| |
| |||||||
Log-Analyse und Auswertung: GVU Ihr Computer wurde gesperrtWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
10.01.2013, 20:35
| #1 |
 |  GVU Ihr Computer wurde gesperrt GUten Abend, bin auch ein User der keine Ahnung vom PC hat, aber diese Virus wie auch immer eingefangen hat. Hab Avast drauf doch der findet nichts. Unddie Firewall kann wohl auch nichts. Emsil Anhang hatte ich auch nicht geöffnet vom unbekanntenabsender..... Im abgesicherten Modus geht win 7 eingeschränkt. was kann ich nun machen? OTL ist schon drtauf.... Danke für Eure hilfe OTL Logfile: Code:
ATTFilter OTL logfile created on: 10.01.2013 20:16:29 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = D:\Download 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,86 Gb Total Physical Memory | 6,72 Gb Available Physical Memory | 85,50% Memory free 15,72 Gb Paging File | 14,82 Gb Available in Paging File | 94,26% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 51,76 Gb Total Space | 3,06 Gb Free Space | 5,91% Space Free | Partition Type: NTFS Drive D: | 175,78 Gb Total Space | 136,63 Gb Free Space | 77,73% Space Free | Partition Type: NTFS Drive Q: | 9,76 Gb Total Space | 2,32 Gb Free Space | 23,72% Space Free | Partition Type: NTFS Computer Name: MAUE-THINK | User Name: Maue | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - D:\Download\OTL.exe (OldTimer Tools) PRC - C:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software) PRC - C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe (Lenovo) ========== Modules (No Company Name) ========== ========== Services (SafeList) ========== SRV:64bit: - (IBMPMSVC) -- C:\Windows\SysNative\ibmpmsvc.exe (Lenovo.) SRV:64bit: - (TPHDEXLGSVC) -- C:\Windows\SysNative\TPHDEXLG64.exe (Lenovo.) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (avast! Antivirus) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software) SRV - (avast! Firewall) -- C:\Programme\Alwil Software\Avast5\afwServ.exe (AVAST Software) SRV - (PassThru Service) -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe () SRV - (HPSLPSVC) -- C:\Users\Maue\AppData\Local\Temp\7zS13AC\hpslpsvc64.dll (Hewlett-Packard Co.) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.) SRV - (DozeSvc) -- C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE (Lenovo.) SRV - (Power Manager DBC Service) -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE (Lenovo) SRV - (QDLService2kLenovo) -- C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kLenovo.exe (QUALCOMM, Inc.) SRV - (AcSvc) -- C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe (Lenovo) SRV - (AcPrfMgrSvc) -- C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe (Lenovo) SRV - (LENOVO.TPKNRSVC) -- C:\Programme\Lenovo\Communications Utility\TPKNRSVC.exe (Lenovo Group Limited) SRV - (LENOVO.CAMMUTE) -- C:\Programme\Lenovo\Communications Utility\CamMute.exe (Lenovo Group Limited) SRV - (TPHKSVC) -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe (Lenovo Group Limited) SRV - (LENOVO.MICMUTE) -- C:\Programme\Lenovo\HOTKEY\micmute.exe (Lenovo Group Limited) SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (EvtEng) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation) SRV - (RegSrvc) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation) SRV - (NMSAccess) -- d:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe () SRV - (SUService) -- c:\Program Files (x86)\Lenovo\System Update\SUService.exe (Lenovo Group Limited) SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) SRV - (TurboBoost) -- C:\Programme\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation) SRV - (ThinkVantage Registry Monitor Service) -- C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited) SRV - (btwdins) -- C:\Programme\ThinkPad\Bluetooth Software\btwdins.exe (Broadcom Corporation.) SRV - (IGDCTRL) -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (HsfXAudioService) -- C:\Windows\SysWOW64\XAudio64.dll (Conexant Systems, Inc.) SRV - (UleadBurningHelper) -- C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.) SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation) SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation) SRV - (IviRegMgr) -- C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo) ========== Driver Services (SafeList) ========== DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software) DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software) DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software) DRV:64bit: - (aswNdis2) -- C:\Windows\SysNative\drivers\aswNdis2.sys (AVAST Software) DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software) DRV:64bit: - (aswKbd) -- C:\Windows\SysNative\drivers\aswKbd.sys (AVAST Software) DRV:64bit: - (aswFW) -- C:\Windows\SysNative\drivers\aswFW.sys (AVAST Software) DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software) DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software) DRV:64bit: - (ggsemc) -- C:\Windows\SysNative\drivers\ggsemc.sys (Sony Ericsson Mobile Communications) DRV:64bit: - (ggflt) -- C:\Windows\SysNative\drivers\ggflt.sys (Sony Ericsson Mobile Communications) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (Point64) -- C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation) DRV:64bit: - (dc3d) -- C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation) DRV:64bit: - (CnxtHdAudService) -- C:\Windows\SysNative\drivers\CHDRT64.sys (Conexant Systems Inc.) DRV:64bit: - (pmxdrv) -- C:\Windows\SysNative\drivers\pmxdrv.sys () DRV:64bit: - (AnyDVD) -- C:\Windows\SysNative\drivers\AnyDVD.sys (SlySoft, Inc.) DRV:64bit: - (aswNdis) -- C:\Windows\SysNative\drivers\aswNdis.sys (ALWIL Software) DRV:64bit: - (htcnprot) -- C:\Windows\SysNative\drivers\htcnprot.