| |
| |||||||
Log-Analyse und Auswertung: Thema: C:\Program Files(x86)\HomeTab\TBupdter.dllWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
15.10.2013, 16:26
| #1 |
| |  Thema: C:\Program Files(x86)\HomeTab\TBupdter.dll Thema: C:\Program Files(x86)\HomeTab\TBupdter.dll Hallo zusammen, vor ca. vier Wochen habe ich ein Programm under Chip auf meinen Rechner (Windows 7/64) geladen und wieder entfernt. Von da an kommt jetzt beim Hochfahren die Meldung: "C:\Program Files(x86)\HomeTab\TBupdter.dll nicht gefunden". Hier im Forum habe ich erfahren, dass es sich dabei um einen Trojaner handeln soll. Habe OTL ausgeführt.Log-Dateien im Anhang. Bitte um Hilfe? Herzliche Dank! Beste Grüße P.S BIN EIN ANFÄNGER UND KENNE MICH MIT COMPURTER NICHT SEHR GUT AUS!!!!  OTL logfile created on: 15.10.2013 16:12:22 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Mister X\Desktop\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16721) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,86 Gb Total Physical Memory | 0,77 Gb Available Physical Memory | 26,94% Memory free 5,71 Gb Paging File | 2,92 Gb Available in Paging File | 51,10% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 72,69 Gb Total Space | 29,10 Gb Free Space | 40,03% Space Free | Partition Type: NTFS Drive D: | 205,87 Gb Total Space | 204,50 Gb Free Space | 99,33% Space Free | Partition Type: NTFS Computer Name: MISTERX-PC | User Name: Mister X | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.10.15 16:04:49 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Mister X\Desktop\Downloads\OTL.exe PRC - [2013.10.10 13:02:51 | 001,862,536 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe PRC - [2013.10.01 12:14:55 | 000,440,392 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2013.10.01 12:14:40 | 000,681,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2013.10.01 12:14:40 | 000,440,392 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2013.09.30 22:26:15 | 000,274,840 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2013.09.03 15:53:50 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2013.07.27 15:16:24 | 000,709,120 | ---- | M] (Windows Net) -- C:\Users\Mister X\AppData\Roaming\Windows Net Data\net.exe PRC - [2013.06.26 19:21:50 | 000,207,528 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2013.06.26 19:21:46 | 000,523,944 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe PRC - [2012.11.16 11:09:00 | 000,542,104 | ---- | M] (Lavasoft) -- C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe PRC - [2012.10.23 18:40:06 | 000,580,728 | ---- | M] (Threat Expert Ltd.) -- C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe PRC - [2011.10.31 14:25:08 | 001,058,400 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe PRC - [2010.08.17 23:55:42 | 005,732,992 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe PRC - [2010.08.12 04:46:34 | 001,597,440 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe PRC - [2010.06.09 18:55:54 | 001,080,448 | ---- | M] (asus) -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe PRC - [2010.05.03 23:45:50 | 000,182,912 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe PRC - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe PRC - [2009.12.15 19:39:38 | 000,096,896 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe PRC - [2009.10.01 04:34:22 | 002,314,240 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2009.10.01 04:33:08 | 000,262,144 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2009.07.31 19:38:24 | 000,305,720 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe PRC - [2009.06.19 19:29:42 | 000,105,016 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe PRC - [2009.06.19 19:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe PRC - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe PRC - [2009.05.14 17:07:14 | 000,759,048 | ---- | M] (ABBYY) -- C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe PRC - [2008.12.23 02:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe PRC - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe PRC - [2006.12.19 18:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe ========== Modules (No Company Name) ========== MOD - [2013.10.10 13:14:08 | 014,340,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\bcf51dc88597d0835c819a2d5a755b74\PresentationFramework.ni.dll MOD - [2013.10.10 13:13:50 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ef0a534be135cd8f0d99d938d8b1814a\System.Windows.Forms.ni.dll MOD - [2013.10.10 13:13:40 | 012,238,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\51478a61dbd40488e320a0061e23c4df\PresentationCore.ni.dll MOD - [2013.10.10 13:13:28 | 003,348,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\4eef5a3a4d0ed6d6fd882947a70df530\WindowsBase.ni.dll MOD - [2013.10.10 13:13:21 | 000,978,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\29f3ae8d313e62b4daed1107ccd29f9f\System.Configuration.ni.dll MOD - [2013.10.10 13:02:51 | 016,233,864 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll MOD - [2013.09.30 22:26:15 | 003,279,768 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2013.09.24 21:26:14 | 000,226,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\5de32c4f69c7141f68b383915ab87ff4\PresentationFramework.Classic.ni.dll MOD - [2013.09.24 21:24:48 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\9a1bc983c28c695729b3e46acdc6933e\System.Management.ni.dll MOD - [2013.09.24 21:23:18 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll MOD - [2013.09.24 21:23:05 | 005,464,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll MOD - [2013.09.24 21:23:00 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll MOD - [2013.09.24 21:22:53 | 011,499,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll MOD - [2010.08.12 04:46:34 | 001,597,440 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe MOD - [2010.02.24 00:14:22 | 000,071,680 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\Brightness.dll MOD - [2010.02.24 00:14:18 | 000,041,472 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\HelpFunc.dll MOD - [2010.02.24 00:14:10 | 000,050,688 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\P4GControl.dll MOD - [2010.02.24 00:12:22 | 000,186,880 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\Resolution.dll MOD - [2010.02.24 00:11:46 | 000,076,288 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\Volume.dll MOD - [2009.08.04 