| |
| |||||||
Log-Analyse und Auswertung: GVU Trojaner! FRST scan schon durchgeführt, wie gehts weiter?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
29.08.2013, 15:18
| #1 |
| |  GVU Trojaner! FRST scan schon durchgeführt, wie gehts weiter? Hallo Trojaner-Board Team! Ich hab nun auch den berüchtigten GVU Trojaner auf dem Rechner. Durch diverse Internet-Recherchen habe ich nun erfahren, dass ich ein FRST scan machen muss. Nun habe ich folgendes Textdokument und weiß nicht weiter... Erbitte eure Hilfe!!! Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-08-2013 Ran by SYSTEM on 29-08-2013 15:37:56 Running from G:\ Windows 7 Home Premium (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Recovery The current controlset is ControlSet003 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log. ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [x] HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-28] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [281768 2011-04-21] (Avira GmbH) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [ArcSoft Connection Service] - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.) HKLM-x32\...\Run: [Iminent] - C:\Program Files (x86)\Iminent\Iminent.exe [1074888 2012-12-19] (Iminent) HKLM-x32\...\Run: [IminentMessenger] - C:\Program Files (x86)\Iminent\Iminent.Messengers.exe [884936 2012-12-19] (Iminent) HKLM-x32\...\Run: [Syncios device service] - C:\Program Files (x86)\Syncios\SynciosDeviceService.exe [578048 2013-07-12] () HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.) HKU\Victoria\...\Run: [Steam] - "C:\Program Files (x86)\Steam\Steam.exe" -silent [x] HKU\Victoria\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\Victoria\AppData\Local\Temp\whfncrgelouuubjgw.exe [57856 2013-08-29] (Valve Corporation) <===== ATTENTION HKU\Victoria\...\Winlogon: [Shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION HKU\Victoria\...\Command Processor: "C:\Users\Victoria\AppData\Local\Temp\whfncrgelouuubjgw.exe" <===== ATTENTION! AppInit_DLLs: C:\PROGRA~2\WI3C8A~1\Datamngr\x64\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\x64\IEBHO.dll [57856 2013-08-29] () AppInit_DLLs-x32: xC:\PROGRA~3\BROWSE~1\261125~1.80\{C16C1~1\BROWSE~1.DLL [2232272 2013-03-26] () ==================== Services (Whitelisted) ================= S2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [136360 2011-04-21] (Avira GmbH) S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [269480 2011-07-21] (Avira GmbH) S4 BrowserProtect; C:\ProgramData\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [2569168 2013-03-26] () S2 IBUpdaterService; C:\Windows\system32\dmwu.exe [1447728 2013-05-21] () S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.) S2 SProtection; C:\Program Files (x86)\Common Files\Umbrella\Umbrella.exe [2620016 2012-12-14] (Iminent) S2 WajamUpdater; C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe [109064 2013-03-28] (Wajam) S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [x] S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [x] S2 Web Assistant Updater; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [x] S2 wlidsvc; "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE" [x] ==================== Drivers (Whitelisted) ==================== S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88288 2011-07-21] (Avira GmbH) S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [123784 2011-07-21] (Avira GmbH) S3 PVUSB; C:\Windows\System32\DRIVERS\CESG64.sys [63808 2010-10-01] (CASIO COMPUTER CO.,LTD.) S3 L1C; system32\DRIVERS\L1C62x64.sys [x] S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-08-29 13:03 - 2013-08-29 13:03 - 01084768 _____ C:\ProgramData\2433f433 2013-08-29 13:03 - 2013-08-29 13:03 - 01084766 _____ C:\Users\Victoria\AppData\Local\2433f433 2013-08-29 13:03 - 2013-08-29 13:03 - 01084726 _____ C:\Users\Victoria\AppData\Roaming\2433f433 2013-08-23 17:52 - 2013-08-23 17:52 - 00000000 _____ C:\end 2013-08-22 18:06 - 2013-08-22 18:06 - 00204214 _____ C:\Users\Victoria\Desktop\ggs1.xcf 2013-08-22 18:06 - 2013-08-22 18:06 - 00003312 _____ C:\Users\Victoria\.recently-used.xbel 2013-08-22 16:12 - 2013-08-22 16:12 - 03022848 _____ C:\Users\Victoria\Desktop\image.jpeg 2013-08-19 00:27 - 2013-08-19 00:28 - 00000000 ____D C:\Program Files (x86)\JDownloader 2013-08-19 00:25 - 2013-08-29 14:25 - 00000304 _____ C:\Windows\Tasks\MetaCrawler.job 2013-08-19 00:25 - 2013-08-19 00:25 - 00003246 _____ C:\Windows\System32\Tasks\MetaCrawler 2013-08-19 00:25 - 2013-08-19 00:25 - 00000000 ____D C:\Users\Victoria\AppData\Roaming\MetaCrawler 2013-08-19 00:25 - 2013-08-19 00:25 - 00000000 ____D C:\Program Files (x86)\Wajam 2013-08-19 00:25 - 2013-08-19 00:25 - 00000000 ____D C:\Program Files (x86)\metaCrawler 2013-08-19 00:18 - 2011-10-27 09:39 - 00000000 ____D C:\Users\Victoria\Desktop\Vol.2 2013-08-18 19:37 - 2013-08-18 21:19 - 160322281 _____ C:\Users\Victoria\Desktop\RUBI02.rar 2013-08-18 19:32 - 2013-08-18 19:32 - 00000000 ____D C:\ProgramData\BrowserDefender 2013-08-18 19:29 - 2013-08-18 19:29 - 00077236 _____ (AppWork UG (haftungsbeschränkt)) C:\Users\Victoria\Desktop\jDownloaderWebInstaller09581.exe 2013-08-15 02:47 - 2013-08-16 18:33 - 00003432 _____ C:\Windows\System32\Tasks\BrowserProtect 2013-08-14 10:40 - 2013-08-14 10:40 - 00011735 _____ C:\Users\Victoria\Desktop\htw.odt 2013-08-14 04:43 - 2013-07-25 10:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL 2013-08-14 04:43 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2013-08-14 04:43 - 2013-07-19 02:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll 2013-08-14 04:43 - 2013-07-19 02:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2013-08-14 04:43 - 2013-07-09 07:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2013-08-14 04:43 - 2013-07-09 06:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll 2013-08-14 04:43 - 2013-07-09 06:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\System32\wow64.dll 2013-08-14 04:43 - 2013-07-09 06:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll 2013-08-14 04:43 - 2013-07-09 06:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll 2013-08-14 04:43 - 2013-07-09 06:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll 2013-08-14 04:43 - 2013-07-09 06:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll 2013-08-14 04:43 - 2013-07-09 06:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll 2013-08-14 04:43 - 2013-07-09 06:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2013-08-14 04:43 - 2013-07-09 06:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2013-08-14 04:43 - 2013-07-09 05:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2013-08-14 04:43 - 2013-07-09 05:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2013-08-14 04:43 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2013-08-14 04:43 - 2013-07-09 05:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2013-08-14 04:43 - 2013-07-09 05:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-08-14 04:43 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2013-08-14 04:43 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2013-08-14 04:43 - 2013-07-09 03:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2013-08-14 04:43 - 2013-07-09 03:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2013-08-14 04:43 - 2013-07-09 03:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2013-08-14 04:43 - 2013-07-09 03:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2013-08-14 04:43 - 2013-07-06 07:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2013-08-14 04:43 - 2013-06-15 05:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys 2013-08-11 16:00 - 2013-08-11 16:35 - 965016471 _____ C:\Users\Victoria\Downloads\iPhone4,1_6.1.3_10B329_Restore.ipsw ==================== One Month Modified Files and Folders ======= 2013-08-29 14:35 - 2011-09-22 07:43 - 01985607 _____ C:\Windows\WindowsUpdate.log 2013-08-29 14:25 - 2013-08-19 00:25 - 00000304 _____ C:\Windows\Tasks\MetaCrawler.job 2013-08-29 14:23 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-08-29 14:23 - 2009-07-14 05:51 - 00099993 _____ C:\Windows\setupact.log 2013-08-29 14:23 - 2009-07-14 05:45 - 00012288 _____ C:\Windows\System32\umstartup.etl 2013-08-29 14:13 - 2009-07-14 05:45 - 00014928 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-08-29 14:13 - 2009-07-14 05:45 - 00014928 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-08-29 14:10 - 2009-07-14 18:58 - 05015718 _____ C:\Windows\System32\perfh007.dat 2013-08-29 14:10 - 2009-07-14 18:58 - 01525038 _____ C:\Windows\System32\perfc007.dat 2013-08-29 14:10 - 2009-07-14 06:13 - 00005194 _____ C:\Windows\System32\PerfStringBackup.INI 2013-08-29 13:14 - 2011-10-10 19:18 - 00067364 _____ C:\Windows\PFRO.log 2013-08-29 13:03 - 2013-08-29 13:03 - 01084768 _____ C:\ProgramData\2433f433 2013-08-29 13:03 - 2013-08-29 13:03 - 01084766 _____ C:\Users\Victoria\AppData\Local\2433f433 2013-08-29 13:03 - 2013-08-29 13:03 - 01084726 _____ C:\Users\Victoria\AppData\Roaming\2433f433 2013-08-29 12:50 - 2012-04-12 22:30 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-08-28 07:39 - 2013-04-30 02:01 - 00260693 _____ C:\Windows\IE10_main.log 2013-08-28 07:38 - 2011-09-22 09:50 - 00379190 _____ C:\Windows\IE9_main.log 2013-08-23 17:52 - 2013-08-23 17:52 - 00000000 _____ C:\end 2013-08-22 18:06 - 2013-08-22 18:06 - 00204214 _____ C:\Users\Victoria\Desktop\ggs1.xcf 2013-08-22 18:06 - 2013-08-22 18:06 - 00003312 _____ C:\Users\Victoria\.recently-used.xbel 2013-08-22 18:06 - 2013-01-19 01:17 - 00000000 ____D C:\Users\Victoria\AppData\Roaming\gtk-2.0 2013-08-22 18:06 - 2011-09-22 07:49 - 00000000 ____D C:\users\Victoria 2013-08-22 17:47 - 2013-01-19 00:36 - 00000000 ____D C:\Users\Victoria\.gimp-2.6 2013-08-22 16:12 - 2013-08-22 16:12 - 03022848 _____ C:\Users\Victoria\Desktop\image.jpeg 2013-08-22 15:59 - 2011-11-05 11:13 - 00000000 ____D C:\Users\Victoria\AppData\Local\Windows Live 2013-08-21 21:50 - 2012-04-12 22:30 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-08-21 21:50 - 2012-04-12 22:30 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-08-21 21:50 - 2011-10-09 16:11 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-08-21 21:14 - 2011-10-17 14:58 - 00000000 ____D C:\Program Files (x86)\Opera 2013-08-19 00:28 - 2013-08-19 00:27 - 00000000 ____D C:\Program Files (x86)\JDownloader 2013-08-19 00:28 - 2012-10-13 19:55 - 00002037 _____ C:\Users\Victoria\Desktop\JDownloader.lnk 2013-08-19 00:25 - 2013-08-19 00:25 - 00003246 _____ C:\Windows\System32\Tasks\MetaCrawler 2013-08-19 00:25 - 2013-08-19 00:25 - 00000000 ____D C:\Users\Victoria\AppData\Roaming\MetaCrawler 2013-08-19 00:25 - 2013-08-19 00:25 - 00000000 ____D C:\Program Files (x86)\Wajam 2013-08-19 00:25 - 2013-08-19 00:25 - 00000000 ____D C:\Program Files (x86)\metaCrawler 2013-08-19 00:25 - 2011-11-06 21:57 - 00000000 ____D C:\Program Files (x86)\Windows iLivid Toolbar 2013-08-18 21:19 - 2013-08-18 19:37 - 160322281 _____ C:\Users\Victoria\Desktop\RUBI02.rar 2013-08-18 19:32 - 2013-08-18 19:32 - 00000000 ____D C:\ProgramData\BrowserDefender 2013-08-18 19:29 - 2013-08-18 19:29 - 00077236 _____ (AppWork UG (haftungsbeschränkt)) C:\Users\Victoria\Desktop\jDownloaderWebInstaller09581.exe 2013-08-16 18:33 - 2013-08-15 02:47 - 00003432 _____ C:\Windows\System32\Tasks\BrowserProtect 2013-08-16 09:14 - 2013-07-07 14:43 - 00000000 ____D C:\Users\Victoria\Desktop\Neuer Ordner 2013-08-15 03:40 - 2013-05-15 09:48 - 00000000 ____D C:\Windows\rescache 2013-08-14 10:40 - 2013-08-14 10:40 - 00011735 _____ C:\Users\Victoria\Desktop\htw.odt 2013-08-11 16:35 - 2013-08-11 16:00 - 965016471 _____ C:\Users\Victoria\Downloads\iPhone4,1_6.1.3_10B329_Restore.ipsw 2013-08-11 16:32 - 2013-04-03 19:33 - 00000000 ____D C:\ProgramData\BrowserProtect 2013-07-31 21:46 - 2012-07-02 19:49 - 00000000 ____D C:\Users\Victoria\Desktop\0 2013-07-30 23:11 - 2013-04-03 19:33 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro Files to move or delete: ==================== C:\Users\Victoria\AppData\Local\Temp\whfncrgelouuubjgw.exe C:\Users\Victoria\AppData\Local\Temp\46207-46208-iphone-unlock-toolkit.exe C:\Users\Victoria\AppData\Local\Temp\5qosv4mq.dll C:\Users\Victoria\AppData\Local\Temp\AskSLib.dll C:\Users\Victoria\AppData\Local\Temp\co2ujauo.dll