| billie_joe | 15.07.2012 13:24 |
System von TR/ATRAPS.Gen, TR/ATRAPS.Gen2 befallen
Hallo,
auch mein PC ist seit gestern von den oben genannten Viren befallen. Alle paar Minuten kommt Avira Free Antivirus mit einer Warnmeldung, dass das System infiziert sei.
Hier der OTL-Scan: Code:
OTL logfile created on: 15.07.2012 13:59:44 - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Kai\Desktop
64bit- Professional (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 1,33 Gb Available Physical Memory | 33,32% Memory free
8,00 Gb Paging File | 5,21 Gb Available in Paging File | 65,19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 29,43 Gb Total Space | 2,57 Gb Free Space | 8,72% Space Free | Partition Type: NTFS
Drive D: | 203,35 Gb Total Space | 120,12 Gb Free Space | 59,07% Space Free | Partition Type: NTFS
Unable to calculate disk information.
Drive F: | 1863,01 Gb Total Space | 1320,90 Gb Free Space | 70,90% Space Free | Partition Type: NTFS
Drive J: | 931,51 Gb Total Space | 264,56 Gb Free Space | 28,40% Space Free | Partition Type: NTFS
Computer Name: KAI-PC | User Name: Kai | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\Kai\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Kai\rasPlayS.exe (gyns xybapv bison lpg)
PRC - D:\Programme\Internet\Opera\opera.exe (Opera Software)
PRC - D:\Programme\Internet\Opera\pluginwrapper\opera_plugin_wrapper.exe (Opera Software)
PRC - D:\Programme\Internet\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Programme\Internet\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Programme\Internet\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Programme\Internet\devolo\dlan\devolonetsvc.exe (devolo AG)
PRC - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - D:\Programme\Verwaltung\Acronis\OSS\reinstall_svc.exe ()
PRC - D:\Programme\Verwaltung\Seagate\Sync\MaxSync.exe (Seagate Technology LLC)
PRC - D:\Programme\Verwaltung\Seagate\Sync\FreeAgentService.exe (Seagate Technology LLC)
PRC - D:\Programme\Verwaltung\Seagate\FreeAgent Status\stxmenumgr.exe (Seagate LLC)
PRC - C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe (Panda Security)
PRC - C:\Windows\SysWOW64\ipconfig.exe (Microsoft Corporation)
========== Modules (No Company Name) ==========
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
MOD - D:\Programme\Internet\Opera\gstreamer\plugins\gstwebmdec.dll ()
MOD - D:\Programme\Internet\Opera\gstreamer\plugins\gstautodetect.dll ()
MOD - D:\Programme\Internet\Opera\gstreamer\plugins\gstwaveform.dll ()
MOD - D:\Programme\Internet\Opera\gstreamer\gstreamer.dll ()
MOD - D:\Programme\Internet\Opera\gstreamer\plugins\gstoggdec.dll ()
MOD - D:\Programme\Internet\Opera\gstreamer\plugins\gstffmpegcolorspace.dll ()
MOD - D:\Programme\Internet\Opera\gstreamer\plugins\gstcoreplugins.dll ()
MOD - D:\Programme\Internet\Opera\gstreamer\plugins\gstaudioresample.dll ()
MOD - D:\Programme\Internet\Opera\gstreamer\plugins\gstaudioconvert.dll ()
MOD - D:\Programme\Internet\Opera\gstreamer\plugins\gstwavparse.dll ()
MOD - D:\Programme\Internet\Opera\gstreamer\plugins\gstdirectsound.dll ()
MOD - D:\Programme\Internet\Opera\gstreamer\plugins\gstdecodebin2.dll ()
MOD - D:\Programme\Internet\Opera\gstreamer\plugins\gsttypefindfunctions.dll ()
MOD - C:\Users\Kai\AppData\Local\Adobe\Acrobat\10.0\Cache\RdLang_weblink.DEU ()
MOD - C:\Users\Kai\AppData\Local\Adobe\Acrobat\10.0\Cache\RdLang_EScript.DEU ()
MOD - C:\Users\Kai\AppData\Local\Adobe\Acrobat\10.0\Cache\RdLang_rdlang32.deu ()
MOD - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\sqlite.dll ()
========== Win32 Services (SafeList) ==========
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (SkypeUpdate) -- D:\Programme\Internet\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Hamachi2Svc) -- D:\Programme\Internet\Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (FLEXnet Licensing Service 64) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Flexera Software, Inc.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AntiVirSchedulerService) -- D:\Programme\Internet\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- D:\Programme\Internet\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (DevoloNetworkService) -- D:\Programme\Internet\devolo\dlan\devolonetsvc.exe (devolo AG)