11:50:05 | 000,110,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_de_31bf3856ad364e35\PresentationCore.resources.dll MOD - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe MOD - [2007.06.15 19:28:36 | 000,147,456 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll MOD - [2007.06.02 02:08:18 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll ========== Services (SafeList) ========== SRV:64bit: - [2013.05.27 07:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV:64bit: - [2012.11.20 16:09:00 | 000,188,760 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\IB Updater\ExtensionUpdaterService.exe -- (IB Updater) SRV:64bit: - [2011.12.13 10:29:20 | 000,036,160 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Windows\SysNative\uxtuneup.dll -- (UxTuneUp) SRV:64bit: - [2010.06.22 20:20:42 | 000,379,520 | ---- | M] (ASUSTeK Computer Inc.) [Disabled | Stopped] -- C:\Windows\SysNative\FBAgent.exe -- (AFBAgent) SRV:64bit: - [2010.03.05 19:26:38 | 001,425,168 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV:64bit: - [2010.03.05 19:07:58 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS) SRV:64bit: - [2010.03.05 19:06:22 | 000,831,760 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV - [2013.10.10 13:02:53 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.10.01 12:14:55 | 000,440,392 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.10.01 12:14:40 | 000,440,392 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013.09.30 22:26:15 | 000,118,680 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.09.17 19:02:30 | 000,234,096 | ---- | M] (soft Xpansion) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe -- (SXDS10) SRV - [2013.09.03 15:53:50 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2013.06.26 19:21:50 | 000,207,528 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2013.06.26 19:21:46 | 000,523,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.10.23 18:40:06 | 000,580,728 | ---- | M] (Threat Expert Ltd.) [Auto | Running] -- C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe -- (Browser Defender Update Service) SRV - [2012.03.02 17:00:26 | 000,025,504 | ---- | M] (Samsung Electronics Co., Ltd.) [Disabled | Stopped] -- C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe -- (SamsungAllShareV2.0) SRV - [2012.03.02 17:00:20 | 000,027,584 | ---- | M] (Samsung Electronics Co., Ltd.) [Disabled | Stopped] -- C:\Program Files (x86)\Samsung\AllShare\AllShareSlideShowService.exe -- (SimpleSlideShowServer) SRV - [2011.12.13 10:34:52 | 002,028,864 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc) SRV - [2011.12.13 10:29:16 | 000,029,504 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Windows\SysWOW64\uxtuneup.dll -- (UxTuneUp) SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.12.15 19:39:38 | 000,096,896 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv) SRV - [2009.10.01 04:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2009.10.01 04:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.05.14 17:07:14 | 000,759,048 | ---- | M] (ABBYY) [Auto | Running] -- C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe -- (ABBYY.Licensing.FineReader.Sprint.9.0) SRV - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService) SRV - [2006.12.19 18:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe -- (EpsonBidirectionalService) ========== Driver Services (SafeList) ========== DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard) DRV:64bit: - [2013.10.01 12:14:58 | 000,132,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2013.10.01 12:14:58 | 000,105,856 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2013.10.01 12:14:58 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2013.06.26 19:21:50 | 000,023,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:64bit: - [2013.06.26 19:21:48 | 000,028,840 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:64bit: - [2013.06.26 19:21:46 | 000,273,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:64bit: - [2013.06.26 19:21:44 | 000,767,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:64bit: - [2012.11.29 20:30:56 | 000,014,456 | ---- | M] (GFI Software) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\gfibto.sys -- (gfibto) DRV:64bit: - [2012.10.23 18:40:32 | 000,077,144 | ---- | M] (PC Tools) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PCTBD64.sys -- (PCTBD) DRV:64bit: - [2012.09.12 16:20:04 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.01.10 23:28:18 | 012,311,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.12.03 11:05:34 | 000,069,152 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.10.07 18:58:24 | 000,035,384 | ---- | M] (ASUSTek Computer Inc) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\AsDsm.sys -- (AsDsm) DRV:64bit: - [2010.07.21 07:33:49 | 000,129,024 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD) DRV:64bit: - [2010.06.18 19:38:06 | 000,039,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WDKMD.sys -- (wdkmd) DRV:64bit: - [2010.03.18 07:21:58 | 007,680,512 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) DRV:64bit: - [2010.02.26 10:32:11 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd) DRV:64bit: - [2010.02.25 05:26:57 | 000,115,312 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\JME.sys -- (JME) DRV:64bit: - [2010.02.03 00:38:29 | 000,271,872 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) DRV:64bit: - [2010.01.18 11:45:49 | 000,717,368 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2009.09.17 21:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) DRV:64bit: - [2009.08.20 04:41:37 | 001,800,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC) DRV:64bit: - [2009.08.18 10:23:31 | 000,143,472 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR) DRV:64bit: - [2009.08.06 23:24:13 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009.07.20 11:29:39 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.20 04:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2009.06.18 21:18:10 | 000,015,928 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\lullaby.sys -- (lullaby) DRV:64bit: - [2009.06.10 22:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.13 18:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor) DRV:64bit: - [2008.05.24 02:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr) DRV - [2011.02.10 11:22:58 | 000,011,856 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2009.07.03 