| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Lyricscontainer, Playdeal etc. eingefangenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
06.08.2013, 23:27
| #16 |
| /// Malware-holic   |  Lyricscontainer, Playdeal etc. eingefangen dus oaHi, deinstalieren sollst es ja nicht, deaktiviern. Fragen sind ja ok, dafür brauchst du dich nicht entschuldigen :-) wenn du Norton nicht deaktiviert bekommst einfach scannen mit Combofix
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
07.08.2013, 00:30
| #17 |
 | Lyricscontainer, Playdeal etc. eingefangen Malwarebytes Anti-Malware (Test) 1.75.0.1300
__________________www.malwarebytes.org Datenbank Version: v2013.08.06.01 Windows Vista Service Pack 1 x64 NTFS Internet Explorer 8.0.6001.19088 Rummler :: RUMMLER-PC [Administrator] Schutz: Aktiviert 06.08.2013 23:57:21 MBAM-log-2013-08-07 (00-10-42).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 255498 Laufzeit: 12 Minute(n), 51 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 3 C:\Users\Rummler\AppData\Local\Temp\BD05E0FF-BAB0-7891-ABDA-FD7FBA42C975\Latest\ccp.exe (PUP.Babylon.A) -> Keine Aktion durchgeführt. C:\Users\Rummler\AppData\Local\Temp\BD05E0FF-BAB0-7891-ABDA-FD7FBA42C975\Latest\Setup.exe (PUP.Babylon.A) -> Keine Aktion durchgeführt. C:\Users\Rummler\AppData\Local\Temp\is357113909\DeltaTB.exe (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. (Ende) ComboFix: Combofix Logfile: Code:
ATTFilter ComboFix 13-08-05.03 - Rummler 07.08.2013 0:48.1.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.49.1031.18.4093.1670 [GMT 2:00]
ausgeführt von:: c:\users\Rummler\Desktop\ComboFix.exe
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\DFR5A45.tmp
c:\program files (x86)\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe
c:\program files (x86)\LyricsContainer\125.dll
c:\users\Rummler\Documents\~WRL2315.tmp
c:\windows\SysWow64\W020T32W.DLL
c:\windows\SysWow64\W021T32W.DLL
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-07-06 bis 2013-08-06 ))))))))))))))))))))))))))))))
.
.
2013-08-06 23:15 . 2013-08-06 23:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-06 20:49 . 2013-08-06 20:49 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-06 20:49 . 2013-08-06 20:49 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-06 20:49 . 2013-08-06 20:49 -------- d-----w- c:\windows\system32\Macromed
2013-08-05 16:47 . 2013-08-05 16:47 -------- d-----w- C:\FRST
2013-08-01 09:09 . 2013-08-01 09:13 -------- d-----w- c:\windows\system32\MRT
2013-07-29 19:36 . 2013-08-06 15:17 -------- d-----w- c:\users\Rummler\AppData\Local\CrashDumps
2013-07-29 19:12 . 2013-07-29 19:12 177312 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2013-07-29 19:12 . 2013-07-29 19:12 -------- d-----w- c:\program files\Common Files\Symantec Shared
2013-07-29 19:10 . 2013-07-29 19:12 -------- d-----w- c:\windows\system32\drivers\NISx64
2013-07-29 19:10 . 2013-07-29 19:10 -------- d-----w- c:\program files (x86)\Norton Internet Security
2013-07-29 19:06 . 2013-08-06 22:22 -------- d-----w- c:\program files (x86)\NortonInstaller
2013-07-28 18:18 . 2013-07-28 18:18 -------- d-----w- c:\users\Rummler\AppData\Roaming\Malwarebytes
2013-07-28 18:17 . 2013-07-28 18:17 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-07-28 18:17 . 2013-07-28 18:17 -------- d-----w- c:\programdata\Malwarebytes
2013-07-28 18:17 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-28 17:34 . 2013-07-28 17:34 -------- d-----w- c:\program files\Enigma Software Group
2013-07-28 17:33 . 2013-07-30 11:11 -------- d-----w- c:\windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP
2013-07-28 17:29 . 2013-07-28 17:29 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2013-07-28 17:06 . 2013-07-28 17:07 835 ----a-w- c:\windows\DeleteOnReboot.bat
2013-07-26 18:14 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CB622040-B8E9-4B47-AE1D-39C07951DEA0}\mpengine.dll
2013-07-23 16:51 . 2013-08-06 23:14 -------- d-----w- c:\program files (x86)\LyricsContainer
2013-07-22 18:50 . 2013-07-22 18:50 -------- d-----w- c:\windows\SysWow64\searchplugins
2013-07-22 18:50 . 2013-07-22 18:50 -------- d-----w- c:\windows\SysWow64\Extensions
2013-07-22 18:49 . 2013-07-22 18:49 -------- d-----w- c:\programdata\Babylon
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-23 22:57 . 2006-11-02 12:35 78277128 ----a-w- c:\windows\system32\mrt.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{1dad3af3-ef2f-4f64-ac4b-11789189fcb6}]
2012-06-11 15:22 1307728 ----a-w- c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17418928]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]
"HP Deskjet 3050A J611 series (NET)"="c:\program files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe" [2011-06-08 2676584]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2013-08-06 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"DVDAgent"="c:\program files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-09-26 1148200]
"TSMAgent"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-09-25 1152296]
"CLMLServer for HP TouchSmart"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-09-25 189736]
"TVAgent"="c:\program files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe" [2008-09-24 206120]
"UCam_Menu"="c:\program files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]
"HP Health Check Scheduler"="c:\program files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]
"hpWirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"ConnectionCenter"="c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2012-07-27 380088]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"svg_file_op6"="del" [X]
"svg_file_op7"="rd" [X]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-2-27 982320]
HP Digital Imaging Monitor.lnk - c:\program files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
MediaServer.lnk - c:\program files (x86)\Twonky\TwonkyServer\twonkytray.exe [2012-7-9 594760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_bd5387da\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_bd5387da\AESTSr64.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Themes
ezSharedSvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 09:14 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-06 21:20 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-06 20:49]
.
2013-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-08-06 21:10]
.
2013-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-08-06 21:10]
.
2013-08-06 c:\windows\Tasks\HP Photo Creations Messager.job
- c:\programdata\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-13 15935520]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-13 82464]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1220392]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.t-online.de/
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: t-online.de\www
Trusted Zone: trost.de\ksm.vpn
Trusted Zone: trost.de\vpn
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{DA3D98A6-868D-4E1B-BB78-0887230DA405} - c:\program files (x86)\LyricsContainer\125.dll
Wow6432Node-HKCU-Run-Registry Reviver - c:\program files (x86)\Reviversoft\Registry Reviver\RegistryReviver.exe
Wow6432Node-HKCU-Run-QtraxNotification - c:\users\Rummler\Qtrax\Player\Notification.exe
Wow6432Node-HKLM-Run-hpqSRMon - (no file)
Wow6432Node-HKLM-Run-TQ566808 - E:\Setup.exe
Wow6432Node-HKLM-Run-CitrixReceiver - c:\programdata\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk
Wow6432Node-HKLM-RunOnce-svg_file_op1 - c:\program files (x86)\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe
Wow6432Node-HKLM-RunOnce-svg_file_op2 - c:\program files (x86)\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe
Wow6432Node-HKLM-RunOnce-svg_file_op3 - c:\program files (x86)\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe
Wow6432Node-HKLM-RunOnce-svg_file_op4 - c:\program files (x86)\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe
Wow6432Node-HKLM-RunOnce-svg_file_op5 - c:\program files (x86)\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe
HKLM-Run-SysTrayApp - c:\program files (x86)\IDT\WDM\sttray64.exe
HKLM-Run-SmartMenu - c:\program files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
Zeit der Fertigstellung: 2013-08-07 01:25:28
ComboFix-quarantined-files.txt 2013-08-06 23:25
.
Vor Suchlauf: 11 Verzeichnis(se), 197.295.587.328 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 197.986.742.272 Bytes frei
.
- - End Of File - - 4A902050D9024DA3423767FD33B29C91
5C86ADEC17B739C437E145E3B3FC2E6D |
|
07.08.2013, 11:29
| #18 |
| /// Malware-holic | Lyricscontainer, Playdeal etc. eingefangen Hi,
__________________hattest du Malwarebytes alle Funde löschen lassen? Falls nein, erneut Updaten, Scannen, Funde löschen, Log posten. Es sind 3 Logs zu erstellen, poste diese möglichst gleichzeitig. 1. Bitte beginne damit, Windows Updates zu instalieren. Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst. Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist: - Updates automatisch Instalieren, - Täglich - Uhrzeit wählen - Bitte den gesammten rest anhaken, außer: - detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist. Klicke jetzt die Schaltfläche "OK" Klicke jetzt "nach Updates suchen". Bitte instaliere zunächst wichtige Updates. Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren. Mache das selbe bitte mit den optionalen Updates. Prüfe unter Rechtsklick, Computer, ob das sp2 (Servicepack2) instaliert ist. Wenn ja, weiter: 2. Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Neustarten. 3. Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Neustarten. 4. Hitmanpro laden: HitmanPro - Download - Filepony Doppelklicken, Scan klicken. Log speichern und posten, bzw als XML exportieren, packen und anhängen, Hitmanpro schließen
__________________ |
|
07.08.2013, 21:02
| #19 |
| | Lyricscontainer, Playdeal etc. eingefangen Hi, irgendetwas ist beim Downloaden des AdwCleaners schiefgegangen. Auf meinem Desktop erscheint irgendein Zip-Opener und QTraxPlayer, jedenfalls kein AdwCleaner. Außerdem wird gemeldet, mein Internet Explorer würde nicht mehr richtig funktionieren (wird momentan mit deaktivierten Add-Ons ausgeführt). Bin einfach Deinem Link gefolgt und zunächst auch auf ...Pony gelandet?! Danke! |
|
07.08.2013, 21:13
| #20 |
| /// Malware-holic | Lyricscontainer, Playdeal etc. eingefangen Hi, das war evtl. ein Link aus ner Werbung auf dieser seite, schau noch mal, den richtigen Download Link hab ich dir gegeben
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
07.08.2013, 22:18
| #21 |
| | Lyricscontainer, Playdeal etc. eingefangen So, hoffe, ich habe alles richtig gemacht. Obwohl ich nach meinem letzten Post Schwierigkeiten mit dem QTrayPlayer hatte. Der ploppte ständig auf... Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.08.07.04 Windows Vista Service Pack 1 x64 NTFS Internet Explorer 8.0.6001.19088 Rummler :: RUMMLER-PC [Administrator] Schutz: Aktiviert 07.08.2013 14:06:13 mbam-log-2013-08-07 (14-06-13).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 233966 Laufzeit: 4 Minute(n), 58 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v2.306 - Datei am 28/07/2013 um 19:04:26 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows (TM) Vista Home Premium Service Pack 1 (64 bits)
# Benutzer : Rummler - RUMMLER-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Rummler\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3CQXIVVI\adwcleaner06[1].exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
Datei Gefunden : C:\Users\Public\Desktop\eBay.lnk
Datei Gefunden : C:\Windows\Tasks\LyricsContainer Update.job
Ordner Gefunden : C:\Program Files (x86)\Conduit
Ordner Gefunden : C:\Program Files (x86)\ConduitEngine
Ordner Gefunden : C:\Program Files (x86)\LyricsContainer
Ordner Gefunden : C:\ProgramData\Babylon
Ordner Gefunden : C:\Users\Rummler\AppData\Local\OpenCandy
Ordner Gefunden : C:\Users\Rummler\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\Rummler\AppData\LocalLow\ConduitEngine
Ordner Gefunden : C:\Users\Rummler\AppData\LocalLow\delta
Ordner Gefunden : C:\Users\Rummler\AppData\LocalLow\DVDVideoSoftTB
Ordner Gefunden : C:\Users\Rummler\AppData\LocalLow\DVDVideoSoftTB
Ordner Gefunden : C:\Users\Rummler\AppData\LocalLow\Freeware.de
Ordner Gefunden : C:\Users\Rummler\AppData\LocalLow\PriceGong
Ordner Gefunden : C:\Users\Rummler\AppData\Roaming\Babylon
Ordner Gefunden : C:\Users\Rummler\AppData\Roaming\OpenCandy
***** [Registrierungsdatenbank] *****
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\conduitEngine
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\conduitEngine
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\DVDVideoSoftTB
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\DVDVideoSoftTB
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Freeware.de
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\LyricsContainer
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gefunden : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gefunden : HKCU\Software\BabSolution
Schlüssel Gefunden : HKCU\Software\DataMngr
Schlüssel Gefunden : HKCU\Software\DataMngr_Toolbar