C:\Users\Victoria\AppData\Local\Temp\contentDATs.exe C:\Users\Victoria\AppData\Local\Temp\dealply.exe C:\Users\Victoria\AppData\Local\Temp\DeltaTB.exe C:\Users\Victoria\AppData\Local\Temp\dp02ryn3.dll C:\Users\Victoria\AppData\Local\Temp\dtqsiupudnrwbkjcy.exe C:\Users\Victoria\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe C:\Users\Victoria\AppData\Local\Temp\htmlayout.dll C:\Users\Victoria\AppData\Local\Temp\installhelper.dll C:\Users\Victoria\AppData\Local\Temp\instloffer.exe C:\Users\Victoria\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe C:\Users\Victoria\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe C:\Users\Victoria\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe C:\Users\Victoria\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe C:\Users\Victoria\AppData\Local\Temp\LiveUpdate.exe C:\Users\Victoria\AppData\Local\Temp\ljo7l66d.dll C:\Users\Victoria\AppData\Local\Temp\LyricsPal.exe C:\Users\Victoria\AppData\Local\Temp\lyricstmp.exe C:\Users\Victoria\AppData\Local\Temp\mgsqlite3.dll C:\Users\Victoria\AppData\Local\Temp\OptimizerPro.exe C:\Users\Victoria\AppData\Local\Temp\pricepeep_130001_1001.exe C:\Users\Victoria\AppData\Local\Temp\SecurityScan_Release.exe C:\Users\Victoria\AppData\Local\Temp\SetupDataMngr_Searchqu.exe C:\Users\Victoria\AppData\Local\Temp\Shortcut_bundlesweetimsetup.exe C:\Users\Victoria\AppData\Local\Temp\SIMEEIInstaller.exe C:\Users\Victoria\AppData\Local\Temp\SQLite.dll C:\Users\Victoria\AppData\Local\Temp\SRAssetsHelper.dll C:\Users\Victoria\AppData\Local\Temp\toolbar457681723.exe C:\Users\Victoria\AppData\Local\Temp\uninstall894993.exe C:\Users\Victoria\AppData\Local\Temp\uninstall895118.exe C:\Users\Victoria\AppData\Local\Temp\uninstall895289.exe C:\Users\Victoria\AppData\Local\Temp\uninstall895367.exe C:\Users\Victoria\AppData\Local\Temp\uninstall895554.exe C:\Users\Victoria\AppData\Local\Temp\update21706259.exe C:\Users\Victoria\AppData\Local\Temp\uxaprzdk.dll C:\Users\Victoria\AppData\Local\Temp\zm1hjbvz.dll C:\Users\Victoria\AppData\Local\Temp\{D39FBC96-A852-49F9-90E1-F2D325FFE889}\{7644E42D-B096-457F-8B5B-901238FC81AE}\MoveIt.dll C:\Users\Victoria\AppData\Local\Temp\{BE0CC9A6-CEDF-4C5E-9732-22D420ADD9E1}\ISBEW64.exe C:\Users\Victoria\AppData\Local\Temp\{BE0CC9A6-CEDF-4C5E-9732-22D420ADD9E1}\ISRT.dll C:\Users\Victoria\AppData\Local\Temp\{BE0CC9A6-CEDF-4C5E-9732-22D420ADD9E1}\_isres_0x0409.dll C:\Users\Victoria\AppData\Local\Temp\{A6FAA947-DB52-BC04-8AFD-DF6FA2D6583A}\x86\regsvr32.exe C:\Users\Victoria\AppData\Local\Temp\{A6FAA947-DB52-BC04-8AFD-DF6FA2D6583A}\x64\regsvr32.exe C:\Users\Victoria\AppData\Local\Temp\{A6FAA947-DB52-BC04-8AFD-DF6FA2D6583A}\Addons\download_save.exe C:\Users\Victoria\AppData\Local\Temp\{A6FAA947-DB52-BC04-8AFD-DF6FA2D6583A}\Addons\incredibar_install.exe C:\Users\Victoria\AppData\Local\Temp\{33726000-2A06-44CC-90B4-B20A38FB2FD0}\{7644E42D-B096-457F-8B5B-901238FC81AE}\MoveIt.dll C:\Users\Victoria\AppData\Local\Temp\{189F75F4-FC21-44B9-BC4D-46F2028A44A5}\ICQ7.exe C:\Users\Victoria\AppData\Local\Temp\updC97E\BabScheduler2000201.exe C:\Users\Victoria\AppData\Local\Temp\Temp1_wirelesskeyview-x64.zip\WirelessKeyView.exe C:\Users\Victoria\AppData\Local\Temp\Temp1_SharePod_3.99.zip\SharePod.exe C:\Users\Victoria\AppData\Local\Temp\Temp1_RemoveWatermark_20090509.zip\RemoveWatermark_20090509\RemoveWatermarkX64.exe C:\Users\Victoria\AppData\Local\Temp\Temp1_gp_win_rc6.1.zip\greenpois0n.exe C:\Users\Victoria\AppData\Local\Temp\TC50069600G.temp\setup.exe C:\Users\Victoria\AppData\Local\Temp\TC50069600G.temp\tinstall.exe C:\Users\Victoria\AppData\Local\Temp\TC50069600G.temp\tinstallwb.exe C:\Users\Victoria\AppData\Local\Temp\TC50069600G.temp\WBDHD44I.DLL C:\Users\Victoria\AppData\Local\Temp\TC50069600G.temp\WBTOS45I.DLL C:\Users\Victoria\AppData\Local\Temp\TC50067500E.temp\DriUpdate32.exe C:\Users\Victoria\AppData\Local\Temp\TC50067500E.temp\DriUpdate64.exe C:\Users\Victoria\AppData\Local\Temp\TC50067500E.temp\ISSetup.dll C:\Users\Victoria\AppData\Local\Temp\TC50067500E.temp\setup.exe C:\Users\Victoria\AppData\Local\Temp\TC50067500E.temp\tinstall.exe