| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: WIN32.BHO.acw TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
12.10.2012, 11:34
| #16 |
| /// the machine /// TB-Ausbilder    |  WIN32.BHO.acw Trojaner Das brauch ich nicht nochmal 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.10.2012, 13:26
| #17 |
 | WIN32.BHO.acw Trojaner C:\$Recycle.Bin\S-1-5-21-761482002-1890292078-4171726984-1000\$R173V2T.exe a variant of Win32/SoftonicDownloader.E application
__________________C:\$Recycle.Bin\S-1-5-21-761482002-1890292078-4171726984-1000\$R5U50C6.exe a variant of Win32/OpenInstall application C:\$Recycle.Bin\S-1-5-21-761482002-1890292078-4171726984-1000\$R72TSMX.exe Win32/SoftonicDownloader.D application C:\$Recycle.Bin\S-1-5-21-761482002-1890292078-4171726984-1000\$RBLWTBI.exe a variant of Win32/InstallCore.AW application C:\$Recycle.Bin\S-1-5-21-761482002-1890292078-4171726984-1000\$RCOFKHR.exe a variant of Win32/Somoto.A application C:\$Recycle.Bin\S-1-5-21-761482002-1890292078-4171726984-1000\$RQ42AMP.exe a variant of Win32/SoftonicDownloader.E application C:\$Recycle.Bin\S-1-5-21-761482002-1890292078-4171726984-1000\$RW4Q1VR.exe Win32/SpeedUpMyPC application C:\Program Files\Uniblue\RegistryBooster\Launcher.exe a variant of Win32/RegistryBooster application C:\Program Files\Uniblue\RegistryBooster\registrybooster.exe Win32/RegistryBooster application |
|
12.10.2012, 13:56
| #18 |
| /// the machine /// TB-Ausbilder | WIN32.BHO.acw Trojaner Den Registry Booster deinstallieren, Papierkorb leeren. Frisches OTL log bitte.
__________________Noch Probleme?
__________________ |
|
12.10.2012, 14:53
| #19 |
| | WIN32.BHO.acw Trojaner OTL Logfile: Code:
ATTFilter OTL logfile created on: 12.10.2012 15:01:43 - Run 6 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Sweetheart\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,42 Gb Available Physical Memory | 47,34% Memory free 6,20 Gb Paging File | 4,19 Gb Available in Paging File | 67,63% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 298,09 Gb Total Space | 65,93 Gb Free Space | 22,12% Space Free | Partition Type: NTFS Computer Name: KUSCHELMONSTER | User Name: Sweetheart | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.10.11 23:10:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sweetheart\Desktop\OTL.exe PRC - [2012.10.03 23:57:42 | 000,711,112 | ---- | M] () -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.0.0\ToolbarUpdater.exe PRC - [2012.09.25 11:43:01 | 001,239,064 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe PRC - [2012.09.19 11:29:44 | 001,869,152 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesApp32.exe PRC - [2012.09.19 11:29:42 | 001,699,168 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe PRC - [2012.09.13 23:18:56 | 000,471,040 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe PRC - [2012.09.13 23:18:20 | 000,217,600 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe PRC - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.09.03 10:11:56 | 011,325,376 | ---- | M] (Innovative Solutions) -- C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe PRC - [2012.08.20 09:33:01 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.06.11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE PRC - [2012.06.08 09:02:24 | 000,521,344 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Online Games Manager\ogmservice.exe PRC - [2012.06.01 08:02:20 | 000,366,536 | ---- | M] (IncrediMail, Ltd.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe PRC - [2012.06.01 08:02:20 | 000,264,136 | ---- | M] (IncrediMail, Ltd.) -- C:\Program Files\IncrediMail\Bin\ImApp.exe PRC - [2012.05.08 16:12:35 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2012.05.08 16:12:35 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.08 16:12:35 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.10.17 15:12:52 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2011.10.07 11:40:42 | 001,387,288 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPointP\SetPoint.exe PRC - [2011.09.27 21:05:24 | 000,149,784 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe PRC - [2009.11.28 21:39:39 | 000,403,968 | ---- | M] (Hansenet) -- C:\Program Files\Alice\Signup\AliceCnn.exe PRC - [2009.08.22 12:31:06 | 005,148,672 | ---- | M] () -- C:\Program Files\Rainlendar2\Rainlendar2.exe PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.01.26 16:31:16 | 002,144,088 | RHS- | M] (Safer Networking Limited) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe PRC - [2009.01.26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe ========== Modules (No Company Name) ========== MOD - [2012.10.12 11:22:47 | 011,820,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\508b444db523c5cf20ff12c7f440837b\System.Web.ni.dll MOD - [2012.10.12 11:22:34 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\846b9cf2756fdd15f704c9bab9c70b6f\System.Runtime.Remoting.ni.dll MOD - [2012.10.12 11:22:22 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\54426ee1881b42af5b090e223f43823c\WindowsBase.ni.dll MOD - [2012.10.12 11:06:21 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll MOD - [2012.10.12 11:06:09 | 001,592,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll MOD - [2012.10.12 11:05:25 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d2630342a066a7cb9056d9eb6157687a\System.Xml.ni.dll MOD - [2012.10.12 11:05:17 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bd76aaaa03ddc15d1840207b5a480644\System.Configuration.ni.dll MOD - [2012.10.12 11:04:49 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll MOD - [2012.10.12 11:04:27 | 011,492,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll MOD - [2012.10.05 11:14:15 | 002,106,392 | ---- | M] () -- c:\ProgramData\Browser Manager\2.3.765.24\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll MOD - [2012.09.25 11:42:58 | 000,460,312 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.79\ppgooglenaclpluginchrome.dll MOD - [2012.09.25 11:42:57 | 012,278,808 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll MOD - [2012.09.25 11:42:55 | 004,005,912 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.79\pdf.dll MOD - [2012.09.25 11:41:39 | 000,578,072 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.79\libglesv2.dll MOD - [2012.09.25 11:41:38 | 000,123,416 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.79\libegl.dll MOD - [2012.09.25 11:41:27 | 000,156,712 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.79\avutil-51.dll MOD - [2012.09.25 11:41:26 | 000,275,496 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.79\avformat-54.dll MOD - [2012.09.25 11:41:24 | 002,168,360 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.79\avcodec-54.dll MOD - [2012.09.13 22:53:32 | 000,037,376 | ---- | M] () -- C:\Windows\System32\atitmpxx.dll MOD - [2012.07.31 11:07:52 | 000,008,648 | ---- | M] () -- C:\Program Files\Innovative Solutions\DriverMax\sync.dll MOD - [2012.06.01 08:02:23 | 000,071,624 | ---- | M] () -- C:\Program Files\IncrediMail\Bin\wlessfp1.dll MOD - [2012.06.01 08:02:21 | 000,268,232 | ---- | M] () -- C:\Program Files\IncrediMail\Bin\ImLookExU.dll MOD - [2012.06.01 08:02:20 | 000,133,064 | ---- | M] () -- C:\Program Files\IncrediMail\Bin\ImComUtlU.dll MOD - [2012.06.01 08:02:20 | 000,079,816 | ---- | M] () -- C:\Program Files\IncrediMail\Bin\ImAppRU.dll MOD - [2012.06.01 08:02:20 | 000,032,648 | ---- | M] () -- C:\Program Files\IncrediMail\Bin\IMHttpComm.dll MOD - [2012.06.01 08:01:41 | 001,000,784 | ---- | M] () -- C:\Program Files\IncrediMail\Bin\AE\ActionEngine.dll MOD - [2012.02.13 13:02:09 | 005,283,840 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll MOD - [2012.02.13 13:02:04 | 004,214,784 | ---- | M] () -- C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll MOD - [2011.10.07 11:41:16 | 000,879,896 | ---- | M] () -- C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll MOD - [2011.01.30 16:19:12 | 000,107,896 | ---- | M] () -- C:\Program Files\IncrediMail\Bin\PMC.dll MOD - [2011.01.04 22:54:12 | 000,243,712 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll MOD - [2009.12.12 16:12:03 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll MOD - [2009.12.03 02:29:15 | 000,667,648 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.dll MOD - [2009.08.22 12:32:50 | 000,724,992 | ---- | M] () -- C:\Program Files\Rainlendar2\plugins\iCalendarPlugin.dll MOD - [2009.08.22 12:31:06 | 005,148,672 | ---- | M] () -- C:\Program Files\Rainlendar2\Rainlendar2.exe MOD - [2009.03.30 06:42:12 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll MOD - [2009.03.30 06:42:12 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll MOD - [2009.03.30 06:42:12 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll MOD - [2009.03.30 06:42:11 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2009.02.18 20:39:19 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll MOD - [2009.02.18 20:39:19 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll MOD - [2009.02.18 20:39:19 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll MOD - [2009.02.18 20:39:17 | 000,196,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll MOD - [2008.11.07 22:00:46 | 000,009,216 | ---- | M] () -- C:\Program Files\Rainlendar2\lfs.dll MOD - [2008.11.07 21:59:08 | 000,131,072 | ---- | M] () -- C:\Program Files\Rainlendar2\lua51.dll MOD - [2007.03.24 22:44:22 | 000,114,688 | ---- | M] () -- C:\Program Files\Alice\Signup\sys.plg MOD - [2007.02.12 18:54:32 | 000,253,952 | ---- | M] () -- C:\Program Files\Alice\Signup\dslsetup.plg MOD - [2005.10.04 18:28:40 | 000,081,920 | ---- | M] () -- C:\Program Files\Alice\Signup\htmlpars.plg MOD - [2005.09.23 19:10:22 | 000,081,920 | ---- | M] () -- C:\Program Files\Alice\Signup\alice.plg MOD - [2005.08.17 20:36:28 | 000,090,112 | ---- | M] () -- C:\Program Files\Alice\Signup\Support.plg MOD - [2005.04.15 13:35:50 | 000,077,824 | ---- | M] () -- C:\Program Files\Alice\Signup\SueDsl.plg ========== Services (SafeList) ========== SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SBSDWSCService) SRV - [2012.10.08 23:10:40 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.10.03 23:57:42 | 000,711,112 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.0.0\ToolbarUpdater.exe -- (vToolbarUpdater13.0.0) SRV - [2012.09.19 11:29:42 | 001,699,168 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc) SRV - [2012.09.13 23:18:20 | 000,217,600 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2012.09.11 09:12:29 | 004,537,664 | ---- | M] () [Auto | Running] -- c:\program files\common files\akamai/netsession_win_5891ae0.dll -- (Akamai) SRV - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.09.05 14:05:50 | 000,124,472 | ---- | M] (MSI) [Disabled | Stopped] -- C:\MSI\MSI SUITE\Super-Charger\SuiteChargeService.exe -- (MSI_SuiteCharger) SRV - [2012.08.30 14:08:28 | 000,102,968 | ---- | M] (MSI) [Disabled | Stopped] -- C:\MSI\MSI SUITE\FastBoot\SuiteFastBootService.exe -- (MSI_SuiteFastBoot) SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.07.12 13:20:54 | 003,947,320 | ---- | M] (Trend Micro Inc.) [Disabled | Stopped] -- C:\Program Files\Trend Micro SafeSync\hrfscore.exe -- (OnlineStorageService) SRV - [2012.06.29 17:56:30 | 000,136,704 | ---- | M] (MSI) [Disabled | Stopped] -- C:\Program Files\MSI\Super-Charger\ChargeService.exe -- (MSI_SuperCharger) SRV - [2012.06.11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE -- (BBUpdate) SRV - [2012.06.11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE -- (BBSvc) SRV - [2012.06.08 09:02:24 | 000,521,344 | ---- | M] (RealNetworks, Inc.) [Auto | Running] -- C:\Program Files\Online Games Manager\ogmservice.exe -- (ogmservice) SRV - [2012.05.08 16:12:35 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.05.08 16:12:35 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.04.23 09:36:32 | 000,010,752 | ---- | M] () [Disabled | Stopped] -- C:\MSI\MSI SUITE\MSIMonitor\MSIFileSyncMonitor.exe -- (MSIFileSyncMonitor) SRV - [2012.04.22 10:05:38 | 000,474,168 | ---- | M] (Sony Corporation) [Disabled | Stopped] -- C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe -- (PMBDeviceInfoProvider) SRV - [2012.04.17 14:01:42 | 000,075,280 | ---- | M] (MSI) [Disabled | Stopped] -- C:\MSI\MSI SUITE\ControlCenter\ComCenService.exe -- (MSI_ComCenService) SRV - [2011.10.17 15:12:52 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) SRV - [2011.09.27 21:03:28 | 000,295,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2011.07.18 20:10:37 | 000,040,960 | ---- | M] () [Disabled | Stopped] -- C:\Users\Sweetheart\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer) SRV - [2010.10.08 11:06:48 | 000,030,016 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp) SRV - [2010.06.14 15:07:14 | 000,615,936 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2010.01.05 00:41:00 | 003,670,928 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc) SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\XDva360.sys -- (XDva360) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleNT.sys -- (EagleNT) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) DRV - File not found [Kernel | Boot | Stopped] -- System32\drivers\nagcnh.sys -- (anepufr) DRV - [2012.10.03 23:57:43 | 000,026,984 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtpx86.sys -- (avgtp) DRV - [2012.09.19 10:50:50 | 000,010,088 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv) DRV - [2012.09.14 00:00:10 | 009,106,432 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2012.09.14 00:00:10 | 009,106,432 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag) DRV - [2012.09.13 22:55:00 | 000,370,176 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap) DRV - [2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012.08.01 23:02:36 | 000,015,248 | ---- | M] (PenMount) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pmkbdfltr.sys -- (pmkbdfltr) DRV - [2012.05.23 13:56:52 | 000,161,640 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\mv61xx.sys -- (mv61xx) DRV - [2012.05.08 16:12:36 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012.05.08 16:12:36 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012.03.30 15:26:30 | 000,007,680 | ---- | M] (MSI) [Kernel | On_Demand | Stopped] -- C:\MSI\MSI SUITE\NTIOLib.sys -- (NTIOLib_1_0_C) DRV - [2012.02.23 14:31:36 | 000,083,984 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdLH3.sys -- (AtiHDAudioService) DRV - [2011.12.29 13:37:44 | 000,028,464 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\LPCFilter.sys -- (LPCFilter) DRV - [2011.09.20 11:08:12 | 000,007,680 | ---- | M] (MSI) [Kernel | On_Demand | Stopped] -- C:\MSI\MSI SUITE\ControlCenter\NTIOLib.sys -- (NTIOLib_1_0_D) DRV - [2011.09.16 17:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2011.09.02 08:31:28 | 000,039,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt) DRV - [2011.09.02 08:31:28 | 000,030,360 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt) DRV - [2011.09.02 08:31:20 | 000,041,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt) DRV - [2010.11.04 15:18:04 | 000,102,728 | ---- | M] (Matrox Graphics Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\MxEFUF32.sys -- (MxEFUF) DRV - [2010.10.20 14:43:08 | 000,007,680 | ---- | M] (MSI) [Kernel | On_Demand | Stopped] -- C:\Program Files\MSI\Live Update 5\NTIOLib.sys -- (NTIOLib_1_0_4) DRV - [2010.03.16 21:20:51 | 000,685,816 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd) DRV - [2010.02.27 10:30:29 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt) DRV - [2010.02.26 14:32:58 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2010.02.26 14:32:46 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2010.02.26 14:32:44 | 000,022,528 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2010.02.26 14:32:44 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2010.02.16 08:57:42 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt) DRV - [2009.12.30 13:55:14 | 000,007,680 | ---- | M] (MSI) [Kernel | On_Demand | Stopped] -- C:\Program Files\MSI\Super-Charger\NTIOLib.sys -- (NTIOLib_1_0_3) DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2008.02.19 08:09:10 | 000,072,704 | ---- | M] (Point Grey Research) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HS3dSensor1394.sys -- (PGR1394b) DRV - [2007.04.13 14:22:56 | 000,228,224 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) DRV - [2006.11.28 23:46:24 | 000,028,224 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PDNMp50.sys -- (PDNMp50) DRV - [2006.11.28 23:46:22 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PDNSp50.sys -- (PDNSp50) DRV - [2002.06.10 15:20:50 | 000,039,936 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvcd.sys -- (QCDonner) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://alice.aol.de IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://alice.aol.de IE - HKLM\..\URLSearchHook: - No CLSID value found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found IE - HKLM\..\SearchScopes,DefaultScope = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - No CLSID value found IE - HKCU\..\URLSearchHook: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - No CLSID value found IE - HKCU\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} IE - HKCU\..\SearchScopes\{299622BC-AC86-494D-9E5C-9B385816C0D6}: "URL" = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&mode=bounce&k=0 IE - HKCU\..\SearchScopes\{2DA5735A-B19D-4322-8CC1-D93D0CFE630E}: "URL" = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&mode=bounce&k=0 IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\..\SearchScopes\{79262CC3-E08A-4E62-868B-482145ABA554}: "URL" = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&mode=bounce&k=0 IE - HKCU\..\SearchScopes\{A92D9454-CA97-4F63-B91F-68786D2099D6}: "URL" = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&mode=bounce&k=0 IE - HKCU\..\SearchScopes\{CA0339FC-CDA1-46FB-96DD-E89D390B0413}: "URL" = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&mode=bounce&k=0 IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredimail.com/german/?search={searchTerms}&loc=search_box IE - HKCU\..