| |
| |||||||
Log-Analyse und Auswertung: Sicherheits-Center deaktiviert sich von selbst, dann SystemabsturzWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
09.06.2013, 15:59
| #1 |
| |  Sicherheits-Center deaktiviert sich von selbst, dann Systemabsturz Guten Tag zusammen! Vielen Dank, dass ihr euch die Zeit nehmt, euch mit meinem kleinen Problem(?) zu befassen. Ich habe in letzter Zeit keine Programme installiert oder fremde EXE-Dateien angeklickt, UAC ist an, Firefox hat einen Ad- und einen Scriptblocker, seht ihr ja sicher alles aus den Logs. Einziges Symptom ist/war folgendes: Ich habe in World of Tanks (Fenstermodus) mehr oder weniger rumge-idle-t, da geht ein SysTray-Balloon auf, der mir sagt, dass das Sicherheits-Center deaktiviert ist. Ich habe also drauf geklickt, um den Dienst neu zu starten, da kam eine Fehlermeldung, dass der Dienst nicht gestartet werden konnte. Noch zweimal wiederholt, man ist ja hartnäckig, aber ohne Erfolg. Ich beendete also WoT und wollte dem Problem gerade näher auf den Grund gehen (bis hierhin war ca. 1 Minute vergangen), da stürzt mein System komplett ab: Schwarzer Bildschirm und dann BIOS, normaler Bootvorgang. Netzwerkkabel entfernt, Bootvorgang fortgesetzt. In Windows angemeldet, sah alles normal aus. Dienstmanager gestartet, um mal nach dem Rechten zu schauen. Folgende Dienste stehen auf Startart "Automatisch", waren aber nicht gestartet: - Sicherheits-Center - Windows Defender - Windows Zeitgeber (liegt laut Ereignisanzeige an der fehlenden Netzwerkverbindung, leuchtet ja auch ein) O. g. Dienste ohne Zwischenfall manuell gestartet. Nach dem Neustart hat mich Sicherheits-Center informiert, dass Automatische Updates deaktiviert sind (automatisch Suchen, aber manuell installieren). Bin ziemlich sicher, dass die normalerweise auf "automatisch installieren" stehen. Letzte Updates waren jedenfalls von gestern Nacht, und die habe ich ganz sicher nicht manuell gestartet. Netzwerkverbindung wiederhergestellt, und Updates erfolgreich 12 wichtige Updates installieren lassen, dann System wie gewünscht neu gestartet. Die o.g. Dienste wurden nach diesem Neustart, und allen weiteren, auch tatsächlich automatisch hochgezogen. HijackThis runtergeladen und ausgeführt. Log wollt ihr hier ja nicht sehen, sah aber erstmal unspektakulär aus. MalwareBytes' Anti-Malware runtergeladen und installiert, keine infizierten Objekte gefunden. Wieder deinstalliert. Tools (defogger, OLT, GMER) runtergeladen und genau nach Anleitung ausgeführt. Beim ersten Durchlauf von GMER ist das System eingefroren, der zweite lief (nach Neustart, versteht sich) durch. Beim Start von GMER kam die Meldung, dass auf "c:\Windows\System32\config\system" nicht zugegriffen werden konnte, weil die Datei von einem anderen Prozess verwendet wird. Während des Scans kam noch einmal die gleiche Meldung, und noch eine für die Datei "C:\Users\CeeDub\ntuser.dat". Ansonsten hatte ich bis jetzt keine Schwierigkeiten. Besteht noch Grund zur Sorge? Vielen Dank für eure Hilfe! OTL.TXT: Code:
ATTFilter OTL logfile created on: 2013-06-09 15:06:11 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\CeeDub\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16576) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: yyyy-MM-dd 4,00 Gb Total Physical Memory | 2,86 Gb Available Physical Memory | 71,50% Memory free 7,99 Gb Paging File | 6,60 Gb Available in Paging File | 82,62% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 1397,17 Gb Total Space | 490,22 Gb Free Space | 35,09% Space Free | Partition Type: NTFS Drive D: | 4,36 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Drive E: | 14,81 Gb Total Space | 5,78 Gb Free Space | 39,05% Space Free | Partition Type: FAT32 Drive H: | 7,18 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: ISIS | User Name: CeeDub | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013-06-09 13:35:41 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\CeeDub\Desktop\OTL.exe PRC - [2013-05-09 10:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe PRC - [2013-05-09 10:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe PRC - [2013-01-18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2010-05-21 01:56:36 | 000,334,384 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnetdhcp.exe PRC - [2010-05-21 01:56:32 | 000,113,200 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe PRC - [2010-05-21 01:56:18 | 000,399,920 