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (DzHDD64) -- C:\Windows\SysNative\drivers\DZHDD64.SYS (Lenovo.) DRV:64bit: - (TPPWRIF) -- C:\Windows\SysNative\drivers\TPPWR64V.SYS () DRV:64bit: - (qcusbnetlno2k) -- C:\Windows\SysNative\drivers\qcusbnetlno2k.sys (QUALCOMM Incorporated) DRV:64bit: - (qcusbserlno2k) -- C:\Windows\SysNative\drivers\qcusbserlno2k.sys (QUALCOMM Incorporated) DRV:64bit: - (qcfilterlno2k) -- C:\Windows\SysNative\drivers\qcfilterlno2k.sys (QUALCOMM Incorporated) DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated) DRV:64bit: - (NETw5s64) -- C:\Windows\SysNative\drivers\NETw5s64.sys (Intel Corporation) DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV:64bit: - (5U877) -- C:\Windows\SysNative\drivers\5U877.sys (Ricoh co.,Ltd.) DRV:64bit: - (e1kexpress) -- C:\Windows\SysNative\drivers\e1k62x64.sys (Intel Corporation) DRV:64bit: - (IBMPMDRV) -- C:\Windows\SysNative\drivers\ibmpmdrv.sys (Lenovo.) DRV:64bit: - (StarOpen) -- C:\Windows\SysNative\drivers\StarOpen.sys () DRV:64bit: - (HTCAND64) -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys (HTC, Corporation) DRV:64bit: - (rimspci) -- C:\Windows\SysNative\drivers\rimspe64.sys (REDC) DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation) DRV:64bit: - (Shockprf) -- C:\Windows\SysNative\drivers\ApsX64.sys (Lenovo.) DRV:64bit: - (TPDIGIMN) -- C:\Windows\SysNative\drivers\ApsHM64.sys (Lenovo.) DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys () DRV:64bit: - (TVTI2C) -- C:\Windows\SysNative\drivers\tvti2c.sys (Lenovo (United States) Inc.) DRV:64bit: - (HECIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation) DRV:64bit: - (TPM) -- C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation) DRV:64bit: - (psadd) -- C:\Windows\SysNative\drivers\psadd.sys (Lenovo (United States) Inc.) DRV:64bit: - (btwavdt) -- C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.) DRV:64bit: - (btwaudio) -- C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.) DRV:64bit: - (btwrchid) -- C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.) DRV:64bit: - (HSF_DPV) -- C:\Windows\SysNative\drivers\CAX_DPV.sys (Conexant Systems, Inc.) DRV:64bit: - (CAXHWAZL) -- C:\Windows\SysNative\drivers\CAXHWAZL.sys (Conexant Systems, Inc.) DRV:64bit: - (winachsf) -- C:\Windows\SysNative\drivers\CAX_CNXT.sys (Conexant Systems, Inc.) DRV:64bit: - (SrvHsfV92) -- C:\Windows\SysNative\drivers\VSTDPV6.SYS (Conexant Systems, Inc.) DRV:64bit: - (SrvHsfWinac) -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS (Conexant Systems, Inc.) DRV:64bit: - (SrvHsfHDA) -- C:\Windows\SysNative\drivers\VSTAZL6.SYS (Conexant Systems, Inc.) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (netw5v64) -- C:\Windows\SysNative\drivers\netw5v64.sys (Intel Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (XAudio) -- C:\Windows\SysNative\drivers\XAudio64.sys (Conexant Systems, Inc.) DRV:64bit: - (btwl2cap) -- C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.) DRV:64bit: - (lenovo.smi) -- C:\Windows\SysNative\drivers\smiifx64.sys (Lenovo Group Limited) DRV:64bit: - (mdmxsdk) -- C:\Windows\SysNative\drivers\mdmxsdk.sys (Conexant) DRV - (AnyDVD) -- C:\Windows\SysWOW64\drivers\AnyDVD.sys (SlySoft, Inc.) DRV - (PCDSRVC{127174DC-C366ED8B-06020000}_0) -- c:\Programme\PC-Doctor\pcdsrvc_x64.pkms (PC-Doctor, Inc.) DRV - (StarOpen) -- C:\Windows\SysWow64\drivers\StarOpen.sys () DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (smihlp) -- C:\Programme\ThinkVantage Fingerprint Software\smihlp.sys (UPEK Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {27008063-4FED-4005-AE7E-4BCC31CAE1E8} IE:64bit: - HKLM\..\SearchScopes\{27008063-4FED-4005-AE7E-4BCC31CAE1E8}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LEMDF8&pc=MALC&src=IE-SearchBox; IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {9237F900-9659-4EC4-B61A-87DD885E436B} IE - HKLM\..\SearchScopes\{9237F900-9659-4EC4-B61A-87DD885E436B}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LEMDF8&pc=MALC&src=IE-SearchBox; IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-789279516-353231628-3817114852-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN IE - HKU\S-1-5-21-789279516-353231628-3817114852-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Lenovo laptops - ThinkPads & IdeaPad [binary data] IE - HKU\S-1-5-21-789279516-353231628-3817114852-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Babylon Search IE - HKU\S-1-5-21-789279516-353231628-3817114852-1000\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKU\S-1-5-21-789279516-353231628-3817114852-1000\..\SearchScopes,DefaultScope = {556D09CF-4FED-4092-B97B-50AE2B2C68E4} IE - HKU\S-1-5-21-789279516-353231628-3817114852-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110187&tt=201112_1849_4712_6&babsrc=SP_ss&mntrId=683dc2760000000000000024d728e49d IE - HKU\S-1-5-21-789279516-353231628-3817114852-1000\..\SearchScopes\{556D09CF-4FED-4092-B97B-50AE2B2C68E4}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKU\S-1-5-21-789279516-353231628-3817114852-1000\..\SearchScopes\{A63C1DAF-38C4-475E-B241-940588C30CEC}: "URL" = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms} IE - HKU\S-1-5-21-789279516-353231628-3817114852-1000\..\SearchScopes\{AC129BF9-68BF-4bc4-A1DC-ECB62712FF99}: "URL" = hxxp://search.kikin.com/search/?q={searchTerms} IE - HKU\S-1-5-21-789279516-353231628-3817114852-1000\..