\SearchScopes\{F4BB98EE-A332-4FDF-8E77-93BE46555CAA}: "URL" = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&mode=bounce&k=0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..extensions.enabledAddons: {336D0C35-8A85-403a-B9D2-65C292C39087}:2.0.0.441 FF - prefs.js..extensions.enabledAddons: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}:6.0.33 FF - prefs.js..extensions.enabledAddons: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}:6.0.35 FF - prefs.js..extensions.enabledAddons: {800b5000-a755-47e1-992b-48a1c1357f07}:1.5.3 FF - prefs.js..extensions.enabledAddons: avg@toolbar:13.0.0.7 FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.3.42 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2 FF - prefs.js..extensions.enabledItems: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}:3.2.1.3 FF - prefs.js..extensions.enabledItems: {000F1EA4-5E08-4564-A29B-29076F63A37A}:1.0.3.139 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0}:2.7.2.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\Users\Sweetheart\AppData\Roaming\Mozilla\Firefox\Profiles\28endelp.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}\plugins\npsoe.dll () FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKLM\Software\MozillaPlugins\@Webzen.com/NPGameWebStarter: C:\Program Files\WEBZEN\WebzenGameStarter\NPGameWebStarter.dll File not found FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010.08.19 20:52:51 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.06 22:02:51 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.16 15:48:58 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010.08.19 20:52:52 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\finder@meingutscheincode.de: C:\Program Files\Mein Gutscheincode Finder\Firefox [2011.07.18 20:10:40 | 000,000,000 | ---D | M] [2009.11.28 21:52:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sweetheart\AppData\Roaming\mozilla\Extensions [2012.10.12 12:07:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sweetheart\AppData\Roaming\mozilla\Firefox\Profiles\28endelp.default\extensions [2010.11.14 10:52:28 | 000,000,000 | ---D | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\Firefox\Profiles\28endelp.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A} [2010.11.03 09:03:51 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Sweetheart\AppData\Roaming\mozilla\Firefox\Profiles\28endelp.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2012.09.07 10:47:12 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Sweetheart\AppData\Roaming\mozilla\Firefox\Profiles\28endelp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012.09.06 10:40:01 | 000,101,871 | ---- | M] () (No name found) -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\extensions\ciuvo-extension@icq.de.xpi [2012.09.23 22:53:40 | 000,000,950 | ---- | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\searchplugins\icqplugin-1.xml [2012.10.04 12:45:06 | 000,000,950 | ---- | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\searchplugins\icqplugin-2.xml [2012.06.06 11:43:27 | 000,001,056 | ---- | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\searchplugins\icqplugin.xml [2011.07.18 20:10:40 | 000,001,687 | ---- | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\searchplugins\winamp-search.xml [2011.07.18 20:10:40 | 000,001,870 | ---- | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\searchplugins\{C9FFD529-F13F-47F5-9D04-488F9F9F6E79}.xml [2011.07.18 20:10:40 | 000,002,077 | ---- | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\searchplugins\{FA9D6423-B334-46A2-9214-7A64B933E387}.xml [2011.07.18 20:10:40 | 000,002,188 | ---- | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\searchplugins\{FEB502EE-54AB-4A4D-8404-1932DE660FCE}.xml [2012.10.12 11:49:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2012.07.30 19:33:39 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} File not found (No name found) -- C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX File not found (No name found) -- C:\PROGRAMDATA\AVG SECURE SEARCH\FIREFOXEXT\13.0.0.7 File not found (No name found) -- C:\PROGRAMDATA\BROWSER MANAGER\2.3.765.24\{16CDFF19-861D-48E3-A751-D99A27784753}\FIREFOXEXTENSION [2012.06.06 22:02:50 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.06.28 17:42:00 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll [2012.06.06 22:02:48 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.06.06 22:02:48 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.06.06 22:02:48 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.06.06 22:02:48 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.06 22:02:48 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.06 22:02:48 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: hxxp://search.babylon.com/?affID=110824&tt=101012_24_4112_2&babsrc=HP_ss&mntrId=5a9e0d6b000000000000000000000000 CHR - default_search_provider: AVG Secure Search (Enabled) CHR - default_search_provider: search_url = https://isearch.avg.com/search?cid={0EAE350D-72C5-45AB-9C68-BFFEBE009481}&mid=7ab495e403bf47d0905c19b4330d3284-f1b2ed4f9eb8b0b53f1fcc3916f29e6d0c224b70&lang=de&ds=tt014&pr=sa&d=&v=&sap=dsp&q={searchTerms} CHR - default_search_provider: suggest_url = hxxp://clients5.google.com/complete/search?hl={language}&q={searchTerms}&client=ie8&inputencoding={inputEncoding}&outputencoding={outputEncoding} CHR - homepage: hxxp://search.babylon.com/?affID=110824&tt=101012_24_4112_2&babsrc=HP_ss&mntrId=5a9e0d6b000000000000000000000000 CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\22.0.1229.79\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\22.0.1229.79\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Sweetheart\AppData\Local\Google\Chrome\User Data\NPAPIFlash\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_278.dll CHR - plugin: Injovo Extension Plugin (Enabled) = C:\Users\Sweetheart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.441_0\npbrowserext.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Users\Sweetheart\AppData\Roaming\Mozilla\plugins\np-mswmp.dll CHR - plugin: AVG SiteSafety plugin (Enabled) = C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\13.0.0\\npsitesafety.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll CHR - plugin: Java(TM) Platform SE 6 U35 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll CHR - plugin: Java Deployment Toolkit 6.0.350.10 (Enabled) = C:\Windows\system32\npdeployJava1.dll CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll CHR - plugin: Unity Player (Enabled) = C:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll CHR - plugin: SOE Web Installer (Enabled) = C:\Users\Sweetheart\AppData\Roaming\Mozilla\Firefox\Profiles\28endelp.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}\plugins\npsoe.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - Extension: YouTube = C:\Users\Sweetheart\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\Sweetheart\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: preisspion.de = C:\Users\Sweetheart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo\3.0.2_0\ CHR - Extension: Google Mail = C:\Users\Sweetheart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können.) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - C:\Program Files\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll (Conversion One GmbH) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll (Google Inc.) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - No CLSID value found. O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4 - HKLM..\Run: [MSI Suite] C:\MSI\MSI SUITE\StartMSISuite.exe () O4 - HKLM..\Run: [Ocs_SM] C:\Users\Sweetheart\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS) O4 - HKLM..\Run: [PMBVolumeWatcher] C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe (Sony Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [Super-Charger] C:\Program Files\MSI\Super-Charger\Super-Charger.exe (MSI) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [] File not found O4 - HKCU..\Run: [DriverMax] C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe (Innovative Solutions) O4 - HKCU..\Run: [DriverMax_RESTART] C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe (Innovative Solutions) O4 - HKCU..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe (IncrediMail, Ltd.) O4 - HKCU..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe () O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited) O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4521BBEC-17A0-4C4D-A607-CF9B32D64006}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{71A460A0-92AC-4C40-9141-0B1041C1D07D}: NameServer = 62.109.123.197 213.191.74.19 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Sweetheart\Pictures\Hintergrundbilder\drachen.jpg O24 - Desktop BackupWallPaper: C:\Users\Sweetheart\Pictures\Hintergrundbilder\drachen.jpg O27 - HKLM IFEO\diagnostictool.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\excel.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\groove.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\hpcustpartic.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\hpwucli.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\hrfsclient.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\imgstud.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\infopath.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\msaccess.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\msi suite.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\msoxmled.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\mspub.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\mstore.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\ois.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\onenote.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\onenotem.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\outlook.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\pmbbrowser.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\pmbinit.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\powerpnt.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\super-charger.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\unins000.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O27 - HKLM IFEO\winword.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {A38B334A-A0A2-436D-BAA0-34FE5E517E44} - Microsoft .NET Framework 1.1 Security Update (KB2656370) ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Reg Error: Value error. ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software) NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.10.12 12:41:19 | 000,000,000 | ---D | C] -- C:\Program Files\ESET [2012.10.12 11:55:20 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2012.10.12 11:53:54 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Google [2012.10.12 10:26:54 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{882B453D-AC34-4177-A6A0-64E49C1E232A} [2012.10.11 23:09:53 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Sweetheart\Desktop\OTL.exe [2012.10.11 23:07:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Browser Manager [2012.10.11 22:26:37 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{C4481F9C-20C7-4C0A-BE6A-9C52BA4F54EB} [2012.10.11 10:26:15 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{308F0B84-DB51-45F1-A72C-7487F5B2133C} [2012.10.10 13:26:10 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{815B5E2E-6E92-49F1-A413-1BB0A79C1CAB} [2012.10.09 23:26:52 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{933D5892-15B0-44CB-9753-42EFB49C89FF} [2012.10.09 14:01:25 | 001,801,592 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\WavesGUILib.dll [2012.10.09 14:01:18 | 007,161,736 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EEP32A.dll [2012.10.09 14:01:17 | 007,377,272 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioRealtek.dll [2012.10.09 14:01:17 | 001,246,584 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioRealtek2.dll [2012.10.09 14:01:17 | 000,351,112 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EED32A.dll [2012.10.09 14:01:17 | 000,349,048 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxVolumeSDAPO.dll [2012.10.09 14:01:17 | 000,106,376 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EEL32A.dll [2012.10.09 14:01:17 | 000,091,528 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EEA32A.dll [2012.10.09 14:01:17 | 000,061,832 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EEG32A.dll [2012.10.09 14:01:16 | 001,929,592 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioEQ.dll [2012.10.09 14:01:16 | 000,717,176 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPOShell.dll [2012.10.09 14:01:15 | 002,195,040 | ---- | C] (Fortemedia Corporation) -- C:\Windows\System32\FMAPO.dll [2012.10.09 14:01:15 | 000,350,072 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO30.dll [2012.10.09 14:01:13 | 000,090,624 | ---- | C] (Real Sound Lab SIA) -- C:\Windows\System32\CONEQMSAPOGUILibrary.dll [2012.10.09 13:58:07 | 000,015,248 | ---- | C] (PenMount) -- C:\Windows\System32\drivers\pmkbdfltr.sys [2012.10.09 11:26:37 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{917B5FA0-BE0A-4C08-9C44-919E43237B04} [2012.10.08 23:26:21 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{F3F3C40E-9E74-48C1-BC02-FF09AB3A0747} [2012.10.08 23:21:29 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Magic3 [2012.10.08 11:29:43 | 000,028,464 | ---- | C] (COMPAL ELECTRONIC INC.) -- C:\Windows\System32\drivers\LPCFilter.sys [2012.10.08 11:26:06 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{47328226-A6A8-414D-BF78-AC938ABEEE4B} [2012.10.07 23:25:51 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{37A7F0E7-36B7-44B2-85DF-1137D5E1B8EE} [2012.10.07 11:25:36 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{0E93320C-D9FC-4B0E-BBDA-6C5DFE8ED582} [2012.10.06 23:07:44 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{4F8B0643-6196-4479-A77D-B2FBF564CCB0} [2012.10.06 11:07:28 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{DE896563-E8FB-4F68-99F5-946CD649BB4C} [2012.10.06 10:44:33 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\System32\CSVer.dll [2012.10.06 10:26:18 | 000,072,704 | ---- | C] (Point Grey Research) -- C:\Windows\System32\drivers\HS3dSensor1394.sys [2012.10.06 10:23:47 | 000,161,640 | ---- | C] (Marvell Semiconductor, Inc.) -- C:\Windows\System32\drivers\mv61xx.sys [2012.10.06 10:23:47 | 000,040,448 | ---- | C] (<Marvell>) -- C:\Windows\System32\mvcoinst.dll [2012.10.06 10:23:47 | 000,014,184 | ---- | C] (Marvell Semiconductor Inc.) -- C:\Windows\System32\drivers\mv61xxmm.sys [2012.10.06 10:18:43 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\.thinupload [2012.10.06 03:18:51 | 000,214,368 | ---- | C] (Synopsys, Inc.) -- C:\Windows\System32\SFNHK.dll [2012.10.06 03:18:50 | 000,074,080 | ---- | C] (Synopsys, Inc.) -- C:\Windows\System32\SFCOM.dll [2012.10.06 03:18:50 | 000,068,960 | ---- | C] (Synopsys, Inc.) -- C:\Windows\System32\SFAPO.dll [2012.10.06 03:18:46 | 000,421,744 | ---- | C] (DTS) -- C:\Windows\System32\DTSU2PLFX32.dll [2012.10.06 03:18:46 | 000,398,192 | ---- | C] (DTS) -- C:\Windows\System32\DTSU2PGFX32.dll [2012.10.06 03:18:46 | 000,357,712 | ---- | C] (Knowles Acoustics ) -- C:\Windows\System32\KAAPORT.dll [2012.10.06 03:18:46 | 000,335,216 | ---- | C] (DTS) -- C:\Windows\System32\DTSU2PREC32.dll [2012.10.06 03:16:05 | 000,011,832 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\acpimof.dll [2012.10.06 03:15:58 | 000,000,000 | ---D | C] -- C:\MSI [2012.10.06 03:15:37 | 000,000,000 | -H-D | C] -- C:\SuperChargerProfile [2012.10.06 03:14:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome [2012.10.06 01:18:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Google [2012.10.06 01:18:31 | 000,000,000 | ---D | C] -- C:\Program Files\Google [2012.10.06 01:18:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Trend Micro [2012.10.06 01:18:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trend Micro SafeSync [2012.10.06 01:18:23 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro SafeSync [2012.10.05 22:42:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSI [2012.10.05 22:42:40 | 000,000,000 | ---D | C] -- C:\Program Files\MSI [2012.10.05 17:21:36 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{80EC128F-6B89-4D55-82E1-47F4EA1A629D} [2012.10.05 00:04:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in [2012.10.04 23:51:59 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{81ED33C1-BFAA-4BA1-957F-441D409073AE} [2012.10.04 23:32:30 | 000,058,880 | ---- | C] (AMD) -- C:\Windows\System32\coinst_9.001.dll [2012.10.04 23:32:29 | 000,163,840 | ---- | C] (AMD) -- C:\Windows\System32\atitmmxx.dll [2012.10.04 23:32:25 | 000,020,992 | ---- | C] (AMD) -- C:\Windows\System32\atimuixx.dll [2012.10.04 23:17:50 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\Innovative Solutions [2012.10.04 23:17:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverMax [2012.10.04 23:17:48 | 000,000,000 | ---D | C] -- C:\Program Files\Innovative Solutions [2012.10.04 22:52:42 | 000,000,000 | ---D | C] -- C:\Windows\System32\RTCOM [2012.10.04 22:51:51 | 001,783,056 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\WavesLib.dll [2012.10.04 22:51:50 | 000,345,328 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSXT.dll [2012.10.04 22:51:50 | 000,185,584 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSHD.dll [2012.10.04 22:51:50 | 000,173,296 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSHP360.dll [2012.10.04 22:51:50 | 000,140,528 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSWOW.dll [2012.10.04 22:51:45 | 000,359,768 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEP32A.dll [2012.10.04 22:51:45 | 000,295,768 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RP3DHT32.dll [2012.10.04 22:51:45 | 000,295,768 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RP3DAA32.dll [2012.10.04 22:51:45 | 000,170,840 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEED32A.dll [2012.10.04 22:51:45 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEL32A.dll [2012.10.04 22:51:45 | 000,064,856 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEG32A.dll [2012.10.04 22:51:44 | 000,232,792 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO20.dll [2012.10.04 22:51:44 | 000,132,368 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO.dll [2012.10.04 