C:\Users\Victoria\AppData\Local\Temp\TC50067500E.temp\tinstallwb.exe C:\Users\Victoria\AppData\Local\Temp\TC50067500E.temp\WBDHD44I.DLL C:\Users\Victoria\AppData\Local\Temp\TC50067500E.temp\WBTOS45I.DLL C:\Users\Victoria\AppData\Local\Temp\TC50067500E.temp\_setup.dll C:\Users\Victoria\AppData\Local\Temp\TC00384500B.temp\Setup.exe C:\Users\Victoria\AppData\Local\Temp\TC00384500B.temp\tinstall.exe C:\Users\Victoria\AppData\Local\Temp\TC00384500B.temp\tinstallwb.exe C:\Users\Victoria\AppData\Local\Temp\TC00384500B.temp\WBDJA44I.DLL C:\Users\Victoria\AppData\Local\Temp\TC00384500B.temp\WBTOS45I.DLL C:\Users\Victoria\AppData\Local\Temp\TC00384500B.temp\Win7Drv\ISSetup.dll C:\Users\Victoria\AppData\Local\Temp\TC00384500B.temp\Win7Drv\setup.exe C:\Users\Victoria\AppData\Local\Temp\PromoEngineInstaller\chutil.dll C:\Users\Victoria\AppData\Local\Temp\PromoEngineInstaller\sqlite3.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\ChCfg.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\RtlExUpd.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Setup.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\AERTAC64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\AERTAR64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\AERTSr64.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\APOPCH.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\FMAPO64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\MaxxAudioAPO20.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\MBAPO32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\MBAPO64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\MBPPCn64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\MBppld64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\MBTHX32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\MBTHX64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\MBWrp64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RAVBg64.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RAVCpl64.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RCoInst64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RP3DAA64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RP3DHT64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RtCOM64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RTCOMDLL.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RTEED64A.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RTEEG64A.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RTEEL64A.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RTEEP64A.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RtkApi64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RtkAPO64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RtkAudioService64.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RtkCfg.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RtkCfg64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RtlCPAPI.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RtlCPAPI64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RtlUpd64.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\RtPgEx64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\SFComm64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\SFDAPO64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\SFHAPO64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\SFProc64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\SFSAPO64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\SkyTel.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\slcshp64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\slgeq64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\slh36064.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\slInit64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\slmaxv64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\sltshd64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\sluapo64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\SRSHP64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\SRSTSH64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\SRSTSX64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\SRSWOW64.