Trojaner-Board - Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten rein

Das ist der WinBuilder. Mit diesem Tool habe ich mir einen bootbaren Memory Stick erstellt, nachdem ich die Malware entdeckt habe.

WinBuilder (link einfügen geht nicht: -> hxxp://en.wikipedia.org/wiki/WinBuilder)

Habe nun auch noch den ActiveScan laufen lassen. Nix gefunden ausser ein paar Tracking Cookies:

Code:

;***********************************************************************************************************************************************************************************

ANALYSIS: 2012-05-31 21:31:29

PROTECTIONS: 1

MALWARE: 43

SUSPECTS: 0

;***********************************************************************************************************************************************************************************

PROTECTIONS

Description                                  Version                       Active    Updated

;===================================================================================================================================================================================

Microsoft Security Essentials                                              Yes       Yes

;===================================================================================================================================================================================

MALWARE

Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location

;===================================================================================================================================================================================

00139060  Cookie/Casalemedia                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\ku05u0v3.txt

00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\q3xlln6k.txt

00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\zu3pgpe9.txt

00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\peb3gxxm.txt

00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\7yc8a7e7.txt

00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\oeajyy2y.txt

00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\oeajyy2y.txt

00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\7yc8a7e7.txt

00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\1arouc54.txt

00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\1arouc54.txt

00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\zu3pgpe9.txt

00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\peb3gxxm.txt

00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\xizgi6gg.txt

00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\0ewn2zhs.txt

00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dibcj278.txt

00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\7zd15klo.txt

00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\7zd15klo.txt

00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\jg9msep5.txt

00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\1bghls01.txt

00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\1bghls01.txt

00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\lq6z477q.txt

00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\zvf4oohp.txt

00145807  Cookie/Linksynergy                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\swzop4k6.txt

00145807  Cookie/Linksynergy                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\dax9jhbj.txt

00145807  Cookie/Linksynergy                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\t0rmf1dr.txt

00145807  Cookie/Linksynergy                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\t0rmf1dr.txt

00145807  Cookie/Linksynergy                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\dax9jhbj.txt

00145869  Cookie/SpyLog                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\jpk1sfdo.txt

00145869  Cookie/SpyLog                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\jpk1sfdo.txt

00147036  Cookie/Adverserve                  TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\536aejfi.txt

00147036  Cookie/Adverserve                  TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\536aejfi.txt

00147036  Cookie/Adverserve                  TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\ek9smhb2.txt

00147036  Cookie/Adverserve                  TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\lkbxlinx.txt

00147036  Cookie/Adverserve                  TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\c95feb6b.txt

00147036  Cookie/Adverserve                  TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\lkbxlinx.txt

00149116  Cookie/Ccbill                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\nn98apwi.txt

00149116  Cookie/Ccbill                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\d7vfr1kk.txt

00149116  Cookie/Ccbill                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\6a6g340l.txt

00149116  Cookie/Ccbill                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\11ad9fmr.txt

00149116  Cookie/Ccbill                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\11ad9fmr.txt

00149116  Cookie/Ccbill                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\nn98apwi.txt

00149116  Cookie/Ccbill                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\d7vfr1kk.txt

00149116  Cookie/Ccbill                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\6a6g340l.txt

00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\ke4vtfdw.txt

00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\10y3hvo6.txt

00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\10y3hvo6.txt

00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\29juvgzi.txt

00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\29juvgzi.txt

00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\gs0f9dxr.txt

00167647  Cookie/Yadro                       TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\m1nps27u.txt

00167647  Cookie/Yadro                       TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\m1nps27u.txt

00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\q4vmudeu.txt

00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\rvckqcmd.txt

00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\rvckqcmd.txt

00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\q4vmudeu.txt

00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dhzup9oa.txt

00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dhzup9oa.txt

00167724  Cookie/HotLog                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\gtnem7fv.txt

00167724  Cookie/HotLog                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\gtnem7fv.txt

00167744  Cookie/GoStats                     TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\mt76t4lg.txt

00167744  Cookie/GoStats                     TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dk63azwu.txt

00167744  Cookie/GoStats                     TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dk63azwu.txt

00167744  Cookie/GoStats                     TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\mt76t4lg.txt

00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\gk8d4hk2.txt

00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\gbtvb3wg.txt

00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\tvcfypcb.txt

00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\gk8d4hk2.txt

00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\rpg39lzk.txt

00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\tvcfypcb.txt

00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\0y8xmus3.txt

00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\z80d0jmm.txt

00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\mlgo2l4v.txt

00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\avyp5ph1.txt

00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\h1wp66q3.txt

00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\avyp5ph1.txt

00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\0y8xmus3.txt

00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\z80d0jmm.txt