SRV - (TunngleService) -- D:\Programme\Internet\Tunngle\TnglCtrl.exe (Tunngle.net GmbH)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (TuneUp.UtilitiesSvc) -- D:\Programme\Verwaltung\TuneUp\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (OS Selector) -- D:\Programme\Verwaltung\Acronis\OSS\reinstall_svc.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FreeAgentGoNext Service) -- D:\Programme\Verwaltung\Seagate\Sync\FreeAgentService.exe (Seagate Technology LLC)
SRV - (HPSLPSVC) -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Microsoft Office Groove Audit Service) -- D:\Programme\Verwaltung\Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (TrojanKillerDriver) -- C:\Windows\SysNative\drivers\gtkdrv.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (snapman) -- C:\Windows\SysNative\drivers\snapman.sys (Acronis)
DRV:64bit: - (pcouffin) -- C:\Windows\SysNative\drivers\pcouffin.sys (VSO Software)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (acedrv11) -- C:\Windows\SysNative\drivers\acedrv11.sys (Protect Software GmbH)
DRV:64bit: - (tap0901t) TAP-Win32 Adapter V9 (Tunngle) -- C:\Windows\SysNative\drivers\tap0901t.sys (Tunngle.net)
DRV:64bit: - (SCDEmu) -- C:\Windows\SysNative\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (RMCAST) -- C:\Windows\SysNative\drivers\rmcast.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (NPF_devolo) NetGroup Packet Filter Driver (devolo) -- C:\Windows\SysWOW64\drivers\npf_devolo.sys (CACE Technologies)
DRV - (DrvAgent64) -- C:\Windows\SysWOW64\drivers\DrvAgent64.SYS (Phoenix Technologies)
DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Server 2003 DDK provider)
DRV - (TuneUpUtilitiesDrv) -- D:\Programme\Verwaltung\TuneUp\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = ED 09 AC 0B 4B 5E CB 01 [binary data]
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0FEF7EB7-CCBB-4A89-9BDD-F1FBEC7BAF1D}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=SPC2&o=15000&src=crm&q={searchTerms}&locale=&apn_ptnrs=PV&apn_dtid=YYYYYYYYDE&apn_uid=564BA9E9-CE3C-4B79-A52E-537B79AE04CF&apn_sauid=B1341CF6-6C79-4FE5-B591-8721FF7E2C6E&
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.7
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0
FF - prefs.js..extensions.enabledItems: wrc@avast.com:20110101
FF - prefs.js..extensions.enabledItems: smartwebprinting@hp.com:4.51
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q="
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\MediaPlayer\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Programme\Internet\Java\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: D:\Programme\MediaPlayer\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: File not found
FF - HKCU\Software\MozillaPlugins\@protectdisc.com/NPPDLicenseHelper: C:\Users\Kai\AppData\Roaming\ProtectDisc\License Helper v2\NPPDLicenseHelper.dll ( )
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.10.23 23:35:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: D:\Programme\Internet\Firefox\components [2012.03.22 03:35:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: D:\Programme\Internet\Firefox\plugins [2011.11.01 19:04:16 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.10.23 23:35:52 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\Kai\AppData\Roaming\01024 [2012.04.08 23:30:42 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: D:\Programme\Internet\Firefox\components [2012.03.22 03:35:28 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: D:\Programme\Internet\Firefox\plugins [2011.11.01 19:04:16 | 000,000,000 | ---D | M]
[2011.03.25 22:28:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kai\AppData\Roaming\mozilla\Extensions
[2010.11.14 00:06:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kai\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.03.25 22:28:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kai\AppData\Roaming\mozilla\Extensions\songbird@songbirdnest.com
