppData\Local\{0156FF0F-04F1-4782-83F9-0A8018D522F5} folder moved successfully. C:\Users\Wagner\AppData\Local\{0229B894-6A22-4165-BFCB-681F89DB9ED1} folder moved successfully. C:\Users\Wagner\AppData\Local\{02606A06-F829-4308-A929-E928020A25E6} folder moved successfully. C:\Users\Wagner\AppData\Local\{02DDDCD8-7276-4298-B27B-8440264F39F6} folder moved successfully. C:\Users\Wagner\AppData\Local\{039C0C65-07AD-47A8-9CF6-C8F40F8A904A} folder moved successfully. C:\Users\Wagner\AppData\Local\{03C9074F-21BE-4D1D-8299-659A90A70289} folder moved successfully. C:\Users\Wagner\AppData\Local\{03DD314A-9657-45C1-9C22-F3E9BBEAF999} folder moved successfully. C:\Users\Wagner\AppData\Local\{0592032D-4FE6-4215-8CD3-F241D7089993} folder moved successfully. C:\Users\Wagner\AppData\Local\{05E2BC78-49CF-4DA4-94ED-17187CFDEA30} folder moved successfully. C:\Users\Wagner\AppData\Local\{0670E309-E75A-47FD-9137-FD28F18C2F20} folder moved successfully. C:\Users\Wagner\AppData\Local\{068108ED-2164-4256-A148-0D56B9323CC9} folder moved successfully. C:\Users\Wagner\AppData\Local\{06B129EB-D5A6-4982-8408-DB1ABD69C8CE} folder moved successfully. C:\Users\Wagner\AppData\Local\{06D32E8E-FF41-4C81-B364-524F974F9BBA} folder moved successfully. C:\Users\Wagner\AppData\Local\{0793AFB6-0FD7-426C-8118-7A5CA7CB4FC5} folder moved successfully. C:\Users\Wagner\AppData\Local\{08D25635-0353-4950-BCC6-63B73E624F01} folder moved successfully. C:\Users\Wagner\AppData\Local\{08E69D43-2A5F-4E55-8BC1-0059B335C401} folder moved successfully. C:\Users\Wagner\AppData\Local\{09E0BF7D-5F65-41A7-9160-7F6DD9E07ED8} folder moved successfully. C:\Users\Wagner\AppData\Local\{0B1F873F-C5AF-4D74-B207-D9833DE62C69} folder moved successfully. C:\Users\Wagner\AppData\Local\{0B5BA18F-83C9-419C-B342-BA3F12BA74FF} folder moved successfully. C:\Users\Wagner\AppData\Local\{0CE17044-E1ED-4762-8F84-2E20181BF468} folder moved successfully. C:\Users\Wagner\AppData\Local\{0DCA63A6-C6F7-4567-90A7-E842C941DBC6} folder moved successfully. C:\Users\Wagner\AppData\Local\{0E91D341-F95B-488D-91EA-D7AD264804A1} folder moved successfully. C:\Users\Wagner\AppData\Local\{0E9A4B5B-9818-4FCC-8CCA-A43B6AF85953} folder moved successfully. C:\Users\Wagner\AppData\Local\{0F2609B6-F5AD-481C-9E06-8A09332983DA} folder moved successfully. C:\Users\Wagner\AppData\Local\{0FAF386E-120F-4687-925E-74127D24A62D} folder moved successfully. C:\Users\Wagner\AppData\Local\{0FBAE5A7-768C-4D55-96D5-30167EB534E9} folder moved successfully. C:\Users\Wagner\AppData\Local\{0FBFEC33-81BB-4F8E-BF54-B0A9B1FDC5AA} folder moved successfully. C:\Users\Wagner\AppData\Local\{0FE524FF-C6F6-4C97-A322-1B580B397077} folder moved successfully. C:\Users\Wagner\AppData\Local\{10679A83-8E84-458E-B5EE-7AE41AE80B72} folder moved successfully. C:\Users\Wagner\AppData\Local\{10C618D3-5D6C-461F-BE8F-362DEB406948} folder moved successfully. C:\Users\Wagner\AppData\Local\{11F6FC17-4FD3-4209-8D18-0A824061BA0E} folder moved successfully. C:\Users\Wagner\AppData\Local\{123D6A13-0D91-492C-9188-EF31228F467A} folder moved successfully. C:\Users\Wagner\AppData\Local\{12AE7F96-346F-4000-BE71-F078756BA16D} folder moved successfully. C:\Users\Wagner\AppData\Local\{135B17D6-7431-4C4E-86DC-C46E877C6B95} folder moved successfully. C:\Users\Wagner\AppData\Local\{13FBC835-04FC-4B12-AC6C-29A8CAE53CB2} folder moved successfully. C:\Users\Wagner\AppData\Local\{15016F8C-0B6F-4681-8B0E-B8DF394AD4B1} folder moved successfully. C:\Users\Wagner\AppData\Local\{15464349-D009-4592-A50A-9512ED41F272} folder moved successfully. C:\Users\Wagner\AppData\Local\{15EC02B7-2F2A-41ED-91BD-7B3A5325BC6B} folder moved successfully. C:\Users\Wagner\AppData\Local\{15F597C0-3131-4F9B-8BA1-BA0810316D72} folder moved successfully. C:\Users\Wagner\AppData\Local\{16659FDA-4F7F-4E3F-9497-B531BC5BA45E} folder moved successfully. C:\Users\Wagner\AppData\Local\{174A660C-FEFF-42E8-9808-A106175D9741} folder moved successfully. C:\Users\Wagner\AppData\Local\{17B943D4-A488-428F-887D-6DEF7BC3DFA7} folder moved successfully. C:\Users\Wagner\AppData\Local\{17C78825-6125-4476-B85F-561460DA6354} folder moved successfully. C:\Users\Wagner\AppData\Local\{17D41B52-2D0A-446A-91BC-30AD0C622EEB} folder moved successfully. C:\Users\Wagner\AppData\Local\{185932A6-40B8-4C30-86D5-1045126DC25A} folder moved successfully. C:\Users\Wagner\AppData\Local\{19025B71-1CA5-4625-B6C9-2199AC157701} folder moved successfully. C:\Users\Wagner\AppData\Local\{191F44DE-0370-40C3-A505-61265468D944} folder moved successfully. C:\Users\Wagner\AppData\Local\{19280C29-0912-4763-B778-CAD3392B617B} folder moved successfully. C:\Users\Wagner\AppData\Local\{194537D8-5596-4DB6-8B86-F4DDFE52CD2E} folder moved successfully. C:\Users\Wagner\AppData\Local\{19D4BDC5-F43F-4F35-9481-37C3F45BAA4A} folder moved successfully. C:\Users\Wagner\AppData\Local\{19DBBF08-6873-4978-8195-6AFE86F88E79} folder moved successfully. C:\Users\Wagner\AppData\Local\{1A37EB30-30CA-4A69-8D0C-DEC6CAE5AF2A} folder moved successfully. C:\Users\Wagner\AppData\Local\{1A782CFA-8047-4CBB-9188-B821599E732D} folder moved successfully. C:\Users\Wagner\AppData\Local\{1A95FE0B-2DA3-4D00-88EE-C431A83D8501} folder moved successfully. C:\Users\Wagner\AppData\Local\{1ABDD18A-EE9A-4EC5-954D-21823B293AB3} folder moved successfully. C:\Users\Wagner\AppData\Local\{1ABFAEF1-311A-420F-96B3-81B362D42F25} folder moved successfully. C:\Users\Wagner\AppData\Local\{1AF79AC4-ADB9-445B-86C1-E442A3997385} folder moved successfully. C:\Users\Wagner\AppData\Local\{1B6407A7-C8B4-4682-A9F4-CF66EADCEA2F} folder moved successfully. C:\Users\Wagner\AppData\Local\{1BCC6BC1-F549-4515-94F5-A9A52AB01781} folder moved successfully. C:\Users\Wagner\AppData\Local\{1BF7AC73-ED27-4E16-9939-F246230C037A} folder moved successfully. C:\Users\Wagner\AppData\Local\{1DA02B8B-0C3E-4E93-B30B-4558F95AC383} folder moved successfully. C:\Users\Wagner\AppData\Local\{1DCCAA9B-F163-46E6-959B-657C95221B65} folder moved successfully. C:\Users\Wagner\AppData\Local\{1DDDE8E6-6856-45C0-99C4-896F9A14DA3D} folder moved successfully. C:\Users\Wagner\AppData\Local\{1DE43D3B-27FA-46DB-BED0-BD84AE02BF5F} folder moved successfully. C:\Users\Wagner\AppData\Local\{1DEE1B19-B2B3-40F9-86CB-023B9700F500} folder moved successfully. C:\Users\Wagner\AppData\Local\{1DF56D1C-F830-41E3-878D-E8ED4606FBC0} folder moved successfully. C:\Users\Wagner\AppData\Local\{1E544854-CC85-49F4-B7CA-8E2C4B674A5B} folder moved successfully. C:\Users\Wagner\AppData\Local\{1E60C8F2-24BF-4C1F-A241-529816C9A705} folder moved successfully. C:\Users\Wagner\AppData\Local\{1EF5F53E-5A47-455D-93D5-A96DDBBAD000} folder moved successfully. C:\Users\Wagner\AppData\Local\{1F0574E4-3165-464E-A00B-977A2CA91EF1} folder moved successfully. C:\Users\Wagner\AppData\Local\{1F1F41AC-99D6-416F-ACB3-6389F808C784} folder moved successfully. C:\Users\Wagner\AppData\Local\{1F928FA9-35FC-408A-8470-55CA2D7FE66A} folder moved successfully. C:\Users\Wagner\AppData\Local\{200CF67E-C2C3-45A5-BF89-E4104C33893C} folder moved successfully. C:\Users\Wagner\AppData\Local\{211E2EB2-8855-4D6C-9A86-E99AC52087CB} folder moved successfully. C:\Users\Wagner\AppData\Local\{21333A3E-8C71-4970-9497-7ABAAC115EB8} folder