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Delta
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Lyrics@LyricsContainer.co
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{463B0ED4-8AFA-404B-90E7-4063A0708050}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{56C1EF1B-89A6-46C9-8718-6138D6C6B237}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7E111A5C-3D11-4F56-9463-5310C3C69025}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A6CAB0A8-95CB-43E9-885B-E2D6F2F99A92}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2736476
Schlüssel Gefunden : HKLM\Software\Conduit
Schlüssel Gefunden : HKLM\Software\conduitEngine
Schlüssel Gefunden : HKLM\Software\conduitEngine
Schlüssel Gefunden : HKLM\Software\DataMngr
Schlüssel Gefunden : HKLM\Software\DVDVideoSoftTB
Schlüssel Gefunden : HKLM\Software\DVDVideoSoftTB
Schlüssel Gefunden : HKLM\Software\Freeware.de
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{56C1EF1B-89A6-46C9-8718-6138D6C6B237}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A6CAB0A8-95CB-43E9-885B-E2D6F2F99A92}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\5b57d9dcb469b814
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{56C1EF1B-89A6-46C9-8718-6138D6C6B237}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E111A5C-3D11-4F56-9463-5310C3C69025}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A6CAB0A8-95CB-43E9-885B-E2D6F2F99A92}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AADCCAAC-6797-446B-AD83-EACF3DDF243F}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D6E017BE-4362-421B-A92C-271AB340E66A}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E028CC8B-4D9D-474F-944B-ADE0B69DE18D}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\abfmigjiaapipflmopkaaooigcjjdojh
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{375B21A6-5464-4A77-8546-EBEA64848F4D}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{47958995-373C-4DFD-8CF9-D02776F0C20D}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E111A5C-3D11-4F56-9463-5310C3C69025}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Lyrics@LyricsContainer.co
Schlüssel Gefunden : HKU\S-1-5-21-118358782-2589971228-455431022-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{7E111A5C-3D11-4F56-9463-5310C3C69025}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{7E111A5C-3D11-4F56-9463-5310C3C69025}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{7E111A5C-3D11-4F56-9463-5310C3C69025}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{7E111A5C-3D11-4F56-9463-5310C3C69025}]
Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.6001.19088
[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - bProtectTabs] = hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=0A750002721A42AE&affID=119556&tsp=4951
*************************
AdwCleaner[R1].txt - [11377 octets] - [28/07/2013 19:04:26]
########## EOF - C:\AdwCleaner[R1].txt - [11438 octets] ##########
AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v2.306 - Datei am 28/07/2013 um 19:06:48 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows (TM) Vista Home Premium Service Pack 1 (64 bits)
# Benutzer : Rummler - RUMMLER-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Rummler\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S02ZIAVS\adwcleaner06[1].exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
Datei Gelöscht : C:\Users\Public\Desktop\eBay.lnk
Datei Gelöscht : C:\Windows\Tasks\LyricsContainer Update.job
Gelöscht mit Neustart : C:\Program Files (x86)\Conduit
Gelöscht mit Neustart : C:\Program Files (x86)\ConduitEngine
Gelöscht mit Neustart : C:\Program Files (x86)\LyricsContainer
Gelöscht mit Neustart : C:\ProgramData\Babylon
Gelöscht mit Neustart : C:\Users\Rummler\AppData\Local\OpenCandy
Gelöscht mit Neustart : C:\Users\Rummler\AppData\LocalLow\Conduit
Gelöscht mit Neustart : C:\Users\Rummler\AppData\LocalLow\ConduitEngine
Gelöscht mit Neustart : C:\Users\Rummler\AppData\LocalLow\delta
Gelöscht mit Neustart : C:\Users\Rummler\AppData\LocalLow\DVDVideoSoftTB
Gelöscht mit Neustart : C:\Users\Rummler\AppData\LocalLow\DVDVideoSoftTB
Gelöscht mit Neustart : C:\Users\Rummler\AppData\LocalLow\Freeware.de
Gelöscht mit Neustart : C:\Users\Rummler\AppData\LocalLow\PriceGong
Gelöscht mit Neustart : C:\Users\Rummler\AppData\Roaming\Babylon
Gelöscht mit Neustart : C:\Users\Rummler\AppData\Roaming\OpenCandy
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\conduitEngine
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DVDVideoSoftTB
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Freeware.de
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\LyricsContainer
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\BabSolution
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Delta
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Lyrics@LyricsContainer.co
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{463B0ED4-8AFA-404B-90E7-4063A0708050}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{56C1EF1B-89A6-46C9-8718-6138D6C6B237}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7E111A5C-3D11-4F56-9463-5310C3C69025}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A6CAB0A8-95CB-43E9-885B-E2D6F2F99A92}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2736476
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\conduitEngine
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\DVDVideoSoftTB
Schlüssel Gelöscht : HKLM\Software\Freeware.de
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{56C1EF1B-89A6-46C9-8718-6138D6C6B237}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A6CAB0A8-95CB-43E9-885B-E2D6F2F99A92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\5b57d9dcb469b814
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{56C1EF1B-89A6-46C9-8718-6138D6C6B237}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E111A5C-3D11-4F56-9463-5310C3C69025}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A6CAB0A8-95CB-43E9-885B-E2D6F2F99A92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AADCCAAC-6797-446B-AD83-EACF3DDF243F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D6E017BE-4362-421B-A92C-271AB340E66A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E028CC8B-4D9D-474F-944B-ADE0B69DE18D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\abfmigjiaapipflmopkaaooigcjjdojh
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{375B21A6-5464-4A77-8546-EBEA64848F4D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{47958995-373C-4DFD-8CF9-D02776F0C20D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E111A5C-3D11-4F56-9463-5310C3C69025}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Lyrics@LyricsContainer.co
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{7E111A5C-3D11-4F56-9463-5310C3C69025}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{7E111A5C-3D11-4F56-9463-5310C3C69025}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{7E111A5C-3D11-4F56-9463-5310C3C69025}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{7E111A5C-3D11-4F56-9463-5310C3C69025}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.6001.19088
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - bProtectTabs] = hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=0A750002721A42AE&affID=119556&tsp=4951 --> hxxp://www.google.com
*************************
AdwCleaner[R1].txt - [11506 octets] - [28/07/2013 19:04:26]
AdwCleaner[S1].txt - [9375 octets] - [28/07/2013 19:06:48]
########## EOF - C:\AdwCleaner[S1].txt - [9435 octets] ##########
AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v2.306 - Datei am 07/08/2013 um 22:24:11 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows (TM) Vista Home Premium Service Pack 2 (64 bits)
# Benutzer : Rummler - RUMMLER-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Rummler\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
Gestoppt & Gelöscht : BrowserDefendert
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Users\Rummler\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data
Datei Gelöscht : C:\Users\Rummler\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences
Datei Gelöscht : C:\Windows\Tasks\Dealply.job
Gelöscht mit Neustart : C:\Program Files (x86)\Conduit
Gelöscht mit Neustart : C:\Program Files (x86)\ConduitEngine
Gelöscht mit Neustart : C:\Program Files (x86)\DealPly
Gelöscht mit Neustart : C:\Program Files (x86)\DealPlyLive
Gelöscht mit Neustart : C:\Program Files (x86)\LyricsContainer
Gelöscht mit Neustart : C:\ProgramData\Babylon
Gelöscht mit Neustart : C:\ProgramData\BrowserDefender
Gelöscht mit Neustart : C:\ProgramData\DealPlyLive
Gelöscht mit Neustart : C:\Users\Rummler\AppData\Local\DealPlyLive
Gelöscht mit Neustart : C:\Users\Rummler\AppData\Roaming\BabSolution
Gelöscht mit Neustart : C:\Users\Rummler\AppData\Roaming\Babylon
Gelöscht mit Neustart : C:\Users\Rummler\AppData\Roaming\DealPly
Gelöscht mit Neustart : C:\Users\Rummler\AppData\Roaming\delta
Gelöscht mit Neustart : C:\Users\Rummler\AppData\Roaming\DSite
Gelöscht mit Neustart : C:\Users\Rummler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender
Gelöscht mit Neustart : C:\Users\Rummler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\LyricsContainer
Schlüssel Gelöscht : HKCU\Software\BabSolution
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\DealPly
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DealPly
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Delta Chrome Toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Schlüssel Gelöscht : HKCU\Software\5b57d9dcb469b814
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickCtrl.9
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.Update3WebControl.3
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CredentialDialogMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CredentialDialogMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\DealPly
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=3
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=9
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\5b57d9dcb469b814
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{0D89DE71-3D99-4288-84DC-F18F1047A7D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{1E0C9B2A-6447-452C-B012-2314A0C29412}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{34A8CEB6-89BB-49F1-B5E4-0D0D6C21F3B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3A4DBD3A-98CC-41CE-AD21-352D42B6F754}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4F8A50F6-69DE-4BE3-A33A-A1079B9AC0DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{501CB57A-D4E2-4855-96AD-EDB0A9083395}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6FF2C4DD-77A4-4BB5-BA4C-B42DEFBF9137}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{83ABA270-8390-4CA6-AE48-FC089F55629E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{8B218A5F-1A3D-4347-94EF-A79575EB8094}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9BDB5E09-4BBA-4422-8C2B-529B281C32B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C536F080-57B7-46D6-8894-C647553F2889}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CA5D945F-E738-4D0B-A0B5-25AC51C64659}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F7698761-4ABA-45C2-A5BB-D2163922C725}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FFCC53E6-2655-47FC-A89B-54E8D7F305D1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C536F080-57B7-46D6-8894-C647553F2889}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1E0C9B2A-6447-452C-B012-2314A0C29412}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{34A8CEB6-89BB-49F1-B5E4-0D0D6C21F3B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3A4DBD3A-98CC-41CE-AD21-352D42B6F754}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4F8A50F6-69DE-4BE3-A33A-A1079B9AC0DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{501CB57A-D4E2-4855-96AD-EDB0A9083395}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6FF2C4DD-77A4-4BB5-BA4C-B42DEFBF9137}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{83ABA270-8390-4CA6-AE48-FC089F55629E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C536F080-57B7-46D6-8894-C647553F2889}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CA5D945F-E738-4D0B-A0B5-25AC51C64659}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F7698761-4ABA-45C2-A5BB-D2163922C725}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFCC53E6-2655-47FC-A89B-54E8D7F305D1}
Schlüssel Gelöscht : HKU\S-1-5-21-118358782-2589971228-455431022-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.6001.19088
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=0A750002721A42AE&affID=119357&tt=070813_12&tsp=4967 --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=0A750002721A42AE&affID=119357&tt=070813_12&tsp=4967 --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - bProtectTabs] = hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=0A750002721A42AE&affID=119357&tt=070813_12&tsp=4967 --> hxxp://www.google.com
-\\ Google Chrome v28.0.1500.95
Datei : C:\Users\Rummler\AppData\Local\Google\Chrome\User Data\Default\Preferences
Gelöscht [l.324] : urls_to_restore_on_startup ="session" : {"restore_on_startup": 4, [ "hxxp://www1.delta-search.c[...]