[2012.03.30 14:41:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kai\AppData\Roaming\mozilla\Firefox\Profiles\29yzrrbu.default\extensions
[2012.02.15 00:29:50 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Kai\AppData\Roaming\mozilla\Firefox\Profiles\29yzrrbu.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2011.01.12 19:17:07 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Kai\AppData\Roaming\mozilla\Firefox\Profiles\29yzrrbu.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.03.30 14:41:45 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Kai\AppData\Roaming\mozilla\Firefox\Profiles\29yzrrbu.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.05.11 02:55:38 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Kai\AppData\Roaming\mozilla\Firefox\Profiles\29yzrrbu.default\extensions\engine@conduit.com
[2011.10.12 14:43:33 | 000,002,401 | ---- | M] () -- C:\Users\Kai\AppData\Roaming\Mozilla\Firefox\Profiles\29yzrrbu.default\searchplugins\askcom.xml
[2012.04.04 19:22:16 | 000,000,950 | ---- | M] () -- C:\Users\Kai\AppData\Roaming\Mozilla\Firefox\Profiles\29yzrrbu.default\searchplugins\icqplugin-1.xml
[2011.03.06 22:41:58 | 000,000,950 | ---- | M] () -- C:\Users\Kai\AppData\Roaming\Mozilla\Firefox\Profiles\29yzrrbu.default\searchplugins\icqplugin-2.xml
[2011.03.24 13:44:26 | 000,000,950 | ---- | M] () -- C:\Users\Kai\AppData\Roaming\Mozilla\Firefox\Profiles\29yzrrbu.default\searchplugins\icqplugin-3.xml
[2011.04.29 18:33:06 | 000,000,950 | ---- | M] () -- C:\Users\Kai\AppData\Roaming\Mozilla\Firefox\Profiles\29yzrrbu.default\searchplugins\icqplugin-4.xml
[2011.05.08 16:03:59 | 000,000,950 | ---- | M] () -- C:\Users\Kai\AppData\Roaming\Mozilla\Firefox\Profiles\29yzrrbu.default\searchplugins\icqplugin-5.xml
[2011.06.27 21:45:01 | 000,000,950 | ---- | M] () -- C:\Users\Kai\AppData\Roaming\Mozilla\Firefox\Profiles\29yzrrbu.default\searchplugins\icqplugin-6.xml
[2011.09.30 12:46:56 | 000,000,950 | ---- | M] () -- C:\Users\Kai\AppData\Roaming\Mozilla\Firefox\Profiles\29yzrrbu.default\searchplugins\icqplugin-7.xml
[2011.02.27 21:35:48 | 000,001,056 | ---- | M] () -- C:\Users\Kai\AppData\Roaming\Mozilla\Firefox\Profiles\29yzrrbu.default\searchplugins\icqplugin.xml
========== Chrome ==========
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programme\Verwaltung\Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Internet\Java\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast5] "D:\Programme\Internet\Avast\avastUI.exe" /nogui File not found
O4 - HKLM..\Run: [avgnt] D:\Programme\Internet\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [GrooveMonitor] D:\Programme\Verwaltung\Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [MaxMenuMgr] D:\Programme\Verwaltung\Seagate\FreeAgent Status\StxMenuMgr.exe (Seagate LLC)
O4 - HKCU..\Run: [{B451BBF9-9553-2F70-8DAE-418E8E61B4C6}] C:\Users\Kai\AppData\Roaming\Iqymeg\uhnuitt.exe File not found
O4 - HKCU..\Run: [Acronis] C:\Users\Kai\AppData\Roaming\8EA0F1.exe (Simon Tatham)
O4 - HKCU..\Run: [Macromedia] C:\Users\Kai\AppData\Roaming\EA85AF.exe (Simon Tatham)
O4 - HKCU..\Run: [QUU2NEE3NUIyRTg0NEIyQj] C:\Users\Kai\rasPlayS.exe (gyns xybapv bison lpg)
F3:64bit: - HKCU WinNT: Load - (C:\Users\Kai\rasPlayS.exe) - C:\Users\Kai\rasPlayS.exe (gyns xybapv bison lpg)
F3 - HKCU WinNT: Load - (C:\Users\Kai\rasPlayS.exe) - C:\Users\Kai\rasPlayS.exe (gyns xybapv bison lpg)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: =
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Kai\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Kai\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programme\Verwaltung\Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programme\Verwaltung\Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - D:\Programme\Internet\ICQ\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - D:\Programme\Internet\ICQ\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Verwaltung\Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9E4396E7-C8EA-409C-AF53-3805408544E3}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E2731AA8-44FC-4A8B-A1C6-1B216716A196}: DhcpNameServer = 7.254.254.254