22:51:43 | 001,509,480 | ---- | C] (DTS) -- C:\Windows\System32\DTSS2SpeakerDLL.dll [2012.10.04 22:51:43 | 001,292,904 | ---- | C] (DTS) -- C:\Windows\System32\DTSS2HeadphoneDLL.dll [2012.10.04 22:51:43 | 001,220,200 | ---- | C] (DTS) -- C:\Windows\System32\DTSBoostDLL.dll [2012.10.04 22:51:43 | 000,654,952 | ---- | C] (DTS) -- C:\Windows\System32\DTSBassEnhancementDLL.dll [2012.10.04 22:51:43 | 000,631,400 | ---- | C] (DTS) -- C:\Windows\System32\DTSSymmetryDLL.dll [2012.10.04 22:51:43 | 000,601,704 | ---- | C] (DTS) -- C:\Windows\System32\DTSVoiceClarityDLL.dll [2012.10.04 22:51:43 | 000,458,344 | ---- | C] (DTS) -- C:\Windows\System32\DTSNeoPCDLL.dll [2012.10.04 22:51:43 | 000,389,736 | ---- | C] (DTS) -- C:\Windows\System32\DTSGainCompensatorDLL.dll [2012.10.04 22:51:43 | 000,375,400 | ---- | C] (DTS) -- C:\Windows\System32\DTSLimiterDLL.dll [2012.10.04 22:51:43 | 000,218,728 | ---- | C] (DTS) -- C:\Windows\System32\DTSGFXAPONS.dll [2012.10.04 22:51:43 | 000,218,728 | ---- | C] (DTS) -- C:\Windows\System32\DTSGFXAPO.dll [2012.10.04 22:51:43 | 000,218,216 | ---- | C] (DTS) -- C:\Windows\System32\DTSLFXAPO.dll [2012.10.04 21:52:45 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab [2012.10.04 19:40:00 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\SystemRequirementsLab [2012.10.04 19:18:10 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Intel Corporation [2012.10.04 19:18:10 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel Corporation [2012.10.04 15:07:14 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Photo Creations [2012.10.04 15:07:14 | 000,000,000 | ---D | C] -- C:\Program Files\HP Photo Creations [2012.10.04 15:05:27 | 000,000,000 | ---D | C] -- C:\Program Files\HP [2012.10.04 15:01:27 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel [2012.10.04 14:59:37 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Leadertech [2012.10.04 14:58:17 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\LogiShrd [2012.10.04 14:57:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Logishrd [2012.10.04 14:57:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\LogiShrd [2012.10.04 14:56:57 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Logitech [2012.10.04 14:56:57 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Logishrd [2012.10.04 14:54:13 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek [2012.10.04 14:54:09 | 000,000,000 | -H-D | C] -- C:\Program Files\Temp [2012.10.04 11:51:44 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{ACC5CE56-0255-4CCB-950F-C13EC639AB4C} [2012.10.04 07:26:43 | 000,000,000 | ---D | C] -- C:\Program Files\AMD APP [2012.10.04 02:10:45 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\PCCUStubInstaller [2012.10.04 02:10:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton [2012.10.04 02:10:21 | 000,000,000 | ---D | C] -- C:\ProgramData\NortonInstaller [2012.10.04 00:25:45 | 000,000,000 | ---D | C] -- C:\Program Files\SmartTweak Software [2012.10.04 00:25:00 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\PackageAware [2012.10.03 23:59:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2013 [2012.10.03 23:58:50 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Secure Search [2012.10.03 23:58:18 | 000,026,984 | ---- | C] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys [2012.10.03 23:58:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVG Secure Search [2012.10.03 23:57:23 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2013 [2012.10.03 23:56:27 | 000,000,000 | -HSD | C] -- C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F} [2012.10.03 23:56:27 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files [2012.10.03 23:51:29 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{AA42FCFF-900E-42A8-9AA6-5512A3E6C83A} [2012.10.03 23:45:24 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Easeware [2012.10.03 23:45:22 | 000,000,000 | ---D | C] -- C:\Program Files\Easeware [2012.10.03 23:35:48 | 000,017,280 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\Windows\System32\roboot.exe [2012.10.03 11:51:12 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{9CDD3A9D-536B-42F8-8098-CE810FD878DA} [2012.10.02 23:50:57 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{83F62225-842A-44B8-B70F-C5A2D56F5224} [2012.10.02 11:50:42 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{566E9734-210E-4AF1-AA20-232CA2D3C1DB} [2012.10.01 22:08:37 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{F7A1A3ED-CE71-4924-BB3C-457279DF5F5C} [2012.10.01 09:50:42 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{B5F9EF2F-DD06-42AF-ACA2-776DBCA72584} [2012.09.30 17:16:09 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{A2AF122E-F70C-432E-B258-8F58D6820BB3} [2012.09.29 18:23:22 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{CACD1CB0-0C48-4AFE-94A6-6AB60674887B} [2012.09.29 00:14:36 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{44DFB7BF-048A-4977-8398-0C9CE4D4F6E3} [2012.09.28 12:13:46 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{263565D5-5096-4053-BC93-829B6F9F443B} [2012.09.27 22:57:34 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{441E7A89-73F0-4E70-964E-576D062F1863} [2012.09.27 22:43:48 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\V-Games [2012.09.27 22:42:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Purplehills [2012.09.27 22:42:43 | 000,000,000 | ---D | C] -- C:\Program Files\Purplehills [2012.09.27 10:57:20 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{CDB2A17F-4C82-48DA-84A6-27952D8CF6A3} [2012.09.26 22:18:47 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{9E55831C-364C-4AF0-8101-20B27E72F5A3} [2012.09.26 10:18:32 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{3AA15C08-A0A4-4C0C-9CA9-B2B4275EBE29} [2012.09.25 22:18:01 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{3AD46BDE-E5BD-4C57-8E27-4586572A1FBF} [2012.09.24 23:35:07 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{C9A78311-E3E1-40C6-B29E-A73159FCE281} [2012.09.24 23:17:30 | 000,000,000 | ---D | C] -- C:\Program Files\Online Games Manager [2012.09.24 23:17:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zylom [2012.09.24 23:06:48 | 000,000,000 | ---D | C] -- C:\ProgramData\PopCap Games [2012.09.24 11:34:52 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{CA8AA90A-A087-4AA2-8A53-47DF51737103} [2012.09.23 22:13:06 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{BA6C85CB-0254-45C6-97DC-C95801261E5E} [2012.09.23 10:07:45 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{EF153F13-1396-4438-A7CF-AC9496081D6C} [2012.09.22 11:13:56 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{77735006-5D11-4E89-868A-77DEE39E4B32} [2012.09.21 16:38:05 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{2EEF052F-76F4-484E-9FF2-1D8505013A95} [2012.09.20 22:07:52 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{2D658D1A-EBE2-4E90-AAB5-9F71D46DC572} [2012.09.20 09:49:23 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{714FEBDC-AFB3-435F-9652-291129A72C13} [2012.09.19 13:56:14 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{4BF72F45-9414-4B73-B183-7D603531D3E1} [2012.09.18 16:36:57 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{818FDAE1-D3BF-400E-ACD1-63A30B552785} [2012.09.17 14:53:25 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{425E75EE-8B3D-48B3-BED6-58DDA84B8EC2} [2012.09.16 22:18:41 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{0E5B1A36-4068-4F87-931C-A3EB206527E7} [2012.09.15 22:01:57 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{FEC59C97-4A4E-4B5E-9F4B-5F072AC10050} [2012.09.14 09:54:32 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{51F21393-BBA4-4780-96BF-800A57D7EDDD} [2012.09.13 09:23:08 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{75924855-E4C4-4161-9B9B-AF77404A6B5A} [1 C:\Users\Sweetheart\AppData\Local\*.tmp files -> C:\Users\Sweetheart\AppData\Local\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.10.12 14:56:37 | 000,004,736 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.10.12 14:56:37 | 000,004,736 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.10.12 14:33:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.10.12 14:10:04 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.10.12 12:11:43 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.10.12 12:11:02 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.10.12 12:10:06 | 3219,304,448 | -HS- | M] () -- C:\hiberfil.sys [2012.10.12 10:27:05 | 000,538,327 | ---- | M] () -- C:\Users\Sweetheart\Desktop\adwcleaner2.004 (1).exe [2012.10.11 23:10:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sweetheart\Desktop\OTL.exe [2012.10.10 23:10:25 | 000,000,866 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.10.07 14:14:18 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat [2012.10.07 14:14:18 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat [2012.10.07 14:14:10 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf [2012.10.06 10:37:47 | 000,001,931 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2012.10.06 10:27:09 | 000,636,998 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.10.06 10:27:09 | 000,604,074 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.10.06 10:27:09 | 000,130,596 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.10.06 10:27:09 | 000,108,468 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.10.05 22:42:42 | 000,001,748 | ---- | M] () -- C:\Users\Public\Desktop\Live Update 5.lnk [2012.10.05 10:41:09 | 002,100,056 | ---- | M] () -- C:\Users\Sweetheart\Documents\anleitung waschmaschine.pdf [2012.10.05 10:34:23 | 000,000,041 | -HS- | M] () -- C:\ProgramData\.zreglib [2012.10.04 23:17:50 | 000,000,987 | ---- | M] () -- C:\Users\Sweetheart\Desktop\DriverMax.lnk [2012.10.04 10:16:09 | 000,390,248 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.10.04 10:15:14 | 182,382,066 | ---- | M] () -- C:\Windows\MEMORY.DMP [2012.10.03 23:59:04 | 000,001,829 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk [2012.10.03 23:59:04 | 000,001,825 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities 2013.lnk [2012.10.03 23:57:43 | 000,026,984 | ---- | M] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys [2012.09.30 00:12:05 | 000,001,236 | ---- | M] () -- C:\Users\Sweetheart\Desktop\Magic Encyclopedia 3 - Illusionen.lnk [2012.09.30 00:10:44 | 000,001,008 | ---- | M] () -- C:\Users\Sweetheart\Desktop\Magic Encyclopedia 2.lnk [2012.09.27 22:42:57 | 000,000,987 | ---- | M] () -- C:\Users\Sweetheart\Desktop\Magic Encyclopedia.lnk [2012.09.24 22:10:20 | 000,047,686 | ---- | M] () -- C:\Users\Sweetheart\Documents\ihre_rechnung.pdf [2012.09.19 11:29:46 | 000,031,584 | ---- | M] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe [2012.09.19 11:29:40 | 000,021,344 | ---- | M] (TuneUp Software) -- C:\Windows\System32\authuitu.dll [2012.09.14 11:29:56 | 000,750,452 | ---- | M] () -- C:\Users\Sweetheart\Documents\eMail_20120914_112547_59.PDF [2012.09.14 11:14:24 | 000,000,736 | ---- | M] () -- C:\Users\Public\Desktop\Winamp.lnk [2012.09.13 23:46:04 | 000,058,880 | ---- | M] (AMD) -- C:\Windows\System32\coinst_9.001.dll [2012.09.13 23:43:16 | 000,276,752 | ---- | M] () -- C:\Windows\System32\atiapfxx.blb [2012.09.13 23:18:56 | 000,471,040 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe [2012.09.13 23:18:20 | 000,217,600 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe [2012.09.13 23:17:06 | 000,163,840 | ---- | M] (AMD) -- C:\Windows\System32\atitmmxx.dll [2012.09.13 23:16:58 | 000,020,992 | ---- | M] (AMD) -- C:\Windows\System32\atimuixx.dll [2012.09.13 23:04:02 | 002,915,680 | ---- | M] () -- C:\Windows\System32\atiumdva.cap [2012.09.13 22:53:32 | 000,037,376 | ---- | M] () -- C:\Windows\System32\atitmpxx.dll [1 C:\Users\Sweetheart\AppData\Local\*.tmp files -> C:\Users\Sweetheart\AppData\Local\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.10.12 10:27:00 | 000,538,327 | ---- | C] () -- C:\Users\Sweetheart\Desktop\adwcleaner2.004 (1).exe [2012.10.12 10:18:50 | 3219,304,448 | -HS- | C] () -- C:\hiberfil.sys [2012.10.10 23:10:25 | 000,000,866 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.10.09 14:01:18 | 000,336,393 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT [2012.10.07 14:14:10 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf [2012.10.06 03:14:44 | 000,001,931 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2012.10.06 01:18:50 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.10.06 01:18:50 | 000,001,102 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.10.05 22:42:42 | 000,001,748 | ---- | C] () -- C:\Users\Public\Desktop\Live Update 5.lnk [2012.10.05 10:41:03 | 002,100,056 | ---- | C] () -- C:\Users\Sweetheart\Documents\anleitung waschmaschine.pdf [2012.10.04 23:32:30 | 002,915,680 | ---- | C] () -- C:\Windows\System32\atiumdva.cap [2012.10.04 23:32:26 | 000,038,204 | ---- | C] () -- C:\Windows\atiogl.xml [2012.10.04 23:32:24 | 000,632,252 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2012.10.04 23:32:21 | 000,276,752 | ---- | C] () -- C:\Windows\System32\atiapfxx.blb [2012.10.04 23:17:50 | 000,000,987 | ---- | C] () -- C:\Users\Sweetheart\Desktop\DriverMax.lnk [2012.10.03 23:59:04 | 000,001,829 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk [2012.10.03 23:59:04 | 000,001,825 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities 2013.lnk [2012.10.03 23:59:03 | 000,001,837 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2013.lnk [2012.09.30 00:12:18 | 000,001,236 | ---- | C] () -- C:\Users\Sweetheart\Desktop\Magic Encyclopedia 3 - Illusionen.lnk [2012.09.30 00:11:23 | 000,001,008 | ---- | C] () -- C:\Users\Sweetheart\Desktop\Magic Encyclopedia 2.lnk [2012.09.27 22:43:45 | 000,000,987 | ---- | C] () -- C:\Users\Sweetheart\Desktop\Magic Encyclopedia.lnk [2012.09.24 23:01:47 | 000,047,686 | ---- | C] () -- C:\Users\Sweetheart\Documents\ihre_rechnung.pdf [2012.09.14 11:35:04 | 000,750,452 | ---- | C] () -- C:\Users\Sweetheart\Documents\eMail_20120914_112547_59.PDF [2012.07.27 22:47:36 | 000,159,232 | ---- | C] () -- C:\Windows\System32\clinfo.exe [2012.07.10 15:00:27 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat [2012.02.01 04:11:30 | 000,037,376 | ---- | C] () -- C:\Windows\System32\atitmpxx.dll [2011.04.27 09:00:47 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib [2011.02.06 13:16:13 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2010.11.16 08:18:00 | 000,000,098 | ---- | C] () -- C:\Users\Sweetheart\AppData\Local\fusioncache.dat [2010.02.24 22:13:51 | 000,083,456 | ---- | C] () -- C:\Users\Sweetheart\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.12.15 22:14:55 | 000,000,000 | ---- | C] () -- C:\Users\Sweetheart\AppData\Roaming\AVSDVDPlayer.m3u [2009.11.26 19:03:51 | 000,001,356 | ---- | C] () -- C:\Users\Sweetheart\AppData\Local\d3d9caps.dat ========== ZeroAccess Check ========== [2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2011.12.19 13:42:01 | 000,000,000 | -HSD | M] -- C:\Users\Sweetheart\AppData\Roaming\.# [2009.12.04 22:13:52 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\Ankh [2010.04.12 20:33:30 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\casanova [2012.10.03 23:45:24 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\Easeware [2012.06.24 08:04:15 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\FOG Downloader [2012.05.25 09:45:51 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\ICQ [2012.05.25 09:40:32 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\ICQ Search [2011.08.01 16:11:50 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\Image Zone Express [2012.10.04 14:59:37 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\Leadertech [2010.11.06 11:28:35 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\LEGO Company [2010.08.14 13:53:21 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\LucasArts [2012.10.08 23:21:29 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\Magic3 [2010.04.08 12:21:50 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\Mount&Blade Warband [2011.03.15 21:23:47 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\MysteryStudio [2010.12.20 12:34:43 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\NCH Swift Sound [2010.08.19 21:14:51 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\Nokia [2011.07.18 20:10:37 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\OCS [2010.03.30 16:20:14 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\Online Solutions [2011.07.18 20:10:40 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\Opera [2012.02.14 09:18:00 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\PC Suite [2012.10.04 02:10:45 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\PCCUStubInstaller [2012.05.05 10:08:34 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\PhotoScape [2011.08.01 16:11:50 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\Printer Info Cache [2010.03.16 21:44:12 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\TeamViewer [2010.08.10 21:38:39 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\TS3Client [2012.10.03 23:57:32 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\TuneUp Software [2011.03.15 21:23:53 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\Ubisoft [2012.09.30 20:57:35 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\V-Games [2010.02.25 22:00:55 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Roaming\WinAVI ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2012.06.06 11:53:07 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2010.02.06 22:10:06 | 000,000,000 | ---D | M] -- C:\.jagex_cache_32 [2009.12.15 10:26:43 | 000,000,000 | -HSD | M] -- C:\Boot [2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2009.11.26 19:02:18 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2010.07.17 16:23:07 | 000,000,000 | ---D | M] -- C:\dvdshrink23de [2012.03.05 08:50:17 | 000,000,000 | ---D | M] -- C:\gPotato.eu [2012.10.06 03:16:57 | 000,000,000 | ---D | M] -- C:\MSI [2010.01.16 15:28:52 | 000,000,000 | RH-D | M] -- C:\MSOCache [2009.12.04 21:54:52 | 000,000,000 | ---D | M] -- C:\nDoors [2012.09.11 10:31:30 | 000,000,000 | ---D | M] -- C:\output [2009.12.10 17:22:35 | 000,000,000 | ---D | M] -- C:\PerfLogs [2012.10.12 15:00:42 | 000,000,000 | ---D | M] -- C:\Program Files [2012.10.12 12:07:01 | 000,000,000 | -H-D | M] -- C:\ProgramData [2009.11.26 19:02:18 | 000,000,000 | -HSD | M] -- C:\Programme [2012.06.06 21:03:06 | 000,000,000 | ---D | M] -- C:\schriften [2012.10.06 03:15:38 | 000,000,000 | -H-D | M] -- C:\SuperChargerProfile [2012.10.12 15:03:56 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2009.11.26 19:03:49 | 000,000,000 | R--D | M] -- C:\Users [2010.01.18 22:15:56 | 000,000,000 | ---D | M] -- C:\VivoxLogs [2012.10.12 12:11:45 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < %windir%\installer\*. /5 > [2012.10.12 11:52:33 | 000,000,000 | ---D | M] -- C:\Windows\installer\{26A24AE4-039D-4CA4-87B4-2F83217007FF} [2012.10.10 23:28:58 | 000,000,000 | ---D | M] -- C:\Windows\installer\{90120000-0030-0000-0000-0000000FF1CE} < %localappdata%\*. /5 > [2012.10.12 11:54:01 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Local\Google [2012.10.12 15:00:44 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Local\Temp [2012.10.11 10:26:20 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Local\{308F0B84-DB51-45F1-A72C-7487F5B2133C} [2012.10.07 23:25:53 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Local\{37A7F0E7-36B7-44B2-85DF-1137D5E1B8EE} [2012.10.08 11:26:07 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Local\{47328226-A6A8-414D-BF78-AC938ABEEE4B} [2012.10.10 13:26:11 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Local\{815B5E2E-6E92-49F1-A413-1BB0A79C1CAB} [2012.10.12 10:26:55 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Local\{882B453D-AC34-4177-A6A0-64E49C1E232A} [2012.10.09 11:26:38 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Local\{917B5FA0-BE0A-4C08-9C44-919E43237B04} [2012.10.09 23:26:53 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Local\{933D5892-15B0-44CB-9753-42EFB49C89FF} [2012.10.11 22:26:39 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Local\{C4481F9C-20C7-4C0A-BE6A-9C52BA4F54EB} [2012.10.08 23:26:23 | 000,000,000 | ---D | M] -- C:\Users\Sweetheart\AppData\Local\{F3F3C40E-9E74-48C1-BC02-FF09AB3A0747} ========== Alternate Data Streams ========== @Alternate Data Stream - 24 bytes -> C:\Windows:5738951E5A09CC69 < End of report > |