\SearchScopes\{C8D93754-A70F-4C12-A42C-A7D0026BA5CD}: "URL" = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=amznsearch.de.ms-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} IE - HKU\S-1-5-21-789279516-353231628-3817114852-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "Elf 1.15 Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2866295&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.startup.homepage: "hxxp://www.klamm.de/?refid=77621|hxxp://www.karibik-mails.de/index.php?page=user.intern.su_statistik|hxxp://www.paiduniversum.de/index.php?page=user.login&schritt=weiter|hxxp://www.surfmore.eu/login.php|hxxp://www.primusportal.de/" FF - prefs.js..extensions.enabledAddons: plugin%40videofiledownload.com:1.5 FF - prefs.js..extensions.enabledAddons: %7Ba7c6cf7f-112c-4500-a7ea-39801a327e5f%7D:2.0 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1 FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.9 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: fb_add_on@avm.de:1.5.5 FF - prefs.js..network.proxy.type: 4 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: D:\Program Files (x86)\Adobe\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2012.12.31 16:40:36 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.12.07 06:04:29 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.12.07 06:04:26 | 000,000,000 | ---D | M] [2010.09.05 19:40:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maue\AppData\Roaming\mozilla\Extensions [2012.11.26 05:44:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maue\AppData\Roaming\mozilla\Firefox\Profiles\fav060lz.default\extensions [2012.06.25 20:45:19 | 000,000,000 | ---D | M] (VideoFileDownload - Download YouTube Videos) -- C:\Users\Maue\AppData\Roaming\mozilla\Firefox\Profiles\fav060lz.default\extensions\plugin@videofiledownload.com [2012.01.13 15:28:56 | 000,874,585 | ---- | M] () (No name found) -- C:\Users\Maue\AppData\Roaming\mozilla\firefox\profiles\fav060lz.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi [2012.11.25 20:07:30 | 000,002,444 | ---- | M] () -- C:\Users\Maue\AppData\Roaming\mozilla\firefox\profiles\fav060lz.default\searchplugins\babylon1.xml [2010.12.12 11:16:22 | 000,000,919 | ---- | M] () -- C:\Users\Maue\AppData\Roaming\mozilla\firefox\profiles\fav060lz.default\searchplugins\conduit.xml [2012.11.25 20:07:30 | 000,002,444 | ---- | M] () -- C:\Users\Maue\AppData\Roaming\mozilla\firefox\profiles\fav060lz.default\searchplugins\mngr.xml [2012.12.07 06:04:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.12.07 06:04:29 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2010.07.12 17:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2012.06.20 04:55:32 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.11.25 20:07:09 | 000,002,361 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml [2012.09.09 15:59:07 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.06.20 04:55:32 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.06.20 04:55:32 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.20 04:55:32 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.20 04:55:32 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.09.06 19:25:42 | 000,000,919 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 174.142.65.65 wolke.skynet O1 - Hosts: 174.142.65.65 announce.mine.nu O1 - Hosts: 174.142.61.140 skynet.wolke O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software) O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (no name) - {82EA3E77-7BD2-4744-A8F2-670770767EC5} - No CLSID value found. O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software) O2 - BHO: (TBSB03968 Class) - {AA61DE26-FA67-4575-9033-918671094293} - C:\Users\Maue\AppData\Roaming\Toolbars\Toolbar fuer eBay\ebay.dll () O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (IePasswordManagerHelper Class) - {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} - C:\Program Files (x86)\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (kikin Plugin) - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Program Files (x86)\kikin\ie_kikin.dll (kikin) O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Toolbar fuer eBay) - {000E148C-F7A7-445A-9044-93BF6CE09ECB} - C:\Users\Maue\AppData\Roaming\Toolbars\Toolbar fuer eBay\ebay.dll () O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-789279516-353231628-3817114852-1000\..\Toolbar\WebBrowser: (Toolbar fuer eBay) - {000E148C-F7A7-445A-9044-93BF6CE09ECB} - C:\Users\Maue\AppData\Roaming\Toolbars\Toolbar fuer eBay\ebay.dll () O3 - HKU\S-1-5-21-789279516-353231628-3817114852-1000\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [AcWin7Hlpr] C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe () O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [LENOVO.TPKNRRES] C:\Programme\Lenovo\Communications Utility\TPKNRRES.exe (Lenovo Group Limited) O4:64bit: - HKLM..\Run: [TPHOTKEY] C:\Programme\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited) O4:64bit: - HKLM..\Run: [TpShocks] C:\Windows\SysNative\TpShocks.exe (Lenovo.) O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Acrobat Assistant 8.0] D:\Program Files (x86)\Adobe\Acrobat\Acrotray.exe (Adobe Systems Inc.) O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] D:\Program Files (x86)\Adobe\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe () O4 - HKLM..\Run: [IMSS] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe () O4 - HKLM..\Run: [PWMTRV] rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor File not found O4 - HKLM..\Run: [RotateImage] C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe (Ricoh co.,Ltd.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-789279516-353231628-3817114852-1000..\Run: [{69FAD388-0C55-9645-E6CE-360971D48CF6}] C:\Users\Maue\AppData\Roaming\Oxuvf\urags.exe File not found O4 - HKU\S-1-5-21-789279516-353231628-3817114852-1000..\Run: [AnyDVD] D:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKU\S-1-5-21-789279516-353231628-3817114852-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105 File not found O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm () O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000 File not found O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra Button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Program Files (x86)\kikin\ie_kikin.dll (kikin) O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MIFE82~1\WEB2~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Lenovo Password Manager... - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - C:\Program Files (x86)\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 10.9.2) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 10.9.