moved successfully. C:\Users\Wagner\AppData\Local\{21DBC860-F7E6-45BD-98D7-4E401ACD9435} folder moved successfully. C:\Users\Wagner\AppData\Local\{22904D40-F57A-4F3F-AD2E-AAEAC39E02F5} folder moved successfully. C:\Users\Wagner\AppData\Local\{22D63E5B-4D3D-4C9C-9590-CB376399AEB3} folder moved successfully. C:\Users\Wagner\AppData\Local\{24D248B0-A53E-440E-9DFD-E69AAC4BF750} folder moved successfully. C:\Users\Wagner\AppData\Local\{263523E6-E355-4356-99F3-6844ECD9C3F3} folder moved successfully. C:\Users\Wagner\AppData\Local\{26F5E62B-CF4F-4A9A-8306-AD3841BDA9F5} folder moved successfully. C:\Users\Wagner\AppData\Local\{26F9438C-84A0-4DF5-9C6E-C3DFB5238068} folder moved successfully. C:\Users\Wagner\AppData\Local\{27EC6C43-3BA5-4197-98FD-2C98CC138840} folder moved successfully. C:\Users\Wagner\AppData\Local\{28022E64-C1B4-4D17-9696-D106D6FD4151} folder moved successfully. C:\Users\Wagner\AppData\Local\{280B95FB-0206-418B-B7FF-6D6A0F7DE94C} folder moved successfully. C:\Users\Wagner\AppData\Local\{285E2C99-9927-4F98-8D14-05DC45DF3828} folder moved successfully. C:\Users\Wagner\AppData\Local\{2AA0BF63-4D12-4541-ABF1-950E6A7D7599} folder moved successfully. C:\Users\Wagner\AppData\Local\{2AB276DC-2EDC-48C2-9735-4B98CA2FFE48} folder moved successfully. C:\Users\Wagner\AppData\Local\{2BC04A19-F2FA-44DE-97E6-234C2B4D1F09} folder moved successfully. C:\Users\Wagner\AppData\Local\{2BF3F41C-8FD1-47C5-B08F-AB68BD8BDD39} folder moved successfully. C:\Users\Wagner\AppData\Local\{2C286CFC-4BCE-4539-9914-002A867C8E9E} folder moved successfully. C:\Users\Wagner\AppData\Local\{2D14A998-EF37-46B4-8114-F0CBDEE66E27} folder moved successfully. C:\Users\Wagner\AppData\Local\{2DC84037-E64A-4A80-ADF9-EA6D6A5E6D1B} folder moved successfully. C:\Users\Wagner\AppData\Local\{2E5B4A57-B9AB-4E63-8AC7-F3FF17F59F3F} folder moved successfully. C:\Users\Wagner\AppData\Local\{30139D4D-12D7-4ABD-92EF-7398855788B9} folder moved successfully. C:\Users\Wagner\AppData\Local\{30CAB58F-0BE8-4D96-B695-179330F8F30A} folder moved successfully. C:\Users\Wagner\AppData\Local\{30D4E19B-2744-4B22-81F7-C2B3882E0F1B} folder moved successfully. C:\Users\Wagner\AppData\Local\{32A8A637-7289-4653-A0EF-1D7BCDA1B840} folder moved successfully. C:\Users\Wagner\AppData\Local\{34F3AF14-4117-4368-A4DA-BF36B8B55A01} folder moved successfully. C:\Users\Wagner\AppData\Local\{34FF560C-A24F-4A3A-83F2-D0B818BFD9A5} folder moved successfully. C:\Users\Wagner\AppData\Local\{3579FDAF-27A6-422F-B50D-A65C10608B6E} folder moved successfully. C:\Users\Wagner\AppData\Local\{35E3BBD3-35B0-47AA-B090-432C1561248C} folder moved successfully. C:\Users\Wagner\AppData\Local\{3726F2F0-9DCB-41AB-B742-564EC3852BA8} folder moved successfully. C:\Users\Wagner\AppData\Local\{3769FED2-8A0E-4016-8115-AD269A4C7FB9} folder moved successfully. C:\Users\Wagner\AppData\Local\{37DCF7CB-2918-4119-8CF2-A350DCD8213E} folder moved successfully. C:\Users\Wagner\AppData\Local\{37EEA4E7-9E08-4B06-A272-C75311ECB928} folder moved successfully. C:\Users\Wagner\AppData\Local\{37F49C1D-0F01-4DB1-BE7D-7872A406BFE6} folder moved successfully. C:\Users\Wagner\AppData\Local\{3806BBD3-AE3C-4FB0-8BAD-822FE4517D4A} folder moved successfully. C:\Users\Wagner\AppData\Local\{3869C9A2-33B4-43C2-B80F-8C435427C76C} folder moved successfully. C:\Users\Wagner\AppData\Local\{39673D1C-89EC-43F8-96AF-93A3BA28775B} folder moved successfully. C:\Users\Wagner\AppData\Local\{396ED6A4-6D95-4A79-8134-4C2679E1D649} folder moved successfully. C:\Users\Wagner\AppData\Local\{39A8DC85-B480-41F4-B0CB-CC4D7B14A16E} folder moved successfully. C:\Users\Wagner\AppData\Local\{39E776D9-1EAC-4158-B592-5B5812FE3F7E} folder moved successfully. C:\Users\Wagner\AppData\Local\{3A6BAC78-E5EE-459E-9786-50F230A3BAA0} folder moved successfully. C:\Users\Wagner\AppData\Local\{3A98EC66-A263-43AB-A053-BA1969E5BDC9} folder moved successfully. C:\Users\Wagner\AppData\Local\{3BF6EBCF-A65F-42B4-8C3F-3898EC34C38F} folder moved successfully. C:\Users\Wagner\AppData\Local\{3C928520-00EE-465C-93FE-83264907379D} folder moved successfully. C:\Users\Wagner\AppData\Local\{3ED6CD6C-151E-47CA-8190-53AD14C7152A} folder moved successfully. C:\Users\Wagner\AppData\Local\{3F20DED6-4536-40AE-ADDC-C3A48A55081B} folder moved successfully. C:\Users\Wagner\AppData\Local\{3FF840EC-02BA-4F7C-8A2B-0A890E1C2A65} folder moved successfully. C:\Users\Wagner\AppData\Local\{40744FBE-A633-4C1B-8C3F-4D5620909A01} folder moved successfully. C:\Users\Wagner\AppData\Local\{408E014A-E56F-45A0-9675-9DF271A4CC5F} folder moved successfully. C:\Users\Wagner\AppData\Local\{422A09A4-7895-4913-B156-7E43B169F9CA} folder moved successfully. C:\Users\Wagner\AppData\Local\{438B778A-3754-47E8-BEAC-DF4E53FAD8CE} folder moved successfully. C:\Users\Wagner\AppData\Local\{43B6227A-DF21-4B38-BD77-77C6345A6303} folder moved successfully. C:\Users\Wagner\AppData\Local\{43FCE93E-B519-4C63-9C3D-59A31D7BF60B} folder moved successfully. C:\Users\Wagner\AppData\Local\{44480BAB-7EAA-49C4-97FC-04FDE0032DBD} folder moved successfully. C:\Users\Wagner\AppData\Local\{449475CD-676C-417E-BBB5-A3F86D00F2E2} folder moved successfully. C:\Users\Wagner\AppData\Local\{44BDA30D-62C4-4024-A4AE-69AC0F342A67} folder moved successfully. C:\Users\Wagner\AppData\Local\{44F6FB93-D257-405C-B383-167C86278112} folder moved successfully. C:\Users\Wagner\AppData\Local\{45AA8A3D-11FC-4189-A51E-5D45698EE599} folder moved successfully. C:\Users\Wagner\AppData\Local\{464D47C8-7865-42BA-84F9-6875DE3451B8} folder moved successfully. C:\Users\Wagner\AppData\Local\{465FEA82-D5DB-457E-A96F-D174E32E76FC} folder moved successfully. C:\Users\Wagner\AppData\Local\{481995C8-2ED8-4085-8787-B95B04AA98A3} folder moved successfully. C:\Users\Wagner\AppData\Local\{4829983D-FAD0-453B-87F2-95D55DA1C197} folder moved successfully. C:\Users\Wagner\AppData\Local\{49258512-2905-40FD-866E-AD44FFC10380} folder moved successfully. C:\Users\Wagner\AppData\Local\{49D526E7-C732-4DB5-B3EC-B1AEE920B85B} folder moved successfully. C:\Users\Wagner\AppData\Local\{4B076044-904C-41DD-8652-4CBACC5CCB20} folder moved successfully. C:\Users\Wagner\AppData\Local\{4B629A78-DDB9-4AA3-B946-860E8D6594A5} folder moved successfully. C:\Users\Wagner\AppData\Local\{4CBEC7F5-0E85-473B-85FA-E878EADEA9AD} folder moved successfully. C:\Users\Wagner\AppData\Local\{4CD297D9-2B4E-4112-A9F8-1D72F69B0F36} folder moved successfully. C:\Users\Wagner\AppData\Local\{4DE2D5F8-DB3F-47CE-B073-8C01091F5469} folder moved successfully. C:\Users\Wagner\AppData\Local\{4E54A223-E988-487E-8D48-53F42FCB792D} folder moved successfully. C:\Users\Wagner\AppData\Local\{4E636DC0-F726-4EA3-A54D-85C003D09BB7} folder moved successfully. C:\Users\Wagner\AppData\Local\{4EA5D9BC-80F1-4026-805D-6602773E2320} folder moved successfully. C:\Users\Wagner\AppData\Local\{4F1FFF42-1FCF-4C64-AC46-C359C74681F9} folder moved successfully. C:\Users\Wagner\AppData\Local\{4FF00D02-AF7D-401E-84FC-9EC83C1CDECE} folder moved successfully. C:\Users\Wagner\AppData\Local\{511AE4DF-A4B3-4A6A-8B77-30D3FC05EC8F} folder moved successfully. C:\Users\Wagner\AppData\Local\{5219CA0D-EB1E-4190-A4D2-A282F082E2A2} folder