02:36:14 | 000,015,416 | ---- | M] (ASUS) [Kernel | Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=66920&tid=6787&ver=4.4&ts=1379437224429&tguid=66920-6787-1379437224429-0CA95287B348943B72453259813FBE49&st=chrome&q= IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=66920&tid=6787&ver=4.4&ts=1379437224429&tguid=66920-6787-1379437224429-0CA95287B348943B72453259813FBE49&st=chrome&q= IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=66920&tid=6787&ver=4.4&ts=1379437224429&tguid=66920-6787-1379437224429-0CA95287B348943B72453259813FBE49&st=chrome&q= IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = about:newtab IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://search.certified-toolbar.com?si=66920&tid=6787&ver=4.4&ts=1379437224429&tguid=66920-6787-1379437224429-0CA95287B348943B72453259813FBE49&st=chrome&q= IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = hxxp://search.certified-toolbar.com?si=66920&tid=6787&ver=4.4&ts=1379437224429&tguid=66920-6787-1379437224429-0CA95287B348943B72453259813FBE49&st=chrome&q= IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = hxxp://search.certified-toolbar.com?si=66920&tid=6787&ver=4.4&ts=1379437224429&tguid=66920-6787-1379437224429-0CA95287B348943B72453259813FBE49&st=chrome&q= IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Default_Page_URL = about:newtab IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = about:newtab IE - HKLM\..\URLSearchHook: {990af1c2-5a27-4460-8149-ecc6bc122af3} - No CLSID value found IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=f3602cc1-eae9-2151-92a6-2527b0a705db&searchtype=ds&q={searchTerms}&installDate=23/09/2013 IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=f3602cc1-eae9-2151-92a6-2527b0a705db&searchtype=ds&q={searchTerms}&installDate=23/09/2013 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=f3602cc1-eae9-2151-92a6-2527b0a705db&searchtype=ds&q={searchTerms}&installDate=23/09/2013 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=f3602cc1-eae9-2151-92a6-2527b0a705db&searchtype=hp&installDate=23/09/2013 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=f3602cc1-eae9-2151-92a6-2527b0a705db&searchtype=ds&q={searchTerms}&installDate=23/09/2013 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=f3602cc1-eae9-2151-92a6-2527b0a705db&searchtype=ds&q={searchTerms}&installDate=23/09/2013 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Start Default_Page_URL = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = IE - HKCU\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=f3602cc1-eae9-2151-92a6-2527b0a705db&searchtype=ds&q={searchTerms}&installDate=23/09/2013 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0 ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..extensions.enabledAddons: toolbar%40gmx.net:2.7.1 FF - prefs.js..extensions.enabledAddons: EFGLQA%4078ETGYN-0W7FN789T87.COM:1.01 FF - prefs.js..extensions.enabledAddons: 249911bc-d1bd-4d66-8c17-df533609e6d8%40c76f3de9-939e-4922-b73c-5d7a3139375d.com:0.92.28 FF - prefs.js..extensions.enabledAddons: %7Bad7ef860-f366-4be1-8d12-4363b9356947%7D:4.7 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:24.0 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@soft-xpansion/npsxpdf: C:\Program Files (x86)\Common Files\Freemium\np-sxpdf.dll (soft-Xpansion) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\IB UPDATER\FIREFOX [2013.01.29 19:15:22 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\IB Updater\Firefox [2013.01.29 19:15:22 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\Firefox\ [2013.02.23 22:44:27 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B45418F9-6406-4828-9D1A-35313FB1E2D6}: C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb [2013.09.17 19:02:30 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.09.17 18:57:27 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{B45418F9-6406-4828-9D1A-35313FB1E2D6}: C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb [2013.09.17 19:02:30 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.09.17 18:57:27 | 000,000,000 | ---D | M] [2011.01.09 00:40:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\Extensions [2013.10.15 15:38:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\2i2ejoga.default\extensions [2013.09.17 23:42:53 | 000,000,000 | ---D | M] (HomeTab) -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\2i2ejoga.default\extensions\{ad7ef860-f366-4be1-8d12-4363b9356947} [2013.09.23 21:03:01 | 000,000,000 | ---D | M] ("Feven 1.5") -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\2i2ejoga.default\extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com [2013.09.17 19:01:32 | 000,000,000 | ---D | M] (pricealarm) -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\2i2ejoga.default\extensions\EFGLQA@78ETGYN-0W7FN789T87.COM [2012.10.16 22:16:33 | 000,000,000 | ---D | M] (Lavasoft Search Plugin) -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\2i2ejoga.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack [2013.10.15 10:41:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\2i2ejoga.default\extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData [2013.10.15 10:41:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\2i2ejoga.default\extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins [2013.10.15 10:41:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\2i2ejoga.default\extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\userCode [2013.10.01 17:32:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\Solo_792844\extensions [2013.10.01 17:32:37 | 000,000,000 | ---D | M] (PriceGong) -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\Solo_792844\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829} [2013.09.23 19:58:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\Solo_792844\extensions\{990af1c2-5a27-4460-8149-ecc6bc122af3} [2013.09.23 19:58:17 | 000,000,000 | ---D | M] (HomeTab) -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\Solo_792844\extensions\{ad7ef860-f366-4be1-8d12-4363b9356947} [2013.09.23 19:58:17 | 000,000,000 | ---D | M] (FoxyDeal) -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\Solo_792844\extensions\{F58A62EB-38DC-43C4-A539-DC52E135208D} [2013.09.23 19:58:20 | 000,000,000 | ---D | M] (pricealarm) -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\Solo_792844\extensions\EFGLQA@78ETGYN-0W7FN789T87.COM [2013.09.23 19:58:18 | 000,000,000 | ---D | M] (Lavasoft Search Plugin) -- C:\Users\Mister X\AppData\Roaming\mozilla\Firefox\Profiles\Solo_792844\extensions\jid1-yZwVFzbsyfMrqQ@jetpack [2013.04.08 19:11:52 | 000,199,379 | ---- | M] () (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\2i2ejoga.default\extensions\m2k@m2kdownloader.com.xpi [2012.12.13 22:29:00 | 000,199,445 | ---- | M] () (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\2i2ejoga.default\extensions\movie2kdownloader@movie2kdownloader.com.xpi [2013.09.02 21:25:12 | 000,579,981 | ---- | M] () (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\2i2ejoga.default\extensions\toolbar@gmx.net.xpi [2013.10.10 12:04:44 | 000,915,554 | ---- | M] () (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\2i2ejoga.