00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\mlgo2l4v.txt

00167756  Cookie/Sexsuche                    TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\f4ltyaxx.txt

00167756  Cookie/Sexsuche                    TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\f4ltyaxx.txt

00167760  Cookie/Hitslink                    TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\axvqq7wy.txt

00167760  Cookie/Hitslink                    TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\b6cdbhb3.txt

00167760  Cookie/Hitslink                    TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\axvqq7wy.txt

00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\1f4w355o.txt

00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\qjz41uc7.txt

00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\h3agq12g.txt

00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\yjuumyyf.txt

00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\39lchpq0.txt

00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\c8zjrh3k.txt

00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\wwn5lypm.txt

00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\h3agq12g.txt

00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\39lchpq0.txt

00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\c8zjrh3k.txt

00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\pqn0apvp.txt

00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\v1j637h9.txt

00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\czl2z1u9.txt

00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\czl2z1u9.txt

00168095  Cookie/888                         TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\dpffwcqb.txt

00168095  Cookie/888                         TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\dpffwcqb.txt

00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\ttc4gv1a.txt

00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\ttc4gv1a.txt

00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dx58ceul.txt

00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\lm3zab6r.txt

00168110  Cookie/Server.iad.Liveperson       TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\0tgzxth3.txt

00168110  Cookie/Server.iad.Liveperson       TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\0tgzxth3.txt

00168110  Cookie/Server.iad.Liveperson       TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\wsx3gl07.txt

00168110  Cookie/Server.iad.Liveperson       TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\wsx3gl07.txt

00168114  Cookie/onestat.com                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\daf1mr5e.txt

00168114  Cookie/onestat.com                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\c9q0nb9q.txt

00168114  Cookie/onestat.com                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\c9q0nb9q.txt

00168114  Cookie/onestat.com                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\daf1mr5e.txt

00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\vgfr6hu0.txt

00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\ukbu89iy.txt

00170304  Cookie/WebtrendsLive               TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\qx1h1z33.txt

00170495  Cookie/PointRoll                   TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\kbtw2vre.txt

00170495  Cookie/PointRoll                   TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\t9gmbwfj.txt

00170495  Cookie/PointRoll                   TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\kbtw2vre.txt

00170495  Cookie/PointRoll                   TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\t9gmbwfj.txt

00170556  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\bw5tg1wj.txt

00170556  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\bw5tg1wj.txt

00170557  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\95f28ssc.txt

00170557  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\95f28ssc.txt

00171982  Cookie/QuestionMarket              TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\0wo1unof.txt

00171982  Cookie/QuestionMarket              TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\0wo1unof.txt

00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\a9gy40e8.txt

00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\ss8qaxqd.txt

00172449  Cookie/MetriWeb                    TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\kidfsoq5.txt

00172449  Cookie/MetriWeb                    TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\kidfsoq5.txt

00182104  Cookie/Hitbox                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\w7qblwdv.txt

00207862  Cookie/did-it                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dab68xc4.txt

00207862  Cookie/did-it                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dab68xc4.txt

00262020  Cookie/Atwola                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\oecos2zi.txt

00262020  Cookie/Atwola                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\5tsqsibz.txt

00262020  Cookie/Atwola                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\aajabxqt.txt

00262020  Cookie/Atwola                      TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\wj8v2u8n.txt

00262020  Cookie/Atwola                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\aajabxqt.txt

00262020  Cookie/Atwola                      TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\oecos2zi.txt

00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\6r17bv04.txt

00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\i2knh3hl.txt

00286732  Cookie/Cgi-bin                     TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\7p6liwhh.txt

00286732  Cookie/Cgi-bin                     TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\7p6liwhh.txt

00286736  Cookie/Cgi-bin                     TrackingCookie      No        0         Yes            No           c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\emf6d93h.txt

00286736  Cookie/Cgi-bin                     TrackingCookie      No        0         Yes            No           h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\emf6d93h.txt

;===================================================================================================================================================================================

SUSPECTS

Sent      Location

;===================================================================================================================================================================================

;===================================================================================================================================================================================

VULNERABILITIES

Id        Severity       Description

;===================================================================================================================================================================================

;===================================================================================================================================================================================

OTL Quick-Scan OHNE Custom Scans

OTL Logfile:

Code:

OTL logfile created on: 01.06.2012 09:39:55 - Run 1

OTL by OldTimer - Version 3.2.44.0     Folder = F:\Downloads\Software

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy

 

15.98 Gb Total Physical Memory | 13.37 Gb Available Physical Memory | 83.67% Memory free

31.95 Gb Paging File | 29.16 Gb Available in Paging File | 91.27% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 238.38 Gb Total Space | 34.55 Gb Free Space | 14.49% Space Free | Partition Type: NTFS

Drive F: | 223.57 Gb Total Space | 26.98 Gb Free Space | 12.07% Space Free | Partition Type: NTFS

Drive Q: | 238.38 Gb Total Space | 34.55 Gb Free Space | 14.49% Space Free | Partition Type: CSC-CACHE

 

Computer Name: *****-PC | User Name: ***** ***** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.05.31 22:31:35 | 000,595,968 | ---- | M] (OldTimer Tools) -- F:\Downloads\Software\OTL.exe

PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.04.04 07:53:56 | 000,312,832 | ---- | M] () -- C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.DEU

MOD - [2011.03.17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf

MOD - [2010.12.21 01:15:30 | 001,041,248 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2011.10.26 04:00:58 | 000,204,288 | ---- | M] (AMD) [Disabled | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2011.06.29 11:51:26 | 000,171,688 | ---- | M] (Intel Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\IPROSetMonitor.exe -- (Intel(R) PROSet Monitoring Service) Intel(R)

SRV:64bit: - [2011.04.12 21:37:20 | 007,681,536 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe -- (MySQL)

SRV:64bit: - [2010.11.20 15:26:50 | 000,084,992 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\Mcx2Svc.dll -- (Mcx2Svc)

SRV:64bit: - [2009.07.14 03:41:27 | 000,097,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\mprdim.dll -- (RemoteAccess)

SRV:64bit: - [2009.07.14 03:41:10 | 000,359,424 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\ipnathlp.dll -- (SharedAccess)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.04.03 17:10:50 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.03.26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV - [2012.03.26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.11.29 18:07:55 | 003,483,600 | ---- | M] (Acronis) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe -- (afcdpsrv)

SRV - [2011.11.10 11:10:16 | 005,899,240 | ---- | M] (Acronis) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe -- (syncagentsrv)

SRV - [2011.11.10 11:09:44 | 001,124,616 | ---- | M] (Acronis) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)

SRV - [2011.09.19 09:40:00 | 001,406,080 | R--- | M] (ASUSTeK Computer Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\ASUS\AsusFanControlService\1.00.08\AsusFanControlService.exe -- (AsusFanControlService)

SRV - [2011.08.09 04:56:04 | 000,947,328 | R--- | M] (ASUSTeK Computer Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\ASUS\AAHM\1.00.15\aaHMSvc.exe -- (asHmComSvc)

SRV - [2011.08.09 04:55:00 | 000,918,144 | R--- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\ASUS\AXSP\1.00.16\atkexComSvc.exe -- (asComSvc)

SRV - [2011.06.12 11:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)

SRV - [2011.05.24 10:33:30 | 001,840,128 | ---- | M] (MAGIX AG) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)

SRV - [2011.05.05 22:36:05 | 000,022,528 | ---- | M] () [Disabled | Stopped] -- C:\Programme\DAZ 3D\Content Management Service\ContentManagementServer.exe -- (DAZContentManagementService)

SRV - [2011.04.26 13:54:12 | 002,702,848 | ---- | M] (MAGIX®) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)

SRV - [2011.04.01 20:17:08 | 000,067,400 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\IIS\Microsoft Web Deploy\MsDepSvc.exe -- (MsDepSvc)

SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS)

SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC)

SRV - [2010.11.20 14:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc)

SRV - [2010.10.21 11:52:26 | 000,586,880 | R--- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe -- (AsSysCtrlService)

SRV - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)

SRV - [2010.08.26 02:17:22 | 000,134,944 | ---- | M] (Nuance Communications, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Nuance\PDF Professional 7\PDFProFiltSrv.exe -- (PDFProFiltSrv)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)

SRV - [2009.07.14 03:15:41 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysWOW64\mprdim.dll -- (RemoteAccess)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009.06.10 22:39:58 | 000,089,920 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_64)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012.03.20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.12.01 19:35:06 | 000,230,864 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt)

DRV:64bit: - [2011.11.29 18:08:00 | 000,367,200 | ---- | M] (Acronis) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\afcdp.sys -- (afcdp)

DRV:64bit: - [2011.11.29 18:07:52 | 001,285,216 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\tdrpman.sys -- (tdrpman)

DRV:64bit: - [2011.11.29 18:07:47 | 000,986,208 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\timntr.sys -- (timounter)

DRV:64bit: - [2011.11.29 18:07:31 | 000,211,040 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vididr.sys -- (vididr)

DRV:64bit: - [2011.11.29 18:07:24 | 000,142,944 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vsflt61.sys -- (vidsflt61) Acronis Disk Storage Filter (61)

DRV:64bit: - [2011.11.29 18:07:21 | 000,310,368 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\snapman.sys -- (snapman)

DRV:64bit: - [2011.11.29 18:07:17 | 000,133,728 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\fltsrv.sys -- (fltsrv)

DRV:64bit: - [2011.11.14 13:02:30 | 000,340,008 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Si3124r5.sys -- (Si3124r5)

DRV:64bit: - [2011.11.14 13:02:30 | 000,022,568 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SiWinAcc.sys -- (SiFilter)

DRV:64bit: - [2011.11.14 13:02:30 | 000,016,936 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SiRemFil.sys -- (SiRemFil)

DRV:64bit: - [2011.10.26 05:05:10 | 010,496,512 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2011.10.26 03:21:58 | 000,326,656 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2011.10.07 10:24:12 | 000,152,064 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ser2pl64.sys -- (Ser2pl)