moved successfully. C:\Users\Wagner\AppData\Local\{52CA17FE-282B-4404-BAC0-9EFFA3BF8708} folder moved successfully. C:\Users\Wagner\AppData\Local\{53236DAC-0EC9-4EDF-B2B1-4B54682C8BB9} folder moved successfully. C:\Users\Wagner\AppData\Local\{53C13FA5-3F6C-4B7A-BB49-8C4F7D58B783} folder moved successfully. C:\Users\Wagner\AppData\Local\{5497C73A-2BEA-404C-B317-EF7403C5868A} folder moved successfully. C:\Users\Wagner\AppData\Local\{54AF5194-B9DF-4A8B-8312-04656E698B8F} folder moved successfully. C:\Users\Wagner\AppData\Local\{54E4722A-5D52-4958-AB51-B6CC32641AFE} folder moved successfully. C:\Users\Wagner\AppData\Local\{54EF3180-FCF6-428D-9DE9-AE3F202AA02B} folder moved successfully. C:\Users\Wagner\AppData\Local\{557E9909-C038-4A64-832C-44990B059152} folder moved successfully. C:\Users\Wagner\AppData\Local\{55C94E73-CDF2-48D7-BD03-18A89E7A5C60} folder moved successfully. C:\Users\Wagner\AppData\Local\{55CBDA9F-C022-4097-9F40-FDBF0402D827} folder moved successfully. C:\Users\Wagner\AppData\Local\{5604C7E8-F0C7-4FAB-96FC-B6FA79DEC3B5} folder moved successfully. C:\Users\Wagner\AppData\Local\{56077C51-B48E-4769-AF2A-81541C10BEC1} folder moved successfully. C:\Users\Wagner\AppData\Local\{566B10EC-571A-4884-B8EA-828F60EDA5EA} folder moved successfully. C:\Users\Wagner\AppData\Local\{56BEBA25-8EA3-41F1-AFB2-897D558DBAAF} folder moved successfully. C:\Users\Wagner\AppData\Local\{56CC6F2A-2255-45D2-9F54-C70F6DA92452} folder moved successfully. C:\Users\Wagner\AppData\Local\{57D7628B-C94E-4928-AB8A-E889EE7CC332} folder moved successfully. C:\Users\Wagner\AppData\Local\{598CE668-EAE6-4E29-8CE3-AA8D446402EE} folder moved successfully. C:\Users\Wagner\AppData\Local\{599B6EE3-14BD-47CA-9FB7-8701EED72BCB} folder moved successfully. C:\Users\Wagner\AppData\Local\{59F9BAA7-B5A3-4E27-A35E-E46E16E6D525} folder moved successfully. C:\Users\Wagner\AppData\Local\{5A44106A-D4FA-41AD-822E-83907319DE3A} folder moved successfully. C:\Users\Wagner\AppData\Local\{5BEC7E73-91F5-4ACC-8389-5D5EDBFE2EF6} folder moved successfully. C:\Users\Wagner\AppData\Local\{5C928D46-1789-4212-85FE-3DD395F1525B} folder moved successfully. C:\Users\Wagner\AppData\Local\{5CD826C2-AF89-4433-B487-D51DF9A9CEB7} folder moved successfully. C:\Users\Wagner\AppData\Local\{5D6F6F48-085C-49E1-9450-6560CB9C81E9} folder moved successfully. C:\Users\Wagner\AppData\Local\{5E85D1F3-0F61-4D37-ACA8-83A76C4DA71B} folder moved successfully. C:\Users\Wagner\AppData\Local\{5F1C9962-389F-4271-989F-71C98BEF2531} folder moved successfully. C:\Users\Wagner\AppData\Local\{5F698631-51D0-4BA8-B978-49C5687E26A9} folder moved successfully. C:\Users\Wagner\AppData\Local\{5F91F27B-BE83-436A-A6D4-D5FD3049D1F6} folder moved successfully. C:\Users\Wagner\AppData\Local\{6045D3A5-CA20-4FAD-8D68-2314F289830C} folder moved successfully. C:\Users\Wagner\AppData\Local\{6172DAA8-AD01-4959-AE77-3FACF7025264} folder moved successfully. C:\Users\Wagner\AppData\Local\{61931A49-1116-4CC3-BBAC-FCDE265B849F} folder moved successfully. C:\Users\Wagner\AppData\Local\{61F87806-8A14-4482-A076-319345EDD52D} folder moved successfully. C:\Users\Wagner\AppData\Local\{61FD1357-F1EC-4746-BAD1-EF02B4AB868B} folder moved successfully. C:\Users\Wagner\AppData\Local\{62856712-1F3F-4D34-BD9D-DBDA5681838F} folder moved successfully. C:\Users\Wagner\AppData\Local\{634C6C0F-5837-4EDB-B50B-FD4AC1758F45} folder moved successfully. C:\Users\Wagner\AppData\Local\{638396AD-282A-4311-9B90-06D8DB6DB8F7} folder moved successfully. C:\Users\Wagner\AppData\Local\{6461C394-79F3-4F2D-B28B-093CDFE7F497} folder moved successfully. C:\Users\Wagner\AppData\Local\{64D5CEFC-5887-4AEC-A6DD-A43FEFC105D3} folder moved successfully. C:\Users\Wagner\AppData\Local\{653B15BF-7108-4255-A360-716819D7DE57} folder moved successfully. C:\Users\Wagner\AppData\Local\{6545AD13-9672-4191-8FA6-3E0E497D19BE} folder moved successfully. C:\Users\Wagner\AppData\Local\{659FDDAD-5BDF-4F8D-8F07-C7C419C44341} folder moved successfully. C:\Users\Wagner\AppData\Local\{66ABF27D-451E-49FE-B670-507FF43460DE} folder moved successfully. C:\Users\Wagner\AppData\Local\{66DCA525-80EA-4DED-A226-97110DFAE54C} folder moved successfully. C:\Users\Wagner\AppData\Local\{6780873E-C8C7-4DA9-AD65-514FF7A8E976} folder moved successfully. C:\Users\Wagner\AppData\Local\{6784C379-00C3-4F69-A25F-5506AC9E24C1} folder moved successfully. C:\Users\Wagner\AppData\Local\{6844592E-B2CB-4069-B9BD-EC53DB40F5C0} folder moved successfully. C:\Users\Wagner\AppData\Local\{688BFD06-F060-4FF2-9D48-462D330E30D8} folder moved successfully. C:\Users\Wagner\AppData\Local\{695D7BB4-64F8-4189-9157-F54DA1657952} folder moved successfully. C:\Users\Wagner\AppData\Local\{696968F5-B60F-4DDB-8D6F-D6B2C83A9339} folder moved successfully. C:\Users\Wagner\AppData\Local\{6973EBFF-9400-4513-9055-F061FC2AE214} folder moved successfully. C:\Users\Wagner\AppData\Local\{699006F8-F31C-4EC7-9BB0-67F53F5B6C00} folder moved successfully. C:\Users\Wagner\AppData\Local\{69EFDCFC-D80C-4C20-9B55-CAB11C26169B} folder moved successfully. C:\Users\Wagner\AppData\Local\{6AC1D6F8-376A-4907-96CB-24879490828E} folder moved successfully. C:\Users\Wagner\AppData\Local\{6AC4A78E-B289-4ED8-948E-77D3E492CCFA} folder moved successfully. C:\Users\Wagner\AppData\Local\{6BEAE4C1-51D4-4C2F-AF83-67DB6E65FEE2} folder moved successfully. C:\Users\Wagner\AppData\Local\{6CBAC366-7E2E-419B-B850-F7D0C124A5BE} folder moved successfully. C:\Users\Wagner\AppData\Local\{6D1B7701-673B-4356-A732-FE388AA043AD} folder moved successfully. C:\Users\Wagner\AppData\Local\{6D8876B2-B2E1-4022-B54C-F4CFE1555ED1} folder moved successfully. C:\Users\Wagner\AppData\Local\{6DD64661-23D4-4F09-AC1C-D72E741FE532} folder moved successfully. C:\Users\Wagner\AppData\Local\{6DE8ACCD-5C6B-4A26-BDC9-5FC85E98B259} folder moved successfully. C:\Users\Wagner\AppData\Local\{6DF9A234-9F2B-4B0D-8BC6-98FD9AF92AE5} folder moved successfully. C:\Users\Wagner\AppData\Local\{6E757EF7-083D-4684-B209-D755B369FE04} folder moved successfully. C:\Users\Wagner\AppData\Local\{6E815B8B-8145-4B8F-95FD-80D70EB9DCF2} folder moved successfully. C:\Users\Wagner\AppData\Local\{6ED9E81C-9632-4687-98B6-4FB22755C50B} folder moved successfully. C:\Users\Wagner\AppData\Local\{6F759695-7E92-41CC-83F6-68C081109E9F} folder moved successfully. C:\Users\Wagner\AppData\Local\{6F763449-06BB-406D-8D80-9198B070D22A} folder moved successfully. C:\Users\Wagner\AppData\Local\{708D729B-A6DB-41D4-AB0E-EC521E2F51CF} folder moved successfully. C:\Users\Wagner\AppData\Local\{70B77496-6509-4334-8B5E-C70F285EFC43} folder moved successfully. C:\Users\Wagner\AppData\Local\{7153CF9A-F8B0-404F-99D8-16512974A3FC} folder moved successfully. C:\Users\Wagner\AppData\Local\{715C9323-833B-4E9D-892D-9854F9FBCFEF} folder moved successfully. C:\Users\Wagner\AppData\Local\{72C67598-A33B-41C7-B605-E4526A8A4662} folder moved successfully. C:\Users\Wagner\AppData\Local\{731FDB74-054F-4D8B-94C8-62B89E956D6B} folder moved successfully. C:\Users\Wagner\AppData\Local\{739FB4C3-C1D4-4244-9AAD-CEDC86CCD0D6} folder moved successfully. C:\Users\Wagner\AppData\Local\{73B2CAB7-2082-4B15-B4DD-E6450FD4845A} folder moved