|
12.10.2012, 15:23
| #20 |
| /// the machine /// TB-Ausbilder | WIN32.BHO.acw Trojaner Meine Frage?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.10.2012, 21:23
| #21 |
| | WIN32.BHO.acw Trojaner mit dem trojaner nicht nein. spybot sagt alles sauber :-) nur lässt sich mein pc nicht mehr runterfahren aber das gehört hier glaub ich ja nicht her |
|
13.10.2012, 09:09
| #22 |
| /// the machine /// TB-Ausbilder | WIN32.BHO.acw Trojaner Seit wann genau? Und definier das mal, geht er gar nicht mehr aus?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.10.2012, 12:33
| #23 |
| | WIN32.BHO.acw Trojaner seid ca 3 tagen.ich geh auf runterfahren, fährt wohl auch ein stück weit runter schaltet sich aber nicht ab. muß ihn also immer erst vom strom nehmen das er aus geht |
|
13.10.2012, 16:03
| #24 |
| /// the machine /// TB-Ausbilder | WIN32.BHO.acw Trojaner Schaun mer mal Öffne OTL, die Box "Extra Registrierung" auf benutze Safe List setzen und Scan drücken, poste beide Logfiles.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.10.2012, 21:58
| #25 |
| | WIN32.BHO.acw Trojaner OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 13.10.2012 22:49:08 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Sweetheart\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 1,51 Gb Available Physical Memory | 50,53% Memory free
6,20 Gb Paging File | 3,82 Gb Available in Paging File | 61,62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 65,99 Gb Free Space | 22,14% Space Free | Partition Type: NTFS
Computer Name: KUSCHELMONSTER | User Name: Sweetheart | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1FF82B92-9F63-42F6-A4F8-B06F5B17B755}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{2147CBDD-765B-4964-8C67-6F5EC78BCB54}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{3C2B7E16-B078-42CA-A117-604E1F032454}" = lport=2869 | protocol=6 | dir=in | app=system |
"{8D37166B-71B0-4AD2-8F2C-154A7E415FAF}" = lport=49160 | protocol=6 | dir=in | name=akamai netsession interface |
"{D80F7629-06FE-4AE7-8366-C9C99F3812AA}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{FB944F08-5E88-421D-B130-43FC7DB1E04F}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09416AD5-69E8-4BF7-8E44-C77752185378}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{428FFF8F-A70B-4D10-88BE-6107AE323D25}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{45F0377D-7AD9-4B0D-8562-13E88D3556C7}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{69DA9E93-5988-4645-9D56-6861547FC256}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{6A58EE75-406F-412B-B857-901C6D39C16B}" = protocol=17 | dir=in | app=c:\users\sweetheart\appdata\local\akamai\netsession_win.exe |
"{715FE989-4F68-4EB9-9648-1CDAFAA55FA3}" = protocol=6 | dir=in | app=c:\users\sweetheart\appdata\local\akamai\netsession_win.exe |
"{79BD2FF8-6804-41B2-BF64-82AFE5461A83}" = protocol=6 | dir=in | app=c:\program files\hp\hp deskjet 1000 j110 series\bin\usbsetup.exe |
"{7BDD2041-3DD6-4814-BBB5-644A5C36B089}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{A1CA806F-E898-43B2-AEAB-AA58F8F85F89}" = protocol=17 | dir=in | app=c:\program files\hp\hp deskjet 1000 j110 series\bin\usbsetup.exe |
"{A6CCB614-2C0A-466F-9E6E-A3224588E50D}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{B0231CC1-9943-427F-BFF8-AD32DDE564B8}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{BF48D252-5961-4F12-B0F3-C5913717ABC2}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{CB422105-18AB-4EFF-BBF9-75B6460E61BF}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{D34F5B63-D0EF-4C46-9C43-8B8A76177149}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{E812DBAD-02AE-46B0-89F6-C419FECC4530}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"TCP Query User{0DF64179-C5F0-4FCE-81AA-93D9A741C03F}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia ovi suite\nokiaovisuite.exe |
"TCP Query User{22E920CE-EF5C-4CCA-BEBF-973AD27F2023}C:\users\sweetheart\downloads\runes_of_magic_5_0_0_2535_full (1).exe" = protocol=6 | dir=in | app=c:\users\sweetheart\downloads\runes_of_magic_5_0_0_2535_full (1).exe |
"TCP Query User{2F2B9E5E-957B-4229-95AF-D15325CD1AC4}C:\program files\microsoft office\office12\groove.exe" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"TCP Query User{5D41422D-1781-496A-A85E-A2E5C1F8182E}C:\users\sweetheart\downloads\runes_of_magic_5_0_0_2535_full.exe" = protocol=6 | dir=in | app=c:\users\sweetheart\downloads\runes_of_magic_5_0_0_2535_full.exe |
"TCP Query User{7965B354-5F97-4A42-AB53-4A530B8BB394}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe |
"TCP Query User{90E3FDC8-C25A-4C53-BBCC-8A5AB0CB0DA8}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe |
"TCP Query User{A1A38D07-11B0-4A09-B6AB-A70F353D763A}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"TCP Query User{B38B0425-942E-4A78-9D47-31A11E897A63}C:\program files\gameforge\nclauncher\nclauncher.exe" = protocol=6 | dir=in | app=c:\program files\gameforge\nclauncher\nclauncher.exe |
"TCP Query User{D1827C1B-E817-402E-9877-1693D7F9707B}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{DB213AA7-C43F-412F-AA35-82ABB6AD7D99}C:\program files\runes of magic\client.exe" = protocol=6 | dir=in | app=c:\program files\runes of magic\client.exe |
"UDP Query User{0F96647B-4A64-402F-874A-D4EF1A67F817}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia ovi suite\nokiaovisuite.exe |
"UDP Query User{61AE8E66-A7A4-4A65-A1E0-87017EC2D80D}C:\program files\gameforge\nclauncher\nclauncher.exe" = protocol=17 | dir=in | app=c:\program files\gameforge\nclauncher\nclauncher.exe |
"UDP Query User{65F46603-0844-419C-8350-C8FFAA4E2754}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe |
"UDP Query User{91772487-948E-493D-A52E-66E9F9A00591}C:\program files\microsoft office\office12\groove.exe" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"UDP Query User{9C25587D-5DE0-4D53-A2B7-9F45DA2A061B}C:\users\sweetheart\downloads\runes_of_magic_5_0_0_2535_full (1).exe" = protocol=17 | dir=in | app=c:\users\sweetheart\downloads\runes_of_magic_5_0_0_2535_full (1).exe |
"UDP Query User{A353D060-8CE0-4353-9DD3-E9E664F9FAB8}C:\program files\runes of magic\client.exe" = protocol=17 | dir=in | app=c:\program files\runes of magic\client.exe |
"UDP Query User{A9E6D0E1-0681-4E0E-827D-AD1D320A9273}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe |
"UDP Query User{B27361BD-E1DE-44EB-B5A8-5B792A21514C}C:\users\sweetheart\downloads\runes_of_magic_5_0_0_2535_full.exe" = protocol=17 | dir=in | app=c:\users\sweetheart\downloads\runes_of_magic_5_0_0_2535_full.exe |
"UDP Query User{D9DA6B8E-E9ED-4516-A925-6D6F76F270C2}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"UDP Query User{EEB93E03-986A-40AD-B745-D22A55C81B45}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{009E5DF2-3F97-480B-89DA-F2D5E672E14A}_is1" = Live Update 5
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0A2063BC-CE17-420A-A629-D9D7AE6EC136}" = HP Deskjet 1000 J110 series - Grundlegende Software für das Gerät
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{1373559F-6DC6-44EA-9079-6ABDCCE8CDAD}" = OviMPlatform
"{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}" = Browser Manager
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}" = Bing Bar
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1E05CF2E-BF5F-4A43-9147-2CCBBE57BC3C}_is1" = Mein Gutscheincode Finder 1.0.0.0
"{1F025E3A-3074-48A3-A8F3-78E735739491}_is1" = MSI SUITE
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20CCA435-1465-4567-885C-4A0AFCD0EB05}" = F2100_Help
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{255FC1CF-2620-4B64-BE02-79B9E609BB3D}" = Webzen Game Starter
"{26A24AE4-039D-4CA4-87B4-2F83216032FF}" = Java(TM) 6 Update 35
"{29F563F4-8807-4496-8463-441EAA0E96AB}" = PC Connectivity Solution
"{2D10FC46-1D96-44C4-8855-85F21B9B011E}" = Ovi Desktop Sync Engine
"{32BC62C5-32B9-F838-ADD4-CFEF544C6888}" = ccc-core-static
"{336D0C35-8A85-403a-B9D2-65C292C39087}_is1" = Web Assistant 2.0.0.441
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{39EEEA22-34DE-46E2-8F17-A88948B635EE}" = Samsung USB Driver
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX
"{3F7A9E82-5A85-4119-A8A5-7D840A0F76DC}" = Photo Notifier and Animation Creator
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50D25574-2C48-4AEC-8FFC-32AEAD2EAEFF}" = Nokia Ovi Player
"{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5A24DD7E-7B01-41AC-ADA8-F1776177A3BA}" = Logitech ImageStudio
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5FD89EA1-99C2-40EE-BBF5-20F8991ED756}" = Catalyst Control Center - Branding
"{66EBD70F-A42C-475F-AEDF-277378151031}" = Nero 7 Essentials
"{6723E416-88C8-4451-BE53-AEE03DBA4DBA}" = Studie zur Verbesserung von HP Deskjet 1000 J110 series Produkten
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6A9EF6CF-7630-4E33-AE22-7D70F3AF4B05}" = AION Free-To-Play
"{6CF47FD1-3CF8-4206-BA24-A2B1E43D8CCA}" = IncrediMail
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{70B31335-50EE-4834-8431-27412CDE62BD}" = Nokia_Multimedia_Common_Components_2_5
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75AE8014-1184-4BC0-B279-C879540719EE}" = PhotoMail Maker
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{771ABEA0-23AF-8F8E-63FE-168779F294B6}" = CCC Help English
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel(R) PRO Network Connections 12.1.12.0
"{7CDF10DD-A9B5-4DA3-AB95-E193248D4369}_is1" = Super-Charger
"{8070452B-15D6-4169-B9B9-FCC3B54588AD}" = Nokia Ovi Suite
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{99C4EF41-3156-4675-BAA2-AF5D07FF146D}" = Yetisports World Tour
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A0D65C73-F2C5-432F-8788-90F8A2E99B98}" = Nokia Ovi Suite Software Updater
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A2F166A0-F031-4E27-A057-C69733219434}_is1" = Runes of Magic
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AEC0CEBC-0FC7-4716-8222-1C4A742719B1}" = Samsung Master
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan
"{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}" = HP Update
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BF9D2E61-64C4-64EA-6AF7-29EB5A110C26}" = AMD Catalyst Install Manager
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}" = TuneUp Utilities 2013
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C71067FC-288F-4E0B-88C6-44DFDA8311E2}" = System Requirements Lab for Intel
"{C92C89BB-1D11-C8D5-1584-D5259818479A}" = ccc-utility
"{CA00F224-335F-6A70-DC7A-45D26F61C443}" = HydraVision
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDDFCC77-7F9C-45E9-B38E-721BA599BA0C}" = HP Deskjet 1000 J110 series Hilfe
"{E03CD71A-F595-49DF-9ADC-0CFC93B1B211}" = PlayMemories Home
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E63E34A7-E552-412B-9E40-FD6FC5227ABA}_is1" = Uniblue RegistryBooster 2010
"{E6B43401-E818-4961-AFED-118DD8E87642}" = RAF
"{E9C18EBD-85BE-47D0-AA73-3FEDCC976B04}" = Toolbox
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EECD7B96-1416-4D3A-B12D-0D2512120C36}" = EasyViewer
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F1FDAA01-988C-423F-AC12-0D8F333943FD}" = Nokia Connectivity Cable Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F47C09DB-746B-2ABA-819B-8FC759034E74}" = Catalyst Control Center Graphics Previews Common
"{F4811919-F252-4B25-9AB2-8859A85810B5}" = TuneUp Utilities Language Pack (de-DE)
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FC54FD8D-789C-406D-BB88-F7C4421B7E83}_is1" = VideoGenie
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Akamai" = Akamai NetSession Interface Service
"Alice" = Alice-Installationsdateien entfernen
"AVG Secure Search" = AVG Security Toolbar
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVS DVD Player_is1" = AVS DVD Player version 2.4
"CCleaner" = CCleaner
"conduitEngine" = Conduit Engine
"DMX5_is1" = DriverMax 6
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FinePix Genie_is1" = FUJIFILM MyFinePix Studio 2.0
"Google Chrome" = Google Chrome
"HFRS_is1" = Trend Micro SafeSync
"HP Photo Creations" = HP Photo Creations
"IncrediMail" = IncrediMail 2.0
"IncrediMail_MediaBar_2 Toolbar" = IncrediMail MediaBar 2 Toolbar
"InstallShield_{6A9EF6CF-7630-4E33-AE22-7D70F3AF4B05}" = AION Free-To-Play
"InstallShield_{EECD7B96-1416-4D3A-B12D-0D2512120C36}" = EasyViewer
"Magic Encyclopedia" = Magic Encyclopedia
"Magic Encyclopedia 2" = Magic Encyclopedia 2
"Magic Encyclopedia 3 - Illusionen" = Magic Encyclopedia 3 - Illusionen
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"NCLauncher_GameForge" = NC Launcher (GameForge)
"Nokia Ovi Suite" = Nokia Ovi Suite
"Online Games Manager" = Online Games Manager v1.10
"Photo Notifier and Animation Creator" = Photo Notifier and Animation Creator
"PhotoMail" = PhotoMail Maker
"PhotoScape" = PhotoScape
"PROSetDX" = Intel(R) PRO Network Connections 12.1.12.0
"Rainlendar2" = Rainlendar2 (remove only)
"SearchAnonymizer" = SearchAnonymizer
"Searchqu MediaBar" = Windows Searchqu Toolbar
"sp6" = Logitech SetPoint 6.32
"Switch" = Switch Audiodatei-Konverter
"TuneUp Utilities 2011" = TuneUp Utilities 2011
"TuneUp Utilities 2013" = TuneUp Utilities 2013
"UnityWebPlayer" = Unity Web Player (All users)
"Winamp" = Winamp
"WinAVI Video Converter 10.0_is1" = WinAVI Video Converter
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"Winamp Detect" = Winamp Erkennungs-Plug-in
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 12.10.2012 05:04:05 | Computer Name = Kuschelmonster | Source = Software Licensing Service | ID = 8193
Description = Der Lizenzaktivierungsplaner (SLUINotify.dll) ist mit folgendem Fehlercode
fehlgeschlagen: 0x800401E4
Error - 12.10.2012 06:04:03 | Computer Name = Kuschelmonster | Source = Software Licensing Service | ID = 8193
Description = Der Lizenzaktivierungsplaner (SLUINotify.dll) ist mit folgendem Fehlercode
fehlgeschlagen: 0x800401E4
Error - 12.10.2012 06:31:35 | Computer Name = Kuschelmonster | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.69.0 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: 137c Anfangszeit: 01cda864968d58ac Zeitpunkt der Beendigung:
4
Error - 12.10.2012 06:56:41 | Computer Name = Kuschelmonster | Source = Software Licensing Service | ID = 8193
Description = Der Lizenzaktivierungsplaner (SLUINotify.dll) ist mit folgendem Fehlercode
fehlgeschlagen: 0x800401E4
Error - 12.10.2012 07:56:38 | Computer Name = Kuschelmonster | Source = Software Licensing Service | ID = 8193
Description = Der Lizenzaktivierungsplaner (SLUINotify.dll) ist mit folgendem Fehlercode
fehlgeschlagen: 0x800401E4
Error - 12.10.2012 08:56:38 | Computer Name = Kuschelmonster | Source = Software Licensing Service | ID = 8193
Description = Der Lizenzaktivierungsplaner (SLUINotify.dll) ist mit folgendem Fehlercode
fehlgeschlagen: 0x800401E4
Error - 12.10.2012 09:56:38 | Computer Name = Kuschelmonster | Source = Software Licensing Service | ID = 8193
Description = Der Lizenzaktivierungsplaner (SLUINotify.dll) ist mit folgendem Fehlercode
fehlgeschlagen: 0x800401E4
Error - 12.10.2012 16:12:12 | Computer Name = Kuschelmonster | Source = Software Licensing Service | ID = 8193
Description = Der Lizenzaktivierungsplaner (SLUINotify.dll) ist mit folgendem Fehlercode
fehlgeschlagen: 0x800401E4
Error - 12.10.2012 17:56:42 | Computer Name = Kuschelmonster | Source = Software Licensing Service | ID = 8193
Description = Der Lizenzaktivierungsplaner (SLUINotify.dll) ist mit folgendem Fehlercode
fehlgeschlagen: 0x800401E4
Error - 13.10.2012 08:10:56 | Computer Name = Kuschelmonster | Source = Software Licensing Service | ID = 8193
Description = Der Lizenzaktivierungsplaner (SLUINotify.dll) ist mit folgendem Fehlercode
fehlgeschlagen: 0x800401E4
[ System Events ]
Error - 13.10.2012 07:25:44 | Computer Name = Kuschelmonster | Source = Service Control Manager | ID = 7026
Description =
Error - 13.10.2012 08:10:56 | Computer Name = Kuschelmonster | Source = Service Control Manager | ID = 7024
Description =
Error - 13.10.2012 10:43:59 | Computer Name = Kuschelmonster | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 13.10.2012 um 14:36:55 unerwartet heruntergefahren.