*************************
AdwCleaner[R1].txt - [11506 octets] - [28/07/2013 19:04:26]
AdwCleaner[S1].txt - [9502 octets] - [28/07/2013 19:06:48]
AdwCleaner[S2].txt - [11698 octets] - [07/08/2013 22:24:11]
########## EOF - C:\AdwCleaner[S2].txt - [11759 octets] ##########
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 5.3.7 (08.07.2013:3) OS: Windows (TM) Vista Home Premium x64 Ran by Rummler on 07.08.2013 at 22:37:22,36 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services Successfully stopped: [Service] dealplylive Successfully deleted: [Service] dealplylive Successfully stopped: [Service] dealplylivem Successfully deleted: [Service] dealplylivem ~~~ Registry Values Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ntredirect Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\qtraxnotification Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully deleted [Registry Value] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\\bProtectTabs Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\dealplylive.exe Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\dealplylive Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\trolltech Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\lyrixeeker Successfully deleted: [Registry Key] "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-118358782-2589971228-455431022-1000\Software\SweetIM" Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\dealplylive Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{00925011-8573-4D8C-866D-78AAF82A2159} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{5FB95484-0C9E-40CA-81FB-F2E35722AED0} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{00925011-8573-4D8C-866D-78AAF82A2159} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{5FB95484-0C9E-40CA-81FB-F2E35722AED0} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DA3D98A6-868D-4E1B-BB78-0887230DA405} ~~~ Files Successfully deleted [File] C:\Windows\Tasks\LyricXeeker Update.job Successfully deleted: [File] "C:\Users\Rummler\AppData\Roaming\microsoft\windows\start menu\programs\Qtrax Player.lnk" ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\babylon" Successfully deleted: [Folder] "C:\ProgramData\browserdefender" Successfully deleted: [Folder] "C:\ProgramData\dealplylive" Successfully deleted: [Folder] "C:\Program Files (x86)\conduit" Successfully deleted: [Folder] "C:\Program Files (x86)\conduitengine" Successfully deleted: [Folder] "C:\Program Files (x86)\dealply" Successfully deleted: [Folder] "C:\Program Files (x86)\dealplylive" Successfully deleted: [Folder] "C:\Program Files (x86)\lyricscontainer" Successfully deleted: [Folder] "C:\Program Files (x86)\lyrixeeker" Successfully deleted: [Folder] "C:\Program Files (x86)\openit" Failed to delete: [Folder] "C:\Users\Rummler\Qtrax" ~~~ Chrome Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\epojlgbehpaeekopencdagbdamnkppci ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 07.08.2013 at 22:46:37,64 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Combofix Logfile: Code:
ATTFilter ComboFix 13-08-05.03 - Rummler 07.08.2013 0:48.1.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.49.1031.18.4093.1670 [GMT 2:00]
ausgeführt von:: c:\users\Rummler\Desktop\ComboFix.exe
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\DFR5A45.tmp
c:\program files (x86)\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe
c:\program files (x86)\LyricsContainer\125.dll
c:\users\Rummler\Documents\~WRL2315.tmp
c:\windows\SysWow64\W020T32W.DLL
c:\windows\SysWow64\W021T32W.DLL
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-07-06 bis 2013-08-06 ))))))))))))))))))))))))))))))
.
.
2013-08-06 23:15 . 2013-08-06 23:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-06 20:49 . 2013-08-06 20:49 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-06 20:49 . 2013-08-06 20:49 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-06 20:49 . 2013-08-06 20:49 -------- d-----w- c:\windows\system32\Macromed
2013-08-05 16:47 . 2013-08-05 16:47 -------- d-----w- C:\FRST
2013-08-01 09:09 . 2013-08-01 09:13 -------- d-----w- c:\windows\system32\MRT
2013-07-29 19:36 . 2013-08-06 15:17 -------- d-----w- c:\users\Rummler\AppData\Local\CrashDumps
2013-07-29 19:12 . 2013-07-29 19:12 177312 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2013-07-29 19:12 . 2013-07-29 19:12 -------- d-----w- c:\program files\Common Files\Symantec Shared
2013-07-29 19:10 . 2013-07-29 19:12 -------- d-----w- c:\windows\system32\drivers\NISx64
2013-07-29 19:10 . 2013-07-29 19:10 -------- d-----w- c:\program files (x86)\Norton Internet Security
2013-07-29 19:06 . 2013-08-06 22:22 -------- d-----w- c:\program files (x86)\NortonInstaller
2013-07-28 18:18 . 2013-07-28 18:18 -------- d-----w- c:\users\Rummler\AppData\Roaming\Malwarebytes
2013-07-28 18:17 . 2013-07-28 18:17 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-07-28 18:17 . 2013-07-28 18:17 -------- d-----w- c:\programdata\Malwarebytes
2013-07-28 18:17 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-28 17:34 . 2013-07-28 17:34 -------- d-----w- c:\program files\Enigma Software Group
2013-07-28 17:33 . 2013-07-30 11:11 -------- d-----w- c:\windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP
2013-07-28 17:29 . 2013-07-28 17:29 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2013-07-28 17:06 . 2013-07-28 17:07 835 ----a-w- c:\windows\DeleteOnReboot.bat
2013-07-26 18:14 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CB622040-B8E9-4B47-AE1D-39C07951DEA0}\mpengine.dll
2013-07-23 16:51 . 2013-08-06 23:14 -------- d-----w- c:\program files (x86)\LyricsContainer
2013-07-22 18:50 . 2013-07-22 18:50 -------- d-----w- c:\windows\SysWow64\searchplugins
2013-07-22 18:50 . 2013-07-22 18:50 -------- d-----w- c:\windows\SysWow64\Extensions
2013-07-22 18:49 . 2013-07-22 18:49 -------- d-----w- c:\programdata\Babylon
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-23 22:57 . 2006-11-02 12:35 78277128 ----a-w- c:\windows\system32\mrt.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{1dad3af3-ef2f-4f64-ac4b-11789189fcb6}]
2012-06-11 15:22 1307728 ----a-w- c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17418928]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]
"HP Deskjet 3050A J611 series (NET)"="c:\program files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe" [2011-06-08 2676584]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2013-08-06 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"DVDAgent"="c:\program files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-09-26 1148200]
"TSMAgent"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-09-25 1152296]
"CLMLServer for HP TouchSmart"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-09-25 189736]
"TVAgent"="c:\program files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe" [2008-09-24 206120]
"UCam_Menu"="c:\program files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]
"HP Health Check Scheduler"="c:\program files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]
"hpWirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"ConnectionCenter"="c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2012-07-27 380088]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"svg_file_op6"="del" [X]
"svg_file_op7"="rd" [X]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-2-27 982320]
HP Digital Imaging Monitor.lnk - c:\program files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
MediaServer.lnk - c:\program files (x86)\Twonky\TwonkyServer\twonkytray.exe [2012-7-9 594760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_bd5387da\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_bd5387da\AESTSr64.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Themes
ezSharedSvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 09:14 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-06 21:20 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-06 20:49]
.
2013-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-08-06 21:10]
.
2013-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-08-06 21:10]
.
2013-08-06 c:\windows\Tasks\HP Photo Creations Messager.job
- c:\programdata\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-13 15935520]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-13 82464]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1220392]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.t-online.de/
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: t-online.de\www
Trusted Zone: trost.de\ksm.vpn
Trusted Zone: trost.de\vpn
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{DA3D98A6-868D-4E1B-BB78-0887230DA405} - c:\program files (x86)\LyricsContainer\125.dll
Wow6432Node-HKCU-Run-Registry Reviver - c:\program files (x86)\Reviversoft\Registry Reviver\RegistryReviver.exe
Wow6432Node-HKCU-Run-QtraxNotification - c:\users\Rummler\Qtrax\Player\Notification.exe
Wow6432Node-HKLM-Run-hpqSRMon - (no file)
Wow6432Node-HKLM-Run-TQ566808 - E:\Setup.exe
Wow6432Node-HKLM-Run-CitrixReceiver - c:\programdata\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk
Wow6432Node-HKLM-RunOnce-svg_file_op1 - c:\program files (x86)\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe
Wow6432Node-HKLM-RunOnce-svg_file_op2 - c:\program files (x86)\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe
Wow6432Node-HKLM-RunOnce-svg_file_op3 - c:\program files (x86)\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe
Wow6432Node-HKLM-RunOnce-svg_file_op4 - c:\program files (x86)\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe
Wow6432Node-HKLM-RunOnce-svg_file_op5 - c:\program files (x86)\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe
HKLM-Run-SysTrayApp - c:\program files (x86)\IDT\WDM\sttray64.exe
HKLM-Run-SmartMenu - c:\program files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
Zeit der Fertigstellung: 2013-08-07 01:25:28
ComboFix-quarantined-files.txt 2013-08-06 23:25
.
Vor Suchlauf: 11 Verzeichnis(se), 197.295.587.328 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 197.986.742.272 Bytes frei
.