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{10454938-3DF5-4929-9975-52A17753564B}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{ADF5C533-559D-4017-8DE4-EA98A0EEFC97}: NameServer = 212.23.97.2 212.23.97.3 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FEDF9DB6-EC78-42C5-8221-86C9F728FEF6}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - AppInit_DLLs: (acaptuser64.dll) - C:\Windows\SysNative\acaptuser64.dll (Adobe Systems, Inc.) O20 - AppInit_DLLs: (c:\progra~3\browse~1\25911~1.18\{c16c1~1\mngr.dll) - File not found O20 - AppInit_DLLs: (acaptuser32.dll) - C:\Windows\SysWow64\acaptuser32.dll (Adobe Systems Incorporated) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (C:\PROGRA~3\dsgsdgdsgdsgw.bat) - C:\ProgramData\dsgsdgdsgdsgw.bat () O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\psfus: DllName - (C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll) - C:\Programme\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008.06.10 17:32:46 | 000,000,049 | -HS- | M] () - Q:\AUTORUN.INF -- [ NTFS ] O33 - MountPoints2\{0fed8bc0-b6da-11df-8860-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{0fed8bc0-b6da-11df-8860-806e6f6e6963}\Shell\AutoRun\command - "" = Q:\LenovoQDrive.exe -- [2009.08.10 22:01:24 | 000,267,576 | -HS- | M] (Lenovo Group Limited) O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.01.10 18:03:30 | 000,147,456 | ---- | C] (Microsoft Corporation) -- C:\Users\Maue\wgsdgsdgdsgsd.exe [2012.12.23 18:37:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Binarysense [2012.12.23 17:26:15 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll [2012.12.23 17:26:15 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll [2012.12.23 17:26:14 | 000,367,616 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll [2012.12.23 17:26:14 | 000,295,424 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll [2012.12.12 18:04:51 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.12.12 18:04:51 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.12.12 18:04:50 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.12.12 18:04:50 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.12.12 18:04:50 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012.12.12 18:04:49 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.12.12 18:04:49 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.12.12 18:04:49 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.12.12 18:04:49 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.12.12 18:04:49 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012.12.12 18:04:48 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012.12.12 18:04:48 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2012.12.12 18:04:46 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.12.12 18:04:46 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.12.12 18:04:46 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2012.12.12 18:02:53 | 001,161,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll [2012.12.12 18:02:53 | 000,424,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll [2012.12.12 18:02:53 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe [2012.12.12 18:02:53 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll [2012.12.12 18:02:51 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll [2012.12.12 18:02:51 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll [2012.12.12 18:02:51 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe [2012.12.12 18:02:51 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll [2012.12.12 18:02:51 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll [2012.12.12 18:02:51 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll [2012.12.12 18:02:51 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll [2012.12.12 18:02:50 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe [2012.12.12 18:02:50 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll [2012.12.12 18:02:50 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll [2012.12.12 18:02:50 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll [2012.12.12 18:02:50 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll [2012.12.12 18:02:50 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll [2012.12.12 18:02:50 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll [2012.12.12 18:02:50 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll [2012.12.12 18:02:50 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll [2012.12.12 18:02:50 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll [2012.12.12 18:02:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll [2012.12.12 18:02:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll [2012.12.12 18:02:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll [2012.12.12 18:02:50 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll [2012.12.12 18:02:49 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll [2012.12.12 18:02:49 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll [2012.12.12 18:02:49 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll [2012.12.12 18:02:49 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll [2012.12.12 18:02:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll [2012.12.12 18:02:48 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll [2012.12.12 18:02:48 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll [2012.12.12 18:02:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll [2012.12.12 18:02:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll [2012.12.12 18:02:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll [2012.12.12 18:02:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll [2012.12.12 18:02:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll [2012.12.12 18:02:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll [2012.12.12 18:02:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll [2012.12.12 18:02:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll [2012.12.12 18:02:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll [2012.12.12 18:02:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll [2012.12.12 18:02:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll [2012.12.12 18:02:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll [2012.12.12 18:02:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll [2012.12.12 18:02:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll [2012.12.12 18:02:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll [2012.12.12 18:02:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll [2012.12.12 18:02:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll [2012.12.12 18:02:48 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe [2012.12.12 18:02:34 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dpnet.dll [2012.12.12 18:02:34 | 000,376,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dpnet.dll [3 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.01.10 18:23:03 | 001,507,406 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.01.10 18:23:03 | 000,657,660 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.01.10 18:23:03 | 000,618,936 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.01.10 18:23:03 | 000,131,032 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.01.10 18:23:03 | 000,107,256 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.01.10 18:18:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.01.10 18:18:51 | 2037,125,119 | -HS- | M] () -- C:\hiberfil.sys [2013.01.10 18:18:12 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad [2013.01.10 18:15:13 | 000,020,704 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.01.10 18:15:13 | 000,020,704 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.01.10 18:03:48 | 000,002,864 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.js [2013.01.10 18:03:48 | 000,001,054 | ---- | M] () -- C:\Users\Maue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk [2013.01.10 18:03:48 | 000,000,159 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.reg [2013.01.10 18:03:48 | 000,000,065 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.bat [2013.01.10 18:03:30 | 000,147,456 | ---- | M] (Microsoft Corporation) -- C:\Users\Maue\wgsdgsdgdsgsd.exe [2013.01.10 17:57:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.01.09 17:57:16 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013.01.09 17:57:16 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013.01.06 20:53:58 | 000,617,333 | ---- | M] () -- C:\Users\Maue\Desktop\IMAG0918.jpg [2013.01.02 10:00:00 | 000,000,332 | ---- | M] () -- C:\Windows\tasks\SystemToolsDailyTest.job [2012.12.31 16:40:37 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt [2012.12.23 18:41:42 | 001,181,696 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.12.23 09:59:59 | 000,000,528 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job [2012.12.16 18:11:22 | 000,046,080 | ---- | M] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll [2012.12.16 15:45:03 | 000,367,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll [2012.12.16 15:13:28 | 000,295,424 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll [2012.12.16 15:13:20 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll [3 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.01.10 18:03:48 | 000,002,864 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.js [2013.01.10 18:03:48 | 000,001,054 | ---- | C] () -- C:\Users\Maue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk [2013.01.10 18:03:48 | 000,000,159 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.reg [2013.01.10 18:03:48 | 000,000,065 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.bat [2013.01.10 18:03:47 | 095,023,320 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad [2013.01.06 20:53:58 | 000,617,333 | ---- | C] () -- C:\Users\Maue\Desktop\IMAG0918.jpg [2011.01.03 16:47:09 | 000,009,728 | ---- | C] () -- C:\Users\Maue\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.09.14 20:59:32 | 000,007,648 | ---- | C] () -- C:\Users\Maue\AppData\Local\Resmon.ResmonCfg [2010.09.10 17:50:10 | 000,000,083 | -HS- | C] () -- C:\ProgramData\.zreglib [2010.09.05 11:26:53 | 000,231,520 | ---- | C] () -- C:\Users\Maue\AppData\Local\wanancsp.dat ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2012.07.14 20:14:57 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Ashampoo [2012.05.06 21:35:24 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Audacity [2012.11.25 20:06:59 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Babylon [2010.09.25 14:54:49 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Canneverbe Limited [2011.05.11 16:29:18 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Ciotu [2011.02.13 22:03:25 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Desktopicon [2012.06.26 16:19:27 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\e-academy Inc [2011.10.03 12:10:04 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\elsterformular [2011.03.04 16:28:44 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\FRITZ! [2012.10.27 01:23:30 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\HTC [2012.10.27 01:23:34 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1 [2011.02.02 18:36:29 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\ICQ [2010.09.23 08:26:33 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\kikin [2010.09.02 15:44:10 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Lenovo [2011.01.29 19:49:24 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\mresreg [2012.12.21 08:21:23 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\MyPhoneExplorer [2010.09.05 17:38:53 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\NetMeter [2012.10.07 19:41:25 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Outlook [2011.05.11 16:20:54 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Oxuvf [2012.05.03 20:04:03 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\PCDr [2010.09.04 16:49:21 