Error - 13.10.2012 10:44:02 | Computer Name = Kuschelmonster | Source = Microsoft-Windows-TaskScheduler | ID = 412
Description =
Error - 13.10.2012 10:44:11 | Computer Name = Kuschelmonster | Source = Service Control Manager | ID = 7023
Description =
Error - 13.10.2012 10:44:24 | Computer Name = Kuschelmonster | Source = Service Control Manager | ID = 7026
Description =
Error - 13.10.2012 16:32:05 | Computer Name = Kuschelmonster | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 13.10.2012 um 17:04:00 unerwartet heruntergefahren.
Error - 13.10.2012 16:32:07 | Computer Name = Kuschelmonster | Source = Microsoft-Windows-TaskScheduler | ID = 412
Description =
Error - 13.10.2012 16:32:19 | Computer Name = Kuschelmonster | Source = Service Control Manager | ID = 7023
Description =
Error - 13.10.2012 16:32:28 | Computer Name = Kuschelmonster | Source = Service Control Manager | ID = 7026
Description =
< End of report >
|
|
13.10.2012, 22:00
| #26 |
| | WIN32.BHO.acw Trojaner OTL Logfile: Code:
ATTFilter OTL logfile created on: 13.10.2012 22:49:08 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Sweetheart\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 1,51 Gb Available Physical Memory | 50,53% Memory free
6,20 Gb Paging File | 3,82 Gb Available in Paging File | 61,62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 65,99 Gb Free Space | 22,14% Space Free | Partition Type: NTFS
Computer Name: KUSCHELMONSTER | User Name: Sweetheart | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012.10.13 09:31:53 | 001,107,552 | ---- | M] () -- C:\Program Files\AVG Secure Search\vprot.exe
PRC - [2012.10.11 23:10:28 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sweetheart\Downloads\OTL (1).exe
PRC - [2012.10.10 12:06:17 | 001,239,064 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2012.10.05 11:14:56 | 002,203,160 | ---- | M] () -- C:\ProgramData\Browser Manager\2.3.765.24\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe
PRC - [2012.10.03 23:57:42 | 000,711,112 | ---- | M] () -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.0.0\ToolbarUpdater.exe
PRC - [2012.09.19 11:29:44 | 001,869,152 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesApp32.exe
PRC - [2012.09.19 11:29:42 | 001,699,168 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe
PRC - [2012.09.13 23:18:56 | 000,471,040 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2012.09.13 23:18:20 | 000,217,600 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.09.07 17:04:44 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.09.03 10:11:56 | 011,325,376 | ---- | M] (Innovative Solutions) -- C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe
PRC - [2012.08.20 09:33:02 | 000,304,120 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avnotify.exe
PRC - [2012.08.20 09:33:01 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.06.11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE
PRC - [2012.06.11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE
PRC - [2012.06.08 09:02:24 | 000,521,344 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Online Games Manager\ogmservice.exe
PRC - [2012.06.01 08:02:20 | 000,366,536 | ---- | M] (IncrediMail, Ltd.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe
PRC - [2012.06.01 08:02:20 | 000,264,136 | ---- | M] (IncrediMail, Ltd.) -- C:\Program Files\IncrediMail\Bin\ImApp.exe
PRC - [2012.05.08 16:12:35 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 16:12:35 | 000,086,992 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\ipmgui.exe
PRC - [2012.05.08 16:12:35 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 16:12:35 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.05.08 15:14:30 | 000,185,856 | ---- | M] () -- C:\Program Files\Web Assistant\ExtensionUpdaterService.exe
PRC - [2011.10.17 15:12:52 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011.10.07 11:40:42 | 001,387,288 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPointP\SetPoint.exe
PRC - [2011.09.27 21:05:24 | 000,149,784 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
PRC - [2009.11.28 21:39:39 | 000,403,968 | ---- | M] (Hansenet) -- C:\Program Files\Alice\Signup\AliceCnn.exe
PRC - [2009.08.22 12:31:06 | 005,148,672 | ---- | M] () -- C:\Program Files\Rainlendar2\Rainlendar2.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.01.26 16:31:16 | 002,144,088 | RHS- | M] (Safer Networking Limited) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009.01.26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
========== Modules (No Company Name) ==========
MOD - [2012.10.13 13:54:56 | 000,240,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\9104e78d8897df008eed3a2af3bda6a2\WindowsFormsIntegration.ni.dll
MOD - [2012.10.13 13:53:36 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\c8c3ab08933fef9fb6657da871395c46\PresentationFramework.Aero.ni.dll
MOD - [2012.10.13 13:53:10 | 000,060,928 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\5fd0071c259b92078ced7cd752a14730\UIAutomationProvider.ni.dll
MOD - [2012.10.13 13:53:09 | 014,329,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\7343fbab1ba137db2f8b284047ef3f3c\PresentationFramework.ni.dll
MOD - [2012.10.13 13:52:56 | 012,219,392 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\7b6293b0c23321c255c2530aea8e32bb\PresentationCore.ni.dll
MOD - [2012.10.13 13:52:36 | 002,295,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\0f2b877ed16daa577f95be735a63d19c\System.Core.ni.dll
MOD - [2012.10.13 13:51:05 | 011,820,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\508b444db523c5cf20ff12c7f440837b\System.Web.ni.dll
MOD - [2012.10.13 13:50:58 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\846b9cf2756fdd15f704c9bab9c70b6f\System.Runtime.Remoting.ni.dll
MOD - [2012.10.13 13:50:57 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\54426ee1881b42af5b090e223f43823c\WindowsBase.ni.dll
MOD - [2012.10.13 13:50:51 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll
MOD - [2012.10.13 13:50:43 | 001,592,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll
MOD - [2012.10.13 13:50:36 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d2630342a066a7cb9056d9eb6157687a\System.Xml.ni.dll
MOD - [2012.10.13 13:50:32 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bd76aaaa03ddc15d1840207b5a480644\System.Configuration.ni.dll
MOD - [2012.10.13 13:50:29 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll
MOD - [2012.10.13 13:50:23 | 011,492,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll
MOD - [2012.10.13 09:31:53 | 001,107,552 | ---- | M] () -- C:\Program Files\AVG Secure Search\vprot.exe
MOD - [2012.10.10 12:06:15 | 000,460,312 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.94\ppgooglenaclpluginchrome.dll
MOD - [2012.10.10 12:06:13 | 012,435,992 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.94\PepperFlash\pepflashplayer.dll
MOD - [2012.10.10 12:06:12 | 004,005,912 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.94\pdf.dll
MOD - [2012.10.10 12:04:57 | 000,578,072 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.94\libglesv2.dll
MOD - [2012.10.10 12:04:55 | 000,123,928 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.94\libegl.dll
MOD - [2012.10.10 12:04:44 | 000,156,712 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.94\avutil-51.dll
MOD - [2012.10.10 12:04:43 | 000,275,496 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.94\avformat-54.dll
MOD - [2012.10.10 12:04:42 | 002,168,360 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\22.0.1229.94\avcodec-54.dll
MOD - [2012.10.05 11:14:56 | 002,203,160 | ---- | M] () -- C:\ProgramData\Browser Manager\2.3.765.24\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe
MOD - [2012.10.05 11:14:15 | 002,106,392 | ---- | M] () -- c:\ProgramData\Browser Manager\2.3.765.24\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll
MOD - [2012.10.03 23:57:43 | 000,134,600 | ---- | M] () -- C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\13.0.0\SiteSafety.dll
MOD - [2012.09.13 22:53:32 | 000,037,376 | ---- | M] () -- C:\Windows\System32\atitmpxx.dll
MOD - [2012.07.31 11:07:52 | 000,008,648 | ---- | M] () -- C:\Program Files\Innovative Solutions\DriverMax\sync.dll
MOD - [2012.06.01 08:02:23 | 000,071,624 | ---- | M] () -- C:\Program Files\IncrediMail\Bin\wlessfp1.dll
MOD - [2012.06.01 08:02:21 | 000,268,232 | ---- | M] () -- C:\Program Files\IncrediMail\Bin\ImLookExU.dll
MOD - [2012.06.01 08:02:20 | 000,133,064 | ---- | M] () -- C:\Program Files\IncrediMail\Bin\ImComUtlU.dll
MOD - [2012.06.01 08:02:20 | 000,079,816 | ---- | M] () -- C:\Program Files\IncrediMail\Bin\ImAppRU.dll
MOD - [2012.06.01 08:02:20 | 000,032,648 | ---- | M] () -- C:\Program Files\IncrediMail\Bin\IMHttpComm.dll
MOD - [2011.10.07 11:41:16 | 000,879,896 | ---- | M] () -- C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll
MOD - [2011.01.30 16:19:12 | 000,107,896 | ---- | M] () -- C:\Program Files\IncrediMail\Bin\PMC.dll
MOD - [2011.01.04 22:54:12 | 000,243,712 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2009.08.22 12:32:50 | 000,724,992 | ---- | M] () -- C:\Program Files\Rainlendar2\plugins\iCalendarPlugin.dll
MOD - [2009.08.22 12:31:06 | 005,148,672 | ---- | M] () -- C:\Program Files\Rainlendar2\Rainlendar2.exe
MOD - [2009.03.30 06:42:12 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009.03.30 06:42:12 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
MOD - [2009.03.30 06:42:12 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2009.03.30 06:42:11 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2008.11.07 22:00:46 | 000,009,216 | ---- | M] () -- C:\Program Files\Rainlendar2\lfs.dll
MOD - [2008.11.07 21:59:08 | 000,131,072 | ---- | M] () -- C:\Program Files\Rainlendar2\lua51.dll
MOD - [2007.03.24 22:44:22 | 000,114,688 | ---- | M] () -- C:\Program Files\Alice\Signup\sys.plg
MOD - [2007.02.12 18:54:32 | 000,253,952 | ---- | M] () -- C:\Program Files\Alice\Signup\dslsetup.plg
MOD - [2005.10.04 18:28:40 | 000,081,920 | ---- | M] () -- C:\Program Files\Alice\Signup\htmlpars.plg
MOD - [2005.09.23 19:10:22 | 000,081,920 | ---- | M] () -- C:\Program Files\Alice\Signup\alice.plg
MOD - [2005.08.17 20:36:28 | 000,090,112 | ---- | M] () -- C:\Program Files\Alice\Signup\Support.plg
MOD - [2005.04.15 13:35:50 | 000,077,824 | ---- | M] () -- C:\Program Files\Alice\Signup\SueDsl.plg
========== Services (SafeList) ==========
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SBSDWSCService)
SRV - [2012.10.08 23:10:40 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.10.05 11:14:56 | 002,203,160 | ---- | M] () [Auto | Running] -- C:\ProgramData\Browser Manager\2.3.765.24\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe -- (Browser Manager)
SRV - [2012.10.03 23:57:42 | 000,711,112 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.0.0\ToolbarUpdater.exe -- (vToolbarUpdater13.0.0)
SRV - [2012.09.19 11:29:42 | 001,699,168 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2012.09.13 23:18:20 | 000,217,600 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.09.11 09:12:29 | 004,537,664 | ---- | M] () [Auto | Running] -- c:\program files\common files\akamai/netsession_win_5891ae0.dll -- (Akamai)
SRV - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.09.05 14:05:50 | 000,124,472 | ---- | M] (MSI) [Disabled | Stopped] -- C:\MSI\MSI SUITE\Super-Charger\SuiteChargeService.exe -- (MSI_SuiteCharger)
SRV - [2012.08.30 14:08:28 | 000,102,968 | ---- | M] (MSI) [Disabled | Stopped] -- C:\MSI\MSI SUITE\FastBoot\SuiteFastBootService.exe -- (MSI_SuiteFastBoot)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.12 13:20:54 | 003,947,320 | ---- | M] (Trend Micro Inc.) [Disabled | Stopped] -- C:\Program Files\Trend Micro SafeSync\hrfscore.exe -- (OnlineStorageService)
SRV - [2012.06.29 17:56:30 | 000,136,704 | ---- | M] (MSI) [Disabled | Stopped] -- C:\Program Files\MSI\Super-Charger\ChargeService.exe -- (MSI_SuperCharger)
SRV - [2012.06.11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE -- (BBUpdate)
SRV - [2012.06.11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE -- (BBSvc)
SRV - [2012.06.08 09:02:24 | 000,521,344 | ---- | M] (RealNetworks, Inc.) [Auto | Running] -- C:\Program Files\Online Games Manager\ogmservice.exe -- (ogmservice)
SRV - [2012.05.08 16:12:35 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.08 16:12:35 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 15:14:30 | 000,185,856 | ---- | M] () [Auto | Running] -- C:\Program Files\Web Assistant\ExtensionUpdaterService.exe -- (Web Assistant Updater)
SRV - [2012.04.23 09:36:32 | 000,010,752 | ---- | M] () [Disabled | Stopped] -- C:\MSI\MSI SUITE\MSIMonitor\MSIFileSyncMonitor.exe -- (MSIFileSyncMonitor)
SRV - [2012.04.22 10:05:38 | 000,474,168 | ---- | M] (Sony Corporation) [Disabled | Stopped] -- C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe -- (PMBDeviceInfoProvider)
SRV - [2012.04.17 14:01:42 | 000,075,280 | ---- | M] (MSI) [Disabled | Stopped] -- C:\MSI\MSI SUITE\ControlCenter\ComCenService.exe -- (MSI_ComCenService)
SRV - [2011.10.17 15:12:52 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2011.09.27 21:03:28 | 000,295,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.07.18 20:10:37 | 000,040,960 | ---- | M] () [Disabled | Stopped] -- C:\Users\Sweetheart\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer)
SRV - [2010.10.08 11:06:48 | 000,030,016 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2010.06.14 15:07:14 | 000,615,936 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010.01.05 00:41:00 | 003,670,928 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\XDva360.sys -- (XDva360)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleNT.sys -- (EagleNT)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - File not found [Kernel | Boot | Stopped] -- System32\drivers\nagcnh.sys -- (anepufr)
DRV - [2012.10.03 23:57:43 | 000,026,984 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtpx86.sys -- (avgtp)