successfully. C:\Users\Wagner\AppData\Local\{748EB833-9A19-48F0-A1CC-FBFDCF29D67A} folder moved successfully. C:\Users\Wagner\AppData\Local\{751C3E6E-881C-4977-95AE-2C43726836E6} folder moved successfully. C:\Users\Wagner\AppData\Local\{75F9C8AF-53B3-4C66-A0B1-7484F809D593} folder moved successfully. C:\Users\Wagner\AppData\Local\{766B14C7-A1A5-4C0E-84BF-FCC7CB04998A} folder moved successfully. C:\Users\Wagner\AppData\Local\{768E6312-4194-4319-8116-F9360A9C6B17} folder moved successfully. C:\Users\Wagner\AppData\Local\{76F31042-BE4C-4CE4-977D-CB121D52F9BC} folder moved successfully. C:\Users\Wagner\AppData\Local\{774027E0-ED92-4072-A6B6-7F46EB06E3AC} folder moved successfully. C:\Users\Wagner\AppData\Local\{7758F9ED-9B39-4136-B126-EB68DEA23857} folder moved successfully. C:\Users\Wagner\AppData\Local\{77EA6FFA-6D76-407C-AD94-CC40B16EF72E} folder moved successfully. C:\Users\Wagner\AppData\Local\{785FDFB4-509A-4CFA-9807-CAF45F9D09B1} folder moved successfully. C:\Users\Wagner\AppData\Local\{792D1297-0BA4-4716-9EA3-47EFA8454A4B} folder moved successfully. C:\Users\Wagner\AppData\Local\{79B88AC4-E18C-40FB-9083-070848CB75D2} folder moved successfully. C:\Users\Wagner\AppData\Local\{7A4E8E6B-84CE-470E-BCA6-7CA0C692CA6E} folder moved successfully. C:\Users\Wagner\AppData\Local\{7B088E9C-E308-44FD-BFCE-EFAD1B94D2CE} folder moved successfully. C:\Users\Wagner\AppData\Local\{7B1FC0B6-A72E-4366-BD7A-3ECF915A60D2} folder moved successfully. C:\Users\Wagner\AppData\Local\{7B7AEE0D-B613-4EE6-A6B2-66F326345EF2} folder moved successfully. C:\Users\Wagner\AppData\Local\{7B7E50E5-BA63-4DC8-9F31-B13AC8197FDD} folder moved successfully. C:\Users\Wagner\AppData\Local\{7C1C18DA-C76F-4E63-9593-F4175BF8C8EF} folder moved successfully. C:\Users\Wagner\AppData\Local\{7CF33CA3-0871-4293-88EF-8F1C18D99486} folder moved successfully. C:\Users\Wagner\AppData\Local\{7D349A79-1F87-4835-800B-F9358888C03B} folder moved successfully. C:\Users\Wagner\AppData\Local\{7E16E103-2955-48BC-86E9-C47CB6E0C5EC} folder moved successfully. C:\Users\Wagner\AppData\Local\{7E6DB76C-B46C-44DD-9B3B-2745787A282E} folder moved successfully. C:\Users\Wagner\AppData\Local\{7F20B64E-6002-4A81-B95B-2BD53B56C40C} folder moved successfully. C:\Users\Wagner\AppData\Local\{7F95DC3B-67DC-4F75-B7AC-443189C98B75} folder moved successfully. C:\Users\Wagner\AppData\Local\{7FE899E7-D6D2-4145-A1B1-CE5717BB2018} folder moved successfully. C:\Users\Wagner\AppData\Local\{803EBFF9-9B9A-4BE6-B9DA-80BA75ABE8CF} folder moved successfully. C:\Users\Wagner\AppData\Local\{80B29256-6D46-4340-BEA0-287D3ED6283F} folder moved successfully. C:\Users\Wagner\AppData\Local\{80FAA5C8-5772-4DB7-8AFF-E80152EF3535} folder moved successfully. C:\Users\Wagner\AppData\Local\{812E3BE1-C90F-4617-B2A4-3121979A0A94} folder moved successfully. C:\Users\Wagner\AppData\Local\{813652EB-40D5-4791-B116-918EF2ECF6C0} folder moved successfully. C:\Users\Wagner\AppData\Local\{81671D4B-F3CA-4B77-8184-FD732A0ADAAF} folder moved successfully. C:\Users\Wagner\AppData\Local\{81919A36-0582-4120-A79E-C27542B6C8BA} folder moved successfully. C:\Users\Wagner\AppData\Local\{82088D2D-CCA6-4462-A1E0-C72B94AC4D85} folder moved successfully. C:\Users\Wagner\AppData\Local\{8289E726-F5BE-4469-AE66-35C0B9C7A173} folder moved successfully. C:\Users\Wagner\AppData\Local\{82B24DFA-E4FD-4E26-B915-D6F89063DB5C} folder moved successfully. C:\Users\Wagner\AppData\Local\{82D2A5CE-62B3-45D6-A7D6-F634C5976947} folder moved successfully. C:\Users\Wagner\AppData\Local\{83A4D1E8-5D33-4CE7-8A63-9D76F04A8511} folder moved successfully. C:\Users\Wagner\AppData\Local\{83DCF964-789F-45B0-89DF-BCE58DBD833B} folder moved successfully. C:\Users\Wagner\AppData\Local\{83EEBF0D-1354-46E0-ACBA-AF3150E8961A} folder moved successfully. C:\Users\Wagner\AppData\Local\{842F4976-FB57-4015-AE7E-1D8A53C09AB9} folder moved successfully. C:\Users\Wagner\AppData\Local\{849B6F9F-F555-4A74-B6CC-5C0CFC4D1E48} folder moved successfully. C:\Users\Wagner\AppData\Local\{8519015D-B56B-4A0C-B889-DFB1555E00F6} folder moved successfully. C:\Users\Wagner\AppData\Local\{85BC1B2F-9736-40C4-B1A2-B27B8D831C35} folder moved successfully. C:\Users\Wagner\AppData\Local\{8742E5A5-891D-49E2-A943-1AE69CAB3F83} folder moved successfully. C:\Users\Wagner\AppData\Local\{87A26351-25E6-41D9-AE48-C24535621FD1} folder moved successfully. C:\Users\Wagner\AppData\Local\{880ECBCA-000B-48C5-8495-244536F49810} folder moved successfully. C:\Users\Wagner\AppData\Local\{88A66EB8-F4E4-459E-828F-04FB40AA5C9A} folder moved successfully. C:\Users\Wagner\AppData\Local\{88AD07A4-A9CD-408C-8F3C-3C9303136F70} folder moved successfully. C:\Users\Wagner\AppData\Local\{88C3E32C-1424-41A9-B0BE-3E06F45D0C03} folder moved successfully. C:\Users\Wagner\AppData\Local\{88DEE423-27C8-4F7B-B889-D9E4D72EEA94} folder moved successfully. C:\Users\Wagner\AppData\Local\{891F006F-BCBC-4121-9A93-5BCC56D6C8D5} folder moved successfully. C:\Users\Wagner\AppData\Local\{89FFE345-77FD-4C9F-AE88-6F506CACAD50} folder moved successfully. C:\Users\Wagner\AppData\Local\{8A470FCC-C9D1-4315-BF23-FB9AEC0147D2} folder moved successfully. C:\Users\Wagner\AppData\Local\{8A8EA93D-61CB-42A3-BC67-74FC7993D6A9} folder moved successfully. C:\Users\Wagner\AppData\Local\{8BC2A353-E998-48C1-A1E7-2CB238F500A4} folder moved successfully. C:\Users\Wagner\AppData\Local\{8CE14A6F-28DD-4B35-A690-4156D70E3382} folder moved successfully. C:\Users\Wagner\AppData\Local\{8D13EF68-6C57-470C-93CC-ACCE2C386DED} folder moved successfully. C:\Users\Wagner\AppData\Local\{8D5A91E0-E6B0-43D5-94D8-505345B7FE4B} folder moved successfully. C:\Users\Wagner\AppData\Local\{8E4F65F5-2E02-49EA-BE40-270EFB8030F5} folder moved successfully. C:\Users\Wagner\AppData\Local\{8E53BCC6-81D0-4132-84A6-9ED68C007C28} folder moved successfully. C:\Users\Wagner\AppData\Local\{8F153C80-3012-4B9C-969A-9373E92BFA9C} folder moved successfully. C:\Users\Wagner\AppData\Local\{8F7EECC1-17AA-4DA9-8019-12E06F878B5D} folder moved successfully. C:\Users\Wagner\AppData\Local\{8FD10C4D-3E15-4F64-A552-167233B96A9E} folder moved successfully. C:\Users\Wagner\AppData\Local\{8FF7BE7A-749C-420E-9EBE-8BC843A4124F} folder moved successfully. C:\Users\Wagner\AppData\Local\{9041A8ED-BE2C-4F17-94FF-74175007121A} folder moved successfully. C:\Users\Wagner\AppData\Local\{90DA55C1-49D5-4669-AAA9-610D222B444F} folder moved successfully. C:\Users\Wagner\AppData\Local\{9166BFB0-7F4F-48F6-AA60-7A626ABA1140} folder moved successfully. C:\Users\Wagner\AppData\Local\{923544FD-55DF-4443-9F6D-F79BE9DBCDA7} folder moved successfully. C:\Users\Wagner\AppData\Local\{926ECCD9-7C2D-4F53-B4FE-C4979D20F06F} folder moved successfully. C:\Users\Wagner\AppData\Local\{92C4C3A7-F718-4A70-B5AC-3D7478AF2B4D} folder moved successfully. C:\Users\Wagner\AppData\Local\{93320734-8CDE-4D3A-8B6A-647621A874D9} folder moved successfully. C:\Users\Wagner\AppData\Local\{957213CF-8D70-4A9E-A1B3-CE0B3B38B406} folder moved successfully. C:\Users\Wagner\AppData\Local\{9633D5A7-871D-4345-9562-6F6661E91809} folder moved successfully. C:\Users\Wagner\AppData\Local\{963E9987-1EE4-4C00-9C5C-FC0A658FEDC0} folder moved successfully. C:\Users\Wagner\AppData\Local\{971BC82D-142C-4A56-A98B-60FE1356245A} folder