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\QcWizard [2010.09.13 05:00:50 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\QuickStoresToolbar [2011.11.22 19:48:10 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\SuperMailer [2011.10.23 08:36:45 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\SuperMailer-Bounce [2011.10.09 11:30:39 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\TeamViewer [2011.10.03 17:07:04 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Thunderbird [2010.09.10 18:00:06 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Toolbars [2012.11.25 20:08:08 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\TuneUp Software [2010.09.25 14:41:20 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Ulead Systems [2012.05.03 20:04:09 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Update ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2010.09.02 15:44:08 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2012.08.27 16:44:47 | 000,000,000 | ---D | M] -- C:\avast! sandbox [2009.07.24 18:28:56 | 000,000,000 | -HSD | M] -- C:\Boot [2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2010.09.02 15:41:17 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2012.06.25 17:05:04 | 000,000,000 | ---D | M] -- C:\HP Universal Print Driver [2010.09.10 21:54:56 | 000,000,000 | ---D | M] -- C:\HP Universal Print Driver PCL6 v5.1.0.1 [2010.09.10 21:57:37 | 000,000,000 | ---D | M] -- C:\HP Universal Print Driver PCL6 x64-bit v5.1.0.1 [2010.08.14 04:18:49 | 000,000,000 | ---D | M] -- C:\Intel [2010.08.14 13:48:23 | 000,000,000 | ---D | M] -- C:\mfg [2010.09.02 15:49:33 | 000,000,000 | RH-D | M] -- C:\MSOCache [2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs [2012.08.31 16:54:40 | 000,000,000 | R--D | M] -- C:\Program Files [2012.12.23 18:38:02 | 000,000,000 | R--D | M] -- C:\Program Files (x86) [2013.01.10 18:03:48 | 000,000,000 | -H-D | M] -- C:\ProgramData [2010.09.02 15:41:17 | 000,000,000 | -HSD | M] -- C:\Programme [2010.09.02 15:41:23 | 000,000,000 | RHSD | M] -- C:\RRbackups [2011.10.11 14:08:51 | 000,000,000 | ---D | M] -- C:\swshare [2010.09.02 15:44:07 | 000,000,000 | ---D | M] -- C:\SWTOOLS [2012.12.06 18:04:35 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2010.09.02 15:41:20 | 000,000,000 | R--D | M] -- C:\Users [2011.08.18 05:07:24 | 000,000,000 | -H-D | M] -- C:\Washer2.rar [2013.01.10 18:06:06 | 000,000,000 | ---D | M] -- C:\Windows < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2011.10.10 05:09:18 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Adobe [2012.10.27 01:16:41 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Apple Computer [2012.07.14 20:14:57 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Ashampoo [2012.05.06 21:35:24 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Audacity [2012.11.25 20:06:59 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Babylon [2010.12.08 18:24:55 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Brother [2010.09.25 14:54:49 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Canneverbe Limited [2011.05.11 16:29:18 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Ciotu [2011.02.13 22:03:25 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Desktopicon [2012.06.26 16:19:27 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\e-academy Inc [2011.10.03 12:10:04 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\elsterformular [2011.03.04 16:28:44 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\FRITZ! [2012.10.27 01:23:30 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\HTC [2012.10.27 01:23:34 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1 [2011.02.02 18:36:29 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\ICQ [2010.09.02 15:44:10 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Identities [2010.09.02 15:55:00 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Intel [2010.09.23 08:26:33 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\kikin [2010.09.02 15:44:10 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Lenovo [2010.09.04 16:06:00 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Macromedia [2009.07.14 08:44:38 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Media Center Programs [2012.10.09 14:16:15 | 000,000,000 | --SD | M] -- C:\Users\Maue\AppData\Roaming\Microsoft [2010.09.05 19:40:30 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Mozilla [2011.01.29 19:49:24 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\mresreg [2012.12.21 08:21:23 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\MyPhoneExplorer [2011.11.17 20:44:26 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Nero [2010.09.05 17:38:53 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\NetMeter [2012.10.07 19:41:25 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Outlook [2011.05.11 16:20:54 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Oxuvf [2012.05.03 20:04:03 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\PCDr [2010.09.04 16:49:21 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\QcWizard [2010.09.13 05:00:50 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\QuickStoresToolbar [2012.08.13 20:41:00 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Skype [2011.11.22 19:48:10 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\SuperMailer [2011.10.23 08:36:45 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\SuperMailer-Bounce [2011.10.09 11:30:39 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\TeamViewer [2011.10.03 17:07:04 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Thunderbird [2010.09.10 18:00:06 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Toolbars [2012.11.25 20:08:08 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\TuneUp Software [2010.09.25 14:41:20 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Ulead Systems [2012.05.03 20:04:09 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Update [2012.07.08 