DRV - [2012.09.19 10:50:50 | 000,010,088 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2012.09.14 00:00:10 | 009,106,432 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2012.09.14 00:00:10 | 009,106,432 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2012.09.13 22:55:00 | 000,370,176 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.08.01 23:02:36 | 000,015,248 | ---- | M] (PenMount) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pmkbdfltr.sys -- (pmkbdfltr)
DRV - [2012.05.23 13:56:52 | 000,161,640 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\mv61xx.sys -- (mv61xx)
DRV - [2012.05.08 16:12:36 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 16:12:36 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.03.30 15:26:30 | 000,007,680 | ---- | M] (MSI) [Kernel | On_Demand | Stopped] -- C:\MSI\MSI SUITE\NTIOLib.sys -- (NTIOLib_1_0_C)
DRV - [2012.02.23 14:31:36 | 000,083,984 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdLH3.sys -- (AtiHDAudioService)
DRV - [2011.12.29 13:37:44 | 000,028,464 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\LPCFilter.sys -- (LPCFilter)
DRV - [2011.09.20 11:08:12 | 000,007,680 | ---- | M] (MSI) [Kernel | On_Demand | Stopped] -- C:\MSI\MSI SUITE\ControlCenter\NTIOLib.sys -- (NTIOLib_1_0_D)
DRV - [2011.09.16 17:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.09.02 08:31:28 | 000,039,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2011.09.02 08:31:28 | 000,030,360 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2011.09.02 08:31:20 | 000,041,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2010.11.04 15:18:04 | 000,102,728 | ---- | M] (Matrox Graphics Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\MxEFUF32.sys -- (MxEFUF)
DRV - [2010.10.20 14:43:08 | 000,007,680 | ---- | M] (MSI) [Kernel | On_Demand | Stopped] -- C:\Program Files\MSI\Live Update 5\NTIOLib.sys -- (NTIOLib_1_0_4)
DRV - [2010.05.10 10:44:42 | 000,025,912 | ---- | M] (Your Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\MSI\Live Update 5\msibios32_100507.sys -- (MSI_MSIBIOS_010507)
DRV - [2010.03.16 21:20:51 | 000,685,816 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2010.02.27 10:30:29 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2010.02.26 14:32:58 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2010.02.26 14:32:46 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2010.02.26 14:32:44 | 000,022,528 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2010.02.26 14:32:44 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2010.02.16 08:57:42 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009.12.30 13:55:14 | 000,007,680 | ---- | M] (MSI) [Kernel | On_Demand | Stopped] -- C:\Program Files\MSI\Super-Charger\NTIOLib.sys -- (NTIOLib_1_0_3)
DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.02.19 08:09:10 | 000,072,704 | ---- | M] (Point Grey Research) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HS3dSensor1394.sys -- (PGR1394b)
DRV - [2007.04.13 14:22:56 | 000,228,224 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express)
DRV - [2006.11.28 23:46:24 | 000,028,224 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PDNMp50.sys -- (PDNMp50)
DRV - [2006.11.28 23:46:22 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PDNSp50.sys -- (PDNSp50)
DRV - [2002.06.10 15:20:50 | 000,039,936 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvcd.sys -- (QCDonner)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://alice.aol.de
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://alice.aol.de
IE - HKLM\..\URLSearchHook: - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found
IE - HKLM\..\URLSearchHook: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Program Files\IncrediMail_MediaBar_2\prxtbInc0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA74C8}: "URL" = hxxp://www.searchqu.com/web?src=ieb&q={searchTerms}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2405280
IE - HKLM\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://search.babylon.com/?affID=110824&tt=101012_24_4112_2&babsrc=HP_ss&mntrId=5a9e0d6b000000000000000000000000
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=110824&tt=101012_24_4112_2&babsrc=HP_ss&mntrId=5a9e0d6b000000000000000000000000
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - No CLSID value found
IE - HKCU\..\URLSearchHook: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Program Files\IncrediMail_MediaBar_2\prxtbInc0.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F464F524D3D4945464D3126713D7B7365617263685465726D737D267372633D7B72656665727265723A736F757263653F7D&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&k=0
IE - HKCU\..\SearchScopes\{299622BC-AC86-494D-9E5C-9B385816C0D6}: "URL" = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{2DA5735A-B19D-4322-8CC1-D93D0CFE630E}: "URL" = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{79262CC3-E08A-4E62-868B-482145ABA554}: "URL" = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA74C8}: "URL" = hxxp://www.searchqu.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E73656172636871752E636F6D2F7765623F7372633D69656226713D7B7365617263685465726D737D&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&k=0
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={0EAE350D-72C5-45AB-9C68-BFFEBE009481}&mid=7ab495e403bf47d0905c19b4330d3284-f1b2ed4f9eb8b0b53f1fcc3916f29e6d0c224b70&lang=de&ds=tt014&pr=sa&d=2012-10-03 23:58:20&v=13.0.0.7&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{A92D9454-CA97-4F63-B91F-68786D2099D6}: "URL" = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E636F6E647569742E636F6D2F526573756C74734578742E617370783F713D7B7365617263685465726D737D26536561726368536F757263653D3426637469643D435432343035323830&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&k=0
IE - HKCU\..\SearchScopes\{CA0339FC-CDA1-46FB-96DD-E89D390B0413}: "URL" = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredimail.com/mb156/?search={searchTerms}&loc=search_box&a=1eynR4mkr3R
IE - HKCU\..\SearchScopes\{F4BB98EE-A332-4FDF-8E77-93BE46555CAA}: "URL" = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=e85d924a-6695-4cd1-a5e0-f1a1f9ae29e7&pid=freewarede&mode=bounce&k=0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Softonic-Eng7 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2405280&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://search.babylon.com/?affID=110824&tt=101012_24_4112_2&babsrc=HP_ss&mntrId=5a9e0d6b000000000000000000000000"
FF - prefs.js..extensions.enabledAddons: {336D0C35-8A85-403a-B9D2-65C292C39087}:2.0.0.441
FF - prefs.js..extensions.enabledAddons: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}:6.0.33
FF - prefs.js..extensions.enabledAddons: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}:6.0.35
FF - prefs.js..extensions.enabledAddons: {800b5000-a755-47e1-992b-48a1c1357f07}:1.5.3
FF - prefs.js..extensions.enabledAddons: avg@toolbar:13.0.0.7
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.3.42
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..extensions.enabledItems: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}:3.2.1.3
FF - prefs.js..extensions.enabledItems: {000F1EA4-5E08-4564-A29B-29076F63A37A}:1.0.3.139
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "https://isearch.avg.com/search?cid=%7B9662d32d-8d32-4e79-82bd-59e5281d4751%7D&mid=7ab495e403bf47d0905c19b4330d3284-f1b2ed4f9eb8b0b53f1fcc3916f29e6d0c224b70&ds=tt014&v=13.0.0.7&lang=de&pr=sa&d=2012-10-03%2023%3A58%3A20&sap=ku&q="
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\13.0.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\Users\Sweetheart\AppData\Roaming\Mozilla\Firefox\Profiles\28endelp.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}\plugins\npsoe.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKLM\Software\MozillaPlugins\@Webzen.com/NPGameWebStarter: C:\Program Files\WEBZEN\WebzenGameStarter\NPGameWebStarter.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010.08.19 20:52:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012.10.12 17:41:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.12\ [2012.10.13 09:31:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.06 22:02:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.16 15:48:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010.08.19 20:52:52 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\finder@meingutscheincode.de: C:\Program Files\Mein Gutscheincode Finder\Firefox [2011.07.18 20:10:40 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\ProgramData\Browser Manager\2.3.765.24\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension [2012.10.12 17:41:53 | 000,000,000 | ---D | M]
[2009.11.28 21:52:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sweetheart\AppData\Roaming\mozilla\Extensions
[2012.10.12 22:43:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sweetheart\AppData\Roaming\mozilla\Firefox\Profiles\28endelp.default\extensions
[2010.11.14 10:52:28 | 000,000,000 | ---D | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\Firefox\Profiles\28endelp.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}
[2010.11.03 09:03:51 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Sweetheart\AppData\Roaming\mozilla\Firefox\Profiles\28endelp.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.09.07 10:47:12 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Sweetheart\AppData\Roaming\mozilla\Firefox\Profiles\28endelp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.09.06 10:40:01 | 000,101,871 | ---- | M] () (No name found) -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\extensions\ciuvo-extension@icq.de.xpi
[2012.09.23 22:53:40 | 000,000,950 | ---- | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\searchplugins\icqplugin-1.xml
[2012.10.04 12:45:06 | 000,000,950 | ---- | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\searchplugins\icqplugin-2.xml
[2012.06.06 11:43:27 | 000,001,056 | ---- | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\searchplugins\icqplugin.xml
[2011.07.18 20:10:40 | 000,001,687 | ---- | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\searchplugins\winamp-search.xml
[2011.07.18 20:10:40 | 000,001,870 | ---- | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\searchplugins\{C9FFD529-F13F-47F5-9D04-488F9F9F6E79}.xml
[2011.07.18 20:10:40 | 000,002,077 | ---- | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\searchplugins\{FA9D6423-B334-46A2-9214-7A64B933E387}.xml
[2011.07.18 20:10:40 | 000,002,188 | ---- | M] () -- C:\Users\Sweetheart\AppData\Roaming\mozilla\firefox\profiles\28endelp.default\searchplugins\{FEB502EE-54AB-4A4D-8404-1932DE660FCE}.xml
[2012.10.12 11:49:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012.07.30 19:33:39 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012.10.12 17:41:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2012.06.06 22:02:50 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.06.28 17:42:00 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2012.06.06 22:02:48 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.10.13 09:31:53 | 000,003,769 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.06.06 22:02:48 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.06 22:02:48 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.06 22:02:48 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.06 22:02:48 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.06 22:02:48 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
========== Chrome ==========
CHR - homepage: hxxp://search.babylon.com/?affID=110824&tt=101012_24_4112_2&babsrc=HP_ss&mntrId=5a9e0d6b000000000000000000000000
CHR - default_search_provider: ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =
CHR - homepage: hxxp://search.babylon.com/?affID=110824&tt=101012_24_4112_2&babsrc=HP_ss&mntrId=5a9e0d6b000000000000000000000000
CHR - Extension: No name found = C:\Users\Sweetheart\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: No name found = C:\Users\Sweetheart\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: No name found = C:\Users\Sweetheart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo\3.0.2_0\
CHR - Extension: No name found = C:\Users\Sweetheart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können.) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - C:\Program Files\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll (Conversion One GmbH)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll ()
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Searchqu Toolbar) - {7FF99715-3016-4381-84CE-E4E4C9673020} - C:\Program Files\Windows Searchqu Toolbar\ToolBar\SearchquDx.dll ()
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll (Google Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (IncrediMail MediaBar 2 Toolbar) - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Program Files\IncrediMail_MediaBar_2\prxtbInc0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {7FF99715-3016-4381-84CE-E4E4C9673020} - C:\Program Files\Windows Searchqu Toolbar\ToolBar\SearchquDx.dll ()
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - {D0F4A166-B8D4-48b8-9D63-80849FE137CB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (IncrediMail MediaBar 2 Toolbar) - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Program Files\IncrediMail_MediaBar_2\prxtbInc0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (IncrediMail MediaBar 2 Toolbar) - {D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - C:\Program Files\IncrediMail_MediaBar_2\prxtbInc0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [MSI Suite] C:\MSI\MSI SUITE\StartMSISuite.exe ()
O4 - HKLM..\Run: [Ocs_SM] C:\Users\Sweetheart\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS)
O4 - HKLM..\Run: [PMBVolumeWatcher] C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Super-Charger] C:\Program Files\MSI\Super-Charger\Super-Charger.exe (MSI)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [DriverMax] C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe (Innovative Solutions)
O4 - HKCU..\Run: [DriverMax_RESTART] C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe (Innovative Solutions)
O4 - HKCU..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe (IncrediMail, Ltd.)