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista64\vncutil64.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\AERTACap.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\AERTARen.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\AERTSrv.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\APOPCH.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\FMAPO.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\MaxxAudioAPO.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\MaxxAudioAPO20.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\MaxxAudioEQ.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\MBAPO32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\MBPPCn32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\MBppld32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\MBTHX32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\MBWrp32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RP3DAA32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RP3DHT32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RTCOMDLL.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RTEED32A.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RTEEG32A.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RTEEL32A.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RTEEP32A.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RtHDVBg.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RtHDVCpl.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RtkAPO.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RtkApoApi.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RtkAudioService.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RtkCfg.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RtkCoInst.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RtkPgExt.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RtlCPAPI.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\RtlUpd.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\SFFXComm.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\SFFXDAPO.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\SFFXHAPO.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\SFFXProc.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\SFFXSAPO.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\SkyTel.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\slcshp32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\slgeq32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\slh36032.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\slInit32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\slmaxv32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\sltshd32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\sluapo32.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\SRSHP360.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\SRSTSHD.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\SRSTSXT.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\SRSWOW.dll C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\vncutil.exe C:\Users\Victoria\AppData\Local\Temp\pftE842~tmp\Vista\WavesLib.dll C:\Users\Victoria\AppData\Local\Temp\pft73FF.tmp\ASInstall.dll C:\Users\Victoria\AppData\Local\Temp\pft73FF.tmp\HttpAgent.dll C:\Users\Victoria\AppData\Local\Temp\pft73FF.tmp\MUIResource.dll C:\Users\Victoria\AppData\Local\Temp\pft4443~tmp\HDMI\Vista64\R4EEA64H.dll C:\Users\Victoria\AppData\Local\Temp\pft4443~tmp\HDMI\Vista64\R4EED64H.dll C:\Users\Victoria\AppData\Local\Temp\pft4443~tmp\HDMI\Vista64\R4EEG64H.dll C:\Users\Victoria\AppData\Local\Temp\pft4443~tmp\HDMI\Vista64\R4EEL64H.dll C:\Users\Victoria\AppData\Local\Temp\pft4443~tmp\HDMI\Vista64\R4EEP64H.dll C:\Users\Victoria\AppData\Local\Temp\pft4443~tmp\HDMI\Vista\R4EEA32H.dll C:\Users\Victoria\AppData\Local\Temp\pft4443~tmp\HDMI\Vista\R4EED32H.dll C:\Users\Victoria\AppData\Local\Temp\pft4443~tmp\HDMI\Vista\R4EEG32H.dll C:\Users\Victoria\AppData\Local\Temp\pft4443~tmp\HDMI\Vista\R4EEL32H.dll C:\Users\Victoria\AppData\Local\Temp\pft4443~tmp\HDMI\Vista\R4EEP32H.dll