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnat.exe PRC - [2010-05-21 01:56:12 | 000,129,584 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe PRC - [2010-05-21 00:40:20 | 000,539,184 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe PRC - [2009-11-20 13:17:54 | 000,106,496 | ---- | M] (NEC Electronics Corporation) -- C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe ========== Modules (No Company Name) ========== ========== Services (SafeList) ========== SRV - [2013-05-24 21:06:53 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013-05-09 10:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus) SRV - [2013-02-26 00:32:22 | 001,260,320 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2013-01-18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012-11-09 12:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2010-05-21 01:56:36 | 000,334,384 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP) SRV - [2010-05-21 01:56:32 | 000,113,200 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe -- (VMAuthdService) SRV - [2010-05-21 01:56:18 | 000,399,920 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service) SRV - [2010-05-21 00:40:20 | 000,539,184 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe -- (VMUSBArbService) SRV - [2010-05-07 01:47:36 | 000,523,576 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\USB Safely Remove\USBSRService.exe -- (USBSafelyRemoveService) SRV - [2010-04-27 17:42:04 | 000,191,024 | ---- | M] (VMware, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe -- (ufad-ws60) SRV - [2010-03-18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009-06-10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009-03-31 07:03:12 | 000,061,976 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe -- (MSSQLServerADHelper100) SRV - [2009-03-30 04:02:56 | 057,617,752 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe -- (MSSQL$SQLEXPRESS) SRV - [2009-03-30 04:01:06 | 000,427,880 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE -- (SQLAgent$SQLEXPRESS) SRV - [2008-07-10 05:31:10 | 000,157,720 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013-05-09 10:59:07 | 001,025,808 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx) DRV:64bit: - [2013-05-09 10:59:07 | 000,378,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP) DRV:64bit: - [2013-05-09 10:59:07 | 000,189,936 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm) DRV:64bit: - [2013-05-09 10:59:07 | 000,072,016 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr) DRV:64bit: - [2013-05-09 10:59:07 | 000,065,336 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt) DRV:64bit: - [2013-05-09 10:59:07 | 000,064,288 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi) DRV:64bit: - [2013-05-09 10:59:06 | 000,080,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt) DRV:64bit: - [2013-05-09 10:59:06 | 000,033,400 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk) DRV:64bit: - [2012-10-07 22:31:40 | 000,231,376 | ---- | M] (TrueCrypt Foundation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt) DRV:64bit: - [2012-03-01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011-03-11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011-03-11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010-11-20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010-11-20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010-05-21 01:57:12 | 000,080,944 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci) DRV:64bit: - [2010-05-21 01:57:08 | 000,018,480 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\VMparport.sys -- (VMparport) DRV:64bit: - [2010-05-21 01:57:04 | 000,068,656 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86) DRV:64bit: - [2010-05-21 01:55:04 | 000,031,792 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd) DRV:64bit: - [2010-05-21 01:54:52 | 000,030,256 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif) DRV:64bit: - [2010-05-21 00:40:12 | 000,038,448 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon) DRV:64bit: - [2010-05-20 22:19:20 | 000,037,680 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmusb.sys -- (vmusb) DRV:64bit: - [2010-05-20 22:19:18 | 000,045,104 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge) DRV:64bit: - [2010-05-20 22:19:18 | 000,020,016 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter) DRV:64bit: - [2009-11-20 13:16:02 | 000,177,152 