09:50:35 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\Winamp [2010.11.28 20:40:30 | 000,000,000 | ---D | M] -- C:\Users\Maue\AppData\Roaming\WinRAR < %APPDATA%\*.exe /s > [2012.02.02 18:31:51 | 004,891,704 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\install_dfv12.exe [2013.01.02 20:44:10 | 005,656,120 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\install_elstam99.exe [2012.02.02 18:31:02 | 008,843,080 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\install_est11.exe [2012.05.05 14:33:30 | 006,220,536 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\install_eur11.exe [2012.05.05 14:33:42 | 005,924,512 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\install_gst11.exe [2012.06.13 20:45:31 | 005,858,552 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\install_gstz11.exe [2012.02.02 18:32:08 | 004,944,584 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\install_lsta12.exe [2012.02.02 18:32:25 | 005,149,704 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\install_lstb12.exe [2012.02.02 18:31:20 | 005,545,576 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\install_par34a11.exe [2012.02.02 18:31:35 | 005,026,376 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\install_ust11.exe [2012.02.02 18:32:42 | 004,939,152 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\install_ustva12.exe [2012.02.02 18:21:32 | 004,384,560 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_10_7094_8086.exe [2012.05.05 14:34:00 | 004,644,016 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_10_8086_8623.exe [2013.01.02 20:44:14 | 004,187,896 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_10_8623_9066.exe [2012.02.02 18:22:19 | 004,393,736 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_11_7094_8086.exe [2012.05.05 14:34:14 | 004,641,416 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_11_8086_8623.exe [2013.01.02 20:44:20 | 004,187,704 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_11_8623_9066.exe [2012.05.05 14:34:27 | 004,670,176 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_12_8086_8623.exe [2013.01.02 20:44:28 | 004,187,960 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_12_8623_9066.exe [2012.02.02 18:22:49 | 007,810,912 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_09_7094_8086.exe [2012.05.05 14:34:43 | 005,480,584 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_09_8086_8623.exe [2013.01.02 20:44:34 | 004,410,080 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_09_8623_9066.exe [2012.02.02 18:23:59 | 007,089,424 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_10_7094_8086.exe [2012.05.05 14:34:58 | 006,388,152 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_10_8086_8623.exe [2013.01.02 20:44:42 | 004,679,928 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_10_8623_9066.exe [2012.05.05 14:35:18 | 007,634,320 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_11_8086_8623.exe [2013.01.02 20:44:51 | 005,258,432 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_11_8623_9066.exe [2012.02.02 18:24:26 | 004,503,912 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_09_7094_8086.exe [2012.05.05 14:35:43 | 004,698,584 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_09_8086_8623.exe [2013.01.02 20:44:59 | 004,198,512 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_09_8623_9066.exe [2012.02.02 18:24:42 | 004,501,512 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_10_7094_8086.exe [2012.05.05 14:35:59 | 004,704,608 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_10_8086_8623.exe [2013.01.02 20:45:08 | 004,223,272 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_10_8623_9066.exe [2013.01.02 20:45:15 | 004,311,408 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_11_8623_9066.exe [2012.02.02 18:25:28 | 004,448,056 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_09_7094_8086.exe [2012.05.05 14:36:49 | 004,633,712 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_09_8086_8623.exe [2013.01.02 20:45:45 | 004,172,032 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_09_8623_9066.exe [2012.02.02 18:25:43 | 004,447,056 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_10_7094_8086.exe [2012.05.05 14:37:01 | 004,640,544 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_10_8086_8623.exe [2013.01.02 20:45:53 | 004,195,192 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_10_8623_9066.exe [2013.01.02 20:46:01 | 004,296,688 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_11_8623_9066.exe [2012.02.02 18:24:57 | 004,454,760 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_09_7094_8086.exe [2012.05.05 14:36:15 | 004,644,016 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_09_8086_8623.exe [2013.01.02 20:45:22 | 004,204,032 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_09_8623_9066.exe [2012.02.02 18:25:13 | 004,453,216 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_10_7094_8086.exe [2012.05.05 14:36:32 | 004,641,152 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_10_8086_8623.exe [2013.01.02 20:45:30 | 004,201,448 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_10_8623_9066.exe [2013.01.02 20:45:38 | 004,317,488 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_11_8623_9066.exe [2012.02.02 18:25:58 | 004,416,784 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_10_7094_8086.exe [2012.05.05 14:37:19 | 004,647,008 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_10_8086_8623.exe [2013.01.02 20:46:09 | 004,189,024 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_10_8623_9066.exe [2012.02.02 18:26:13 | 004,422,952 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_11_7094_8086.exe [2012.05.05 14:37:35 | 004,645,376 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_11_8086_8623.exe [2013.01.02 20:46:18 | 004,171,168 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_11_8623_9066.exe [2012.05.05 14:38:00 | 004,701,816 