DRV:64bit: - [2011.09.14 18:05:34 | 000,394,216 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci)

DRV:64bit: - [2011.09.14 18:05:34 | 000,129,000 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3)

DRV:64bit: - [2011.08.15 11:30:04 | 000,056,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)

DRV:64bit: - [2011.08.09 07:42:36 | 000,315,696 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mvs91xx.sys -- (mvs91xx)

DRV:64bit: - [2011.08.01 15:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)

DRV:64bit: - [2011.07.20 03:37:56 | 000,342,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress) Intel(R)

DRV:64bit: - [2011.06.10 07:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2011.06.07 00:07:00 | 000,231,440 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2011.05.18 08:08:32 | 000,047,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB)

DRV:64bit: - [2011.05.17 16:44:46 | 000,044,480 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\libusb0.sys -- (libusb0)

DRV:64bit: - [2011.03.23 16:41:28 | 000,036,448 | ---- | M] (Asmedia Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\asahci64.sys -- (asahci64)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.12.17 00:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2010.11.20 11:26:11 | 000,328,192 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\udfs.sys -- (udfs)

DRV:64bit: - [2010.09.21 10:07:08 | 000,312,184 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ArcSec.sys -- (ArcSec)

DRV:64bit: - [2010.08.17 19:28:32 | 000,026,136 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ICCWDT.sys -- (ICCWDT) Intel(R) Watchdog Timer Driver (Intel(R) WDT)

DRV:64bit: - [2010.04.27 09:30:52 | 000,184,968 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)

DRV:64bit: - [2010.04.27 09:29:54 | 000,083,080 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)

DRV:64bit: - [2010.03.10 09:02:18 | 000,102,624 | R--- | M] (Mobile Action Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\gpslc64.sys -- (gpslc64)

DRV:64bit: - [2009.08.09 23:25:45 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:47:48 | 000,024,144 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\crcdisk.sys -- (crcdisk)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\ws2ifsl.sys -- (ws2ifsl)

DRV:64bit: - [2009.07.14 01:19:47 | 000,092,160 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\cdfs.sys -- (cdfs)

DRV:64bit: - [2009.06.30 10:37:16 | 000,033,800 | ---- | M] (Panda Security, S.L.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\pavboot64.sys -- (pavboot)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2008.01.19 01:10:30 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)

DRV:64bit: - [2005.03.29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - SOFTWARE\Classes\CLSID\{7e111a5c-3d11-4f56-9463-5310c3c69025}\InprocServer32 File not found

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.heise.de/

IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ch.msn.com/default.aspx?ocid=iehp

IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-CH

IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 70 30 73 DB A2 61 CC 01  [binary data]

IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - SOFTWARE\Classes\CLSID\{7e111a5c-3d11-4f56-9463-5310c3c69025}\InprocServer32 File not found

IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\..\SearchScopes,DefaultScope = {D492C723-FCAA-44C1-8975-8E64552FE353}

IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\..\SearchScopes\{5B59ED8B-AB3D-46FA-823E-398A5EDF1EE2}: "URL" = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms}

IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\..\SearchScopes\{D492C723-FCAA-44C1-8975-8E64552FE353}: "URL" = hxxp://www.google.ch/search?q={searchTerms}

IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: ""

FF - prefs.js..browser.search.defaultthis.engineName: "Freeware.de Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2736476&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.selectedEngine: ""

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..network.proxy.type: 0

 

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.0: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.4: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.4: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()

FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Program Files (x86)\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\***** *****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKCU\Software\MozillaPlugins\microsoft.com/DpeCiDetectorPlugin: C:\Users\***** *****\AppData\Local\Apps\2.0\3JV2876W.ZM7\O8RN4POV.048\cont..tion_c3bce3770c238a49_0001.0000_cd0e32ce0c5b3ab8\npDpeCiDetectorPlugin.dll (Microsoft)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.05.10 13:01:47 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2011.08.30 08:37:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***** *****\AppData\Roaming\mozilla\Extensions

[2012.05.12 22:19:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***** *****\AppData\Roaming\mozilla\Firefox\Profiles\k00bo4vt.default\extensions

[2012.05.10 13:01:47 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.04.21 03:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.04.21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.04.21 03:54:08 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.04.21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.04.21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.04.21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.04.21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2012.05.07 18:04:35 | 000,001,398 | RHS- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O1 - Hosts: 93.115.241.27 www.google-analytics.com.

O1 - Hosts: 93.115.241.27 ad-emea.doubleclick.net.

O1 - Hosts: 93.115.241.27 www.statcounter.com.

O1 - Hosts: 108.163.215.51 www.google-analytics.com.

O1 - Hosts: 108.163.215.51 ad-emea.doubleclick.net.

O1 - Hosts: 108.163.215.51 www.statcounter.com.

O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll File not found

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll File not found

O2:64bit: - BHO: (no name) - AutorunsDisabled - No CLSID value found.