moved successfully. C:\Users\Wagner\AppData\Local\{9757D7A8-B8B9-4134-9B09-38362B7E959F} folder moved successfully. C:\Users\Wagner\AppData\Local\{97807881-1695-4717-B7D7-426E1230E39B} folder moved successfully. C:\Users\Wagner\AppData\Local\{988F093A-6C59-4AD0-A4FC-E7265DBDAFEB} folder moved successfully. C:\Users\Wagner\AppData\Local\{98F0D6DA-DB6C-4883-A783-D1F05097F585} folder moved successfully. C:\Users\Wagner\AppData\Local\{9958082B-6F7F-4CF8-975B-73D381713787} folder moved successfully. C:\Users\Wagner\AppData\Local\{9A853B55-C7EF-4AC9-B25F-F1EF429BADFD} folder moved successfully. C:\Users\Wagner\AppData\Local\{9B9940D4-D12F-48D3-827D-34D396D1D6C3} folder moved successfully. C:\Users\Wagner\AppData\Local\{9C110D8E-9E3E-4D63-830C-4165CB5B598B} folder moved successfully. C:\Users\Wagner\AppData\Local\{9C1C049B-A967-4DAF-82B9-055FC5CAE60C} folder moved successfully. C:\Users\Wagner\AppData\Local\{9D07C5FE-7422-4214-8E11-EDEEFCB85E55} folder moved successfully. C:\Users\Wagner\AppData\Local\{9D285C8F-5583-486F-8F61-DDC91024017B} folder moved successfully. C:\Users\Wagner\AppData\Local\{9DDE5153-DB55-464F-B65A-19944D8FC86E} folder moved successfully. C:\Users\Wagner\AppData\Local\{9DE5DC66-39BE-47B5-8D29-22637C8BC606} folder moved successfully. C:\Users\Wagner\AppData\Local\{9E8F6783-2C83-45FB-BD5E-3A8E02EE7893} folder moved successfully. C:\Users\Wagner\AppData\Local\{9EAC359B-AF4A-4F86-BF39-663C38D6BCE6} folder moved successfully. C:\Users\Wagner\AppData\Local\{9EC018FF-A7A1-4F57-B1AB-6AC41D354C6D} folder moved successfully. C:\Users\Wagner\AppData\Local\{9EC294FB-49AD-4695-866D-63444ABA8459} folder moved successfully. C:\Users\Wagner\AppData\Local\{9F10E1E0-339B-4274-B132-F960276AC1E4} folder moved successfully. C:\Users\Wagner\AppData\Local\{9F251B39-2235-49FF-AD1F-795702B67A24} folder moved successfully. C:\Users\Wagner\AppData\Local\{9F25AD6D-F62E-4091-9BB6-8F7B14227005} folder moved successfully. C:\Users\Wagner\AppData\Local\{9F5CD9BB-C084-42A9-93DB-68EF65B7B7F8} folder moved successfully. C:\Users\Wagner\AppData\Local\{9F8BD129-BABB-4BBF-9D4C-52E7952F2F00} folder moved successfully. C:\Users\Wagner\AppData\Local\{9F95B1D1-7E7E-42F1-99AD-28961F199CD0} folder moved successfully. C:\Users\Wagner\AppData\Local\{9FBB9942-9265-4C07-8276-9B85A9F12915} folder moved successfully. C:\Users\Wagner\AppData\Local\{A09A80ED-9065-4C6C-BDC5-0668C8E0C2DE} folder moved successfully. C:\Users\Wagner\AppData\Local\{A0B477F2-50A7-4F87-BD4D-9508511809DC} folder moved successfully. C:\Users\Wagner\AppData\Local\{A0E5F803-02C5-40AD-AF25-A5C1612732B3} folder moved successfully. C:\Users\Wagner\AppData\Local\{A11DF049-F963-4AEB-A18A-D5DD10B8F4F6} folder moved successfully. C:\Users\Wagner\AppData\Local\{A19746E1-75E4-4320-8D9F-91C8AFE5435D} folder moved successfully. C:\Users\Wagner\AppData\Local\{A23F7CD1-EB29-455D-9D46-0345EC87EAF8} folder moved successfully. C:\Users\Wagner\AppData\Local\{A3D961A3-50C5-415A-A552-20E7F0987934} folder moved successfully. C:\Users\Wagner\AppData\Local\{A4351778-EA61-4623-9728-4B58A6D16A8D} folder moved successfully. C:\Users\Wagner\AppData\Local\{A57A7ECC-9068-49ED-A192-1C82C5EB7955} folder moved successfully. C:\Users\Wagner\AppData\Local\{A58C7961-40B2-406C-ADB6-2F2071CB3D6B} folder moved successfully. C:\Users\Wagner\AppData\Local\{A59A324C-F2C0-4582-AAD7-2C3C842279D5} folder moved successfully. C:\Users\Wagner\AppData\Local\{A692A490-98E0-4472-A021-0F6EA8992892} folder moved successfully. C:\Users\Wagner\AppData\Local\{A76A6678-A6C5-470E-8A12-789B4F02D6F4} folder moved successfully. C:\Users\Wagner\AppData\Local\{A7D3F5ED-5A0A-47B3-8A7D-6BF0C59F1CB4} folder moved successfully. C:\Users\Wagner\AppData\Local\{A7FCA964-0E06-41F5-B605-869BB488F3EC} folder moved successfully. C:\Users\Wagner\AppData\Local\{A81AFB53-7898-448B-AA64-E4CE56D4FE17} folder moved successfully. C:\Users\Wagner\AppData\Local\{A8F8EFB8-BE82-461A-B0B2-C43E1673A73B} folder moved successfully. C:\Users\Wagner\AppData\Local\{A95300A6-ADE5-49BF-B837-1B18933573FB} folder moved successfully. C:\Users\Wagner\AppData\Local\{A9B9014C-9D87-4D2C-8830-F6A2CC65F47D} folder moved successfully. C:\Users\Wagner\AppData\Local\{AA8EE96F-CD81-4F02-9B57-A2F172BAFDF5} folder moved successfully. C:\Users\Wagner\AppData\Local\{AB50BBEA-F567-4C9C-A441-95746BFC5C8E} folder moved successfully. C:\Users\Wagner\AppData\Local\{AC072233-0C25-4303-8827-C41BE317F823} folder moved successfully. C:\Users\Wagner\AppData\Local\{AC93993A-7311-432A-ACB4-34FD636F24C6} folder moved successfully. C:\Users\Wagner\AppData\Local\{AD62ABAF-DDE9-40EC-B8A7-0EF20F833B67} folder moved successfully. C:\Users\Wagner\AppData\Local\{ADD36B95-84F6-43D3-B779-7027969E1567} folder moved successfully. C:\Users\Wagner\AppData\Local\{AE12B64B-8FAD-4194-BBCB-6554B56755AE} folder moved successfully. C:\Users\Wagner\AppData\Local\{AEBEEBF0-4B66-4D74-9116-11835122862E} folder moved successfully. C:\Users\Wagner\AppData\Local\{AFB50D4C-E3AC-4D5B-B4C7-D870165C151F} folder moved successfully. C:\Users\Wagner\AppData\Local\{AFC61EFD-B3AF-4A9F-B8E0-9E2D2DA0543C} folder moved successfully. C:\Users\Wagner\AppData\Local\{B0474C52-7B9E-4A6F-935B-E547B68AC99F} folder moved successfully. C:\Users\Wagner\AppData\Local\{B1027CC9-77EA-466C-9022-1923E938DF63} folder moved successfully. C:\Users\Wagner\AppData\Local\{B104A1BB-B64C-46C6-9BA0-B6650D325E43} folder moved successfully. C:\Users\Wagner\AppData\Local\{B25937B8-0704-4257-B981-F94EF6F9F551} folder moved successfully. C:\Users\Wagner\AppData\Local\{B2DE2CE1-FD5A-4663-9904-44E4303BDAE4} folder moved successfully. C:\Users\Wagner\AppData\Local\{B38688CD-1548-42AA-B43E-6881EF0BCED2} folder moved successfully. C:\Users\Wagner\AppData\Local\{B481835E-8374-4E28-8737-8704D22D7F68} folder moved successfully. C:\Users\Wagner\AppData\Local\{B4C09A37-E9E2-4381-9987-38FDA6B6B106} folder moved successfully. C:\Users\Wagner\AppData\Local\{B622643B-10F2-4FE3-8508-5F46BEEFFA0D} folder moved successfully. C:\Users\Wagner\AppData\Local\{B69E7A0B-3425-4F28-A528-EBB23C02368B} folder moved successfully. C:\Users\Wagner\AppData\Local\{B6A277EA-BAB9-4A95-8C10-722CA15ACBC2} folder moved successfully. C:\Users\Wagner\AppData\Local\{B727C09A-7BC4-41DB-837D-FFF7D1EA641B} folder moved successfully. C:\Users\Wagner\AppData\Local\{B73546FE-C45D-41EB-995B-4D6A92771CE0} folder moved successfully. C:\Users\Wagner\AppData\Local\{B7475DAE-BE91-42D7-B5E3-63E7CA67ACFE} folder moved successfully. C:\Users\Wagner\AppData\Local\{B78F574C-A2D6-4A07-B826-52697E73E497} folder moved successfully. C:\Users\Wagner\AppData\Local\{B88161D1-EAB4-4BCD-9617-F28ADC79FB17} folder moved successfully. C:\Users\Wagner\AppData\Local\{B8E3A29F-E9C6-4F45-968D-F4B42350755D} folder moved successfully. C:\Users\Wagner\AppData\Local\{B91F8DAC-0B45-4231-B6AA-E9DAA3832AFB} folder moved successfully. C:\Users\Wagner\AppData\Local\{B9875266-A19B-4BB2-A03D-88AF7B054DF4} folder moved successfully. C:\Users\Wagner\AppData\Local\{BA49321E-368C-4BD2-A9E5-BCA5C95A5C7B} folder moved successfully. C:\Users\Wagner\AppData\Local\{BA732679-82E5-468E-816A-12F0C09D5A5F} folder