O4 - HKCU..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4521BBEC-17A0-4C4D-A607-CF9B32D64006}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{71A460A0-92AC-4C40-9141-0B1041C1D07D}: NameServer = 213.191.74.18 62.109.123.196
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\13.0.0\ViProtocol.dll ()
O20 - AppInit_DLLs: (c:\progra~2\browse~1\23765~1.24\{16cdf~1\browse~1.dll) - c:\ProgramData\Browser Manager\2.3.765.24\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Sweetheart\Pictures\Hintergrundbilder\drachen.jpg
O24 - Desktop BackupWallPaper: C:\Users\Sweetheart\Pictures\Hintergrundbilder\drachen.jpg
O27 - HKLM IFEO\diagnostictool.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\excel.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\groove.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\hpcustpartic.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\hpwucli.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\hrfsclient.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\imgstud.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\infopath.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\msaccess.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\msi suite.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\msoxmled.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\mspub.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\mstore.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\ois.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\onenote.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\onenotem.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\outlook.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\pmbbrowser.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\pmbinit.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\powerpnt.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\super-charger.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\unins000.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O27 - HKLM IFEO\winword.exe: Debugger - C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe (TuneUp Software)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2012.10.13 22:33:33 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{8DE6DF08-594B-4083-B0E5-0FBB19E4C9E8}
[2012.10.13 09:37:52 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{ACA90A87-879B-49EA-A2DB-9F9BCFB5A01C}
[2012.10.13 09:37:43 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\AVG Secure Search
[2012.10.12 16:57:07 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2012.10.12 16:55:34 | 000,000,000 | ---D | C] -- C:\141f41d6742d92c2f2e6594a08
[2012.10.12 16:55:03 | 000,000,000 | ---D | C] -- C:\Windows\CheckSur
[2012.10.12 16:45:10 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{3F45D755-A7B6-4048-9B16-92F3A444A456}
[2012.10.12 12:41:19 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.10.12 11:55:20 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java(1)
[2012.10.12 11:53:54 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Google
[2012.10.12 10:26:54 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{882B453D-AC34-4177-A6A0-64E49C1E232A}
[2012.10.11 23:07:34 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browser Manager
[2012.10.11 23:07:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Browser Manager
[2012.10.11 22:26:37 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{C4481F9C-20C7-4C0A-BE6A-9C52BA4F54EB}
[2012.10.11 10:26:15 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{308F0B84-DB51-45F1-A72C-7487F5B2133C}
[2012.10.10 13:32:54 | 003,602,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2012.10.10 13:32:54 | 003,550,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2012.10.10 13:26:10 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{815B5E2E-6E92-49F1-A413-1BB0A79C1CAB}
[2012.10.09 23:26:52 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{933D5892-15B0-44CB-9753-42EFB49C89FF}
[2012.10.09 14:01:25 | 001,801,592 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\WavesGUILib.dll
[2012.10.09 14:01:24 | 000,725,632 | ---- | C] (Sony Corporation) -- C:\Windows\System32\SFSS_APO.dll
[2012.10.09 14:01:23 | 002,486,416 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkPgExt.dll
[2012.10.09 14:01:23 | 001,501,840 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RTSndMgr.cpl
[2012.10.09 14:01:21 | 000,658,064 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkApoApi.dll
[2012.10.09 14:01:21 | 000,094,864 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkCoInstII.dll
[2012.10.09 14:01:18 | 007,161,736 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EEP32A.dll
[2012.10.09 14:01:18 | 006,702,592 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RCoRes.dat
[2012.10.09 14:01:17 | 007,377,272 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioRealtek.dll
[2012.10.09 14:01:17 | 001,246,584 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioRealtek2.dll
[2012.10.09 14:01:17 | 000,351,112 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EED32A.dll
[2012.10.09 14:01:17 | 000,349,048 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxVolumeSDAPO.dll
[2012.10.09 14:01:17 | 000,106,376 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EEL32A.dll
[2012.10.09 14:01:17 | 000,091,528 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EEA32A.dll
[2012.10.09 14:01:17 | 000,061,832 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EEG32A.dll
[2012.10.09 14:01:16 | 001,929,592 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioEQ.dll
[2012.10.09 14:01:16 | 000,717,176 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPOShell.dll
[2012.10.09 14:01:15 | 002,195,040 | ---- | C] (Fortemedia Corporation) -- C:\Windows\System32\FMAPO.dll
[2012.10.09 14:01:15 | 000,350,072 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO30.dll
[2012.10.09 14:01:13 | 000,090,624 | ---- | C] (Real Sound Lab SIA) -- C:\Windows\System32\CONEQMSAPOGUILibrary.dll
[2012.10.09 13:58:07 | 000,015,248 | ---- | C] (PenMount) -- C:\Windows\System32\drivers\pmkbdfltr.sys
[2012.10.09 11:26:37 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{917B5FA0-BE0A-4C08-9C44-919E43237B04}
[2012.10.08 23:26:21 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{F3F3C40E-9E74-48C1-BC02-FF09AB3A0747}
[2012.10.08 23:21:29 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Magic3
[2012.10.08 11:29:43 | 000,028,464 | ---- | C] (COMPAL ELECTRONIC INC.) -- C:\Windows\System32\drivers\LPCFilter.sys
[2012.10.08 11:26:06 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{47328226-A6A8-414D-BF78-AC938ABEEE4B}
[2012.10.07 23:25:51 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{37A7F0E7-36B7-44B2-85DF-1137D5E1B8EE}
[2012.10.07 14:16:16 | 000,208,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WinFXDocObj.exe
[2012.10.07 14:14:11 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2012.10.07 14:14:11 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.10.07 14:14:10 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2012.10.07 14:14:10 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2012.10.07 14:14:10 | 000,367,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2012.10.07 14:14:10 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2012.10.07 14:14:10 | 000,223,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2012.10.07 14:14:10 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.10.07 14:14:10 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2012.10.07 14:14:10 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2012.10.07 14:14:10 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2012.10.07 14:14:10 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2012.10.07 14:14:10 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2012.10.07 14:14:10 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2012.10.07 14:14:10 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2012.10.07 14:14:10 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2012.10.07 14:14:09 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.10.07 14:14:09 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.10.07 14:14:09 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.10.07 14:14:09 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.10.07 14:14:09 | 000,353,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2012.10.07 14:14:09 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.10.07 14:14:09 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2012.10.07 14:14:09 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2012.10.07 14:14:09 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2012.10.07 14:14:09 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2012.10.07 14:14:09 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.10.07 14:14:09 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2012.10.07 14:14:09 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2012.10.07 14:14:09 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2012.10.07 14:14:09 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2012.10.07 14:14:09 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2012.10.07 14:14:09 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2012.10.07 14:14:08 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2012.10.07 14:14:08 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2012.10.07 14:14:08 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2012.10.07 14:14:08 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2012.10.07 11:25:36 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{0E93320C-D9FC-4B0E-BBDA-6C5DFE8ED582}
[2012.10.06 23:07:44 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{4F8B0643-6196-4479-A77D-B2FBF564CCB0}
[2012.10.06 11:07:28 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{DE896563-E8FB-4F68-99F5-946CD649BB4C}
[2012.10.06 10:44:33 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\System32\CSVer.dll
[2012.10.06 10:26:18 | 000,072,704 | ---- | C] (Point Grey Research) -- C:\Windows\System32\drivers\HS3dSensor1394.sys
[2012.10.06 10:23:47 | 000,161,640 | ---- | C] (Marvell Semiconductor, Inc.) -- C:\Windows\System32\drivers\mv61xx.sys
[2012.10.06 10:23:47 | 000,040,448 | ---- | C] (<Marvell>) -- C:\Windows\System32\mvcoinst.dll
[2012.10.06 10:23:47 | 000,014,184 | ---- | C] (Marvell Semiconductor Inc.) -- C:\Windows\System32\drivers\mv61xxmm.sys
[2012.10.06 10:18:43 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\.thinupload
[2012.10.06 03:18:51 | 001,379,760 | ---- | C] (TOSHIBA Corporation) -- C:\Windows\System32\tosade.dll
[2012.10.06 03:18:51 | 000,819,648 | ---- | C] (TOSHIBA Corporation) -- C:\Windows\System32\tadefxapo2.dll
[2012.10.06 03:18:51 | 000,214,368 | ---- | C] (Synopsys, Inc.) -- C:\Windows\System32\SFNHK.dll
[2012.10.06 03:18:51 | 000,134,584 | ---- | C] (TOSHIBA Corporation) -- C:\Windows\System32\tadefxapo.dll
[2012.10.06 03:18:51 | 000,058,264 | ---- | C] (TOSHIBA CORPORATION.) -- C:\Windows\System32\TepeqAPO.dll
[2012.10.06 03:18:50 | 000,074,080 | ---- | C] (Synopsys, Inc.) -- C:\Windows\System32\SFCOM.dll
[2012.10.06 03:18:50 | 000,068,960 | ---- | C] (Synopsys, Inc.) -- C:\Windows\System32\SFAPO.dll
[2012.10.06 03:18:48 | 000,013,416 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkCoLDR.dll
[2012.10.06 03:18:46 | 000,421,744 | ---- | C] (DTS) -- C:\Windows\System32\DTSU2PLFX32.dll
[2012.10.06 03:18:46 | 000,398,192 | ---- | C] (DTS) -- C:\Windows\System32\DTSU2PGFX32.dll
[2012.10.06 03:18:46 | 000,357,712 | ---- | C] (Knowles Acoustics ) -- C:\Windows\System32\KAAPORT.dll
[2012.10.06 03:18:46 | 000,335,216 | ---- | C] (DTS) -- C:\Windows\System32\DTSU2PREC32.dll
[2012.10.06 03:18:45 | 000,176,736 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\System32\AERTACap.dll
[2012.10.06 03:18:45 | 000,095,840 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\System32\AERTARen.dll
[2012.10.06 03:16:05 | 000,011,832 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\acpimof.dll
[2012.10.06 03:15:58 | 000,000,000 | ---D | C] -- C:\MSI
[2012.10.06 03:15:37 | 000,000,000 | -H-D | C] -- C:\SuperChargerProfile
[2012.10.06 03:14:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.10.06 01:18:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Google
[2012.10.06 01:18:31 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012.10.06 01:18:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Trend Micro
[2012.10.06 01:18:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trend Micro SafeSync
[2012.10.06 01:18:23 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro SafeSync
[2012.10.05 22:42:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSI
[2012.10.05 22:42:40 | 000,000,000 | ---D | C] -- C:\Program Files\MSI
[2012.10.05 17:21:36 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{80EC128F-6B89-4D55-82E1-47F4EA1A629D}
[2012.10.05 00:04:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
[2012.10.04 23:51:59 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{81ED33C1-BFAA-4BA1-957F-441D409073AE}
[2012.10.04 23:37:10 | 000,102,728 | ---- | C] (Matrox Graphics Inc.) -- C:\Windows\System32\drivers\MxEFUF32.sys
[2012.10.04 23:32:30 | 000,058,880 | ---- | C] (AMD) -- C:\Windows\System32\coinst_9.001.dll
[2012.10.04 23:32:29 | 000,163,840 | ---- | C] (AMD) -- C:\Windows\System32\atitmmxx.dll
[2012.10.04 23:32:29 | 000,071,168 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atisamu32.dll
[2012.10.04 23:32:28 | 019,624,960 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\atioglxx.dll
[2012.10.04 23:32:25 | 009,106,432 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\drivers\atikmdag.sys
[2012.10.04 23:32:25 | 000,370,176 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\drivers\atikmpag.sys
[2012.10.04 23:32:25 | 000,056,832 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atimpc32.dll
[2012.10.04 23:32:25 | 000,056,832 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\amdpcom32.dll
[2012.10.04 23:32:25 | 000,020,992 | ---- | C] (AMD) -- C:\Windows\System32\atimuixx.dll
[2012.10.04 23:32:24 | 000,033,280 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atigktxx.dll
[2012.10.04 23:32:24 | 000,014,848 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atiglpxx.dll
[2012.10.04 23:32:23 | 013,703,168 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\System32\aticaldd.dll
[2012.10.04 23:32:23 | 000,442,368 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\atidemgy.dll
[2012.10.04 23:32:23 | 000,046,080 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\System32\aticalrt.dll
[2012.10.04 23:32:21 | 000,163,840 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\atiapfxx.exe
[2012.10.04 23:32:21 | 000,078,336 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\amdave32.dll
[2012.10.04 23:32:21 | 000,053,248 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\drivers\ati2erec.dll
[2012.10.04 23:32:21 | 000,044,032 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\System32\aticalcl.dll
[2012.10.04 23:32:21 | 000,043,520 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\System32\ati2edxx.dll
[2012.10.04 23:17:50 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\Innovative Solutions
[2012.10.04 23:17:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverMax
[2012.10.04 23:17:48 | 000,000,000 | ---D | C] -- C:\Program Files\Innovative Solutions
[2012.10.04 22:52:42 | 000,000,000 | ---D | C] -- C:\Windows\System32\RTCOM
[2012.10.04 22:51:51 | 001,783,056 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\WavesLib.dll
[2012.10.04 22:51:50 | 000,345,328 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSXT.dll
[2012.10.04 22:51:50 | 000,185,584 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSHD.dll
[2012.10.04 22:51:50 | 000,173,296 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSHP360.dll
[2012.10.04 22:51:50 | 000,140,528 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSWOW.dll
[2012.10.04 22:51:48 | 000,076,392 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkCoInst.dll
[2012.10.04 22:51:45 | 003,196,048 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkAPO.dll
[2012.10.04 22:51:45 | 000,359,768 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEP32A.dll
[2012.10.04 22:51:45 | 000,295,768 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RP3DHT32.dll
[2012.10.04 22:51:45 | 000,295,768 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RP3DAA32.dll
[2012.10.04 22:51:45 | 000,170,840 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEED32A.dll
[2012.10.04 22:51:45 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEL32A.dll
[2012.10.04 22:51:45 | 000,064,856 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEG32A.dll
[2012.10.04 22:51:44 | 000,232,792 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO20.dll
[2012.10.04 22:51:44 | 000,132,368 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO.dll
[2012.10.04 22:51:43 | 001,509,480 | ---- | C] (DTS) -- C:\Windows\System32\DTSS2SpeakerDLL.dll
[2012.10.04 22:51:43 | 001,292,904 | ---- | C] (DTS) -- C:\Windows\System32\DTSS2HeadphoneDLL.dll
[2012.10.04 22:51:43 | 001,220,200 | ---- | C] (DTS) -- C:\Windows\System32\DTSBoostDLL.dll
[2012.10.04 22:51:43 | 000,654,952 | ---- | C] (DTS) -- C:\Windows\System32\DTSBassEnhancementDLL.dll
[2012.10.04 22:51:43 | 000,631,400 | ---- | C] (DTS) -- C:\Windows\System32\DTSSymmetryDLL.dll
[2012.10.04 22:51:43 | 000,601,704 | ---- | C] (DTS) -- C:\Windows\System32\DTSVoiceClarityDLL.dll
[2012.10.04 22:51:43 | 000,458,344 | ---- | C] (DTS) -- C:\Windows\System32\DTSNeoPCDLL.dll
[2012.10.04 22:51:43 | 000,389,736 | ---- | C] (DTS) -- C:\Windows\System32\DTSGainCompensatorDLL.dll
[2012.10.04 22:51:43 | 000,375,400 | ---- | C] (DTS) -- C:\Windows\System32\DTSLimiterDLL.dll
[2012.10.04 22:51:43 | 000,218,728 | ---- | C] (DTS) -- C:\Windows\System32\DTSGFXAPONS.dll
[2012.10.04 22:51:43 | 000,218,728 | ---- | C] (DTS) -- C:\Windows\System32\DTSGFXAPO.dll
[2012.10.04 22:51:43 | 000,218,216 | ---- | C] (DTS) -- C:\Windows\System32\DTSLFXAPO.dll
[2012.10.04 21:52:45 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab
[2012.10.04 19:40:00 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\SystemRequirementsLab
[2012.10.04 19:18:10 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Intel Corporation
[2012.10.04 19:18:10 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel Corporation
[2012.10.04 15:07:14 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Photo Creations
[2012.10.04 15:07:14 | 000,000,000 | ---D | C] -- C:\Program Files\HP Photo Creations
[2012.10.04 15:05:27 | 000,000,000 | ---D | C] -- C:\Program Files\HP
[2012.10.04 15:01:27 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
[2012.10.04 14:59:37 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Leadertech
[2012.10.04 14:59:16 | 000,016,400 | ---- | C] (Logitech, Inc.) -- C:\Windows\System32\drivers\LNonPnP.sys
[2012.10.04 14:58:17 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\LogiShrd
[2012.10.04 14:57:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Logishrd
[2012.10.04 14:57:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\LogiShrd
[2012.10.04 14:56:57 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Logitech
[2012.10.04 14:56:57 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Logishrd
[2012.10.04 14:54:29 | 000,319,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\DIFxAPI.dll
[2012.10.04 14:54:13 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2012.10.04 14:54:09 | 000,000,000 | -H-D | C] -- C:\Program Files\Temp
[2012.10.04 14:54:08 | 001,706,640 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\RtlExUpd.dll
[2012.10.04 11:51:44 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{ACC5CE56-0255-4CCB-950F-C13EC639AB4C}
[2012.10.04 07:26:43 | 000,000,000 | ---D | C] -- C:\Program Files\AMD APP
[2012.10.04 02:10:45 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\PCCUStubInstaller
[2012.10.04 02:10:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton
[2012.10.04 02:10:21 | 000,000,000 | ---D | C] -- C:\ProgramData\NortonInstaller