- - End Of File - - 4A902050D9024DA3423767FD33B29C91
5C86ADEC17B739C437E145E3B3FC2E6D |
|
07.08.2013, 22:23
| #22 |
| /// Malware-holic | Lyricscontainer, Playdeal etc. eingefangen nein. 1. sind die windows updates nicht instaliert, kein servicepack 1 instaliere so lange Updates, bis es keine neuen mehr gibt. prüfe dann unter Rechtsklick, computer, eigenschaften, ob das servicepack2 drauf ist 2. hast du anstelle des hitmanpro logs ein combofix log gepostet
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
08.08.2013, 09:48
| #23 |
| | Lyricscontainer, Playdeal etc. eingefangen Hi, ich habe alle Updates runtergeladen. Hier die richtige Log-Datei: Code:
ATTFilter HitmanPro 3.7.7.203
www.hitmanpro.com
Computer name . . . . : RUMMLER-PC
Windows . . . . . . . : 6.0.2.6002.X64/2
User name . . . . . . : Rummler-PC\Rummler
UAC . . . . . . . . . : Enabled
License . . . . . . . : Free
Scan date . . . . . . : 2013-08-08 10:41:37
Scan mode . . . . . . : Normal
Scan duration . . . . : 5m 11s
Disk access mode . . : Direct disk access (SRB)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : No
Threats . . . . . . . : 0
Traces . . . . . . . : 78
Objects scanned . . . : 3.897.996
Files scanned . . . . : 31.318
Remnants scanned . . : 425.154 files / 3.441.524 keys
Potential Unwanted Programs _________________________________________________
HKU\S-1-5-21-118358782-2589971228-455431022-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{4D2D3B0F-69BE-477A-90F5-FDDB05357975} (Claro)
HKU\S-1-5-21-118358782-2589971228-455431022-1000\Software\Microsoft\Internet Explorer\SearchScopes\bProtectorDefaultScope (Claro)
HKU\S-1-5-21-118358782-2589971228-455431022-1000\Software\Microsoft\Windows\CurrentVersion\Ext\BPROTECTSETTINGS\ (Claro)
Cookies _____________________________________________________________________
C:\Users\Rummler\AppData\Roaming\Microsoft\Windows\Cookies\4QA7AQ58.txt
C:\Users\Rummler\AppData\Roaming\Microsoft\Windows\Cookies\9TVEKFBG.txt
C:\Users\Rummler\AppData\Roaming\Microsoft\Windows\Cookies\AA4UGUC3.txt
C:\Users\Rummler\AppData\Roaming\Microsoft\Windows\Cookies\JUZEITAU.txt
C:\Users\Rummler\AppData\Roaming\Microsoft\Windows\Cookies\P4WJDL5R.txt
C:\Users\Rummler\AppData\Roaming\Microsoft\Windows\Cookies\XCO36M91.txt
Ich hoffe, jetzt hab' ich es... |
|
08.08.2013, 12:42
| #24 |
| /// Malware-holic | Lyricscontainer, Playdeal etc. eingefangen Jepp. Hitmanpro Funde löschen lassen, neustart, neues FRST Log.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
08.08.2013, 19:13
| #25 |
| | Lyricscontainer, Playdeal etc. eingefangen Hi! Hitmanpro gibt mir gar nicht die Möglichkeit, irgendwelche Funde zu löschen. Da ist kein Button o.ä.?! |
|
08.08.2013, 19:15
| #26 |
| /// Malware-holic | Lyricscontainer, Playdeal etc. eingefangen auf weiter klicken sollte gehen.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
08.08.2013, 19:31
| #27 |
| | Lyricscontainer, Playdeal etc. eingefangen Leider nein. Nach "Weiter" geht nur noch "Abbrechen" und folgender Hinweis: "Die Anwendung ist nicht aktiviert. Das Entfernen von Viren oder anderer Software ist deaktiviert." Ich finde die Möglichkeit der Aktivierung nicht. |
|
08.08.2013, 19:34
| #28 |
| /// Malware-holic | Lyricscontainer, Playdeal etc. eingefangen Programm evtl. schon mal genutzt? mach sonst weiter mit frst
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
08.08.2013, 19:41
| #29 |
| | Lyricscontainer, Playdeal etc. eingefangenFRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-08-2013
Ran by Rummler (administrator) on 08-08-2013 20:36:51
Running from C:\Users\Rummler\Desktop
Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_58be29c0\AESTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
() C:\Program Files (x86)\SMINST\BLService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
() C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
() C:\Program Files (x86)\Twonky\TwonkyServer\twonkyproxy.exe
(PacketVideo) C:\Program Files (x86)\Twonky\TwonkyServer\twonkystarter.exe
() C:\Program Files (x86)\Twonky\TwonkyServer\twonkywebdav.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
() C:\Program Files (x86)\Twonky\TwonkyServer\TwonkyServer.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe
(PacketVideo) C:\Program Files (x86)\Twonky\TwonkyServer\twonkytray.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Receiver\Receiver.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
() C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDExtHost.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDAppHost.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDRuntimeHost.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPNetworkCommunicator.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Companion\companionuser.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_8_800_94_ActiveX.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)
HKLM\...\Run: [SmartMenu] - C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [912688 2008-09-23] (Hewlett-Packard)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [x]
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [450048 2009-07-21] (IDT, Inc.)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2008-06-09] (Hewlett-Packard Company)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [17418928 2012-07-13] (Skype Technologies S.A.)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [HP Deskjet 3050A J611 series (NET)] - C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe [2676584 2011-06-08] (Hewlett-Packard Co.)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe [x]
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-08-06] (Google Inc.)
HKLM-x32\...\Run: [DVDAgent] - C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe [1148200 2008-09-26] (CyberLink Corp.)
HKLM-x32\...\Run: [TSMAgent] - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe [1152296 2008-09-25] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer for HP TouchSmart] - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [189736 2008-09-25] (CyberLink)
HKLM-x32\...\Run: [TVAgent] - C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe [206120 2008-09-24] (CyberLink Corp.)
HKLM-x32\...\Run: [UCam_Menu] - C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM-x32\...\Run: [QlbCtrl.exe] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [202032 2008-08-01] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP Health Check Scheduler] - c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [75008 2008-06-16] (Hewlett-Packard)
HKLM-x32\...\Run: [hpWirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [488752 2008-04-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [ConnectionCenter] - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [380088 2012-07-27] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [hpqSRMon] - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [81920 2008-03-13] (Hewlett-Packard)
HKLM-x32\...\Run: [BingDesktop] - C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2249352 2013-06-20] (Microsoft Corp.)
HKU\Default\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [972080 2008-09-30] (Hewlett-Packard)
HKU\Default User\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [972080 2008-09-30] (Hewlett-Packard)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
ShortcutTarget: BTTray.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MediaServer.lnk
ShortcutTarget: MediaServer.lnk -> C:\Program Files (x86)\Twonky\TwonkyServer\twonkytray.exe (PacketVideo)
SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
SSODL-x32: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\SysWOW64\webcheck.dll (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {00925011-8573-4D8C-866D-78AAF82A2159} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKLM - {46169191-57A4-409E-9D31-B03CAEF4D7D0} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKLM - {5FB95484-0C9E-40CA-81FB-F2E35722AED0} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM-x32 - {46169191-57A4-409E-9D31-B03CAEF4D7D0} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKCU - DefaultScope {46169191-57A4-409E-9D31-B03CAEF4D7D0} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {46169191-57A4-409E-9D31-B03CAEF4D7D0} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=DE&ver=20&locale=de_DE&gct=kwd&qsrc=2869
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: LyricXeeker - {5c819b39-cbc9-4faf-8bd2-9d0699eb330a} - C:\Program Files (x86)\LyriXeeker\126.dll No File
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: DealPly Shopping - {9cf699ca-2174-4ed8-bec1-ba82095edce0} - C:\Program Files (x86)\DealPly\DealPlyIE.dll No File
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
DPF: HKLM-x32 {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Chrome:
=======
CHR Extension: (YouTube) - C:\Users\Rummler\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Rummler\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (DealPly Shopping) - C:\Users\Rummler\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi\3.5.0.0_0
CHR Extension: (Gmail) - C:\Users\Rummler\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_58be29c0\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-20] (Microsoft Corp.)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [109352 2013-08-07] (SurfRight B.V.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSSQL$CENTROSQL; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-20] (Symantec Corporation)
R2 Recovery Service for Windows; C:\Program Files (x86)\SMINST\BLService.exe [365904 2008-09-23] ()
S2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_bd5387da\STacSV64.exe [279040 2008-09-11] (IDT, Inc.)
R2 TVCapSvc; C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [296320 2008-09-24] ()
R2 TVSched; C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [116096 2008-09-24] ()
R2 TwonkyProxy; C:\Program Files (x86)\Twonky\TwonkyServer\twonkyproxy.exe [545608 2012-07-09] ()
R2 TwonkyServer; C:\Program Files (x86)\Twonky\TwonkyServer\twonkystarter.exe [549704 2012-07-09] (PacketVideo)
R2 TwonkyWebDav; C:\Program Files (x86)\Twonky\TwonkyServer\twonkywebdav.exe [271176 2012-07-09] ()
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]
==================== Drivers (Whitelisted) ====================
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-20] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-20] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-07-29] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-07-29] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2013-07-29] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\IPSDefs\20130807.001\IDSvia64.sys [513184 2013-07-26] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\IPSDefs\20130807.001\IDSvia64.sys [513184 2013-07-26] (Symantec Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\VirusDefs\20130808.003\ENG64.SYS [126040 2013-07-29] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\VirusDefs\20130808.003\ENG64.SYS [126040 2013-07-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\VirusDefs\20130808.003\EX64.SYS [2098776 2013-07-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\VirusDefs\20130808.003\EX64.SYS [2098776 2013-07-29] (Symantec Corporation)
R3 SRTSP; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-15] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-04] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-20] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-07-29] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2012-09-06] (Symantec Corporation)
R1 SYMTDIv; C:\Windows\system32\drivers\NISx64\1404000.028\SYMTDIV.SYS [457304 2013-04-24] (Symantec Corporation)
R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [27632 2008-09-26] (Cyberlink Corp.)
R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [27632 2008-09-26] (Cyberlink Corp.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
U2 vidicom Server; "C:\Program Files (x86)\Common Files\vidicom\VcmServer.exe"
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-08 20:10 - 2013-08-08 20:10 - 00001360 _____ C:\Users\Rummler\Desktop\HitmanPro_20130808_2010.log
2013-08-08 10:47 - 2013-08-08 10:47 - 00003478 _____ C:\Users\Rummler\Desktop\HitmanPro_20130808_1047.log
2013-08-08 08:32 - 2013-08-08 08:32 - 00000000 ____D C:\Windows\de
2013-08-08 08:29 - 2013-08-08 08:29 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2013-08-08 08:28 - 2013-08-08 08:28 - 00000761 _____ C:\Users\Rummler\Documents\Meine freigegebenen Ordner.lnk
2013-08-08 08:26 - 2013-08-08 08:32 - 00000000 ____D C:\Program Files (x86)\Windows Live
2013-08-08 08:26 - 2013-08-08 08:26 - 00000000 ____D C:\Program Files\Windows Live
2013-08-08 08:26 - 2012-03-08 18:40 - 00048488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fssfltr.sys
2013-08-08 08:25 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2013-08-08 08:25 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2013-08-08 08:25 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2013-08-08 08:25 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2013-08-08 08:25 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2013-08-08 08:25 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2013-08-08 07:51 - 2013-08-08 11:27 - 00000000 ____D C:\Users\Rummler\AppData\Local\Windows Live
2013-08-08 07:51 - 2009-08-04 10:12 - 01103872 _____ (Microsoft Corporation) C:\Windows\system32\webservices.dll
2013-08-08 07:51 - 2009-08-04 10:02 - 00754688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webservices.dll