moved successfully. C:\Users\Wagner\AppData\Local\{BA78C932-D6A5-41B5-9021-5A1B005BB50A} folder moved successfully. C:\Users\Wagner\AppData\Local\{BAF63919-2DB1-46F2-B259-41AF59D0EB70} folder moved successfully. C:\Users\Wagner\AppData\Local\{BB657DE3-024D-463D-89F8-A96FF7EB6DB9} folder moved successfully. C:\Users\Wagner\AppData\Local\{BCC4C326-70B3-496F-A751-252512E0132B} folder moved successfully. C:\Users\Wagner\AppData\Local\{BCD52DD4-84A2-4FF7-ADB7-217FCF6A3109} folder moved successfully. C:\Users\Wagner\AppData\Local\{BD12BDAB-7551-4450-B528-7A35AA07C5EC} folder moved successfully. C:\Users\Wagner\AppData\Local\{BDD0C623-3F0C-4CF0-978A-D5644D2CF57F} folder moved successfully. C:\Users\Wagner\AppData\Local\{BDE3452A-DD1E-4D0F-A65F-49644A5005F0} folder moved successfully. C:\Users\Wagner\AppData\Local\{BE72000F-FA14-42A9-B6B4-8F3D9C99405F} folder moved successfully. C:\Users\Wagner\AppData\Local\{BE7444DC-6861-4004-B618-448C1AF1AC88} folder moved successfully. C:\Users\Wagner\AppData\Local\{BEB85609-4EA2-495B-82BD-C18F3E8D89CF} folder moved successfully. C:\Users\Wagner\AppData\Local\{C17F55B8-E70A-4212-A103-FD131161D84D} folder moved successfully. C:\Users\Wagner\AppData\Local\{C1C46168-9575-46FD-9F46-DEA584358D01} folder moved successfully. C:\Users\Wagner\AppData\Local\{C23D8463-487B-4CFA-AA04-712FAF7668D8} folder moved successfully. C:\Users\Wagner\AppData\Local\{C315A624-B014-4A0E-951C-01CC10666F89} folder moved successfully. C:\Users\Wagner\AppData\Local\{C3B60140-EE71-418E-8488-8318B4E37221} folder moved successfully. C:\Users\Wagner\AppData\Local\{C41D5EBE-570B-4BDB-8B7E-6982239E46E0} folder moved successfully. C:\Users\Wagner\AppData\Local\{C5010DC6-D538-4586-B7D3-52A23900181D} folder moved successfully. C:\Users\Wagner\AppData\Local\{C5218960-6AA6-447D-B2D9-F4CE9556BAD1} folder moved successfully. C:\Users\Wagner\AppData\Local\{C526BC6C-D46E-4082-BB4E-5902DB259376} folder moved successfully. C:\Users\Wagner\AppData\Local\{C571692A-8E0F-407B-85CF-9849CDF02501} folder moved successfully. C:\Users\Wagner\AppData\Local\{C6C0DAEB-B5B9-4089-AC9F-526D1C043D9B} folder moved successfully. C:\Users\Wagner\AppData\Local\{C7CC7850-A2F1-4826-A9CB-C03A3B51857B} folder moved successfully. C:\Users\Wagner\AppData\Local\{CA7CBEDF-0B57-42BC-BBA9-19ADBBE05E86} folder moved successfully. C:\Users\Wagner\AppData\Local\{CAAA1D75-39F6-4D75-A983-BDB9BDED26A4} folder moved successfully. C:\Users\Wagner\AppData\Local\{CB55654A-80F9-4AAD-B33C-DEE6177815EC} folder moved successfully. C:\Users\Wagner\AppData\Local\{CB993C32-489C-4D47-A391-F606440FE8B2} folder moved successfully. C:\Users\Wagner\AppData\Local\{CBCF1856-B09D-419A-A31F-2EAB6E69A404} folder moved successfully. C:\Users\Wagner\AppData\Local\{CBFB0EBD-197F-4565-BE67-91F8C31469E1} folder moved successfully. C:\Users\Wagner\AppData\Local\{CCFFD6D3-6DF7-4FF4-B94A-38A3609FFCC2} folder moved successfully. C:\Users\Wagner\AppData\Local\{CD07EABE-5A4D-44FB-96E7-CD9DCE508191} folder moved successfully. C:\Users\Wagner\AppData\Local\{CD387A59-BC7B-4497-996E-4961397D73C9} folder moved successfully. C:\Users\Wagner\AppData\Local\{CDB848B1-0178-499E-892C-03871663F37D} folder moved successfully. C:\Users\Wagner\AppData\Local\{CE720837-930E-4F87-9514-C5F9C746EC41} folder moved successfully. C:\Users\Wagner\AppData\Local\{CEBF8399-2F98-47F1-9493-91F31AED5FCA} folder moved successfully. C:\Users\Wagner\AppData\Local\{CFB0D349-0334-4158-9D45-E696E7398E4F} folder moved successfully. C:\Users\Wagner\AppData\Local\{D04243B1-004E-43AB-87B1-50F3D1091BA1} folder moved successfully. C:\Users\Wagner\AppData\Local\{D10C5250-5035-4E01-83DD-ECFDA4C6FDCB} folder moved successfully. C:\Users\Wagner\AppData\Local\{D298C802-6A0B-42C2-A8A1-8926629B42F1} folder moved successfully. C:\Users\Wagner\AppData\Local\{D347934F-2B0D-450A-BE94-59702E64A4FF} folder moved successfully. C:\Users\Wagner\AppData\Local\{D45A6557-4CE8-4CC6-B8D9-559799BE92F9} folder moved successfully. C:\Users\Wagner\AppData\Local\{D573CA88-0293-4ACE-8B63-2B95E5379861} folder moved successfully. C:\Users\Wagner\AppData\Local\{D5A589BD-30BB-4670-AFE1-C5AC8B4DD1FB} folder moved successfully. C:\Users\Wagner\AppData\Local\{D7121E64-1347-4383-BBE5-F445C1333D15} folder moved successfully. C:\Users\Wagner\AppData\Local\{D83F00BE-9A27-427E-B12A-7B8EB0A702DB} folder moved successfully. C:\Users\Wagner\AppData\Local\{D9A73CB0-6FBE-42CE-B2E6-1FA9810B0FE9} folder moved successfully. C:\Users\Wagner\AppData\Local\{D9FB18B1-F272-4730-8033-C3457F372B56} folder moved successfully. C:\Users\Wagner\AppData\Local\{DA849090-9024-4CFB-AE94-93D0C72664B2} folder moved successfully. C:\Users\Wagner\AppData\Local\{DAF2D68C-70ED-49F4-B2D0-8AC729EB6032} folder moved successfully. C:\Users\Wagner\AppData\Local\{DB58065A-E5D3-40EA-999F-F6D0CAD903A7} folder moved successfully. C:\Users\Wagner\AppData\Local\{DB6A2833-69F0-412B-B7FD-33F6984ECE5B} folder moved successfully. C:\Users\Wagner\AppData\Local\{DBCDDD52-731C-47F8-8786-7A565FCB1109} folder moved successfully. C:\Users\Wagner\AppData\Local\{DC195892-CC24-437F-88C8-A784B1F45563} folder moved successfully. C:\Users\Wagner\AppData\Local\{DDA89165-A95C-4843-9D6B-3BE0D545672C} folder moved successfully. C:\Users\Wagner\AppData\Local\{DDCB63FF-5FD7-448D-B6FC-3A9FC17D0381} folder moved successfully. C:\Users\Wagner\AppData\Local\{DEEEE874-1013-4F66-94E4-31E1B3FEE038} folder moved successfully. C:\Users\Wagner\AppData\Local\{DF53614E-74CF-4B40-9991-E7CD67EA6310} folder moved successfully. C:\Users\Wagner\AppData\Local\{DFE4BCFC-F50F-44D6-9360-1F4C8DA4012C} folder moved successfully. C:\Users\Wagner\AppData\Local\{E04A9000-5AF9-4BCA-9978-0D6CEA5E69FF} folder moved successfully. C:\Users\Wagner\AppData\Local\{E0DEFC46-16B1-4934-9E2C-79265C1B2BF7} folder moved successfully. C:\Users\Wagner\AppData\Local\{E1E75A36-7CD3-46A3-84BA-229DCC45495C} folder moved successfully. C:\Users\Wagner\AppData\Local\{E29AE63C-424F-4AAB-867E-E7D88A7E5E14} folder moved successfully. C:\Users\Wagner\AppData\Local\{E2C36B76-355C-4E3D-B852-28D85A736D03} folder moved successfully. C:\Users\Wagner\AppData\Local\{E35D13DB-24D5-412A-852E-0450C9D796F2} folder moved successfully. C:\Users\Wagner\AppData\Local\{E4740E17-8F33-49F3-9F3B-2483062D8FAD} folder moved successfully. C:\Users\Wagner\AppData\Local\{E4B883BC-B9A8-47B9-B0A1-C78E8AC85330} folder moved successfully. C:\Users\Wagner\AppData\Local\{E50A596D-61C7-4341-85E4-52086ECD1202} folder moved successfully. C:\Users\Wagner\AppData\Local\{E51E8781-E219-4A2A-BA94-2ACA18E88346} folder moved successfully. C:\Users\Wagner\AppData\Local\{E57C2C5B-4FCF-4CD9-9EAB-AA2F4B3ABD80} folder moved successfully. C:\Users\Wagner\AppData\Local\{E586617B-3C75-4AB7-AA75-447117D3EF0E} folder moved successfully. C:\Users\Wagner\AppData\Local\{E62FF2DE-8FF4-433A-9C77-F6F31213662F} folder moved successfully. C:\Users\Wagner\AppData\Local\{E779E23E-2803-43A0-A2ED-9AC368549B47} folder moved successfully. C:\Users\Wagner\AppData\Local\{E78A042F-EE82-4766-9934-8BD9C4A5478A} folder moved successfully. C:\Users\Wagner\AppData\Local\{E8133CD7-7C1C-41A5-899F-9CFC153251C2} folder moved