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found.

O3 - HKLM\..\Toolbar: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll File not found

O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1

O7 - HKU\S-1-5-21-3339107563-512239636-558935408-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 File not found

O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)

O8:64bit: - Extra context menu item: Inhalt der ausgewählten Links an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)

O8:64bit: - Extra context menu item: Linkinhalt an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)

O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found

O8:64bit: - Extra context menu item: PDF-Datei aus Linkinhalt erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)

O8:64bit: - Extra context menu item: PDF-Datei erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)

O8:64bit: - Extra context menu item: PDF-Dateien aus den ausgewählten Links erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: An vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)

O8 - Extra context menu item: Inhalt der ausgewählten Links an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)

O8 - Extra context menu item: Linkinhalt an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: PDF-Datei aus Linkinhalt erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)

O8 - Extra context menu item: PDF-Datei erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)

O8 - Extra context menu item: PDF-Dateien aus den ausgewählten Links erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)

O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.de/common/asusTek_sys_ctrl.cab (asusTek_sysctrl Class)

O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Reg Error: Key error.)

O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.6.0.cab (DLM Control)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)

O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{928B20C8-9DCE-4683-92D8-6850A87AF2FA}: DhcpNameServer = 10.0.3.10 10.0.3.11

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{928B20C8-9DCE-4683-92D8-6850A87AF2FA}: Domain = *****.******.****

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{928B20C8-9DCE-4683-92D8-6850A87AF2FA}: NameServer = 10.0.3.10 10.0.3.11

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B4827602-B9CD-4900-8CA2-1A87B729BC06}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E1DBC193-78EA-4388-8106-53D58B8FAA89}: DhcpNameServer = 192.168.1.1

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{2e634b82-cd94-11e0-9ac6-bcaec5159772}\Shell - "" = AutoRun

O33 - MountPoints2\{2e634b82-cd94-11e0-9ac6-bcaec5159772}\Shell\AutoRun\command - "" = E:\setup.exe

O33 - MountPoints2\{ebab1660-3a42-11e1-b5e6-5404a62f3bca}\Shell - "" = AutoRun

O33 - MountPoints2\{ebab1660-3a42-11e1-b5e6-5404a62f3bca}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL H:\Win-Azure.pdf

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.05.31 18:49:05 | 000,033,800 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysNative\drivers\pavboot64.sys

[2012.05.31 18:49:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Panda Security

[2012.05.31 12:56:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.05.31 09:56:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy

[2012.05.31 09:56:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy

[2012.05.31 09:56:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy

[2012.05.30 18:07:22 | 000,000,000 | ---D | C] -- C:\Users\***** *****\AppData\Roaming\Malwarebytes

[2012.05.30 18:07:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.05.30 18:07:16 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.05.30 18:07:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.05.30 18:07:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.05.30 16:59:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Samsung

[2012.05.30 16:56:11 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.05.30 16:23:51 | 000,000,000 | RHSD | C] -- C:\acroldr

[2012.05.25 00:15:06 | 000,000,000 | ---D | C] -- C:\Users\***** *****\AppData\Roaming\FrontDesign

[2012.05.25 00:14:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Frontplatten Designer

[2012.05.25 00:14:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FrontDesign

[2012.05.21 18:53:58 | 000,000,000 | ---D | C] -- C:\Users\***** *****\AppData\Roaming\Crosshairs Embedded

[2012.05.21 18:53:08 | 000,000,000 | ---D | C] -- C:\Users\***** *****\Documents\Crosshairs Embedded

[2012.05.21 18:20:01 | 000,000,000 | ---D | C] -- C:\Users\***** *****\AppData\Roaming\controlSUITE

[2012.05.21 18:19:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\controlSUITE

[2012.05.21 18:17:14 | 000,000,000 | ---D | C] -- C:\Program Files\controlSUITE

[2012.05.15 14:39:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN

[2012.05.15 14:31:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2012.05.14 23:01:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab

[2012.05.12 19:11:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Ant

[2012.05.12 12:36:21 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files

[2012.05.12 12:31:13 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData

[2012.05.12 01:56:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

[2012.05.12 01:56:15 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight

[2012.05.10 22:41:19 | 000,000,000 | ---D | C] -- C:\WinPEx64

[2012.05.10 22:25:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows AIK

[2012.05.10 22:25:27 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Imaging

[2012.05.10 22:25:23 | 000,000,000 | ---D | C] -- C:\Program Files\Windows AIK

[2012.05.09 23:34:34 | 000,000,000 | ---D | C] -- C:\Windows\pss

[2012.05.07 19:43:24 | 000,000,000 | ---D | C] -- C:\Users\***** *****\AppData\Roaming\AllDup

[2012.05.07 19:43:07 | 002,369,456 | ---- | C] (Codejock Software) -- C:\Windows\SysWow64\Codejock.CommandBars.v13.4.2.ocx