2013-08-08 07:19 - 2013-04-17 14:32 - 01268224 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-08-08 07:19 - 2013-04-17 14:32 - 00327680 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-08-08 07:19 - 2013-04-17 14:32 - 00287232 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-08-08 07:19 - 2013-04-17 14:32 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-08-08 07:19 - 2013-04-17 13:29 - 02002944 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-08-08 07:19 - 2013-04-17 13:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-08-08 07:19 - 2013-04-17 13:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-08-08 07:19 - 2013-04-17 13:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-08-08 07:19 - 2013-04-17 13:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-08-08 07:19 - 2013-04-17 13:27 - 00566272 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-08-08 07:19 - 2013-04-17 13:02 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-08-08 07:19 - 2013-04-17 12:58 - 01556480 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-08-08 07:19 - 2013-04-17 12:58 - 01149440 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-08-08 07:19 - 2013-04-17 12:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-08-08 07:19 - 2013-04-17 12:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-08-08 07:19 - 2013-04-17 12:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-08-08 07:19 - 2013-04-17 12:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-08-08 07:19 - 2011-03-13 00:52 - 01653760 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2013-08-08 07:19 - 2011-03-12 23:55 - 00876032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-08-08 06:56 - 2013-08-08 06:56 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-08-08 06:44 - 2013-08-08 06:44 - 00000000 ____D C:\Windows\SysWOW64\spool
2013-08-08 06:44 - 2013-08-08 06:44 - 00000000 ____D C:\Program Files\Windows Portable Devices
2013-08-08 06:44 - 2013-08-08 06:44 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2013-08-08 06:43 - 2013-08-08 06:43 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2013-08-08 06:43 - 2013-08-08 06:43 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_07_00.Wdf
2013-08-08 03:17 - 2009-10-01 03:02 - 02537472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2013-08-08 03:17 - 2009-10-01 03:02 - 00334848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceApi.dll
2013-08-08 03:17 - 2009-10-01 03:02 - 00087552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WPDShServiceObj.dll
2013-08-08 03:17 - 2009-10-01 03:02 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WPDShextAutoplay.exe
2013-08-08 03:17 - 2009-10-01 03:01 - 00350208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WPDSp.dll
2013-08-08 03:17 - 2009-10-01 03:01 - 00196608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceWMDRM.dll
2013-08-08 03:17 - 2009-10-01 03:01 - 00160256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceTypes.dll
2013-08-08 03:17 - 2009-10-01 03:01 - 00100864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceClassExtension.dll
2013-08-08 03:17 - 2009-10-01 03:01 - 00060928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceConnectApi.dll
2013-08-08 03:17 - 2009-10-01 02:52 - 02727936 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2013-08-08 03:17 - 2009-10-01 02:52 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceApi.dll
2013-08-08 03:17 - 2009-10-01 02:52 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\WPDShextAutoplay.exe
2013-08-08 03:17 - 2009-10-01 02:51 - 00573440 _____ (Microsoft Corporation) C:\Windows\system32\wpd_ci.dll
2013-08-08 03:17 - 2009-10-01 02:51 - 00433152 _____ (Microsoft Corporation) C:\Windows\system32\WPDSp.dll
2013-08-08 03:17 - 2009-10-01 02:51 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\WpdMtp.dll
2013-08-08 03:17 - 2009-10-01 02:51 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceWMDRM.dll
2013-08-08 03:17 - 2009-10-01 02:51 - 00214528 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceTypes.dll
2013-08-08 03:17 - 2009-10-01 02:51 - 00113152 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceClassExtension.dll
2013-08-08 03:17 - 2009-10-01 02:51 - 00110080 _____ (Microsoft Corporation) C:\Windows\system32\WPDShServiceObj.dll
2013-08-08 03:17 - 2009-10-01 02:51 - 00107008 _____ (Microsoft Corporation) C:\Windows\system32\wpdbusenum.dll
2013-08-08 03:17 - 2009-10-01 02:51 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceConnectApi.dll
2013-08-08 03:17 - 2009-10-01 02:51 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\WpdMtpUS.dll
2013-08-08 03:17 - 2009-10-01 02:51 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WpdUsb.sys
2013-08-08 03:17 - 2009-10-01 02:51 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\BthMtpContextHandler.dll
2013-08-08 03:17 - 2009-10-01 02:51 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\WpdConns.dll
2013-08-08 02:15 - 2012-07-26 06:55 - 00785512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-08-08 02:15 - 2012-07-26 06:55 - 00054376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2013-08-08 02:15 - 2012-07-26 05:08 - 00744448 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2013-08-08 02:15 - 2012-07-26 05:08 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2013-08-08 02:15 - 2012-07-26 05:08 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2013-08-08 02:15 - 2012-07-26 05:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2013-08-08 02:15 - 2012-07-26 05:08 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2013-08-08 02:15 - 2012-07-26 04:36 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2013-08-08 02:15 - 2012-07-26 04:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2013-08-08 02:15 - 2012-07-26 04:26 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2013-08-08 02:15 - 2012-06-02 16:57 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2013-08-08 02:15 - 2012-06-02 16:35 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
2013-08-08 02:15 - 2009-07-14 14:19 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\winusb.dll
2013-08-08 02:15 - 2009-07-14 14:12 - 00016896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winusb.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 03695416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-08-08 02:04 - 2013-08-08 02:04 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-08-08 02:04 - 2013-08-08 02:04 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-08 02:04 - 2013-08-08 02:04 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-08 02:04 - 2013-08-08 02:04 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-08 02:04 - 2013-08-08 02:04 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-08 02:04 - 2013-08-08 02:04 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-08 02:04 - 2013-08-08 02:04 - 00434176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00403248 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-08-08 02:04 - 2013-08-08 02:04 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00353584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00203776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\advpack.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00130560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00123392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00114176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advpack.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-08-08 02:04 - 2013-08-08 02:04 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00066048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00063488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-08-08 02:04 - 2013-08-08 02:04 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-08 02:02 - 2013-08-08 02:02 - 03548672 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 03068416 _____ (Microsoft Corporation) C:\Windows\system32\xpsservices.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 02873344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 01554432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xpsservices.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\OpcServices.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 01257984 _____ (Microsoft Corporation) C:\Windows\system32\MFH264Dec.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 01204224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 01075712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 01032192 _____ (Microsoft Corporation) C:\Windows\system32\printfilterpipelinesvc.exe
2013-08-08 02:02 - 2013-08-08 02:02 - 00979456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFH264Dec.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00847360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OpcServices.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00748544 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00625152 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00586240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00478720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00428544 _____ (Microsoft Corporation) C:\Windows\system32\MFHEAACdec.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00377344 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4src.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2013-08-08 02:02 - 2013-08-08 02:02 - 00357376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFHEAACdec.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00345088 _____ (Microsoft Corporation) C:\Windows\system32\mfreadwrite.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00302592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4src.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00261632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfreadwrite.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00258048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv
2013-08-08 02:02 - 2013-08-08 02:02 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\XpsRasterService.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00209920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00195072 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00135680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsRasterService.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00098816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\printfilterpipelineprxy.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2013-08-08 02:01 - 2013-08-08 02:01 - 01209856 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00974848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00792576 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00449024 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00411648 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00369664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00328192 _____ (Microsoft Corporation) C:\Windows\system32\dxdiag.exe
2013-08-08 02:01 - 2013-08-08 02:01 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhotoMetadataHandler.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\dxdiagn.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00252928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxdiag.exe
2013-08-08 02:01 - 2013-08-08 02:01 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxdiagn.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00189440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-08-08 01:15 - 2009-09-10 04:07 - 03815424 _____ (Microsoft Corporation) C:\Windows\system32\UIRibbon.dll
2013-08-08 01:15 - 2009-09-10 04:06 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\UIRibbonRes.dll
2013-08-08 01:15 - 2009-09-10 04:05 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2013-08-08 01:15 - 2009-09-10 04:01 - 03023360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIRibbon.dll
2013-08-08 01:15 - 2009-09-10 04:00 - 01164800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIRibbonRes.dll
2013-08-08 01:15 - 2009-09-10 04:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-08-08 01:14 - 2012-02-29 17:37 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\wmi.dll
2013-08-08 01:14 - 2012-02-29 17:35 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-08-08 01:14 - 2012-02-29 17:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmi.dll
2013-08-08 01:14 - 2012-02-29 17:09 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-08-08 01:14 - 2012-02-29 15:52 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fs_rec.sys
2013-08-08 00:45 - 2012-12-16 15:31 - 00048128 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-08-08 00:45 - 2012-12-16 15:12 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-08-08 00:45 - 2012-12-16 13:08 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-08-08 00:45 - 2012-12-16 12:50 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-08-08 00:43 - 2011-02-22 16:47 - 00479744 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-08-08 00:43 - 2011-02-22 16:13 - 00288768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-08-08 00:42 - 2013-04-24 06:09 - 01269248 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-08 00:42 - 2013-04-24 06:09 - 00174592 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-08 00:42 - 2013-04-24 06:09 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-08 00:42 - 2013-04-24 06:09 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-08-08 00:42 - 2013-04-24 06:00 - 00985600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-08 00:42 - 2013-04-24 06:00 - 00133120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-08 00:42 - 2013-04-24 06:00 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-08 00:42 - 2013-04-24 06:00 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-08-08 00:42 - 2013-04-24 04:10 - 01078272 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-08-08 00:42 - 2013-04-24 03:46 - 00812544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-08-08 00:40 - 2011-08-25 18:20 - 00735744 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll
2013-08-08 00:40 - 2011-08-25 18:19 - 00847360 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2013-08-08 00:40 - 2011-08-25 18:19 - 00332288 _____ (Microsoft Corporation) C:\Windows\system32\oleacc.dll
2013-08-08 00:40 - 2011-08-25 18:15 - 00555520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll
2013-08-08 00:40 - 2011-08-25 18:14 - 00563712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2013-08-08 00:40 - 2011-08-25 18:14 - 00238080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleacc.dll
2013-08-08 00:40 - 2011-08-25 15:54 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\oleaccrc.dll
2013-08-08 00:40 - 2011-08-25 15:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaccrc.dll
2013-08-08 00:39 - 2013-06-01 06:19 - 00619008 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-08-08 00:39 - 2013-06-01 06:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-08-08 00:39 - 2013-03-11 15:33 - 04691304 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-08 00:39 - 2013-03-09 06:16 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-08-08 00:39 - 2013-03-09 03:48 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-08-08 00:39 - 2013-03-03 21:13 - 01513320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2013-08-08 00:39 - 2012-11-20 06:22 - 00204288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-08-08 00:39 - 2012-11-20 06:21 - 00253952 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-08-08 00:39 - 2012-08-21 13:50 - 00267648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2013-08-08 00:39 - 2012-05-01 16:29 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2013-08-08 00:39 - 2012-02-01 17:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2013-08-08 00:39 - 2011-06-15 18:16 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\xmllite.dll
2013-08-08 00:39 - 2011-06-15 18:12 - 00182784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xmllite.dll
2013-08-08 00:38 - 2013-06-04 04:03 - 02775040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-08-08 00:38 - 2012-06-04 17:29 - 00516480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-08-08 00:38 - 2012-06-02 02:22 - 00347136 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-08-08 00:38 - 2012-06-02 02:05 - 00077312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-08-08 00:38 - 2012-06-02 02:04 - 00278528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-08-08 00:38 - 2011-11-16 18:43 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2013-08-08 00:38 - 2011-11-16 18:42 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-08-08 00:38 - 2011-11-16 18:41 - 01689600 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-08-08 00:38 - 2011-11-16 18:23 - 00377344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2013-08-08 00:38 - 2011-11-16 16:34 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-08-08 00:37 - 2013-04-17 15:04 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-08-08 00:37 - 2013-04-17 14:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-08-08 00:37 - 2012-05-11 18:34 - 00788480 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2013-08-08 00:37 - 2012-05-11 17:57 - 00623616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\localspl.dll
2013-08-08 00:37 - 2011-10-25 18:13 - 00352256 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-08-08 00:37 - 2011-10-25 17:58 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2013-08-08 00:37 - 2011-10-14 19:31 - 00211968 _____ (Microsoft Corporation) C:\Windows\system32\winmm.dll
2013-08-08 00:37 - 2011-10-14 19:27 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\mcicda.dll
2013-08-08 00:37 - 2011-10-14 19:27 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\mciwave.dll
2013-08-08 00:37 - 2011-10-14 19:27 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\mciseq.dll
2013-08-08 00:37 - 2011-10-14 18:03 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmm.dll
2013-08-08 00:37 - 2011-10-14 18:00 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mciseq.dll
2013-08-08 00:36 - 2013-04-15 16:17 - 00901496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-08-08 00:36 - 2013-04-13 05:34 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-08-08 00:36 - 2013-03-08 06:18 - 00451072 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-08-08 00:36 - 2013-02-12 04:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2013-08-08 00:36 - 2012-11-22 06:22 - 00456192 _____ (Microsoft Corporation) C:\Windows\system32\shlwapi.dll
2013-08-08 00:36 - 2012-11-22 05:54 - 00353280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shlwapi.dll
2013-08-08 00:36 - 2012-11-02 12:47 - 01869824 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2013-08-08 00:36 - 2012-11-02 12:47 - 01794560 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2013-08-08 00:36 - 2012-11-02 12:19 - 01400832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2013-08-08 00:36 - 2012-11-02 12:19 - 01248768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2013-08-08 00:36 - 2012-09-25 18:31 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll
2013-08-08 00:36 - 2012-09-25 18:19 - 00075776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\synceng.dll
2013-08-08 00:36 - 2012-08-24 18:07 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-08 00:36 - 2012-08-24 17:53 - 00172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-08 00:36 - 2012-03-21 01:34 - 00072576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys
2013-08-08 00:36 - 2012-01-09 18:16 - 00708096 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2013-08-08 00:36 - 2012-01-09 17:54 - 00613376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpencom.dll
2013-08-08 00:36 - 2011-11-18 22:55 - 01585152 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-08 00:36 - 2011-11-18 22:55 - 01167984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-08 00:36 - 2011-10-14 19:30 - 00559616 _____ (Microsoft Corporation) C:\Windows\system32\EncDec.dll
2013-08-08 00:36 - 2011-10-14 18:02 - 00429056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EncDec.dll
2013-08-08 00:35 - 2013-05-08 06:50 - 01423720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-08 00:35 - 2013-05-08 06:18 - 01706496 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-08 00:35 - 2013-05-08 06:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-08 00:35 - 2013-03-08 06:17 - 02425344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-08-08 00:35 - 2013-03-08 05:52 - 02067968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-08-08 00:35 - 2012-11-08 06:26 - 01570816 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2013-08-08 00:35 - 2012-11-08 05:48 - 01314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2013-08-08 00:35 - 2012-09-28 18:34 - 01210368 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-08-08 00:35 - 2012-09-28 18:13 - 00860160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-08-08 00:35 - 2012-06-29 18:20 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\netapi32.dll
2013-08-08 00:35 - 2012-06-29 18:01 - 00467968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll
2013-08-08 00:35 - 2012-01-03 16:25 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-08-08 00:35 - 2011-12-14 18:38 - 00621056 _____ (Microsoft Corporation) C:\Windows\system32\msvcrt.dll
2013-08-08 00:35 - 2011-12-14 18:17 - 00680448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll
2013-08-08 00:35 - 2011-11-18 20:07 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2013-08-08 00:35 - 2011-11-18 19:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2013-08-08 00:35 - 2011-04-21 16:17 - 00695296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2013-08-08 00:35 - 2010-05-04 21:40 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\msshsq.dll
2013-08-08 00:35 - 2010-05-04 21:13 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msshsq.dll
2013-08-08 00:35 - 2009-06-17 12:37 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BTHUSB.SYS
2013-08-08 00:31 - 2013-05-02 06:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-08-08 00:31 - 2013-05-02 06:04 - 00443904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-08-08 00:31 - 2013-05-02 06:03 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\printcom.dll
2013-08-08 00:14 - 2011-07-29 18:08 - 00375808 _____ (Microsoft Corporation) C:\Windows\system32\psisdecd.dll
2013-08-08 00:14 - 2011-07-29 18:08 - 00289792 _____ (Microsoft Corporation) C:\Windows\system32\psisrndr.ax
2013-08-08 00:14 - 2011-07-29 18:06 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\Mpeg2Data.ax
2013-08-08 00:14 - 2011-07-29 18:06 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\MSDvbNP.ax
2013-08-08 00:14 - 2011-07-29 18:01 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\psisdecd.dll
2013-08-08 00:14 - 2011-07-29 18:01 - 00217088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\psisrndr.ax
2013-08-08 00:14 - 2011-07-29 18:00 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Mpeg2Data.ax
2013-08-08 00:14 - 2011-07-29 18:00 - 00057856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSDvbNP.ax
2013-08-08 00:13 - 2012-11-13 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-08 00:13 - 2012-11-13 03:29 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-08 00:13 - 2012-06-08 19:59 - 12899840 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-08-08 00:13 - 2012-06-08 19:47 - 11586048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-08-08 00:12 - 2012-11-02 12:45 - 00477696 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2013-08-08 00:12 - 2012-11-02 12:45 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\dpnathlp.dll
2013-08-08 00:12 - 2012-11-02 12:18 - 00376320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnet.dll
2013-08-08 00:12 - 2012-11-02 10:59 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\dpnsvr.exe
2013-08-08 00:12 - 2012-11-02 10:26 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnsvr.exe
2013-08-07 23:54 - 2012-06-03 00:19 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-08-07 23:54 - 2012-06-03 00:19 - 00701976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-08-07 23:54 - 2012-06-03 00:19 - 00577048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2013-08-07 23:54 - 2012-06-03 00:19 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-08-07 23:54 - 2012-06-03 00:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2013-08-07 23:54 - 2012-06-03 00:19 - 00038424 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2013-08-07 23:54 - 2012-06-03 00:19 - 00035864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2013-08-07 23:54 - 2012-06-03 00:15 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-08-07 23:54 - 2012-06-03 00:15 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-08-07 23:54 - 2012-06-03 00:12 - 00088576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2013-08-07 23:54 - 2012-06-02 15:19 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-08-07 23:54 - 2012-06-02 15:19 - 00171904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2013-08-07 23:54 - 2012-06-02 15:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-08-07 23:54 - 2012-06-02 15:12 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2013-08-07 22:57 - 2013-08-07 23:07 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-07 22:57 - 2013-08-07 22:57 - 00001744 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2013-08-07 22:57 - 2013-08-07 22:57 - 00000000 ____D C:\Program Files\HitmanPro
2013-08-07 22:56 - 2013-08-07 22:57 - 09853928 _____ (SurfRight B.V.) C:\Users\Rummler\Desktop\HitmanPro_x64.exe
2013-08-07 22:46 - 2013-08-07 22:46 - 00004084 _____ C:\Users\Rummler\Desktop\JRT.txt
2013-08-07 22:37 - 2013-08-07 22:37 - 00000000 ____D C:\Windows\ERUNT
2013-08-07 22:36 - 2013-08-07 22:36 - 00957082 _____ (Oleg N. Scherbakov) C:\Users\Rummler\Desktop\JRT.exe
2013-08-07 22:24 - 2013-08-07 22:24 - 00011797 _____ C:\AdwCleaner[S2].txt
2013-08-07 22:23 - 2013-08-07 22:23 - 00666633 _____ C:\Users\Rummler\Desktop\adwcleaner.exe
2013-08-07 21:53 - 2013-08-07 21:53 - 00000000 ____D C:\Users\Rummler\Qtrax
2013-08-07 21:50 - 2013-08-07 21:50 - 00003352 _____ C:\Windows\System32\Tasks\BrowserDefendert
2013-08-07 21:49 - 2013-08-08 20:03 - 00000904 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
2013-08-07 21:49 - 2013-08-08 11:54 - 00000908 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2013-08-07 21:49 - 2013-08-07 22:27 - 00000424 _____ C:\Windows\Tasks\At1.job
2013-08-07 21:49 - 2013-08-07 21:49 - 00003904 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA
2013-08-07 21:49 - 2013-08-07 21:49 - 00003732 _____ C:\Windows\System32\Tasks\QtraxPlayer
2013-08-07 21:49 - 2013-08-07 21:49 - 00003652 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineCore
2013-08-07 21:49 - 2013-08-07 21:49 - 00003370 _____ C:\Windows\System32\Tasks\DealPlyUpdate
2013-08-07 21:49 - 2013-08-07 21:49 - 00003314 _____ C:\Windows\System32\Tasks\EPUpdater
2013-08-07 21:49 - 2013-08-07 21:49 - 00001400 _____ C:\Windows\System32\Tasks\At1
2013-08-07 21:45 - 2013-08-07 21:45 - 00791488 _____ C:\Users\Rummler\Desktop\ZipOpenerSetup.exe
2013-08-07 16:45 - 2013-08-07 16:45 - 00000000 ____H C:\Windows\system32\Drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2013-08-07 16:45 - 2013-08-07 16:45 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SynTP_01009.Wdf
2013-08-07 16:22 - 2013-08-07 16:22 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-08-07 15:05 - 2013-08-07 15:12 - 00000000 ____D C:\Windows\SysWOW64\ca-ES
2013-08-07 15:05 - 2013-08-07 15:11 - 00000000 ____D C:\Windows\SysWOW64\eu-ES
2013-08-07 15:05 - 2013-08-07 15:10 - 00000000 ____D C:\Windows\SysWOW64\vi-VN
2013-08-07 15:05 - 2013-08-07 15:08 - 00000000 ____D C:\Windows\system32\eu-ES
2013-08-07 15:05 - 2013-08-07 15:08 - 00000000 ____D C:\Windows\system32\ca-ES
2013-08-07 15:05 - 2013-08-07 15:07 - 00000000 ____D C:\Windows\system32\vi-VN
2013-08-07 14:27 - 2013-08-07 14:27 - 00000000 ____D C:\Windows\system32\EventProviders
2013-08-07 01:25 - 2013-08-07 01:25 - 00017973 _____ C:\ComboFix.txt