C:\Users\Victoria\AppData\Local\Temp\OCS\ICSharpCode.SharpZipLib.dll C:\Users\Victoria\AppData\Local\Temp\OCS\ocs_v6k.exe C:\Users\Victoria\AppData\Local\Temp\OCS\Downloads\3fb4024f7caf3a01809ef819569822ba\9c01e5d71e442bf564f271e62b1d5357\AmazonIconInstaller.exe C:\Users\Victoria\AppData\Local\Temp\OCS\Downloads\3fb4024f7caf3a01809ef819569822ba\611a80e9562b4c0738021647c910846f\crossfire_downloader.exe C:\Users\Victoria\AppData\Local\Temp\OCS\Downloads\3fb4024f7caf3a01809ef819569822ba\611a80e9562b4c0738021647c910846f\CrossFire_Setup_v1103.exe C:\Users\Victoria\AppData\Local\Temp\nsz40C4.tmp\nsJSON.dll C:\Users\Victoria\AppData\Local\Temp\nsqB7BB.tmp\babylon.dll C:\Users\Victoria\AppData\Local\Temp\nsqB7BB.tmp\bprotect.exe C:\Users\Victoria\AppData\Local\Temp\nsqB7BB.tmp\InetLoad.dll C:\Users\Victoria\AppData\Local\Temp\nsqB7BB.tmp\installutils.dll C:\Users\Victoria\AppData\Local\Temp\nsqB7BB.tmp\kerberos_bho.dll C:\Users\Victoria\AppData\Local\Temp\nsqB7BB.tmp\nsis7z.dll C:\Users\Victoria\AppData\Local\Temp\nsqB7BB.tmp\protector.dll C:\Users\Victoria\AppData\Local\Temp\nsf5561.tmp\nsProcess.dll C:\Users\Victoria\AppData\Local\Temp\IXP881.TMP\SetupAdmin.exe C:\Users\Victoria\AppData\Local\Temp\IXP625.TMP\SetupAdmin.exe C:\Users\Victoria\AppData\Local\Temp\IXP580.TMP\SetupAdmin.exe C:\Users\Victoria\AppData\Local\Temp\IXP465.TMP\SetupAdmin.exe C:\Users\Victoria\AppData\Local\Temp\IXP415.TMP\SetupAdmin.exe C:\Users\Victoria\AppData\Local\Temp\IXP367.TMP\SetupAdmin.exe C:\Users\Victoria\AppData\Local\Temp\IXP208.TMP\SetupAdmin.exe C:\Users\Victoria\AppData\Local\Temp\is1098755234\Vgrabber.exe C:\Users\Victoria\AppData\Local\Temp\is1070216317\ActiveMailSetup.exe C:\Users\Victoria\AppData\Local\Temp\is1070216317\bundlesweetimsetup.exe C:\Users\Victoria\AppData\Local\Temp\is1070216317\chrome_logic.exe C:\Users\Victoria\AppData\Local\Temp\is1070216317\DeltaTB.exe C:\Users\Victoria\AppData\Local\Temp\is1070216317\JDownloaderSetup_IC.exe C:\Users\Victoria\AppData\Local\Temp\is1070216317\wajam_download.exe C:\Users\Victoria\AppData\Local\Temp\is1070216317\wajam_validate.exe C:\Users\Victoria\AppData\Local\Temp\gm_ttt_38242\D3DX8.dll C:\Users\Victoria\AppData\Local\Temp\e4jCFFB.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\e4jBA13.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\e4jA0E4.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\e4j9C23.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\e4j927E.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\e4j912B.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\e4j8C86.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\e4j8AF4.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\e4j890.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\e4j7F51.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\e4j5A11.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\e4j5060.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\e4j425C.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\e4j3004.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\e4j14BC.tmp_dir\i4jdel.exe C:\Users\Victoria\AppData\Local\Temp\ct2625848\ieLogic.exe C:\Users\Victoria\AppData\Local\Temp\ct2625848\statisticsStub.exe C:\Users\Victoria\AppData\Local\Temp\C1A206A4-AC49-4EEF-AC23-86314E626750\CbsProvider.dll C:\Users\Victoria\AppData\Local\Temp\C1A206A4-AC49-4EEF-AC23-86314E626750\CompatProvider.dll C:\Users\Victoria\AppData\Local\Temp\busCDE8\BUSolution.dll C:\Users\Victoria\AppData\Local\Temp\A7BB767C-BAB0-7891-BD58-F244C6017733\Latest\AC.exe C:\Users\Victoria\AppData\Local\Temp\A7BB767C-BAB0-7891-BD58-F244C6017733\Latest\BabMaint.exe C:\Users\Victoria\AppData\Local\Temp\A7BB767C-BAB0-7891-BD58-F244C6017733\Latest\BExternal.dll C:\Users\Victoria\AppData\Local\Temp\A7BB767C-BAB0-7891-BD58-F244C6017733\Latest\BUSolution.dll C:\Users\Victoria\AppData\Local\Temp\A7BB767C-BAB0-7891-BD58-F244C6017733\Latest\BUSUninstall.exe C:\Users\Victoria\AppData\Local\Temp\A7BB767C-BAB0-7891-BD58-F244C6017733\Latest\ccp.exe C:\Users\Victoria\AppData\Local\Temp\A7BB767C-BAB0-7891-BD58-F244C6017733\Latest\ChromeToolbarSetup.dll