[2012.05.07 19:43:07 | 001,000,992 | ---- | C] (Bennet-Tec Information Systems, Inc) -- C:\Windows\SysWow64\TList8.ocx

[2012.05.07 19:43:07 | 000,450,560 | ---- | C] (LogicNP Software (hxxp://www.ssware.com)) -- C:\Windows\SysWow64\fldrvw90.ocx

[2012.05.07 19:43:07 | 000,171,752 | ---- | C] (Michael Thummerer Software Design) -- C:\Windows\SysWow64\mtRTF2.ocx

[2012.05.07 19:43:07 | 000,089,888 | ---- | C] (Michael Thummerer Software Design) -- C:\Windows\SysWow64\mtFrame.ocx

[2012.05.07 19:43:07 | 000,077,504 | ---- | C] (Michael Thummerer Software Design) -- C:\Windows\SysWow64\mtScrollContainer.ocx

[2012.05.07 19:43:07 | 000,044,736 | ---- | C] (Michael Thummerer Software Design) -- C:\Windows\SysWow64\mtSubclass.dll

[2012.05.07 19:43:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AllDup

[2012.05.07 19:43:07 | 000,000,000 | ---D | C] -- C:\ProgramData\AllDup

[2012.05.07 19:43:06 | 000,086,016 | ---- | C] (Michael Thummerer Software Design) -- C:\Windows\SysWow64\mtSplitter.ocx

[2012.05.07 19:43:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AllDup

[2012.05.06 13:54:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AbleMP3

[2012.05.06 01:45:07 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\MAGIX_Music_Maker_MX_Production_Suite

[2012.05.04 10:20:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client

[2012.05.04 10:20:00 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client

[2012.05.04 10:04:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Systernals

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.06.01 08:51:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.06.01 08:48:38 | 000,014,848 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.06.01 08:48:38 | 000,014,848 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.06.01 08:45:45 | 001,806,450 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.06.01 08:45:45 | 000,773,364 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.06.01 08:45:45 | 000,715,840 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.06.01 08:45:45 | 000,174,948 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.06.01 08:45:45 | 000,142,886 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.06.01 08:41:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.06.01 08:41:24 | 4276,207,614 | -HS- | M] () -- C:\hiberfil.sys

[2012.05.31 18:32:41 | 000,001,346 | ---- | M] () -- C:\Users\***** *****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk

[2012.05.31 11:23:53 | 000,002,073 | ---- | M] () -- C:\Users\Public\Desktop\Lightroom 4.1 64-Bit.lnk

[2012.05.31 09:56:40 | 000,001,264 | ---- | M] () -- C:\Users\***** *****\Desktop\Spybot - Search & Destroy.lnk

[2012.05.31 08:48:34 | 000,002,050 | ---- | M] () -- C:\Users\***** *****\Documents\xRM-Entwicklung.RDP

[2012.05.30 18:07:18 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.05.30 17:06:57 | 000,504,016 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.05.30 16:55:53 | 000,000,866 | ---- | M] () -- C:\Windows\SysWow64\InstallUtil.InstallLog

[2012.05.28 17:53:10 | 000,000,218 | ---- | M] () -- C:\Users\***** *****\.recently-used.xbel

[2012.05.28 14:34:59 | 000,000,063 | ---- | M] () -- C:\Users\***** *****\.gtk-bookmarks

[2012.05.27 22:34:54 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI

[2012.05.27 20:50:40 | 000,001,299 | ---- | M] () -- C:\Users\***** *****\Documents\Frontplatte_37x30mm.fpd

[2012.05.27 20:49:20 | 000,001,299 | ---- | M] () -- C:\Users\***** *****\Documents\Frontplatte_37x30mm.bak

[2012.05.25 17:03:34 | 000,001,470 | ---- | M] () -- C:\Users\***** *****\swissmap.properties

[2012.05.22 23:06:17 | 000,042,625 | ---- | M] () -- C:\Windows\SysWow64\6.skb

[2012.05.22 23:01:15 | 000,037,681 | ---- | M] () -- C:\Windows\SysWow64\5.skb

[2012.05.22 22:56:10 | 000,019,378 | ---- | M] () -- C:\Windows\SysWow64\4.skb

[2012.05.22 12:58:23 | 000,098,871 | ---- | M] () -- C:\Users\***** *****\Desktop\2.skb

[2012.05.22 12:53:22 | 000,022,355 | ---- | M] () -- C:\Users\***** *****\Desktop\1.skb

[2012.05.22 12:45:26 | 000,019,720 | ---- | M] () -- C:\Users\***** *****\Desktop\0.skb

[2012.05.22 00:15:22 | 000,030,779 | ---- | M] () -- C:\Windows\SysWow64\3.skb

[2012.05.22 00:08:58 | 000,028,544 | ---- | M] () -- C:\Windows\SysWow64\2.skb

[2012.05.22 00:03:10 | 000,028,708 | ---- | M] () -- C:\Windows\SysWow64\1.skb

[2012.05.21 23:58:06 | 000,010,740 | ---- | M] () -- C:\Windows\SysWow64\0.skb

[2012.05.18 18:34:21 | 000,002,070 | ---- | M] () -- C:\Users\***** *****\Documents\HostEurope_xRM.RDP