2013-08-07 00:43 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-07 00:43 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-07 00:43 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-07 00:43 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-07 00:43 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-07 00:43 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-07 00:43 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-07 00:43 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-07 00:19 - 2013-08-07 01:25 - 00000000 ____D C:\Qoobox
2013-08-07 00:18 - 2013-08-07 00:18 - 05100695 ____R (Swearware) C:\Users\Rummler\Desktop\ComboFix.exe
2013-08-07 00:17 - 2013-08-07 01:20 - 00000000 ____D C:\Windows\erdnt
2013-08-07 00:13 - 2013-08-07 00:13 - 00005016 _____ C:\Users\Rummler\Documents\Malwarebytes Anti.odt
2013-08-06 23:10 - 2013-08-08 20:20 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-06 23:10 - 2013-08-08 20:03 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-06 23:10 - 2013-08-06 23:21 - 00002025 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-06 23:10 - 2013-08-06 23:15 - 00004108 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-08-06 23:10 - 2013-08-06 23:15 - 00003856 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-08-06 23:09 - 2013-08-06 23:09 - 00001922 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-08-06 23:08 - 2013-08-06 23:08 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-08-06 22:49 - 2013-08-08 11:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-06 22:49 - 2013-08-06 22:50 - 00003738 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-06 22:49 - 2013-08-06 22:49 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-06 22:49 - 2013-08-06 22:49 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-06 22:49 - 2013-08-06 22:49 - 00000000 ____D C:\Windows\system32\Macromed
2013-08-05 18:51 - 2013-08-05 18:56 - 00028191 _____ C:\Users\Rummler\Desktop\Addition.txt
2013-08-05 18:47 - 2013-08-05 18:47 - 00000000 ____D C:\FRST
2013-08-05 18:46 - 2013-08-05 18:46 - 01788733 _____ (Farbar) C:\Users\Rummler\Desktop\FRST64.exe
2013-08-01 11:09 - 2013-08-01 11:13 - 00000000 ____D C:\Windows\system32\MRT
2013-07-29 21:36 - 2013-08-08 20:06 - 00000000 ____D C:\Users\Rummler\AppData\Local\CrashDumps
2013-07-29 21:13 - 2013-07-29 21:13 - 00000000 ____D C:\Windows\System32\Tasks\Norton Internet Security
2013-07-29 21:13 - 2013-07-29 21:13 - 00000000 ____D C:\Users\Rummler\Documents\Symantec
2013-07-29 21:12 - 2013-07-29 21:12 - 00177312 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2013-07-29 21:12 - 2013-07-29 21:12 - 00007631 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
2013-07-29 21:12 - 2013-07-29 21:12 - 00003234 _____ C:\Windows\System32\Tasks\Norton WSC Integration
2013-07-29 21:12 - 2013-07-29 21:12 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared
2013-07-29 21:11 - 2013-07-29 21:11 - 00002291 _____ C:\Users\Public\Desktop\Norton Internet Security.lnk
2013-07-29 21:10 - 2013-07-29 21:12 - 00000000 ____D C:\Windows\system32\Drivers\NISx64
2013-07-29 21:10 - 2013-07-29 21:10 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security
2013-07-28 20:18 - 2013-07-28 20:18 - 00000000 ____D C:\Users\Rummler\AppData\Roaming\Malwarebytes
2013-07-28 20:17 - 2013-07-28 20:17 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-28 20:17 - 2013-07-28 20:17 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-28 20:17 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-28 19:35 - 2013-07-28 19:35 - 00000000 _____ C:\autoexec.bat
2013-07-28 19:34 - 2013-07-28 19:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-07-28 19:33 - 2013-07-30 13:11 - 00000000 ____D C:\Windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP
2013-07-28 19:06 - 2013-08-07 22:24 - 00001795 _____ C:\Windows\DeleteOnReboot.bat
2013-07-28 19:06 - 2013-07-28 19:07 - 00009502 _____ C:\AdwCleaner[S1].txt
2013-07-28 19:04 - 2013-07-28 19:04 - 00011506 _____ C:\AdwCleaner[R1].txt
2013-07-22 20:50 - 2013-07-22 20:50 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-07-22 20:50 - 2013-07-22 20:50 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-07-22 20:49 - 2013-07-22 20:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2013-08-08 20:20 - 2013-08-06 23:10 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-08 20:20 - 2009-02-18 23:46 - 00000000 ____D C:\Users\Rummler\AppData\Roaming\Skype
2013-08-08 20:10 - 2013-08-08 20:10 - 00001360 _____ C:\Users\Rummler\Desktop\HitmanPro_20130808_2010.log
2013-08-08 20:07 - 2008-10-23 16:46 - 00764216 _____ C:\Windows\system32\perfh007.dat
2013-08-08 20:07 - 2008-10-23 16:46 - 00183688 _____ C:\Windows\system32\perfc007.dat
2013-08-08 20:07 - 2008-10-23 09:47 - 00003578 _____ C:\Windows\System32\Tasks\HP Health Check
2013-08-08 20:07 - 2006-11-02 14:46 - 01802564 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-08 20:06 - 2013-07-29 21:36 - 00000000 ____D C:\Users\Rummler\AppData\Local\CrashDumps
2013-08-08 20:04 - 2012-12-28 12:54 - 00000000 ____D C:\ProgramData\TwonkyServer
2013-08-08 20:03 - 2013-08-07 21:49 - 00000904 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
2013-08-08 20:03 - 2013-08-06 23:10 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-08 20:03 - 2010-09-14 19:45 - 00032061 _____ C:\ProgramData\nvModes.001
2013-08-08 20:03 - 2010-09-14 19:44 - 00032061 _____ C:\ProgramData\nvModes.dat
2013-08-08 20:01 - 2006-11-02 17:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-08 20:01 - 2006-11-02 17:22 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-08 20:01 - 2006-11-02 17:22 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-08 11:58 - 2008-12-25 01:37 - 01309936 _____ C:\Windows\WindowsUpdate.log
2013-08-08 11:58 - 2008-10-23 07:49 - 00001076 _____ C:\Windows\bthservsdp.dat
2013-08-08 11:58 - 2006-11-02 17:42 - 00032510 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-08 11:54 - 2013-08-07 21:49 - 00000908 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2013-08-08 11:27 - 2013-08-08 07:51 - 00000000 ____D C:\Users\Rummler\AppData\Local\Windows Live
2013-08-08 11:03 - 2013-08-06 22:49 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-08 11:01 - 2012-12-03 10:27 - 00000260 _____ C:\Windows\Tasks\HP Photo Creations Messager.job
2013-08-08 11:00 - 2006-11-02 17:21 - 00400624 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-08 10:47 - 2013-08-08 10:47 - 00003478 _____ C:\Users\Rummler\Desktop\HitmanPro_20130808_1047.log
2013-08-08 08:45 - 2009-01-31 16:03 - 00109088 _____ C:\Users\Rummler\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-08 08:32 - 2013-08-08 08:32 - 00000000 ____D C:\Windows\de
2013-08-08 08:32 - 2013-08-08 08:26 - 00000000 ____D C:\Program Files (x86)\Windows Live
2013-08-08 08:29 - 2013-08-08 08:29 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2013-08-08 08:28 - 2013-08-08 08:28 - 00000761 _____ C:\Users\Rummler\Documents\Meine freigegebenen Ordner.lnk
2013-08-08 08:26 - 2013-08-08 08:26 - 00000000 ____D C:\Program Files\Windows Live
2013-08-08 08:26 - 2006-11-02 15:33 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-08-08 08:25 - 2008-10-23 09:20 - 00037878 _____ C:\Windows\DirectX.log
2013-08-08 08:16 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\rescache
2013-08-08 07:50 - 2010-07-13 21:09 - 01782570 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-08-08 06:56 - 2013-08-08 06:56 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-08-08 06:56 - 2009-01-31 16:07 - 00000979 _____ C:\Users\Rummler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-08-08 06:56 - 2009-01-31 16:07 - 00000949 _____ C:\Users\Rummler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2013-08-08 06:44 - 2013-08-08 06:44 - 00000000 ____D C:\Windows\SysWOW64\spool
2013-08-08 06:44 - 2013-08-08 06:44 - 00000000 ____D C:\Program Files\Windows Portable Devices
2013-08-08 06:44 - 2013-08-08 06:44 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2013-08-08 06:44 - 2006-11-02 17:27 - 00220200 _____ C:\Windows\setupact.log
2013-08-08 06:44 - 2006-11-02 17:07 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-08-08 06:44 - 2006-11-02 17:07 - 00000000 ____D C:\Program Files\Windows Journal
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\uk-UA
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\tr-TR
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\th-TH
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\sr-Latn-CS
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\sl-SI
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\sk-SK
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\ro-RO
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\lv-LV
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\lt-LT
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\hr-HR
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\he-IL
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\et-EE
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\bg-BG
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\ar-SA
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\zh-HK
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\uk-UA
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\tr-TR
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\th-TH
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\sr-Latn-CS
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\sl-SI
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\sk-SK
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\ro-RO
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\lv-LV
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\lt-LT
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\hr-HR
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\he-IL
2013-08-08 06:44 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\et-EE
2013-08-08 06:44 - 2006-11-02 15:33 - 00000000 ___RD C:\Windows\Offline Web Pages
2013-08-08 06:44 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\system32\bg-BG
2013-08-08 06:44 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\system32\ar-SA
2013-08-08 06:44 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-08-08 06:44 - 2006-11-02 15:33 - 00000000 ____D C:\Program Files\Common Files\System
2013-08-08 06:43 - 2013-08-08 06:43 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2013-08-08 06:43 - 2013-08-08 06:43 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_07_00.Wdf
2013-08-08 02:04 - 2013-08-08 02:04 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 03695416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-08-08 02:04 - 2013-08-08 02:04 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-08-08 02:04 - 2013-08-08 02:04 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-08 02:04 - 2013-08-08 02:04 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-08 02:04 - 2013-08-08 02:04 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-08 02:04 - 2013-08-08 02:04 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-08 02:04 - 2013-08-08 02:04 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-08 02:04 - 2013-08-08 02:04 - 00434176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00403248 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-08-08 02:04 - 2013-08-08 02:04 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00353584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00203776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\advpack.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00130560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00123392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00114176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advpack.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-08-08 02:04 - 2013-08-08 02:04 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00066048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00063488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-08-08 02:04 - 2013-08-08 02:04 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-08-08 02:04 - 2013-08-08 02:04 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-08-08 02:04 - 2013-08-08 02:04 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-08 02:04 - 2011-10-12 08:12 - 00007383 _____ C:\Windows\IE9_main.log
2013-08-08 02:04 - 2006-11-02 14:16 - 00008798 _____ C:\Windows\SysWOW64\icrav03.rat
2013-08-08 02:04 - 2006-11-02 14:16 - 00001988 _____ C:\Windows\SysWOW64\ticrf.rat
2013-08-08 02:04 - 2006-11-02 08:36 - 00008798 _____ C:\Windows\system32\icrav03.rat
2013-08-08 02:04 - 2006-11-02 08:36 - 00001988 _____ C:\Windows\system32\ticrf.rat
2013-08-08 02:02 - 2013-08-08 02:02 - 03548672 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 03068416 _____ (Microsoft Corporation) C:\Windows\system32\xpsservices.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 02873344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 01554432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xpsservices.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\OpcServices.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 01257984 _____ (Microsoft Corporation) C:\Windows\system32\MFH264Dec.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 01204224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 01075712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 01032192 _____ (Microsoft Corporation) C:\Windows\system32\printfilterpipelinesvc.exe
2013-08-08 02:02 - 2013-08-08 02:02 - 00979456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFH264Dec.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00847360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OpcServices.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00748544 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00625152 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00586240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00478720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00428544 _____ (Microsoft Corporation) C:\Windows\system32\MFHEAACdec.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00377344 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4src.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2013-08-08 02:02 - 2013-08-08 02:02 - 00357376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFHEAACdec.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00345088 _____ (Microsoft Corporation) C:\Windows\system32\mfreadwrite.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00302592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4src.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00261632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfreadwrite.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00258048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv
2013-08-08 02:02 - 2013-08-08 02:02 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\XpsRasterService.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00209920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00195072 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00135680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsRasterService.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00098816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\printfilterpipelineprxy.dll
2013-08-08 02:02 - 2013-08-08 02:02 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2013-08-08 02:01 - 2013-08-08 02:01 - 01209856 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00974848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00792576 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00449024 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00411648 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00369664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00328192 _____ (Microsoft Corporation) C:\Windows\system32\dxdiag.exe
2013-08-08 02:01 - 2013-08-08 02:01 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhotoMetadataHandler.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\dxdiagn.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00252928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxdiag.exe
2013-08-08 02:01 - 2013-08-08 02:01 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxdiagn.dll
2013-08-08 02:01 - 2013-08-08 02:01 - 00189440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-08-07 23:07 - 2013-08-07 22:57 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-07 22:57 - 2013-08-07 22:57 - 00001744 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2013-08-07 22:57 - 2013-08-07 22:57 - 00000000 ____D C:\Program Files\HitmanPro
2013-08-07 22:57 - 2013-08-07 22:56 - 09853928 _____ (SurfRight B.V.) C:\Users\Rummler\Desktop\HitmanPro_x64.exe
2013-08-07 22:46 - 2013-08-07 22:46 - 00004084 _____ C:\Users\Rummler\Desktop\JRT.txt
2013-08-07 22:37 - 2013-08-07 22:37 - 00000000 ____D C:\Windows\ERUNT
2013-08-07 22:36 - 2013-08-07 22:36 - 00957082 _____ (Oleg N. Scherbakov) C:\Users\Rummler\Desktop\JRT.exe
2013-08-07 22:27 - 2013-08-07 21:49 - 00000424 _____ C:\Windows\Tasks\At1.job
2013-08-07 22:24 - 2013-08-07 22:24 - 00011797 _____ C:\AdwCleaner[S2].txt
2013-08-07 22:24 - 2013-07-28 19:06 - 00001795 _____ C:\Windows\DeleteOnReboot.bat
2013-08-07 22:23 - 2013-08-07 22:23 - 00666633 _____ C:\Users\Rummler\Desktop\adwcleaner.exe
2013-08-07 21:53 - 2013-08-07 21:53 - 00000000 ____D C:\Users\Rummler\Qtrax
2013-08-07 21:53 - 2009-01-31 15:54 - 00000000 ____D C:\Users\Rummler
2013-08-07 21:50 - 2013-08-07 21:50 - 00003352 _____ C:\Windows\System32\Tasks\BrowserDefendert
2013-08-07 21:49 - 2013-08-07 21:49 - 00003904 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA
2013-08-07 21:49 - 2013-08-07 21:49 - 00003732 _____ C:\Windows\System32\Tasks\QtraxPlayer
2013-08-07 21:49 - 2013-08-07 21:49 - 00003652 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineCore
2013-08-07 21:49 - 2013-08-07 21:49 - 00003370 _____ C:\Windows\System32\Tasks\DealPlyUpdate
2013-08-07 21:49 - 2013-08-07 21:49 - 00003314 _____ C:\Windows\System32\Tasks\EPUpdater
2013-08-07 21:49 - 2013-08-07 21:49 - 00001400 _____ C:\Windows\System32\Tasks\At1
2013-08-07 21:45 - 2013-08-07 21:45 - 00791488 _____ C:\Users\Rummler\Desktop\ZipOpenerSetup.exe
2013-08-07 18:56 - 2008-01-21 05:26 - 00331460 _____ C:\Windows\PFRO.log
2013-08-07 18:50 - 2008-10-23 09:16 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-07 18:49 - 2006-11-02 14:34 - 00000254 _____ C:\Windows\win.ini
2013-08-07 16:45 - 2013-08-07 16:45 - 00000000 ____H C:\Windows\system32\Drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2013-08-07 16:45 - 2013-08-07 16:45 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SynTP_01009.Wdf
2013-08-07 16:22 - 2013-08-07 16:22 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-08-07 16:06 - 2008-12-25 02:48 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-07 15:38 - 2009-01-31 16:07 - 00000915 _____ C:\Users\Rummler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2013-08-07 15:14 - 2006-11-02 17:07 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-08-07 15:14 - 2006-11-02 17:07 - 00000000 ____D C:\Program Files\Windows Photo Gallery
2013-08-07 15:14 - 2006-11-02 17:07 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-07 15:14 - 2006-11-02 17:07 - 00000000 ____D C:\Program Files\Windows Collaboration
2013-08-07 15:14 - 2006-11-02 17:07 - 00000000 ____D C:\Program Files\Movie Maker
2013-08-07 15:14 - 2006-11-02 17:07 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-08-07 15:14 - 2006-11-02 17:07 - 00000000 ____D C:\Program Files (x86)\Windows Photo Gallery
2013-08-07 15:14 - 2006-11-02 17:07 - 00000000 ____D C:\Program Files (x86)\Windows Calendar
2013-08-07 15:13 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\servicing
2013-08-07 15:12 - 2013-08-07 15:05 - 00000000 ____D C:\Windows\SysWOW64\ca-ES
2013-08-07 15:11 - 2013-08-07 15:05 - 00000000 ____D C:\Windows\SysWOW64\eu-ES
2013-08-07 15:11 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\SLUI
2013-08-07 15:11 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\setup
2013-08-07 15:11 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-08-07 15:11 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\manifeststore
2013-08-07 15:11 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\AdvancedInstallers
2013-08-07 15:10 - 2013-08-07 15:05 - 00000000 ____D C:\Windows\SysWOW64\vi-VN
2013-08-07 15:10 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\SysWOW64\migwiz
2013-08-07 15:09 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\IME
2013-08-07 15:08 - 2013-08-07 15:05 - 00000000 ____D C:\Windows\system32\eu-ES
2013-08-07 15:08 - 2013-08-07 15:05 - 00000000 ____D C:\Windows\system32\ca-ES
2013-08-07 15:08 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\SLUI
2013-08-07 15:08 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\setup
2013-08-07 15:08 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\oobe
2013-08-07 15:08 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2013-08-07 15:07 - 2013-08-07 15:05 - 00000000 ____D C:\Windows\system32\vi-VN
2013-08-07 15:07 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\migwiz
2013-08-07 15:07 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\manifeststore
2013-08-07 14:27 - 2013-08-07 14:27 - 00000000 ____D C:\Windows\system32\EventProviders
2013-08-07 08:00 - 2009-02-16 10:14 - 00002070 _____ C:\Users\Public\Desktop\HP Photosmart Essential 3.0.lnk
2013-08-07 01:25 - 2013-08-07 01:25 - 00017973 _____ C:\ComboFix.txt
2013-08-07 01:25 - 2013-08-07 00:19 - 00000000 ____D C:\Qoobox
2013-08-07 01:25 - 2006-11-02 15:33 - 00000000 __RHD C:\Users\Default
2013-08-07 01:20 - 2013-08-07 00:17 - 00000000 ____D C:\Windows\erdnt
2013-08-07 01:18 - 2006-11-02 14:34 - 00000215 _____ C:\Windows\system.ini
2013-08-07 00:18 - 2013-08-07 00:18 - 05100695 ____R (Swearware) C:\Users\Rummler\Desktop\ComboFix.exe
2013-08-07 00:13 - 2013-08-07 00:13 - 00005016 _____ C:\Users\Rummler\Documents\Malwarebytes Anti.odt
2013-08-07 00:12 - 2012-08-11 13:45 - 00002641 _____ C:\Users\Rummler\Desktop\Microsoft Word 2010.lnk
2013-08-06 23:44 - 2008-10-23 09:22 - 00000000 ____D C:\Program Files (x86)\CyberLink
2013-08-06 23:44 - 2008-10-23 08:28 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-06 23:41 - 2009-01-31 15:54 - 00000000 ____D C:\Users\Rummler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2013-08-06 23:39 - 2008-10-23 09:22 - 00000000 ____D C:\ProgramData\CyberLink
2013-08-06 23:34 - 2009-02-14 15:26 - 00000000 ____D C:\Users\Rummler\AppData\Local\Google
2013-08-06 23:27 - 2010-07-20 19:45 - 00000000 ____D C:\Program Files (x86)\CENTROdigital
2013-08-06 23:21 - 2013-08-06 23:10 - 00002025 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-06 23:15 - 2013-08-06 23:10 - 00004108 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-08-06 23:15 - 2013-08-06 23:10 - 00003856 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-08-06 23:15 - 2008-10-23 09:21 - 00000000 ____D C:\ProgramData\Adobe
2013-08-06 23:14 - 2009-02-01 16:17 - 00000000 ____D C:\Users\Rummler\AppData\Roaming\Adobe
2013-08-06 23:11 - 2009-08-27 23:28 - 00000000 ____D C:\Program Files\Google
2013-08-06 23:11 - 2009-02-25 00:10 - 00000000 ____D C:\Users\Rummler\AppData\Local\Adobe
2013-08-06 23:11 - 2009-02-14 15:25 - 00000000 ____D C:\ProgramData\Google
2013-08-06 23:11 - 2009-02-14 15:25 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-06 23:09 - 2013-08-06 23:09 - 00001922 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-08-06 23:08 - 2013-08-06 23:08 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-08-06 22:50 - 2013-08-06 22:49 - 00003738 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-06 22:49 - 2013-08-06 22:49 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-06 22:49 - 2013-08-06 22:49 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-06 22:49 - 2013-08-06 22:49 - 00000000 ____D C:\Windows\system32\Macromed
2013-08-05 18:56 - 2013-08-05 18:51 - 00028191 _____ C:\Users\Rummler\Desktop\Addition.txt
2013-08-05 18:47 - 2013-08-05 18:47 - 00000000 ____D C:\FRST
2013-08-05 18:46 - 2013-08-05 18:46 - 01788733 _____ (Farbar) C:\Users\Rummler\Desktop\FRST64.exe
2013-08-03 23:53 - 2013-03-25 09:28 - 00000184 _____ C:\Users\Rummler\Desktop\Citrix Access Gateway.url
2013-08-02 13:10 - 2012-07-05 11:05 - 00000000 ____D C:\Users\Rummler\Desktop\WBZ
2013-08-01 11:13 - 2013-08-01 11:09 - 00000000 ____D C:\Windows\system32\MRT
2013-07-30 13:11 - 2013-07-28 19:33 - 00000000 ____D C:\Windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP
2013-07-29 21:13 - 2013-07-29 21:13 - 00000000 ____D C:\Windows\System32\Tasks\Norton Internet Security
2013-07-29 21:13 - 2013-07-29 21:13 - 00000000 ____D C:\Users\Rummler\Documents\Symantec
2013-07-29 21:12 - 2013-07-29 21:12 - 00177312 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2013-07-29 21:12 - 2013-07-29 21:12 - 00007631 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
2013-07-29 21:12 - 2013-07-29 21:12 - 00003234 _____ C:\Windows\System32\Tasks\Norton WSC Integration
2013-07-29 21:12 - 2013-07-29 21:12 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared
2013-07-29 21:12 - 2013-07-29 21:10 - 00000000 ____D C:\Windows\system32\Drivers\NISx64
2013-07-29 21:12 - 2008-10-23 08:30 - 00000000 ____D C:\ProgramData\Norton
2013-07-29 21:11 - 2013-07-29 21:11 - 00002291 _____ C:\Users\Public\Desktop\Norton Internet Security.lnk
2013-07-29 21:10 - 2013-07-29 21:10 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security
2013-07-28 20:18 - 2013-07-28 20:18 - 00000000 ____D C:\Users\Rummler\AppData\Roaming\Malwarebytes
2013-07-28 20:17 - 2013-07-28 20:17 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-28 20:17 - 2013-07-28 20:17 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-28 19:35 - 2013-07-28 19:35 - 00000000 _____ C:\autoexec.bat
2013-07-28 19:34 - 2013-07-28 19:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-07-28 19:07 - 2013-07-28 19:06 - 00009502 _____ C:\AdwCleaner[S1].txt
2013-07-28 19:04 - 2013-07-28 19:04 - 00011506 _____ C:\AdwCleaner[R1].txt
2013-07-28 18:39 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\system
2013-07-26 20:29 - 2012-08-27 17:37 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-07-22 20:50 - 2013-07-22 20:50 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-07-22 20:50 - 2013-07-22 20:50 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-07-22 20:50 - 2011-12-19 22:11 - 00000000 ____D C:\Users\Rummler\Documents\bilder spielzeug
2013-07-22 20:49 - 2013-07-22 20:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-11 09:31 - 2010-07-20 19:17 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
Files to move or delete:
====================
C:\ProgramData\nvModes.dat
C:\Windows\Tasks\At1.job
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-08 20:09
==================== End Of Log ============================
|
|
08.08.2013, 20:01
| #30 |
| /// Malware-holic | Lyricscontainer, Playdeal etc. eingefangen Hi, 1. bitte die Google Toolbar deinstalieren 2. norton ist nich aktuell, bitte auf 2014 upgraden. 3. Deinstaliere in Google: DealPly https://support.google.com/chrome/answer/113907?hl=de Neustarten, prüfen ob sie gelöscht ist. 4. Fix mit FRST Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=DE&ver=20&locale=de_DE&gct=kwd&qsrc=2869
BHO-x32: LyricXeeker - {5c819b39-cbc9-4faf-8bd2-9d0699eb330a} - C:\Program Files (x86)\LyriXeeker\126.dll No File
BHO-x32: DealPly Shopping - {9cf699ca-2174-4ed8-bec1-ba82095edce0} - C:\Program Files (x86)\DealPly\DealPlyIE.dll No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
bitte teste, ob es im Firefox, internet explorer, und sonstigen evtl. instalierte Browser, irgendwelche ungewollten toolbars, umleitungen oder sonstigen Probleme gibt. Teste wie pc und programme allgemein laufen. b
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Lyricscontainer, Playdeal etc. eingefangen |
| aktuelle, anzeige, anzeigen, deaktivieren, durchgeführt, durchs, eingefangen, einzige, fenster, festgestellt, gen, guten, hoffe, interne, langsam, lyricscontainer, lösung, malware, nicht mehr, norton, norton internet security, problem, rechner, security, software, unerwünschte, unerwünschte fenster |
Linear-Darstellung