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013.05.21 19:51:44 | 000,195,916 | ---- | M] () (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\2i2ejoga.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi [2013.04.08 19:11:52 | 000,199,379 | ---- | M] () (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\Solo_792844\extensions\m2k@m2kdownloader.com.xpi [2012.12.13 22:29:00 | 000,199,445 | ---- | M] () (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\Solo_792844\extensions\movie2kdownloader@movie2kdownloader.com.xpi [2013.09.02 21:25:12 | 000,579,981 | ---- | M] () (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\Solo_792844\extensions\toolbar@gmx.net.xpi [2013.07.31 19:58:54 | 000,824,302 | ---- | M] () (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\Solo_792844\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013.05.21 19:51:44 | 000,195,916 | ---- | M] () (No name found) -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\Solo_792844\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi [2013.09.23 21:37:40 | 000,001,050 | ---- | M] () -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\2i2ejoga.default\searchplugins\11-suche.xml [2013.09.23 21:37:40 | 000,002,418 | ---- | M] () -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\2i2ejoga.default\searchplugins\englische-ergebnisse.xml [2013.09.23 21:37:40 | 000,010,701 | ---- | M] () -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\2i2ejoga.default\searchplugins\gmx-suche.xml [2013.09.23 21:37:40 | 000,002,432 | ---- | M] () -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\2i2ejoga.default\searchplugins\lastminute.xml [2013.09.23 21:37:40 | 000,005,682 | ---- | M] () -- C:\Users\Mister X\AppData\Roaming\mozilla\firefox\profiles\2i2ejoga.default\searchplugins\webde-suche.xml [2013.08.17 12:04:20 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2013.08.17 12:04:20 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013.08.17 12:04:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2013.09.30 22:26:36 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} ========== Chrome ========== CHR - Extension: No name found = C:\Users\Mister X\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg\1.24.28_0\crossrider CHR - Extension: No name found = C:\Users\Mister X\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg\1.24.28_0\ CHR - Extension: No name found = C:\Users\Mister X\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmlgoencnlndpglbocajlimaikjohmab\ CHR - Extension: No name found = C:\Users\Mister X\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\ CHR - Extension: No name found = C:\Users\Mister X\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\ O1 HOSTS File: ([2011.05.12 20:30:30 | 000,434,100 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 127.0.0.1 123fporn.info O1 - Hosts: 14938 more lines... O2:64bit: - BHO: (Feven 1.5) - {11111111-1111-1111-1111-110311851132} - C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll (Feven) O2:64bit: - BHO: (IB Updater) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\IB Updater\Extension64.dll () O2:64bit: - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION) O2 - BHO: (no name) - {11111111-1111-1111-1111-110011501160} - No CLSID value found. O2 - BHO: (Feven 1.5) - {11111111-1111-1111-1111-110311851132} - C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho.dll (Feven) O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) O2 - BHO: (IB Updater) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\IB Updater\Extension32.dll () O3:64bit: - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION) O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (Free PDF Perfect) - {EFC2B9BE-AB2B-47F1-A47D-9EB28E58C917} - C:\Program Files (x86)\Freemium\Free PDF Perfect\ieagent64.dll (soft Xpansion) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) O3 - HKLM\..\Toolbar: (no name) - {a25e7121-3dd8-41b3-855b-756c5bc45449} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3 - HKLM\..\Toolbar: (Free PDF Perfect) - {EFC2B9BE-AB2B-47F1-A47D-9EB28E58C917} - C:\Program Files (x86)\Freemium\Free PDF Perfect\ieagent32.dll (soft Xpansion) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [Ad-Aware Browsing Protection] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft) O4 - HKLM..\Run: [AllShareAgent] C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [EEventManager] C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION) O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS) O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe () O4 - HKCU..\Run: [EPLTarget\P0000000000000000] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE /EPT "EPLTarget\P0000000000000000" /M "XP-205 207 Series" File not found O4 - HKCU..\Run: [EPLTarget\P0000000000000001] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE /EPT "EPLTarget\P0000000000000001" /M "XP-205 207 Series" File not found O4 - HKCU..\Run: [EPLTarget\P0000000000000002] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE /EPT "EPLTarget\P0000000000000002" /M "XP-205 207 Series" File not found O4 - Startup: C:\Users\Mister X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\net.lnk = C:\Users\Mister X\AppData\Roaming\Windows Net Data\net.exe (Windows Net) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Mister X\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Mister X\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{56CD46D1-E8B4-4A93-96B8-87AAE8E57880}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DC17D024-9176-4609-BFFC-ACCDD2528B3E}: NameServer = 0.0.0.0 O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O20 - AppInit_DLLs: (c:\progra~3\browse~2\261095~1.52\{c16c1~1\browse~1.dll) - File not found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O27:64bit: - HKLM IFEO\AllShare.