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Programme\Verwaltung\Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22:64bit: - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - D:\Programme\Verwaltung\Stardock\Stardock\Fences\FencesMenu64.dll (Stardock)
O27:64bit: - HKLM IFEO\hpwucli.exe: Debugger - D:\Programme\Verwaltung\TuneUp\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\hpwucli.exe: Debugger - D:\Programme\Verwaltung\TuneUp\TUAutoReactivator64.exe (TuneUp Software)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\Programme\Verwaltung\Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - Unable to obtain root file information for disk J:\
O33 - MountPoints2\{809bf32e-0c63-11e1-92cc-001d7d9a76f0}\Shell - "" = AutoRun
O33 - MountPoints2\{809bf32e-0c63-11e1-92cc-001d7d9a76f0}\Shell\AutoRun\command - "" = I:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2012.07.15 13:58:00 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Kai\Desktop\OTL.exe
[2012.07.15 13:47:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Security
[2012.07.15 13:47:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Panda USB Vaccine
[2012.07.15 13:47:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
[2012.07.15 13:44:27 | 000,848,856 | ---- | C] (Panda Security ) -- C:\Users\Kai\Desktop\USBVaccine1014Setup.exe
[2012.07.15 01:05:07 | 000,491,520 | ---- | C] (Microsoft) -- C:\Users\Kai\AppData\Roaming\hnvjtm.exe
[2012.07.15 00:25:37 | 000,279,040 | RHS- | C] (gyns xybapv bison lpg) -- C:\Users\Kai\rasPlayS.exe
[2012.07.14 23:48:19 | 000,000,000 | ---D | C] -- C:\Users\Kai\AppData\Roaming\Avira
[2012.07.14 23:45:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.07.14 23:45:06 | 000,132,832 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.07.14 23:45:06 | 000,098,848 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.07.14 23:45:06 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.07.14 23:45:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.07.14 23:20:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Earthworm Jim
[2012.07.14 23:14:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GridinSoft
[2012.07.13 16:07:11 | 000,000,000 | ---D | C] -- C:\Users\Kai\AppData\Roaming\Yqi
[2012.07.13 16:07:11 | 000,000,000 | ---D | C] -- C:\Users\Kai\AppData\Roaming\Iqymeg
[2012.07.11 21:54:00 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012.07.07 13:35:26 | 001,024,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmpmde.dll
[2012.07.07 13:35:26 | 000,738,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmpmde.dll
[2012.07.06 15:59:23 | 000,000,000 | ---D | C] -- C:\Users\Kai\Desktop\Pils Daddy
[2012.07.06 14:58:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Media Player
[2012.07.06 14:58:09 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Games
[2012.06.30 23:11:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\devolo
[2012.06.30 23:11:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe AIR
[2012.06.29 13:35:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AudibleManager
[2012.06.29 13:35:06 | 000,000,000 | ---D | C] -- D:\Kai\Documents\Audible
[2012.06.28 12:00:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2012.06.21 14:46:07 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2012.06.21 14:46:07 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2012.06.21 14:46:06 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2012.06.21 14:45:58 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2012.06.21 14:45:58 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2012.06.21 14:45:58 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2012.06.21 14:45:50 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2012.06.21 14:45:50 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2010.11.14 17:08:25 | 000,082,816 | ---- | C] (VSO Software) -- C:\Users\Kai\AppData\Roaming\pcouffin.sys