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_12_8086_8623.exe [2013.01.02 20:46:25 | 004,191,960 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_12_8623_9066.exe [2012.02.02 18:26:29 | 004,473,376 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_10_7094_8086.exe [2012.05.05 14:38:17 | 004,698,720 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_10_8086_8623.exe [2013.01.02 20:46:34 | 004,225,952 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_10_8623_9066.exe [2012.02.02 18:26:44 | 004,482,440 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_11_7094_8086.exe [2012.05.05 14:38:31 | 004,700,288 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_11_8086_8623.exe [2013.01.02 20:46:42 | 004,224,696 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_11_8623_9066.exe [2012.05.05 14:38:42 | 004,709,024 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_12_8086_8623.exe [2013.01.02 20:46:50 | 004,226,472 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_12_8623_9066.exe [2012.02.02 18:27:01 | 004,842,576 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_09_7094_8086.exe [2012.05.05 14:38:56 | 004,772,752 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_09_8086_8623.exe [2013.01.02 20:46:59 | 004,281,328 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_09_8623_9066.exe [2012.02.02 18:27:18 | 004,851,968 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_10_7094_8086.exe [2012.05.05 14:39:09 | 004,768,568 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_10_8086_8623.exe [2013.01.02 20:47:07 | 004,282,016 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_10_8623_9066.exe [2012.05.05 14:39:24 | 004,816,032 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_11_8086_8623.exe [2013.01.02 20:47:15 | 004,287,032 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_11_8623_9066.exe [2012.02.02 18:30:33 | 012,718,200 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_pica_0_7094_8086.exe [2012.05.05 14:32:55 | 007,941,880 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_pica_0_8086_8623.exe [2013.01.02 20:43:56 | 007,686,320 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_pica_0_8623_10296.exe [2012.02.02 18:28:07 | 004,417,240 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_10_7094_8086.exe [2012.05.05 14:40:18 | 004,672,152 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_10_8086_8623.exe [2013.01.02 20:47:50 | 004,198,912 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_10_8623_9066.exe [2012.02.02 18:28:23 | 004,449,656 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_11_7094_8086.exe [2012.05.05 14:40:32 | 004,663,976 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_11_8086_8623.exe [2013.01.02 20:47:58 | 004,195,800 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_11_8623_9066.exe [2012.05.05 14:40:45 | 004,729,800 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_12_8086_8623.exe [2013.01.02 20:48:07 | 004,211,640 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_12_8623_9066.exe [2012.02.02 18:27:35 | 004,473,720 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_09_7094_8086.exe [2012.05.05 14:39:35 | 004,652,240 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_09_8086_8623.exe [2013.01.02 20:47:25 | 004,204,712 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_09_8623_9066.exe [2012.02.02 18:27:51 | 004,490,080 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_10_7094_8086.exe [2012.05.05 14:39:49 | 004,651,400 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_10_8086_8623.exe [2013.01.02 20:47:33 | 004,180,648 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_10_8623_9066.exe [2012.05.05 14:40:04 | 004,734,712 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_11_8086_8623.exe [2013.01.02 20:47:41 | 004,206,288 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_11_8623_9066.exe [2011.10.03 12:07:11 | 012,578,160 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Maue\AppData\Roaming\elsterformular\update\ElsterFormular_update-12_3_2_6814k.exe [2011.10.10 21:35:29 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Maue\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe [2011.03.04 16:27:33 | 000,080,896 | R--- | M] () -- C:\Users\Maue\AppData\Roaming\Microsoft\Installer\{2D5D9603-22CF-4B99-83F6-0CD20330F62E}\Icon8CF9C550.exe [2010.09.12 09:32:26 | 000,715,512 | ---- | M] () -- C:\Users\Maue\AppData\Roaming\QuickStoresToolbar\unins000.exe [2010.07.13 10:33:40 | 000,045,304 | ---- | M] (Andreas Breitschopp - Softwareentwicklung und -vertrieb) -- C:\Users\Maue\AppData\Roaming\QuickStoresToolbar\Update.exe [2008.04.24 09:37:24 | 000,049,152 | ---- | M] () -- C:\Users\Maue\AppData\Roaming\Toolbars\Toolbar fuer eBay\uninstall.exe [2008.04.24 09:37:26 | 000,065,536 | ---- | M] () -- C:\Users\Maue\AppData\Roaming\Toolbars\Toolbar fuer eBay\update.exe < %SYSTEMROOT%\system32\drivers\*.sys /lockedfiles > < %SYSTEMROOT%\System32\config\*.sav > < %SYSTEMROOT%\*. /mp /s > < %SYSTEMROOT%\system32\*.dll /lockedfiles > [1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] < > [2009.07.14 06:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT [2009.07.14 06:08:49 | 000,032,640 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2010.08.14 04:41:32 | 000,000,332 | ---- | C] () -- C:\Windows\Tasks\SystemToolsDailyTest.job [2010.08.14 04:41:33 | 000,000,528 | ---- | C] () -- C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job [2012.10.09 14:16:06 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job < End of report > |
| Themen zu GVU Ihr Computer wurde gesperrt |
| abend, abgesicherte, abgesicherten, abgesicherten modus, ahnung, anhang, avast, bekannte, cdburnerxp, compu, computer, computer wurde gesperrt, eingefangen, firewall, gefangen, gen, gesperrt, guten, ideapad, ihr computer wurde gesperrt, keine ahnung, lenovo, logfiles otl, modus, msn deutschland, plug-in, pwmtr64v.dll, unbekannte, virus, win, win 7 |
Baum-Darstellung