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\fighterlauncher.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\logfilescollector.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\spamcfg.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\uninstall.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\AllShare.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\fighterlauncher.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\logfilescollector.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\spamcfg.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\uninstall.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2013.03.15 11:25:18 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.10.15 15:45:22 | 000,000,000 | ---D | C] -- C:\FRST [2013.10.15 13:08:59 | 000,000,000 | ---D | C] -- C:\Users\Mister X\AppData\Roaming\Epson [2013.10.15 13:06:31 | 000,135,168 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EEBAPI.dll [2013.10.15 13:06:31 | 000,110,592 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EEBDSCVR.dll [2013.10.15 13:06:31 | 000,077,824 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EBAPI.dll [2013.10.15 13:06:31 | 000,065,536 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EEBUtil.dll [2013.10.15 13:06:31 | 000,055,808 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EEBSDKIF.dll [2013.10.15 13:02:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\EPSON [2013.10.15 12:46:58 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\EPSON [2013.10.15 12:46:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON [2013.10.15 12:43:02 | 000,000,000 | ---D | C] -- C:\Users\Mister X\AppData\Local\ABBYY [2013.10.15 12:42:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ABBYY FineReader 9.0 Sprint [2013.10.15 12:42:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ABBYY FineReader 9.0 Sprint [2013.10.15 12:42:24 | 000,000,000 | ---D | C] -- C:\ProgramData\ABBYY [2013.10.15 12:42:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ABBYY [2013.10.15 12:41:14 | 000,000,000 | ---D | C] -- C:\ProgramData\UDL [2013.10.15 12:39:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epson Software [2013.10.15 12:39:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EPSON [2013.10.15 12:39:07 | 000,558,592 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\ensppmon.dll [2013.10.15 12:39:07 | 000,558,592 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\enppmon.dll [2013.10.15 12:39:07 | 000,535,552 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\ensppui.dll [2013.10.15 12:39:07 | 000,535,552 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\enppui.dll [2013.10.15 12:39:07 | 000,219,648 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\enspres.dll [2013.10.15 12:39:07 | 000,219,648 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\enpres.dll [2013.10.15 12:39:07 | 000,000,000 | ---D | C] -- C:\Program Files\EpsonNet [2013.10.15 12:39:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EPSON Software [2013.10.15 12:38:44 | 000,010,752 | ---- | C] (SEIKO EPSON CORP.) -- C:\Windows\SysNative\E_GCINST.DLL [2013.10.15 12:38:34 | 000,120,320 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\E_ILMILE.DLL [2013.10.15 12:38:32 | 000,083,968 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\E_ID4BILE.DLL [2013.10.15 12:38:23 | 000,000,000 | ---D | C] -- C:\ProgramData\EPSON [2013.10.10 13:19:50 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.10.10 13:19:49 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013.10.10 13:19:48 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll [2013.10.10 13:19:48 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2013.10.10 13:19:48 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe [2013.10.10 13:19:48 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe [2013.10.10 13:19:48 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2013.10.10 13:19:48 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2013.10.10 13:19:48 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2013.10.10 13:19:48 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2013.10.10 13:19:48 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2013.10.10 13:19:47 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013.10.10 13:19:46 | 003,959,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013.10.10 13:19:46 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013.10.10 13:19:46 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.10.09 12:39:59 | 000,633,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\comctl32.dll [2013.10.09 12:39:58 | 000,368,128 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll [2013.10.09 12:39:58 | 000,295,424 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll [2013.10.09 12:39:58 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\fontsub.dll [2013.10.09 12:39:58 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\fontsub.dll [2013.10.09 12:39:58 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll [2013.10.09 12:39:58 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lpk.dll [2013.10.09 12:39:58 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll [2013.10.09 12:39:58 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dciman32.dll [2013.10.09 12:39:55 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\hidclass.sys [2013.10.09 12:39:55 | 000,032,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\hidparse.sys [2013.10.09 12:39:54 | 000,102,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\davclnt.dll [2013.10.09 12:39:49 | 005,549,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2013.10.09 12:39:49 | 000,878,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\advapi32.dll [2013.10.09 12:39:48 | 003,969,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2013.10.09 12:39:48 | 000,859,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdh.dll [2013.10.09 12:39:47 | 003,914,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2013.10.09 12:39:47 | 001,732,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll [2013.10.09 12:39:47 | 000,619,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdh.dll [2013.10.09 12:39:47 