[2012.05.17 14:47:43 | 000,178,237 | ---- | M] () -- C:\Users\***** *****\Documents\100km2012.xml

[2012.05.15 17:35:39 | 000,334,720 | ---- | M] (Sysinternals - www.sysinternals.com) -- C:\Windows\SysNative\RootkitRevealer.exe

[2012.05.14 13:34:48 | 000,129,533 | ---- | M] () -- C:\Users\***** *****\Documents\IntelliPlanArchive.zip

[2012.05.10 13:41:41 | 000,107,991 | ---- | M] () -- C:\Users\***** *****\Documents\Track_26km.gpx

[2012.05.10 13:41:21 | 000,103,030 | ---- | M] () -- C:\Users\***** *****\Documents\Route_26km.gpx

[2012.05.10 13:01:56 | 000,001,136 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.05.07 19:43:07 | 000,000,985 | ---- | M] () -- C:\Users\Public\Desktop\AllDup.lnk

[2012.05.07 18:04:35 | 000,001,398 | RHS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2012.05.06 01:45:34 | 000,001,096 | ---- | M] () -- C:\Users\Public\Desktop\MAGIX Music Maker MX Production Suite Download-Version.lnk

[2012.05.04 10:20:48 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif

[2012.05.04 10:20:11 | 001,831,984 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI

 
 ========== Files Created - No Company Name ==========

 

[2012.05.31 18:32:41 | 000,001,346 | ---- | C] () -- C:\Users\***** *****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk

[2012.05.31 11:23:53 | 000,002,081 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Lightroom 4.1 64-Bit.lnk

[2012.05.31 11:23:53 | 000,002,073 | ---- | C] () -- C:\Users\Public\Desktop\Lightroom 4.1 64-Bit.lnk

[2012.05.31 09:56:40 | 000,001,264 | ---- | C] () -- C:\Users\***** *****\Desktop\Spybot - Search & Destroy.lnk

[2012.05.31 08:45:54 | 000,002,050 | ---- | C] () -- C:\Users\***** *****\Documents\xRM-Entwicklung.RDP

[2012.05.30 18:07:18 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.05.28 17:53:10 | 000,000,218 | ---- | C] () -- C:\Users\***** *****\.recently-used.xbel

[2012.05.28 14:34:59 | 000,000,063 | ---- | C] () -- C:\Users\***** *****\.gtk-bookmarks

[2012.05.25 00:17:48 | 000,001,299 | ---- | C] () -- C:\Users\***** *****\Documents\Frontplatte_37x30mm.fpd

[2012.05.25 00:17:48 | 000,001,299 | ---- | C] () -- C:\Users\***** *****\Documents\Frontplatte_37x30mm.bak

[2012.05.22 23:06:17 | 000,042,625 | ---- | C] () -- C:\Windows\SysWow64\6.skb

[2012.05.22 23:01:15 | 000,037,681 | ---- | C] () -- C:\Windows\SysWow64\5.skb

[2012.05.22 22:56:10 | 000,019,378 | ---- | C] () -- C:\Windows\SysWow64\4.skb

[2012.05.22 12:58:23 | 000,098,871 | ---- | C] () -- C:\Users\***** *****\Desktop\2.skb

[2012.05.22 12:53:22 | 000,022,355 | ---- | C] () -- C:\Users\***** *****\Desktop\1.skb

[2012.05.22 12:45:26 | 000,019,720 | ---- | C] () -- C:\Users\***** *****\Desktop\0.skb

[2012.05.22 00:15:22 | 000,030,779 | ---- | C] () -- C:\Windows\SysWow64\3.skb

[2012.05.22 00:08:58 | 000,028,544 | ---- | C] () -- C:\Windows\SysWow64\2.skb

[2012.05.22 00:03:10 | 000,028,708 | ---- | C] () -- C:\Windows\SysWow64\1.skb

[2012.05.21 23:58:06 | 000,010,740 | ---- | C] () -- C:\Windows\SysWow64\0.skb

[2012.05.18 18:34:21 | 000,002,070 | ---- | C] () -- C:\Users\***** *****\Documents\HostEurope_xRM.RDP

[2012.05.17 14:47:43 | 000,178,237 | ---- | C] () -- C:\Users\***** *****\Documents\100km2012.xml

[2012.05.10 13:41:41 | 000,107,991 | ---- | C] () -- C:\Users\***** *****\Documents\Track_26km.gpx

[2012.05.10 13:41:21 | 000,103,030 | ---- | C] () -- C:\Users\***** *****\Documents\Route_26km.gpx