C:\Users\Victoria\AppData\Local\Temp\A7BB767C-BAB0-7891-BD58-F244C6017733\Latest\CrxInstaller.dll C:\Users\Victoria\AppData\Local\Temp\A7BB767C-BAB0-7891-BD58-F244C6017733\Latest\GUninstaller.exe C:\Users\Victoria\AppData\Local\Temp\A7BB767C-BAB0-7891-BD58-F244C6017733\Latest\IEHelper.dll C:\Users\Victoria\AppData\Local\Temp\A7BB767C-BAB0-7891-BD58-F244C6017733\Latest\MyBabylonTB.exe C:\Users\Victoria\AppData\Local\Temp\A7BB767C-BAB0-7891-BD58-F244C6017733\Latest\Setup.exe C:\Users\Victoria\AppData\Local\Temp\A7BB767C-BAB0-7891-BD58-F244C6017733\Latest\sqlite3.dll C:\Users\Victoria\AppData\Local\Temp\908209415\wssetup.exe C:\Users\Victoria\AppData\Local\Temp\45B021C7-BAB0-7891-A3B6-32E17C748A88\Latest\BabMaint.exe C:\Users\Victoria\AppData\Local\Temp\45B021C7-BAB0-7891-A3B6-32E17C748A88\Latest\BExternal.dll C:\Users\Victoria\AppData\Local\Temp\45B021C7-BAB0-7891-A3B6-32E17C748A88\Latest\BUSolForMontiera.dll C:\Users\Victoria\AppData\Local\Temp\45B021C7-BAB0-7891-A3B6-32E17C748A88\Latest\BUSolution.dll C:\Users\Victoria\AppData\Local\Temp\45B021C7-BAB0-7891-A3B6-32E17C748A88\Latest\ccp.exe C:\Users\Victoria\AppData\Local\Temp\45B021C7-BAB0-7891-A3B6-32E17C748A88\Latest\ChromeToolbarSetup.dll C:\Users\Victoria\AppData\Local\Temp\45B021C7-BAB0-7891-A3B6-32E17C748A88\Latest\CrxInstaller.dll C:\Users\Victoria\AppData\Local\Temp\45B021C7-BAB0-7891-A3B6-32E17C748A88\Latest\enhancedNT.dll C:\Users\Victoria\AppData\Local\Temp\45B021C7-BAB0-7891-A3B6-32E17C748A88\Latest\GUninstaller.exe C:\Users\Victoria\AppData\Local\Temp\45B021C7-BAB0-7891-A3B6-32E17C748A88\Latest\IEHelper.dll C:\Users\Victoria\AppData\Local\Temp\45B021C7-BAB0-7891-A3B6-32E17C748A88\Latest\MntrDLLInstall.dll C:\Users\Victoria\AppData\Local\Temp\45B021C7-BAB0-7891-A3B6-32E17C748A88\Latest\MyDeltaTB.exe C:\Users\Victoria\AppData\Local\Temp\45B021C7-BAB0-7891-A3B6-32E17C748A88\Latest\Setup.exe C:\Users\Victoria\AppData\Local\Temp\45B021C7-BAB0-7891-A3B6-32E17C748A88\Latest\sqlite3.dll C:\Users\Victoria\AppData\Local\Temp\3648617406\simboapp.exe C:\Users\Victoria\AppData\Local\Temp\2827278562\chromeupdaterfull.exe C:\Users\Victoria\AppData\Local\Temp\.193860086\BrowserConnection.dll C:\Users\Victoria\AppData\Local\Temp\.193860086\datamngr.dll C:\Users\Victoria\AppData\Local\Temp\.193860086\DnsBHO.dll C:\Users\Victoria\AppData\Local\Temp\.193860086\IEBHO.dll C:\Users\Victoria\AppData\Local\Temp\.193860086\x64\BrowserConnection.dll C:\Users\Victoria\AppData\Local\Temp\.193860086\x64\datamngr.dll C:\Users\Victoria\AppData\Local\Temp\.193860086\x64\datamngrUI.exe C:\Users\Victoria\AppData\Local\Temp\.193860086\x64\DnsBHO.dll C:\Users\Victoria\AppData\Local\Temp\.193860086\x64\IEBHO.dll C:\Users\Victoria\AppData\Local\Temp\.193860086\ToolBar\dtUser.exe C:\Users\Victoria\AppData\Local\Temp\.193860086\ToolBar\searchquband.dll C:\Users\Victoria\AppData\Local\Temp\.193860086\ToolBar\searchqudtx.dll C:\Users\Victoria\AppData\Local\Temp\.193860086\ToolBar\uninstall.exe ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= ==================== Memory info =========================== Percentage of memory in use: 14% Total physical RAM: 3958.85 MB Available physical RAM: 3382.71 MB Total Pagefile: 3957 MB Available Pagefile: 3376.14 MB Total Virtual: 8192 MB Available Virtual: 8191.88 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:148.81 GB) (Free:3.82 GB) NTFS Drive d: (Data) (Fixed) (Total:148.88 GB) (Free:136.86 GB) NTFS Drive e: (SYSTEM) (Fixed) (Total:0.39 GB) (Free:0.18 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive g: (INTENSO USB) (Removable) (Total:1.89 GB) (Free:0.18 GB) FAT Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 354B0B60) Partition 1: (Active) - (Size=400 MB) - (Type=27) Partition 2: (Not Active) - (Size=149 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=149 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows XP) (Size: 2 GB) (Disk ID: B6914AF2) Partition 1: (Active) - (Size=2 GB) - (Type=06) LastRegBack: 2013-08-22 15:04 ==================== End Of Log ============================ |
Baum-Darstellung