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll [2013.10.09 12:39:46 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe [2013.10.09 12:39:46 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll [2013.10.09 12:39:46 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe [2013.10.09 12:39:46 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll [2013.10.09 12:39:46 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe [2013.10.09 12:39:37 | 000,124,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationCFFRasterizerNative_v0300.dll [2013.10.09 12:39:37 | 000,102,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll [2013.10.09 12:39:36 | 000,461,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\scavengeui.dll [2013.10.09 12:39:34 | 000,325,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usbport.sys [2013.10.09 12:39:34 | 000,007,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usbd.sys [2013.10.06 19:28:44 | 000,000,000 | ---D | C] -- C:\Users\Mister X\Documents\ProcAlyzer Dumps [2013.10.03 10:48:18 | 000,000,000 | ---D | C] -- C:\Users\Mister X\Desktop\OpenOffice 4.0.1 (de) Installation Files [2013.10.01 15:37:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy 2 [2013.09.23 23:16:45 | 000,000,000 | ---D | C] -- C:\Users\Mister X\Desktop\Bewerber [2013.09.23 21:13:30 | 000,000,000 | ---D | C] -- C:\Users\Mister X\AppData\Roaming\337 [2013.09.23 21:12:34 | 000,000,000 | ---D | C] -- C:\Users\Mister X\AppData\Roaming\Omiga Plus [2013.09.23 21:12:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Omiga Plus [2013.09.23 21:12:22 | 000,000,000 | ---D | C] -- C:\Users\Mister X\AppData\Roaming\WinZipper [2013.09.23 21:12:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinZipper [2013.09.23 19:58:26 | 000,000,000 | ---D | C] -- C:\Program Files\Uninstaller [2013.09.23 19:56:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Feven 1.5 [2013.09.23 19:19:10 | 000,000,000 | ---D | C] -- C:\ProgramData\DSearchLink [2013.09.21 11:18:08 | 000,000,000 | ---D | C] -- C:\Users\Mister X\Desktop\Tattoo [2013.09.17 19:02:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemium [2013.09.17 19:02:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\soft Xpansion [2013.09.17 19:02:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Freemium [2013.09.17 19:02:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Freemium [2013.09.17 19:02:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Freemium [2013.09.17 19:02:14 | 000,000,000 | ---D | C] -- C:\SoloApp [2013.09.17 19:01:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Covus Freemium [2013.09.17 19:01:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Package Cache [2013.09.17 19:01:27 | 000,000,000 | ---D | C] -- C:\Users\Mister X\AppData\Roaming\Windows Net Data [2013.09.17 19:01:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HomeTab [2013.09.17 18:32:20 | 000,000,000 | ---D | C] -- C:\Users\Mister X\AppData\Roaming\com.adobe.formscentral.FormsCentralForAcrobat [2013.09.17 18:30:58 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe [2013.09.17 18:18:52 | 000,000,000 | ---D | C] -- C:\Users\Mister X\Adobe Acrobat XI Pro [2013.09.17 18:13:39 | 000,000,000 | ---D | C] -- C:\Users\Mister X\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant [2013.09.17 11:45:35 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\ljkb [2013.09.16 18:21:29 | 000,000,000 | ---D | C] -- C:\Users\Mister X\Desktop\BW Unterlagen [2013.09.16 18:15:21 | 000,000,000 | ---D | C] -- C:\Users\Mister X\Desktop\Lebenslauf_Bernd_05.13 [2013.09.16 18:08:40 | 000,000,000 | ---D | C] -- C:\Users\Mister X\AppData\Roaming\OpenOffice [2013.09.16 18:05:29 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.0 [2013.09.16 18:04:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice 4 [2008.08.12 06:45:20 | 000,155,648 | ---- | C] (ASUS) -- C:\Program Files (x86)\Common Files\MSIactionall.dll [47 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\Mister X\Documents\*.tmp files -> C:\Users\Mister X\Documents\*.tmp -> ] [1 C:\Users\Mister X\Desktop\*.tmp files -> C:\Users\Mister X\Desktop\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.10.15 16:16:53 | 009,175,040 | -HS- | M] () -- C:\Users\Mister X\ntuser.dat [2013.10.15 16:02:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.10.15 15:21:54 | 000,010,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.10.15 15:21:54 | 000,010,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.10.15 15:21:29 | 000,001,892 | ---- | M] () -- C:\Windows\tasks\Feven 1.5-chromeinstaller.job [2013.10.15 15:21:29 | 000,001,284 | ---- | M] () -- C:\Windows\tasks\Feven 1.5-updater.job [2013.10.15 15:21:26 | 000,001,816 | ---- | M] () -- C:\Windows\tasks\Feven 1.5-firefoxinstaller.job [2013.10.15 15:21:24 | 000,001,188 | ---- | M] () -- C:\Windows\tasks\Feven 1.5-codedownloader.job [2013.10.15 15:21:24 | 000,001,088 | ---- | M] () -- C:\Windows\tasks\Feven 1.5-enabler.job [2013.10.15 15:14:22 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2013.10.15 15:14:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.10.15 14:21:05 | 002,192,946 | -H-- | M] () -- C:\Users\Mister X\AppData\Local\IconCache.db [2013.10.15 14:11:27 | 000,000,749 | RH-- | M] () -- C:\Windows\WindowsShell.Manifest [2013.10.15 13:40:09 | 000,001,147 | ---- | M] () -- C:\Users\Mister X\Desktop\Event Manager.lnk [2013.10.15 13:00:14 | 000,013,841 | ---- | M] () -- C:\Windows\wininit.ini [2013.10.15 12:41:15 | 000,002,165 | ---- | M] () -- C:\Users\Public\Desktop\Epson Easy Photo Print.lnk [2013.10.15 12:40:29 | 000,000,308 | ---- | M] () -- C:\Windows\setup.iss [2013.10.15 12:39:56 | 000,002,419 | ---- | M] () -- C:\Users\Public\Desktop\Netzwerkhandbuch EPSON XP-205 207 Series.lnk [2013.10.15 12:39:49 | 000,002,419 | ---- | M] () -- C:\Users\Public\Desktop\Benutzerhandbuch EPSON XP-205 207 Series.lnk [2013.10.11 22:52:08 | 000,014,634 | ---- | M] () -- C:\Users\Mister X\Desktop\Kalkulation Whg..ods [2013.10.10 19:29:56 | 001,494,040 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.10.10 19:29:56 | 000,652,698 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.10.10 19:29:56 | 000,614,846 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.10.10 19:29:56 | 000,129,448 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.10.10 19:29:56 | 000,105,830 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.10.10 19:23:46 | 000,304,832 