[2009.07.14 02:20:27 | 000,086,016 | -HS- | C] (Simon Tatham) -- C:\Users\Kai\AppData\Roaming\EA85AF.exe
[2009.07.14 02:20:27 | 000,086,016 | -HS- | C] (Simon Tatham) -- C:\Users\Kai\AppData\Roaming\8EA0F1.exe
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Kai\AppData\Roaming\*.tmp files -> C:\Users\Kai\AppData\Roaming\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.07.15 14:01:22 | 002,115,791 | ---- | M] () -- C:\Users\Kai\Desktop\tdsskiller.zip
[2012.07.15 13:59:00 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Kai\Desktop\OTL.exe
[2012.07.15 13:44:27 | 000,848,856 | ---- | M] (Panda Security ) -- C:\Users\Kai\Desktop\USBVaccine1014Setup.exe
[2012.07.15 13:11:35 | 000,014,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.15 13:11:35 | 000,014,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.15 13:03:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.15 01:05:10 | 000,491,520 | ---- | M] (Microsoft) -- C:\Users\Kai\AppData\Roaming\hnvjtm.exe
[2012.07.15 00:25:37 | 000,279,040 | RHS- | M] (gyns xybapv bison lpg) -- C:\Users\Kai\rasPlayS.exe
[2012.07.14 23:45:14 | 000,001,018 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012.07.14 23:37:18 | 099,308,192 | ---- | M] () -- C:\Users\Kai\Desktop\avira_free_antivirus_de12001125.exe
[2012.07.14 23:27:28 | 000,000,867 | ---- | M] () -- C:\Users\Public\Desktop\Trojan Killer.lnk
[2012.07.14 23:20:07 | 000,000,832 | ---- | M] () -- C:\Users\Kai\Desktop\Earthworm Jim.lnk
[2012.07.14 23:20:07 | 000,000,529 | ---- | M] () -- C:\Users\Kai\Desktop\Earthworm Jim on the Gamefabrique.lnk
[2012.07.14 19:18:59 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.07.14 19:18:59 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.07.14 17:45:19 | 089,192,389 | ---- | M] () -- C:\Users\Kai\Desktop\EP² Tape.rar
[2012.07.14 17:43:16 | 040,521,701 | ---- | M] () -- C:\Users\Kai\Desktop\Zenit - Weit weg.zip
[2012.07.13 18:33:38 | 001,650,820 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.13 18:33:38 | 000,710,826 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.13 18:33:38 | 000,663,838 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.13 18:33:38 | 000,153,918 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.13 18:33:38 | 000,125,968 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.13 18:27:11 | 147,824,928 | ---- | M] () -- C:\Users\Kai\Desktop\Oliver_Schories-My_Summer_2012_(Mixtape_June_2012).mp3
[2012.07.13 18:27:05 | 056,244,050 | ---- | M] () -- C:\Users\Kai\Desktop\Stress_und_Trauma_-_Bald_is_wieder_Gestern.zip
[2012.07.13 02:20:18 | 055,084,792 | ---- | M] () -- C:\Users\Kai\Desktop\bellini-boyz.zip
[2012.07.12 16:25:40 | 118,103,787 | ---- | M] () -- C:\Users\Kai\Desktop\AZEALIA BANKS - FANTASEA.zip
[2012.07.12 14:15:06 | 000,453,344 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.11 22:00:51 | 077,737,905 | ---- | M] () -- C:\Users\Kai\Desktop\Gavlyn_-_Habit_That_You_Blame_%282009%29_%5BMP3%5D_CR_3970148.rar
[2012.07.10 12:01:32 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.07.03 18:21:18 | 000,285,328 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2012.07.02 01:59:58 | 000,061,201 | ---- | M] () -- C:\Users\Kai\Desktop\praktikumsordnung_2001.pdf
[2012.07.01 23:06:06 | 142,838,755 | ---- | M] () -- C:\Users\Kai\Desktop\01 - PWA #04 - Evergreens sind immer da.mp3
[2012.06.30 23:12:02 | 000,000,978 | ---- | M] () -- C:\Users\Public\Desktop\devolo dLAN Cockpit.lnk
[2012.06.25 09:09:34 | 062,163,890 | ---- | M] () -- C:\Users\Kai\Desktop\DynamiK - Wir ham da mal was Vorbereitet EP.zip
[2012.06.16 17:18:13 | 096,043,118 | ---- | M] () -- C:\Users\Kai\Desktop\Twist89&Kool4Rymes_Kool4Rymes Mixtape.rar
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Kai\AppData\Roaming\*.tmp files -> C:\Users\Kai\AppData\Roaming\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.07.15 14:04:12 | 000,022,016 | ---- | C] () -- C:\Windows\Installer\{2731b7aa-dfc0-40cc-ec99-7f853a80c869}\U\800000cb.@