[2012.05.10 13:01:56 | 000,001,136 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.05.07 19:43:07 | 000,000,985 | ---- | C] () -- C:\Users\Public\Desktop\AllDup.lnk

[2012.05.06 01:45:34 | 000,001,096 | ---- | C] () -- C:\Users\Public\Desktop\MAGIX Music Maker MX Production Suite Download-Version.lnk

[2012.05.04 10:20:28 | 000,001,921 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk

[2012.04.22 11:04:46 | 000,159,527 | ---- | C] () -- C:\Windows\FlyChart Uninstaller.exe

[2012.04.22 10:59:22 | 000,159,866 | ---- | C] () -- C:\Windows\FlyChart Uninstaller.exe.bak

[2012.03.31 00:45:22 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll

[2012.03.30 23:50:40 | 000,000,046 | ---- | C] () -- C:\Windows\SysWow64\DonationCoder_urlsnooper_InstallInfo.dat

[2012.01.31 19:15:42 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll

[2012.01.31 19:15:42 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll

[2012.01.31 19:15:42 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll

[2012.01.31 19:15:42 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll

[2011.12.06 01:35:05 | 000,000,000 | ---- | C] () -- C:\Windows\gconf.INI

[2011.12.01 20:16:46 | 005,506,256 | ---- | C] () -- C:\Windows\PE_File.dll

[2011.12.01 20:13:41 | 005,444,880 | ---- | C] () -- C:\Windows\PE_Rom.dll

[2011.12.01 17:25:38 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys

[2011.11.29 16:27:39 | 000,043,736 | ---- | C] () -- C:\Windows\Ascd_log.ini

[2011.11.29 16:14:59 | 000,036,550 | ---- | C] () -- C:\Windows\Ascd_tmp.ini

[2011.11.10 15:30:55 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib

[2011.10.26 03:38:38 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat

[2011.10.26 03:38:38 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat

[2011.10.25 22:21:48 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll

[2011.10.25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll

[2011.09.14 12:47:40 | 000,053,760 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll

[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2011.08.23 16:41:08 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI

[2011.08.23 16:41:08 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\bd9045cd.dat

[2011.08.23 16:41:08 | 000,000,026 | ---- | C] () -- C:\Windows\BRPP2KA.INI

[2011.08.23 16:40:23 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL

[2011.08.23 16:40:21 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI

[2011.08.23 16:30:55 | 001,831,984 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011.08.23 16:07:48 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.08.23 15:28:48 | 000,013,440 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys

[2011.08.23 15:21:29 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini

[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

[2010.08.03 07:21:24 | 000,014,464 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsUpIO.sys

 
 ========== LOP Check ==========

 

[2012.05.21 19:34:56 | 000,000,000 | ---D | M] -- C:\Users\a0273787\AppData\Roaming\Texas Instruments, Inc

[2011.11.29 18:09:21 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Acronis

[2012.05.07 23:58:28 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\AllDup

[2012.03.28 21:59:05 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Amazon

[2012.05.04 09:42:36 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Biep

[2011.12.20 21:10:21 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Blender Foundation

[2012.03.30 23:22:55 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Bolide(R) Software

[2011.11.06 10:58:04 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

[2011.09.09 21:17:17 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

[2012.05.30 21:04:17 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\controlSUITE

[2012.05.21 18:53:58 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Crosshairs Embedded

[2011.12.24 01:25:13 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\DAZ 3D

[2012.04.29 12:31:06 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\digital publishing

[2012.03.30 23:50:40 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\DonationCoder

[2012.05.24 23:29:22 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\FileZilla

[2011.11.28 22:22:44 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\FreeCommander

[2012.05.25 00:15:07 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\FrontDesign

[2011.09.03 16:28:06 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\GARMIN

[2011.12.10 20:16:42 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\GHISLER

[2012.05.28 14:38:23 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\gtk-2.0

[2011.12.08 02:08:05 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\ibf

[2011.09.08 19:10:09 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\ImgBurn

[2012.05.06 01:54:12 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\MAGIX

[2012.05.23 17:33:50 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\MediaMonkey

[2011.09.22 18:47:19 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Mobile Action

[2011.11.05 21:39:26 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\MySQL

[2011.08.31 23:10:38 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Nuance

[2012.01.25 23:14:26 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\pdfforge

[2011.12.23 13:38:54 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Poser Debut

[2011.08.30 00:06:30 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\proDAD

[2011.11.14 12:31:44 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\PTGui

[2012.02.27 18:36:47 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Samsung

[2011.11.13 14:00:39 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\TrueCrypt

[2011.12.22 23:59:26 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Unity

[2011.08.29 22:19:37 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Windows Live Writer

[2012.04.25 09:17:32 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Ybxow

[2012.05.02 21:28:14 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Zaux

[2011.08.23 18:52:03 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Zeon

[2012.04.28 21:48:21 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 195 bytes -> C:\ProgramData\TEMP:0574215C
 

< End of report >

--- --- ---