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.10.10 13:02:51 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013.10.10 13:02:51 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013.10.06 22:25:26 | 000,042,642 | ---- | M] () -- C:\Users\Mister X\Documents\cc_20131006_222503.reg [2013.10.03 17:07:52 | 000,054,847 | ---- | M] () -- C:\Users\Mister X\Desktop\Objekt Berechnung.ods [2013.10.01 12:14:58 | 000,132,600 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys [2013.10.01 12:14:58 | 000,105,856 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys [2013.10.01 12:14:58 | 000,083,160 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avnetflt.sys [2013.10.01 12:14:58 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys [2013.09.29 16:18:58 | 000,007,168 | ---- | M] () -- C:\Users\Mister X\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013.09.24 00:10:25 | 000,015,945 | ---- | M] () -- C:\Users\Mister X\Desktop\Telefonliste Stand 16 09 2013 intern.pdf [2013.09.23 20:59:17 | 001,592,922 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2013.09.23 01:27:49 | 000,690,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.09.23 01:27:48 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.09.23 01:27:48 | 000,109,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2013.09.23 01:27:48 | 000,061,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2013.09.23 01:27:48 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2013.09.23 00:55:16 | 000,051,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2013.09.23 00:54:55 | 000,603,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013.09.23 00:54:51 | 003,959,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013.09.23 00:54:51 | 000,855,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013.09.23 00:54:50 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013.09.23 00:54:50 | 000,136,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll [2013.09.23 00:54:50 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2013.09.23 00:54:50 | 000,039,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2013.09.21 04:48:36 | 000,089,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe [2013.09.21 04:39:47 | 000,071,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe [2013.09.17 19:02:31 | 000,010,464 | ---- | M] () -- C:\Windows\SysWow64\sx_p2d.tlb [2013.09.17 19:01:27 | 000,001,962 | ---- | M] () -- C:\Users\Mister X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\net.lnk [2013.09.17 19:00:51 | 000,069,616 | ---- | M] () -- C:\Users\Mister X\AppData\Local\GDIPFONTCACHEV1.DAT [2013.09.17 18:58:13 | 000,017,676 | ---- | M] () -- C:\Users\Mister X\Documents\cc_20130917_185808.reg [2013.09.16 18:08:14 | 000,000,000 | ---- | M] () -- C:\END [47 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\Mister X\Documents\*.tmp files -> C:\Users\Mister X\Documents\*.tmp -> ] [1 C:\Users\Mister X\Desktop\*.tmp files -> C:\Users\Mister X\Desktop\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.10.15 13:40:09 | 000,001,147 | ---- | C] () -- C:\Users\Mister X\Desktop\Event Manager.lnk [2013.10.15 12:41:15 | 000,002,165 | ---- | C] () -- C:\Users\Public\Desktop\Epson Easy Photo Print.lnk [2013.10.15 12:40:28 | 000,000,308 | ---- | C] () -- C:\Windows\setup.iss [2013.10.15 12:39:56 | 000,002,419 | ---- | C] () -- C:\Users\Public\Desktop\Netzwerkhandbuch EPSON XP-205 207 Series.lnk [2013.10.15 12:39:49 | 000,002,419 | ---- | C] () -- C:\Users\Public\Desktop\Benutzerhandbuch EPSON XP-205 207 Series.lnk [2013.10.06 22:25:24 | 000,042,642 | ---- | C] () -- C:\Users\Mister X\Documents\cc_20131006_222503.reg [2013.10.01 17:33:13 | 000,013,841 | ---- | C] () -- C:\Windows\wininit.ini [2013.09.26 12:13:20 | 000,002,037 | ---- | C] () -- C:\Users\Mister X\a6a5af975981bd7a.jpg [2013.09.24 00:10:24 | 000,015,945 | ---- | C] () -- C:\Users\Mister X\Desktop\Telefonliste Stand 16 09 2013 intern.pdf [2013.09.23 21:18:56 | 000,001,158 | ---- | C] () -- C:\Users\Mister X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2013.09.23 19:57:17 | 000,001,284 | ---- | C] () -- C:\Windows\tasks\Feven 1.5-updater.job [2013.09.23 19:57:13 | 000,001,088 | ---- | C] () -- C:\Windows\tasks\Feven 1.5-enabler.job [2013.09.23 19:57:09 | 000,001,188 | ---- | C] () -- C:\Windows\tasks\Feven 1.5-codedownloader.job [2013.09.23 19:56:55 | 000,001,816 | ---- | C] () -- C:\Windows\tasks\Feven 1.5-firefoxinstaller.job [2013.09.23 19:56:50 | 000,001,892 | ---- | C] () -- C:\Windows\tasks\Feven 1.5-chromeinstaller.job [2013.09.22 16:43:30 | 000,755,337 | ---- | C] () -- C:\Users\Mister X\Desktop\Mietbescheinigung.jpg [2013.09.22 16:21:04 | 000,014,634 | ---- | C] () -- C:\Users\Mister X\Desktop\Kalkulation Whg..ods [2013.09.22 15:51:54 | 000,054,847 | ---- | C] () -- C:\Users\Mister X\Desktop\Objekt Berechnung.ods [2013.09.17 19:02:31 | 000,010,464 | ---- | C] () -- C:\Windows\SysWow64\sx_p2d.tlb [2013.09.17 19:01:27 | 000,001,962 | ---- | C] () -- C:\Users\Mister X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\net.lnk [2013.09.17 19:01:08 | 000,032,328 | ---- | C] () -- C:\Windows\Launcher.exe [2013.09.17 18:58:11 | 000,017,676 | ---- | C] () -- C:\Users\Mister X\Documents\cc_20130917_185808.reg [2013.09.16 18:08:14 | 000,000,000 | ---- | C] () -- C:\END [2013.09.02 22:35:41 | 002,192,946 | -H-- | C] () -- C:\Users\Mister X\AppData\Local\IconCache.db [2013.02.23 22:44:26 | 000,769,144 | ---- | C] () -- C:\Windows\BDTSupport.dll [2013.01.12 18:38:20 | 000,524,288 | -HS- | C] () -- C:\Users\Mister X\ntuser.dat{113ac0fc-5cd6-11e2-b9e3-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms [2013.01.12 18:38:20 | 000,524,288 | -HS- | C] () -- C:\Users\Mister X\ntuser.dat{113ac0fc-5cd6-11e2-b9e3-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms [2013.01.12 18:38:20 | 000,065,536 | -HS- | C] () -- C:\Users\Mister X\ntuser.dat{113ac0fc-5cd6-11e2-b9e3-806e6f6e6963}.TM.blf [2012.12.22 17:13:37 | 000,166,805 | ---- | C] () -- C:\Users\Mister X\181818_407369259339522_1502564598_n.jpg [2012.12.09 19:59:56 | 000,000,017 | ---- | C] () -- C:\Windows\SysWow64\shortcut_ex.dat [2012.01.10 23:27:26 | 000,867,020 | ---- | C] () -- C:\Windows\SysWow64\igkrng575.bin [2012.01.10 23:27:26 | 000,128,204 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin [2012.01.10 23:27:26 | 000,105,608 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin [2012.01.10 22:29:54 | 013,904,384 