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2009-11-20 13:15:58 | 000,075,776 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2009-07-14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009-07-14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009-07-14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009-06-10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009-06-10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009-06-10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009-06-10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009-03-01 23:05:32 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009-02-24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mcdbus.sys -- (mcdbus) DRV - [2010-04-27 17:41:34 | 000,032,816 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Program Files (x86)\VMware\VMware Workstation\vstor2-ws60.sys -- (vstor2-ws60) DRV - [2009-07-14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2009-02-24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\mcdbus.sys -- (mcdbus) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 82 B6 C0 75 9A 00 CE 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.update: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "about:blank" FF - prefs.js..extensions.enabledAddons: %7B5e594888-3e8e-47da-b2c6-b0b545112f84%7D:1.3.13 FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.6.2 FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.15 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.6 FF - prefs.js..extensions.enabledItems: {5e594888-3e8e-47da-b2c6-b0b545112f84}:1.3.3 FF - prefs.js..extensions.enabledItems: twitternotifier@naan.net:1.9.7.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {5384767E-00D9-40E9-B72F-9CC39D655D6F}:1.4.1.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.1.0.2 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll () FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013-05-24 21:06:47 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013-05-15 19:26:37 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013-05-24 21:06:47 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013-05-15 19:26:37 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2012-10-10 20:40:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\CeeDub\AppData\Roaming\mozilla\Extensions [2012-10-10 20:40:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\CeeDub\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2013-05-29 07:27:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\CeeDub\AppData\Roaming\mozilla\Firefox\Profiles\73d2a0ts.default\extensions [2012-10-10 20:40:52 | 000,000,000 | ---D | M] (EPUBReader) -- C:\Users\CeeDub\AppData\Roaming\mozilla\Firefox\Profiles\73d2a0ts.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2013-05-29 07:27:57 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\CeeDub\AppData\Roaming\mozilla\Firefox\Profiles\73d2a0ts.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2012-12-28 23:09:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\CeeDub\AppData\Roaming\mozilla\Firefox\Profiles\73d2a0ts.default.sic\extensions [2012-12-28 23:09:34 | 000,000,000 | ---D | M] (EPUBReader) -- C:\Users\CeeDub\AppData\Roaming\mozilla\Firefox\Profiles\73d2a0ts.default.sic\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2012-12-28 23:09:36 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\CeeDub\AppData\Roaming\mozilla\Firefox\Profiles\73d2a0ts.default.sic\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2012-12-28 23:09:31 | 000,000,000 | ---D | M] (Echofon) -- C:\Users\CeeDub\AppData\Roaming\mozilla\Firefox\Profiles\73d2a0ts.default.sic\extensions\twitternotifier@naan.net [2013-02-06 08:18:57 | 000,080,640 | ---- | M] () (No name found) -- C:\Users\CeeDub\AppData\Roaming\mozilla\firefox\profiles\73d2a0ts.default\extensions\{5e594888-3e8e-47da-b2c6-b0b545112f84}.xpi [2013-05-26 08:34:44 | 000,534,261 | ---- | M] () (No name found) -- C:\Users\CeeDub\AppData\Roaming\mozilla\firefox\profiles\73d2a0ts.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-05-08 18:15:39 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\CeeDub\AppData\Roaming\mozilla\firefox\profiles\73d2a0ts.