[2012.07.15 14:04:12 | 000,016,896 | ---- | C] () -- C:\Windows\Installer\{2731b7aa-dfc0-40cc-ec99-7f853a80c869}\U\80000000.@
[2012.07.15 14:01:21 | 002,115,791 | ---- | C] () -- C:\Users\Kai\Desktop\tdsskiller.zip
[2012.07.15 00:09:10 | 000,001,696 | ---- | C] () -- C:\Windows\Installer\{2731b7aa-dfc0-40cc-ec99-7f853a80c869}\U\00000001.@
[2012.07.14 23:45:14 | 000,001,018 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012.07.14 23:36:39 | 099,308,192 | ---- | C] () -- C:\Users\Kai\Desktop\avira_free_antivirus_de12001125.exe
[2012.07.14 23:27:28 | 000,000,867 | ---- | C] () -- C:\Users\Public\Desktop\Trojan Killer.lnk
[2012.07.14 23:20:07 | 000,000,832 | ---- | C] () -- C:\Users\Kai\Desktop\Earthworm Jim.lnk
[2012.07.14 23:20:07 | 000,000,529 | ---- | C] () -- C:\Users\Kai\Desktop\Earthworm Jim on the Gamefabrique.lnk
[2012.07.14 17:43:20 | 089,192,389 | ---- | C] () -- C:\Users\Kai\Desktop\EP² Tape.rar
[2012.07.14 17:43:00 | 040,521,701 | ---- | C] () -- C:\Users\Kai\Desktop\Zenit - Weit weg.zip
[2012.07.13 18:26:17 | 056,244,050 | ---- | C] () -- C:\Users\Kai\Desktop\Stress_und_Trauma_-_Bald_is_wieder_Gestern.zip
[2012.07.13 18:24:48 | 147,824,928 | ---- | C] () -- C:\Users\Kai\Desktop\Oliver_Schories-My_Summer_2012_(Mixtape_June_2012).mp3
[2012.07.13 02:20:02 | 055,084,792 | ---- | C] () -- C:\Users\Kai\Desktop\bellini-boyz.zip
[2012.07.12 16:25:02 | 118,103,787 | ---- | C] () -- C:\Users\Kai\Desktop\AZEALIA BANKS - FANTASEA.zip
[2012.07.11 21:21:27 | 077,737,905 | ---- | C] () -- C:\Users\Kai\Desktop\Gavlyn_-_Habit_That_You_Blame_%282009%29_%5BMP3%5D_CR_3970148.rar
[2012.07.02 01:59:57 | 000,061,201 | ---- | C] () -- C:\Users\Kai\Desktop\praktikumsordnung_2001.pdf
[2012.07.01 23:05:26 | 142,838,755 | ---- | C] () -- C:\Users\Kai\Desktop\01 - PWA #04 - Evergreens sind immer da.mp3
[2012.06.30 23:12:02 | 000,000,978 | ---- | C] () -- C:\Users\Public\Desktop\devolo dLAN Cockpit.lnk
[2012.06.25 09:08:47 | 062,163,890 | ---- | C] () -- C:\Users\Kai\Desktop\DynamiK - Wir ham da mal was Vorbereitet EP.zip
[2012.06.16 17:16:25 | 096,043,118 | ---- | C] () -- C:\Users\Kai\Desktop\Twist89&Kool4Rymes_Kool4Rymes Mixtape.rar
[2012.06.09 00:25:05 | 000,000,153 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2012.04.13 23:11:44 | 000,034,753 | ---- | C] () -- C:\Windows\scunin.dat
[2012.04.08 23:32:20 | 000,040,960 | R--- | C] () -- C:\Windows\SysWow64\psfind.dll
[2012.04.08 23:30:35 | 000,000,016 | ---- | C] () -- C:\Users\Kai\AppData\Roaming\blckdom.res
[2012.01.11 10:01:43 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{2731b7aa-dfc0-40cc-ec99-7f853a80c869}\@
[2012.01.11 10:01:43 | 000,002,048 | -HS- | C] () -- C:\Users\Kai\AppData\Local\{2731b7aa-dfc0-40cc-ec99-7f853a80c869}\@
[2011.10.23 23:32:01 | 000,226,792 | ---- | C] () -- C:\Windows\hpoins18.dat
[2011.10.23 23:32:01 | 000,005,355 | ---- | C] () -- C:\Windows\hpomdl18.dat
[2011.08.17 01:35:55 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat
[2011.07.12 12:43:51 | 000,000,091 | ---- | C] () -- C:\Users\Kai\AppData\Local\fusioncache.dat
[2010.12.31 00:03:37 | 000,000,289 | ---- | C] () -- C:\Windows\game.ini
[2010.12.01 21:46:44 | 000,000,011 | ---- | C] () -- C:\Windows\BRVIDEO.INI
[2010.12.01 21:46:44 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini
[2010.12.01 21:46:39 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.12.01 21:45:50 | 000,000,334 | ---- | C] () -- C:\Windows\Brownie.ini
[2010.11.14 17:08:25 | 000,099,384 | ---- | C] () -- C:\Users\Kai\AppData\Roaming\inst.exe
[2010.11.14 17:08:25 | 000,007,859 | ---- | C] () -- C:\Users\Kai\AppData\Roaming\pcouffin.cat
[2010.11.14 17:08:25 | 000,001,167 | ---- | C] () -- C:\Users\Kai\AppData\Roaming\pcouffin.inf
[2010.11.14 00:06:01 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.11.13 14:37:33 | 001,627,778 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.11.05 18:49:46 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
< End of report >
Da der andere Scan undendlich lang ist muss ich den Post wegen zu vielen Zeichen unterteilen. |