successfully. C:\Users\Wagner\AppData\Local\{E85CC26D-6A9B-4981-96D5-635826851137} folder moved successfully. C:\Users\Wagner\AppData\Local\{E90EE8A8-7ADF-44DB-87C1-AC30BDCF9211} folder moved successfully. C:\Users\Wagner\AppData\Local\{E9394652-0398-4D9F-AE9C-7F022C1352C0} folder moved successfully. C:\Users\Wagner\AppData\Local\{E976802B-5759-4E01-A831-A655AE9229DD} folder moved successfully. C:\Users\Wagner\AppData\Local\{EA0C4CD9-F0A8-4C2C-B4E4-F19FE44B50DE} folder moved successfully. C:\Users\Wagner\AppData\Local\{EAB983DE-0C53-4ECF-96D7-199B6DC5283E} folder moved successfully. C:\Users\Wagner\AppData\Local\{EAEA7FC9-E181-4546-B943-DF2BBE309F66} folder moved successfully. C:\Users\Wagner\AppData\Local\{EBDE461E-EB9F-42B7-BC02-E49AF70B2910} folder moved successfully. C:\Users\Wagner\AppData\Local\{ECD7F71E-13A4-48C5-B3D9-D4B5B616EAD7} folder moved successfully. C:\Users\Wagner\AppData\Local\{ED63A918-8F72-4729-84D1-0DC51B171B26} folder moved successfully. C:\Users\Wagner\AppData\Local\{ED69F4A6-8B47-4F1B-B0A8-976B644842FF} folder moved successfully. C:\Users\Wagner\AppData\Local\{EE36F72A-69EE-467F-BE57-61298FFA921A} folder moved successfully. C:\Users\Wagner\AppData\Local\{EE7B5708-1E72-4468-ACED-8B9D8D84044A} folder moved successfully. C:\Users\Wagner\AppData\Local\{EED8576D-5D7E-4F1D-8CDD-F78D0D7832CE} folder moved successfully. C:\Users\Wagner\AppData\Local\{EFC3ADB9-5970-4B3E-91D2-8D6DF6743EF6} folder moved successfully. C:\Users\Wagner\AppData\Local\{EFC8E449-BCF5-4EFF-A5E4-9C6DAFA7AF20} folder moved successfully. C:\Users\Wagner\AppData\Local\{F0AB32CC-4560-4C95-9F76-B163CAAFDC0A} folder moved successfully. C:\Users\Wagner\AppData\Local\{F2FB26FE-1AAD-44F1-825D-74030FA28111} folder moved successfully. C:\Users\Wagner\AppData\Local\{F3D0DF05-7585-4DE5-BFF8-C93B6F4FFD91} folder moved successfully. C:\Users\Wagner\AppData\Local\{F4585C9D-7EF9-4DA9-A71C-86384D0941C6} folder moved successfully. C:\Users\Wagner\AppData\Local\{F4D6263C-13C4-4DE5-A2CD-70A3FC2C03C8} folder moved successfully. C:\Users\Wagner\AppData\Local\{F4E58996-EF88-414C-89E4-0D24EDFB218C} folder moved successfully. C:\Users\Wagner\AppData\Local\{F54BF7F4-4CEE-40B3-A256-376787B57C3F} folder moved successfully. C:\Users\Wagner\AppData\Local\{F599268F-04DD-4698-B30A-429C80A5EE7C} folder moved successfully. C:\Users\Wagner\AppData\Local\{F5D51919-9DAD-453C-8428-0FE288E21D8E} folder moved successfully. C:\Users\Wagner\AppData\Local\{F65EED43-229C-4114-9D01-71FA0D9CCC9C} folder moved successfully. C:\Users\Wagner\AppData\Local\{F6F4DDC1-7CDA-49E8-935B-1C278B65AA81} folder moved successfully. C:\Users\Wagner\AppData\Local\{F7C8004C-B4CD-4FAB-AB9A-CDD212C76FB0} folder moved successfully. C:\Users\Wagner\AppData\Local\{F822E98C-1AF3-4B8E-9A47-78AD46E2A5CE} folder moved successfully. C:\Users\Wagner\AppData\Local\{F8DC19A5-AED7-4F74-9ED9-FC6D9E65AD2A} folder moved successfully. C:\Users\Wagner\AppData\Local\{F9263A3A-8CFE-494B-A4C7-040610975586} folder moved successfully. C:\Users\Wagner\AppData\Local\{F95A33E2-05FA-452E-8086-6CB85DB37DE6} folder moved successfully. C:\Users\Wagner\AppData\Local\{F9A1C14C-22FC-42A8-8D25-4E3028EAB9A3} folder moved successfully. C:\Users\Wagner\AppData\Local\{FA01E930-144D-48F9-83B5-696C5054A688} folder moved successfully. C:\Users\Wagner\AppData\Local\{FA0593CC-10C8-47A9-877D-967172A7F46B} folder moved successfully. C:\Users\Wagner\AppData\Local\{FA13C6F2-344C-456B-B9A8-FC5D344B6E24} folder moved successfully. C:\Users\Wagner\AppData\Local\{FA206AD3-62E2-4174-BF67-BF4E67E81C14} folder moved successfully. C:\Users\Wagner\AppData\Local\{FA258C42-A09C-404E-A314-FAD17C0568E5} folder moved successfully. C:\Users\Wagner\AppData\Local\{FA46C234-6D66-47EA-939F-CF78DBAB992D} folder moved successfully. C:\Users\Wagner\AppData\Local\{FA800EA5-F610-4630-90E3-25B35D0F8B49} folder moved successfully. C:\Users\Wagner\AppData\Local\{FAC9318D-F9D6-4A21-8106-6B7BC5D977F1} folder moved successfully. C:\Users\Wagner\AppData\Local\{FAE6B779-F266-4C4A-83AB-AA1755579702} folder moved successfully. C:\Users\Wagner\AppData\Local\{FB3E27C1-6436-4AB9-898A-5006A499E784} folder moved successfully. C:\Users\Wagner\AppData\Local\{FBA98EF8-3998-45FA-BF5A-48394E947749} folder moved successfully. C:\Users\Wagner\AppData\Local\{FC0E2028-2A2E-4A13-8045-547DF2E36281} folder moved successfully. C:\Users\Wagner\AppData\Local\{FC15DC8F-00BB-4DA4-9415-0CD36C131583} folder moved successfully. C:\Users\Wagner\AppData\Local\{FC802F4E-7ADA-4129-A979-849FD8937041} folder moved successfully. C:\Users\Wagner\AppData\Local\{FCE2BBDC-2FF6-4496-B09D-2CA6673BEF5B} folder moved successfully. C:\Users\Wagner\AppData\Local\{FD158E53-A94A-4F8C-A833-4051A382C0C9} folder moved successfully. C:\Users\Wagner\AppData\Local\{FD51AD55-8C7E-454E-AC33-B9488B8026DD} folder moved successfully. C:\Users\Wagner\AppData\Local\{FD7F7A51-0954-45F4-A5EB-C4F0448B3C5E} folder moved successfully. C:\Users\Wagner\AppData\Local\{FD815B7F-52F8-4A67-B6A2-6BFBC8C24A9A} folder moved successfully. C:\Users\Wagner\AppData\Local\{FD8354E1-216B-4ACF-912E-BBAAAB6C7847} folder moved successfully. C:\Users\Wagner\AppData\Local\{FDB4FE2A-EBA5-4639-9BED-AC4F49B2468B} folder moved successfully. C:\Users\Wagner\AppData\Local\{FDBA3908-F628-4384-B092-50D521AC093C} folder moved successfully. C:\Users\Wagner\AppData\Local\{FE167BD7-A99E-4993-91A1-6DFD7770C0E1} folder moved successfully. C:\Users\Wagner\AppData\Local\{FEEB4304-95EC-435B-BAF2-952392FBE816} folder moved successfully. C:\Users\Wagner\AppData\Local\{FFC477DC-32AF-4152-8387-524B0CDE9DF3} folder moved successfully. C:\Users\Wagner\AppData\Local\{FFE76974-97DA-4314-9613-EF785B46744F} folder moved successfully. C:\Users\Wagner\AppData\Local\Temp\AutoRun.exe moved successfully. C:\Users\Wagner\AppData\Local\Temp\eauninstall.exe moved successfully. C:\Users\Wagner\AppData\Local\Temp\EBU1E4A.exe moved successfully. C:\Users\Wagner\AppData\Local\Temp\EBUCDAA.exe moved successfully. C:\Users\Wagner\AppData\Local\Temp\First15.exe moved successfully. C:\Users\Wagner\AppData\Local\Temp\FlashPlayerUpdate.exe moved successfully. C:\Users\Wagner\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe moved successfully. C:\Users\Wagner\AppData\Local\Temp\IcqUpdater.exe moved successfully. C:\Users\Wagner\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe moved successfully. C:\Users\Wagner\AppData\Local\Temp\uninst.exe moved successfully. C:\Users\Wagner\AppData\Local\Temp\vlc-1.0.3-win32.exe moved successfully. C:\Users\Wagner\AppData\Local\Temp\VP6Install.exe moved successfully. C:\Users\Wagner\AppData\Local\Temp\wlsetup-cvr.exe moved successfully. C:\Users\Wagner\AppData\Local\Temp\_is7445.exe moved successfully. C:\Users\Wagner\AppData\Local\Temp\_isB164.exe moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\5535ab32-7af11405-n folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\f84c6ae-2a2166d5-n folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully. C:\Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully. C:\Users\Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully. < ipconfig /flushdns /c > Windows-IP-Konfiguration Der