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-11-07 08:31:41 | 000,080,384 | ---- | M] () (No name found) -- C:\Users\CeeDub\AppData\Roaming\mozilla\firefox\profiles\73d2a0ts.default.sic\extensions\{5e594888-3e8e-47da-b2c6-b0b545112f84}.xpi [2012-12-18 07:46:44 | 000,532,971 | ---- | M] () (No name found) -- C:\Users\CeeDub\AppData\Roaming\mozilla\firefox\profiles\73d2a0ts.default.sic\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-11-23 23:26:26 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\CeeDub\AppData\Roaming\mozilla\firefox\profiles\73d2a0ts.default.sic\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2008-06-19 19:06:05 | 000,000,908 | ---- | M] () -- C:\Users\CeeDub\AppData\Roaming\mozilla\firefox\profiles\73d2a0ts.default\searchplugins\imdb.xml [2008-06-25 18:26:21 | 000,001,108 | ---- | M] () -- C:\Users\CeeDub\AppData\Roaming\mozilla\firefox\profiles\73d2a0ts.default\searchplugins\wikipedia-en.xml [2013-05-24 21:06:55 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2013-05-24 21:06:44 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-05-24 21:06:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013-05-24 21:06:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013-05-24 21:06:54 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2013-05-24 21:06:54 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} O1 HOSTS File: ([2009-06-10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O4:64bit: - HKLM..\Run: [Greenshot] C:\Programme\Greenshot\Greenshot.exe (Greenshot) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation) O4 - HKLM..\Run: [vmware-tray] C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe (VMware, Inc.) O4 - HKCU..\Run: [SkyDrive] C:\Users\CeeDub\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation) O4 - HKCU..\Run: [TrueCrypt] C:\Program Files\TrueCrypt\TrueCrypt.exe (TrueCrypt Foundation) O4 - HKCU..\Run: [USB Safely Remove] C:\Program Files (x86)\USB Safely Remove\USBSafelyRemove.exe () O4 - Startup: C:\Users\CeeDub\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.) O4 - Startup: C:\Users\CeeDub\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TheUsualSuspects.lnk = C:\Program Files (x86)\TheUsualSuspects.bat () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 223 O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - C:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll (VMware, Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - C:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{00F520D9-ABB9-4720-8A4E-5DE03CDE787D}: NameServer = 172.16.19.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013-06-09 14:04:52 | 026,957,289 | ---- | C] (Igor Pavlov) -- C:\Users\CeeDub\Documents\tor-browser-2.3.25-8_en-US.exe [2013-06-09 13:35:35 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\CeeDub\Desktop\OTL.exe [2013-06-09 12:32:04 | 000,000,000 | ---D | C] -- C:\Users\CeeDub\AppData\Roaming\Malwarebytes [2013-06-09 12:31:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013-05-24 21:06:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2013-05-15 19:26:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013-06-09 15:04:45 | 000,001,990 | -H-- | M] () -- C:\Users\CeeDub\Documents\Default.rdp [2013-06-09 15:03:35 | 000,000,000 | ---- | M] () -- C:\Users\CeeDub\defogger_reenable [2013-06-09 14:54:22 | 000,377,856 | ---- | M] () -- C:\Users\CeeDub\Desktop\gmer_2.1.19163.exe [2013-06-09 14:52:46 | 000,050,477 | ---- | M] () -- C:\Users\CeeDub\Desktop\Defogger.exe [2013-06-09 14:09:35 | 000,015,136 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013-06-09 14:09:35 | 000,015,136 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013-06-09 14:05:25 | 026,957,289 | ---- | M] (Igor Pavlov) -- C:\Users\CeeDub\Documents\tor-browser-2.3.25-8_en-US.exe [2013-06-09 14:00:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013-06-09 14:00:51 | 3219,267,584 | -HS- | M] () -- C:\hiberfil.sys [2013-06-09 13:35:41 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\CeeDub\Desktop\OTL.exe [2013-06-09 13:12:52 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt [2013-06-09 12:25:51 | 000,369,152 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013-05-21 01:08:11 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf [2013-05-21 01:08:11 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2013-06-09 15:03:35 | 000,000,000 | ---- | C] () -- C:\Users\CeeDub\defogger_reenable [2013-06-09 14:54:21 | 000,377,856 | ---- | C] () -- C:\Users\CeeDub\Desktop\gmer_2.1.19163.exe [2013-06-09 14:52:45 | 000,050,477 | ---- | C] () -- C:\Users\CeeDub\Desktop\Defogger.exe [2013-06-09 13:12:54 | 000,189,936 | ---- | C] () -- C:\Windows\SysNative\drivers\aswVmm.sys [2013-06-09 13:12:53 | 000,065,336 | ---- | C] () -- C:\Windows\SysNative\drivers\aswRvrt.sys [2013-06-09 12:00:56 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf [2013-06-09 11:59:54 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf [2013-05-21 01:08:11 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf [2013-05-21 01:08:11 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf [2013-04-13 14:04:34 | 000,002,104 | ---- | C] () -- C:\Users\CeeDub\AppData\Local\recently-used.xbel [2012-11-05 22:03:22 | 000,000,000 | ---- | C] () -- C:\Users\CeeDub\AppData\Local\debuggee.mdmp [2012-10-20 11:53:07 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2012-10-20 11:53:07 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2012-10-11 01:17:25 | 000,208,384 | ---- | C] () -- C:\Program Files (x86)\ShutdownTimer.exe [2012-10-10 00:48:29 | 000,006,840 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012-10-09 19:56:03 | 000,003,584 | ---- | C] () -- C:\Users\CeeDub\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012-10-09 18:48:55 | 000,000,658 | ---- | C] () -- C:\Program Files (x86)\TheUsualSuspects.bat [2012-10-09 18:48:55 | 000,000,064 | ---- | C] () -- C:\Program Files (x86)\WhatsMyIP.bat [2012-10-08 00:27:55 | 000,178,688 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [2012-10-07 23:15:33 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini ========== ZeroAccess Check ========== [2009-07-14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013-02-27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013-02-27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-07-14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010-11-20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009-07-14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2012-10-09 22:43:43 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\BatMail [2013-03-03 16:19:39 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\calibre [2012-10-13 17:23:38 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\Canneverbe Limited [2012-10-09 21:33:05 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\Esperanto [2013-05-20 08:42:29 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\EVA [2012-10-09 18:06:19 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\GHISLER [2013-04-16 13:17:32 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\Greenshot [2012-10-09 20:19:09 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\Helios [2013-03-26 00:02:55 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\IrfanView [2012-10-09 20:46:12 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\Jubilation [2012-10-09 20:25:20 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\LibreOffice [2012-10-09 20:56:30 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\Miranda [2012-11-01 15:31:35 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\mp3DirectCut [2012-10-09 22:08:20 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\Notepad++ [2013-03-09 10:52:19 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\PassWordSafe [2013-05-20 08:42:29 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\PWD [2012-10-09 20:01:20 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\Spacejock Software [2012-12-05 22:17:02 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\SumatraPDF [2012-12-16 19:51:22 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\TeamViewer [2012-10-21 17:54:12 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\Thumbnail me [2012-10-09 18:07:47 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\Thunderbird [2013-04-09 20:55:49 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\Thunderbird.sic [2012-10-11 21:32:35 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\TrueCrypt [2012-10-24 01:12:42 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\USBSafelyRemove [2013-01-23 21:41:09 | 000,000,000 | ---D | M] -- C:\Users\CeeDub\AppData\Roaming\Wargaming.net ========== Purity Check ========== < End of report > Geändert von Covenanter (09.06.2013 um 16:12 Uhr) |
| Themen zu Sicherheits-Center deaktiviert sich von selbst, dann Systemabsturz |
| antivirus, aswrvrt.sys, avast, bildschirm, exe-dateien, explorer, fehlermeldung, firefox, format, home, infizierte, logfile, mozilla, problem, prozess, realtek, registry, schwarzer bildschirm, server, software, starten, system, updates, usb, windows |
Baum-Darstellung