[2012.10.04 00:25:45 | 000,000,000 | ---D | C] -- C:\Program Files\SmartTweak Software
[2012.10.04 00:25:00 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\PackageAware
[2012.10.03 23:59:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2013
[2012.10.03 23:58:50 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Secure Search
[2012.10.03 23:58:18 | 000,026,984 | ---- | C] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys
[2012.10.03 23:58:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVG Secure Search
[2012.10.03 23:58:16 | 000,000,000 | ---D | C] -- C:\Program Files\AVG Secure Search
[2012.10.03 23:57:23 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2013
[2012.10.03 23:56:27 | 000,000,000 | -HSD | C] -- C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
[2012.10.03 23:56:27 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012.10.03 23:51:29 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{AA42FCFF-900E-42A8-9AA6-5512A3E6C83A}
[2012.10.03 23:45:24 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\Easeware
[2012.10.03 23:45:22 | 000,000,000 | ---D | C] -- C:\Program Files\Easeware
[2012.10.03 23:35:48 | 000,017,280 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\Windows\System32\roboot.exe
[2012.10.03 11:51:12 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{9CDD3A9D-536B-42F8-8098-CE810FD878DA}
[2012.10.02 23:50:57 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{83F62225-842A-44B8-B70F-C5A2D56F5224}
[2012.10.02 11:50:42 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{566E9734-210E-4AF1-AA20-232CA2D3C1DB}
[2012.10.01 22:08:37 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{F7A1A3ED-CE71-4924-BB3C-457279DF5F5C}
[2012.10.01 09:50:42 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{B5F9EF2F-DD06-42AF-ACA2-776DBCA72584}
[2012.09.30 17:16:09 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{A2AF122E-F70C-432E-B258-8F58D6820BB3}
[2012.09.29 18:23:22 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{CACD1CB0-0C48-4AFE-94A6-6AB60674887B}
[2012.09.29 00:14:36 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{44DFB7BF-048A-4977-8398-0C9CE4D4F6E3}
[2012.09.28 12:13:46 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{263565D5-5096-4053-BC93-829B6F9F443B}
[2012.09.27 22:57:34 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{441E7A89-73F0-4E70-964E-576D062F1863}
[2012.09.27 22:43:48 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Roaming\V-Games
[2012.09.27 22:42:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Purplehills
[2012.09.27 22:42:43 | 000,000,000 | ---D | C] -- C:\Program Files\Purplehills
[2012.09.27 10:57:20 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{CDB2A17F-4C82-48DA-84A6-27952D8CF6A3}
[2012.09.26 22:18:47 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{9E55831C-364C-4AF0-8101-20B27E72F5A3}
[2012.09.26 10:18:32 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{3AA15C08-A0A4-4C0C-9CA9-B2B4275EBE29}
[2012.09.25 22:18:01 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{3AD46BDE-E5BD-4C57-8E27-4586572A1FBF}
[2012.09.24 23:35:07 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{C9A78311-E3E1-40C6-B29E-A73159FCE281}
[2012.09.24 23:17:30 | 000,000,000 | ---D | C] -- C:\Program Files\Online Games Manager
[2012.09.24 23:17:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zylom
[2012.09.24 23:06:48 | 000,000,000 | ---D | C] -- C:\ProgramData\PopCap Games
[2012.09.24 11:34:52 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{CA8AA90A-A087-4AA2-8A53-47DF51737103}
[2012.09.23 22:13:06 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{BA6C85CB-0254-45C6-97DC-C95801261E5E}
[2012.09.23 10:07:45 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{EF153F13-1396-4438-A7CF-AC9496081D6C}
[2012.09.22 11:13:56 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{77735006-5D11-4E89-868A-77DEE39E4B32}
[2012.09.21 16:38:05 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{2EEF052F-76F4-484E-9FF2-1D8505013A95}
[2012.09.20 22:07:52 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{2D658D1A-EBE2-4E90-AAB5-9F71D46DC572}
[2012.09.20 09:49:23 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{714FEBDC-AFB3-435F-9652-291129A72C13}
[2012.09.19 14:41:13 | 002,047,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.09.19 14:18:42 | 000,555,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAutomationCore.dll
[2012.09.19 14:18:42 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleaccrc.dll
[2012.09.19 14:18:31 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2012.09.19 14:17:53 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciseq.dll
[2012.09.19 14:17:51 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll
[2012.09.19 14:17:51 | 000,217,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax
[2012.09.19 14:17:51 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Mpeg2Data.ax
[2012.09.19 14:17:51 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSDvbNP.ax
[2012.09.19 14:17:42 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[2012.09.19 14:17:30 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2012.09.19 14:17:30 | 000,497,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll
[2012.09.19 14:17:24 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012.09.19 14:17:19 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2012.09.19 14:17:19 | 001,069,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012.09.19 14:17:19 | 000,683,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2012.09.19 14:17:19 | 000,219,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2012.09.19 14:17:19 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2012.09.19 14:17:11 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll
[2012.09.19 14:17:09 | 000,613,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpencom.dll
[2012.09.19 14:17:06 | 000,376,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2012.09.19 13:56:14 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{4BF72F45-9414-4B73-B183-7D603531D3E1}
[2012.09.18 16:36:57 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{818FDAE1-D3BF-400E-ACD1-63A30B552785}
[2012.09.17 14:53:25 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{425E75EE-8B3D-48B3-BED6-58DDA84B8EC2}
[2012.09.16 22:18:41 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{0E5B1A36-4068-4F87-931C-A3EB206527E7}
[2012.09.15 22:01:57 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{FEC59C97-4A4E-4B5E-9F4B-5F072AC10050}
[2012.09.14 09:54:32 | 000,000,000 | ---D | C] -- C:\Users\Sweetheart\AppData\Local\{51F21393-BBA4-4780-96BF-800A57D7EDDD}
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Users\Sweetheart\AppData\Local\*.tmp files -> C:\Users\Sweetheart\AppData\Local\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.10.13 22:33:16 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.10.13 22:32:16 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.10.13 22:32:09 | 000,004,736 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.13 22:32:09 | 000,004,736 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.13 22:32:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.13 22:31:59 | 3219,304,448 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.13 14:10:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.10.13 09:33:56 | 000,001,931 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.10.10 23:10:25 | 000,000,866 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.08 23:10:40 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.10.08 23:10:40 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.10.07 14:14:18 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat
[2012.10.07 14:14:18 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat
[2012.10.07 14:14:11 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2012.10.07 14:14:11 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.10.07 14:14:10 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2012.10.07 14:14:10 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2012.10.07 14:14:10 | 000,367,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2012.10.07 14:14:10 | 000,353,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2012.10.07 14:14:10 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2012.10.07 14:14:10 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.10.07 14:14:10 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2012.10.07 14:14:10 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2012.10.07 14:14:10 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2012.10.07 14:14:10 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2012.10.07 14:14:10 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2012.10.07 14:14:10 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2012.10.07 14:14:10 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2012.10.07 14:14:10 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2012.10.07 14:14:10 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2012.10.07 14:14:09 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.10.07 14:14:09 | 001,800,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.10.07 14:14:09 | 001,427,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.10.07 14:14:09 | 000,607,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.10.07 14:14:09 | 000,353,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2012.10.07 14:14:09 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.10.07 14:14:09 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2012.10.07 14:14:09 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2012.10.07 14:14:09 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2012.10.07 14:14:09 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2012.10.07 14:14:09 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.10.07 14:14:09 | 000,118,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2012.10.07 14:14:09 | 000,101,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2012.10.07 14:14:09 | 000,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2012.10.07 14:14:09 | 000,054,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2012.10.07 14:14:09 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2012.10.07 14:14:09 | 000,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2012.10.07 14:14:08 | 000,130,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2012.10.07 14:14:08 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2012.10.07 14:14:08 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2012.10.07 14:14:08 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2012.10.06 10:27:09 | 000,636,998 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.10.06 10:27:09 | 000,604,074 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.10.06 10:27:09 | 000,130,596 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.10.06 10:27:09 | 000,108,468 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.10.06 03:18:59 | 000,319,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\DIFxAPI.dll
[2012.10.05 22:42:42 | 000,001,748 | ---- | M] () -- C:\Users\Public\Desktop\Live Update 5.lnk
[2012.10.05 22:30:47 | 000,016,400 | ---- | M] (Logitech, Inc.) -- C:\Windows\System32\drivers\LNonPnP.sys
[2012.10.05 10:41:09 | 002,100,056 | ---- | M] () -- C:\Users\Sweetheart\Documents\anleitung waschmaschine.pdf
[2012.10.05 10:34:23 | 000,000,041 | -HS- | M] () -- C:\ProgramData\.zreglib
[2012.10.04 23:17:50 | 000,000,987 | ---- | M] () -- C:\Users\Sweetheart\Desktop\DriverMax.lnk
[2012.10.04 10:16:09 | 000,390,248 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.10.03 23:59:04 | 000,001,829 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2012.10.03 23:59:04 | 000,001,825 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities 2013.lnk
[2012.10.03 23:57:43 | 000,026,984 | ---- | M] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys
[2012.09.30 00:12:05 | 000,001,236 | ---- | M] () -- C:\Users\Sweetheart\Desktop\Magic Encyclopedia 3 - Illusionen.lnk
[2012.09.30 00:10:44 | 000,001,008 | ---- | M] () -- C:\Users\Sweetheart\Desktop\Magic Encyclopedia 2.lnk
[2012.09.27 22:42:57 | 000,000,987 | ---- | M] () -- C:\Users\Sweetheart\Desktop\Magic Encyclopedia.lnk
[2012.09.24 22:10:20 | 000,047,686 | ---- | M] () -- C:\Users\Sweetheart\Documents\ihre_rechnung.pdf
[2012.09.19 11:29:46 | 000,031,584 | ---- | M] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe
[2012.09.19 11:29:40 | 000,021,344 | ---- | M] (TuneUp Software) -- C:\Windows\System32\authuitu.dll
[2012.09.14 11:29:56 | 000,750,452 | ---- | M] () -- C:\Users\Sweetheart\Documents\eMail_20120914_112547_59.PDF
[2012.09.14 11:14:24 | 000,000,736 | ---- | M] () -- C:\Users\Public\Desktop\Winamp.lnk
[2012.09.14 00:03:12 | 005,557,416 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atiumdag.dll
[2012.09.14 00:00:10 | 009,106,432 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\drivers\atikmdag.sys
[2012.09.13 23:46:04 | 000,058,880 | ---- | M] (AMD) -- C:\Windows\System32\coinst_9.001.dll
[2012.09.13 23:43:16 | 000,276,752 | ---- | M] () -- C:\Windows\System32\atiapfxx.blb
[2012.09.13 23:42:10 | 000,163,840 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\atiapfxx.exe
[2012.09.13 23:40:48 | 000,046,080 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Windows\System32\aticalrt.dll
[2012.09.13 23:40:40 | 000,044,032 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Windows\System32\aticalcl.dll
[2012.09.13 23:36:06 | 013,703,168 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Windows\System32\aticaldd.dll
[2012.09.13 23:27:40 | 000,934,912 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\aticfx32.dll
[2012.09.13 23:27:20 | 019,624,960 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\atioglxx.dll
[2012.09.13 23:23:52 | 006,477,824 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atidxx32.dll
[2012.09.13 23:19:26 | 000,442,368 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\atidemgy.dll
[2012.09.13 23:18:56 | 000,471,040 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
[2012.09.13 23:18:20 | 000,217,600 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
[2012.09.13 23:17:06 | 000,163,840 | ---- | M] (AMD) -- C:\Windows\System32\atitmmxx.dll
[2012.09.13 23:16:58 | 000,020,992 | ---- | M] (AMD) -- C:\Windows\System32\atimuixx.dll
[2012.09.13 23:16:50 | 000,043,520 | ---- | M] (ATI Technologies, Inc.) -- C:\Windows\System32\ati2edxx.dll
[2012.09.13 23:05:08 | 002,691,584 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atiumdva.dll
[2012.09.13 23:04:02 | 002,915,680 | ---- | M] () -- C:\Windows\System32\atiumdva.cap
[2012.09.13 22:56:38 | 000,078,336 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\amdave32.dll
[2012.09.13 22:56:20 | 000,071,168 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atisamu32.dll
[2012.09.13 22:56:12 | 000,405,504 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\atiadlxx.dll
[2012.09.13 22:55:58 | 000,056,832 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atimpc32.dll
[2012.09.13 22:55:58 | 000,056,832 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\amdpcom32.dll
[2012.09.13 22:55:58 | 000,014,848 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atiglpxx.dll
[2012.09.13 22:55:46 | 000,033,280 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atigktxx.dll
[2012.09.13 22:55:00 | 000,370,176 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\drivers\atikmpag.sys
[2012.09.13 22:54:10 | 000,109,568 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atiuxpag.dll
[2012.09.13 22:53:56 | 000,082,944 | ---- | M] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atiu9pag.dll
[2012.09.13 22:53:32 | 000,037,376 | ---- | M] () -- C:\Windows\System32\atitmpxx.dll
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Users\Sweetheart\AppData\Local\*.tmp files -> C:\Users\Sweetheart\AppData\Local\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.10.12 10:18:50 | 3219,304,448 | -HS- | C] () -- C:\hiberfil.sys
[2012.10.10 23:10:25 | 000,000,866 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.09 14:01:18 | 000,336,393 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT
[2012.10.07 14:14:10 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2012.10.06 03:14:44 | 000,001,931 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.10.06 01:18:50 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.10.06 01:18:50 | 000,001,102 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.10.05 22:42:42 | 000,001,748 | ---- | C] () -- C:\Users\Public\Desktop\Live Update 5.lnk
[2012.10.05 10:41:03 | 002,100,056 | ---- | C] () -- C:\Users\Sweetheart\Documents\anleitung waschmaschine.pdf
[2012.10.04 23:32:30 | 002,915,680 | ---- | C] () -- C:\Windows\System32\atiumdva.cap
[2012.10.04 23:32:26 | 000,038,204 | ---- | C] () -- C:\Windows\atiogl.xml
[2012.10.04 23:32:24 | 000,632,252 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2012.10.04 23:32:21 | 000,276,752 | ---- | C] () -- C:\Windows\System32\atiapfxx.blb
[2012.10.04 23:17:50 | 000,000,987 | ---- | C] () -- C:\Users\Sweetheart\Desktop\DriverMax.lnk
[2012.10.03 23:59:04 | 000,001,829 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2012.10.03 23:59:04 | 000,001,825 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities 2013.lnk
[2012.10.03 23:59:03 | 000,001,837 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2013.lnk
[2012.09.30 00:12:18 | 000,001,236 | ---- | C] () -- C:\Users\Sweetheart\Desktop\Magic Encyclopedia 3 - Illusionen.lnk
[2012.09.30 00:11:23 | 000,001,008 | ---- | C] () -- C:\Users\Sweetheart\Desktop\Magic Encyclopedia 2.lnk
[2012.09.27 22:43:45 | 000,000,987 | ---- | C] () -- C:\Users\Sweetheart\Desktop\Magic Encyclopedia.lnk
[2012.09.24 23:01:47 | 000,047,686 | ---- | C] () -- C:\Users\Sweetheart\Documents\ihre_rechnung.pdf
[2012.09.14 11:35:04 | 000,750,452 | ---- | C] () -- C:\Users\Sweetheart\Documents\eMail_20120914_112547_59.PDF
[2012.07.27 22:47:36 | 000,159,232 | ---- | C] () -- C:\Windows\System32\clinfo.exe
[2012.07.10 15:00:27 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat
[2012.02.01 04:11:30 | 000,037,376 | ---- | C] () -- C:\Windows\System32\atitmpxx.dll
[2011.04.27 09:00:47 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib
[2011.02.06 13:16:13 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.11.16 08:18:00 | 000,000,098 | ---- | C] () -- C:\Users\Sweetheart\AppData\Local\fusioncache.dat
[2010.02.24 22:13:51 | 000,083,456 | ---- | C] () -- C:\Users\Sweetheart\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.12.15 22:14:55 | 000,000,000 | ---- | C] () -- C:\Users\Sweetheart\AppData\Roaming\AVSDVDPlayer.m3u
[2009.11.26 19:03:51 | 000,001,356 | ---- | C] () -- C:\Users\Sweetheart\AppData\Local\d3d9caps.dat
========== ZeroAccess Check ==========
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== Alternate Data Streams ==========
@Alternate Data Stream - 24 bytes -> C:\Windows:5738951E5A09CC69
< End of report >
|
|
13.10.2012, 22:05
| #27 |
| /// the machine /// TB-Ausbilder | WIN32.BHO.acw Trojaner Conduit Engine Searchq Mediabar sollte doch schon vor ewigen posts deinstalliert werden? Kann es sein dass dein Vista nicht aktviert ist? Also kein gültiger Lezenzkey eingegeben wurde? Der Error taucht nämlich 10mal im Eventlog auf.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.10.2012, 22:14
| #28 |
| | WIN32.BHO.acw Trojaner conduit hab ich erneut deinstalliert und die mediabar taucht in der systemsteuerung in dem fenster nicht auf. hatte ich gestern alles schonmal runtergeschmissen. das weiß ich nicht ob das registriert ist. hab den pc vor paar jahren mit windows vista bekommen und seidher noch nie selbst neu installieren müssen |
|
13.10.2012, 22:17
| #29 |
| /// the machine /// TB-Ausbilder | WIN32.BHO.acw Trojaner Downloade dir bitte Windows Repair (All In One) von hier.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.10.2012, 23:03
| #30 |
| | WIN32.BHO.acw Trojaner kann man step2 auch überspringen? fährt nicht runter oder überprüft der dann trotzdem? |
|
| Themen zu WIN32.BHO.acw Trojaner |
| entdeck, entdeckt, heute, rechner, spybot, troja, trojane, trojaner, win, win32.bho.acw |
Linear-Darstellung