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll [2011.12.06 21:58:46 | 000,007,168 | ---- | C] () -- C:\Users\Mister X\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.10.30 12:57:53 | 000,000,000 | ---- | C] () -- C:\Users\Mister X\AppData\Local\{492E81F5-350C-4154-AD5E-C5C39DB76E74} [2011.05.13 18:51:52 | 000,007,663 | ---- | C] () -- C:\Users\Mister X\AppData\Local\Resmon.ResmonCfg [2011.04.06 19:10:31 | 000,524,288 | -HS- | C] () -- C:\Users\Mister X\ntuser.dat{77ec4730-606a-11e0-8b4a-20cf30cfa05c}.TMContainer00000000000000000002.regtrans-ms [2011.04.06 19:10:30 | 000,524,288 | -HS- | C] () -- C:\Users\Mister X\ntuser.dat{77ec4730-606a-11e0-8b4a-20cf30cfa05c}.TMContainer00000000000000000001.regtrans-ms [2011.04.06 19:10:30 | 000,065,536 | -HS- | C] () -- C:\Users\Mister X\ntuser.dat{77ec4730-606a-11e0-8b4a-20cf30cfa05c}.TM.blf [2011.02.19 11:32:55 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011.01.16 13:34:57 | 000,000,088 | -H-- | C] () -- C:\ProgramData\aspg.dat [2011.01.09 00:10:40 | 000,000,680 | RHS- | C] () -- C:\Users\Mister X\ntuser.pol [2011.01.08 19:18:49 | 000,069,616 | ---- | C] () -- C:\Users\Mister X\AppData\Local\GDIPFONTCACHEV1.DAT [2011.01.08 19:18:31 | 000,524,288 | -HS- | C] () -- C:\Users\Mister X\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms [2011.01.08 19:18:31 | 000,524,288 | -HS- | C] () -- C:\Users\Mister X\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms [2011.01.08 19:18:31 | 000,065,536 | -HS- | C] () -- C:\Users\Mister X\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf [2011.01.08 19:18:31 | 000,000,020 | -HS- | C] () -- C:\Users\Mister X\ntuser.ini [2011.01.08 19:18:30 | 009,175,040 | -HS- | C] () -- C:\Users\Mister X\ntuser.dat [2011.01.08 19:18:30 | 007,077,888 | -HS- | C] () -- C:\Users\Mister X\NTUSER.DAT_tureg_old [2009.04.08 19:31:56 | 000,106,496 | ---- | C] () -- C:\Program Files (x86)\Common Files\CPInstallAction.dll [2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files (x86)\Common Files\banner.jpg ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013.07.26 04:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.07.26 03:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013.09.23 21:13:30 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\337 [2012.10.16 22:54:13 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\Ad-Aware Antivirus [2011.05.04 19:09:27 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\Asus WebStorage [2012.10.16 22:16:30 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\blekko [2013.04.28 16:42:05 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\Canneverbe Limited [2013.09.17 18:13:39 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant [2013.09.17 18:32:20 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\com.adobe.formscentral.FormsCentralForAcrobat [2011.10.09 09:20:30 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\com.socialbox.socialbox [2012.10.09 17:34:43 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\DVDVideoSoft [2012.10.09 14:18:17 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\DVDVideoSoftIEHelpers [2013.10.15 13:16:09 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\Epson [2012.10.10 12:10:06 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\Fighters [2013.03.17 17:04:03 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\MyPhoneExplorer [2013.09.23 21:21:45 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\Omiga Plus [2012.10.09 14:18:06 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\OpenCandy [2013.09.16 18:08:40 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\OpenOffice [2013.10.01 21:22:58 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\Samsung [2013.09.22 16:51:45 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\SoftGrid Client [2013.02.23 22:34:05 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\TestApp [2011.01.19 21:42:57 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\TP [2012.03.02 18:28:18 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\TuneUp Software [2013.10.10 12:31:39 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\Windows Net Data [2013.09.23 21:12:22 | 000,000,000 | ---D | M] -- C:\Users\Mister X\AppData\Roaming\WinZipper ========== Purity Check ========== ========== Custom Scans ========== < C:\ProgramFiles(x86)\HomeTab\TBUpdater.dll > [2009.07.14 07:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT [2009.07.14 07:08:49 | 000,032,640 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2012.04.05 04:56:18 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job [2013.09.23 19:56:50 | 000,001,892 | ---- | C] () -- C:\Windows\Tasks\Feven 1.5-chromeinstaller.job [2013.09.23 19:56:55 | 000,001,816 | ---- | C] () -- C:\Windows\Tasks\Feven 1.5-firefoxinstaller.job [2013.09.23 19:57:09 | 000,001,188 | ---- | C] () -- C:\Windows\Tasks\Feven 1.5-codedownloader.job [2013.09.23 19:57:13 | 000,001,088 | ---- | C] () -- C:\Windows\Tasks\Feven 1.5-enabler.job [2013.09.23 19:57:17 | 000,001,284 | ---- | C] () -- C:\Windows\Tasks\Feven 1.5-updater.job ========== Files - Unicode (All) ========== [2013.09.17 18:10:24 | 097,949,955 | ---- | M] ()(C:\Windows\SysWow64\???H) -- C:\Windows\SysWow64\汊㱾H [2013.09.17 18:10:24 | 097,949,955 | ---- | C] ()(C:\Windows\SysWow64\???H) -- C:\Windows\SysWow64\汊㱾H ========== Alternate Data Streams ========== @Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp  FC5A2B2@Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:430C6D84 < End of report > |
|
15.10.2013, 16:46
| #2 |
| /// TB-Ausbilder   | Thema: C:\Program Files(x86)\HomeTab\TBupdter.dll Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
|
|
18.10.2013, 18:49
| #3 |
| /// TB-Ausbilder | Thema: C:\Program Files(x86)\HomeTab\TBupdter.dll Fehlende Rückmeldung
__________________Dieses Thema wurde aus den Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten. PM an mich falls Du denoch weiter machen willst. Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist. Jeder andere bitte hier klicken und einen eigenen Thread erstellen! |
|
| Themen zu Thema: C:\Program Files(x86)\HomeTab\TBupdter.dll |
| ad-aware, antivir, avg, avira, bho, browser, converter, desktop, feven 1.5, firefox, flash player, format, freemium, gmx.net, helper, home, hometab\tbupdater.dll, install.exe, installation, logfile, mozilla, mp3, object, programm, registry, scan, security, software, trojaner, windows |
Linear-Darstellung