DNS-Aufl”sungscache wurde geleert. C:\Users\Wagner\Desktop\cmd.bat deleted successfully. C:\Users\Wagner\Desktop\cmd.txt deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes ->Flash cache emptied: 75 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Gast ->Temp folder emptied: 48575420 bytes ->Temporary Internet Files folder emptied: 49201265 bytes ->Java cache emptied: 23515606 bytes ->Flash cache emptied: 41726 bytes User: Public User: Silja ->Temp folder emptied: 1130355 bytes ->Temporary Internet Files folder emptied: 29468129 bytes ->Flash cache emptied: 1089 bytes User: Wagner ->Temp folder emptied: 485757494 bytes ->Temporary Internet Files folder emptied: 881844051 bytes ->FireFox cache emptied: 143629342 bytes ->Flash cache emptied: 2891565 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 392470463 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 6865561 bytes RecycleBin emptied: 459532552 bytes Total Files Cleaned = 2,408.00 mb OTL by OldTimer - Version 3.2.60.0 log created on 09092012_192907 Files\Folders moved on Reboot... C:\Users\Wagner\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot... Liebe Grüße |
10.09.2012, 02:38 | #4 |
/// Helfer-Team | Gvu trojaner Bitte das Malwarebytes Logfile posten! Schritt 2 (Reiter Logberichte) |
10.09.2012, 17:16 | #5 |
| Gvu trojaner Entschuldigung Malwarebytes Log: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.09.09.05 Windows 7 x64 NTFS Internet Explorer 9.0.8112.16421 Wagner :: WAGNER-PC [Administrator] Schutz: Aktiviert 09.09.2012 20:02:50 mbam-log-2012-09-09 (20-02-50).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 488296 Laufzeit: 1 Stunde(n), 32 Minute(n), 22 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\_OTL\MovedFiles\09092012_192907\C_Users\Wagner\AppData\Local\Temp\fest0r_ot.exe (Spyware.Zbot.DG) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) |
11.09.2012, 00:24 | #6 |
/// Helfer-Team | Gvu trojaner Sehr gut! Wie laeuft der Rechner? Malware-Scan mit Emsisoft Anti-Malware Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm. Lade über Jetzt Updaten die aktuellen Signaturen herunter. Wähle den Freeware-Modus aus. Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers. Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten. Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________ --> Gvu trojaner |
11.09.2012, 16:37 | #7 | |
| Gvu trojaner Ok wenn ich das Emisoft Setup starten möchte kommt direkt nach der Sprachauswahl folgende Fehlermeldung: Zitat:
Vielen Dank schon mal Geändert von 1Silli1 (11.09.2012 um 16:50 Uhr) |
12.09.2012, 08:31 | #8 |
/// Helfer-Team | Gvu trojaner Alles Windows Updates einspielen, inkl. Service Pack! |
13.09.2012, 19:36 | #9 |
| Gvu trojaner Alles klar hier ist der Bericht: Code:
ATTFilter Emsisoft Anti-Malware - Version 6.6 Letztes Update: 9/13/2012 6:54:50 PM Scan Einstellungen: Scan Methode: Detail Scan Objekte: Rootkits, Speicher, Traces, C:\, D:\ Archiv Scan: An ADS Scan: An Scan Beginn: 9/13/2012 6:55:44 PM C:\_OTL\MovedFiles\09092012_192907\C_Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\215ac186-7431da29 -> r__aa\r__ab.class gefunden: Java.CVE!E2 C:\_OTL\MovedFiles\09092012_192907\C_Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\215ac186-7431da29 -> r__aa\r__ac.class gefunden: Exploit.Java.Agent!E2 C:\_OTL\MovedFiles\09092012_192907\C_Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\215ac186-7431da29 -> r__aa\r__aa.class gefunden: Exploit.Java.Blacole!E2 C:\_OTL\MovedFiles\09092012_192907\C_Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\215ac186-7431da29 -> r__aa\r__ad.class gefunden: Exploit.Java.Agent!E2 Gescannt 709626 Gefunden 4 Scan Ende: 9/13/2012 8:26:16 PM Scan Zeit: 1:30:32 C:\_OTL\MovedFiles\09092012_192907\C_Users\Wagner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\215ac186-7431da29 -> r__aa\r__aa.class Quarantäne Exploit.Java.Blacole!E2 Quarantäne 1 |
14.09.2012, 15:25 | #10 |
/// Helfer-Team | Gvu trojaner Sehr gut! Deinstalliere: Emsisoft Anti-Malware ESET Online Scanner Vorbereitung
|
15.09.2012, 01:09 | #11 |
| Gvu trojaner Ok vielen Dank. Hier ist die Log Datei : Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=437e66423e61a84cae3c76db02d1a2a5 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-09-14 07:59:40 # local_time=2012-09-14 09:59:40 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=513 16777085 100 97 894 96715441 0 0 # compatibility_mode=1797 16775165 100 94 5344642 84176605 5521674 0 # compatibility_mode=5893 16776573 100 94 14377 99274592 0 0 # compatibility_mode=8192 67108863 100 0 501 501 0 0 # compatibility_mode=9217 16777214 25 13 83563498 83563500 0 0 # scanned=269750 # found=0 # cleaned=0 # scan_time=8038 |
16.09.2012, 18:00 | #12 |
/// Helfer-Team | Gvu trojaner Java aktualisieren Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck Java deaktivieren Aufgrund derezeitigen Sicherheitsluecke: http://www.trojaner-board.de/122961-...ktivieren.html Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck |
19.09.2012, 22:03 | #13 |
| Gvu trojaner Hallo hier der plug in check Code:
ATTFilter PluginCheck Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen. Überprüft wird: Browser, Flash, Java und Adobe Reader Version. Firefox 13.0.1 ist veraltet! Flash (11,4,402,278) ist aktuell. Java (1,7,0,7) ist aktuell. Adobe Reader 9,3,0,148 ist veraltet! Aktualisieren Sie bitte auf die neueste Version: 10,1,3 Zurück Code:
ATTFilter PluginCheck Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen. Überprüft wird: Browser, Flash, Java und Adobe Reader Version. Firefox 13.0.1 ist veraltet! Flash (11,4,402,278) ist aktuell. Java (1,7,0,7) ist aktuell. Adobe Reader 9,3,0,148 ist veraltet! Aktualisieren Sie bitte auf die neueste Version: 10,1,3 Geändert von 1Silli1 (19.09.2012 um 22:08 Uhr) |
21.09.2012, 12:05 | #14 | |
/// Helfer-Team | Gvu trojanerZitat:
Sehr gut! damit bist Du sauber und entlassen! adwCleaner entfernen
Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
Zurücksetzen der Sicherheitszonen Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen. Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html Systemwiederherstellungen leeren Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein: Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7 Danach wieder aktivieren. Aufräumen mit CCleaner Lasse mit CCleaner (Download) (Anleitung) Fehler in der
Lektuere zum abarbeiten: http://www.trojaner-board.de/90880-d...tallation.html http://www.trojaner-board.de/105213-...tellungen.html PluginCheck http://www.trojaner-board.de/96344-a...-rechners.html Secunia Online Software Inspector http://www.trojaner-board.de/71715-k...iendungen.html http://www.trojaner-board.de/83238-a...sschalten.html PC wird immer langsamer - was tun? |
25.09.2012, 14:21 | #15 |
| Gvu trojaner Alles klar und vielen dank |
Themen zu Gvu trojaner |
asus, autostart, bingbar, c:\windows, data, explorer, format, google, home, hotkey, icq, internetverbindung, laptop, logfile, microsoft, pagefile.sys, plug-in, scan, spyware.zbot.dg, tools, trojan.ransom.gen, trojaner, vdeck.exe, verbindung, webcam, windows, wireless |