Trojaner-Board - Mein Internet Explorer öffnet von alleine und zeigt mir ständig werbungen

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Mein Internet Explorer öffnet von alleine und zeigt mir ständig werbungen (https://www.trojaner-board.de/92181-internet-explorer-oeffnet-alleine-zeigt-mir-staendig-werbungen.html)

Mein Internet Explorer öffnet von alleine und zeigt mir ständig werbungen

Hallo Zusammen, ich bitte um Hilfe , wie ich im forum gelesen habe , sollte ich hijackthis verwenden, habe ich gemacht, aber ich kenne mich dem programm garnicht aus hier die meine daten:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:37:49, on 24.10.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18975)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
D:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\Xwovia.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
D:\Mozilla Firefox\firefox.exe
D:\Mozilla Firefox\plugin-container.exe
C:\Users\***\AppData\Local\Temp\Xtx.exe
C:\Users\***\Desktop\HiJackThis204.exe
C:\Windows\system32\SearchProtocolHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1008&m=aspire_6930g
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1008&m=aspire_6930g
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1008&m=aspire_6930g
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AdblockIE - {90EFF544-3981-4d46-85C9-C0361D0931D6} - mscoree.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [LManager] D:\Program Files\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [KOO9RV9K4Z] C:\Users\Kerim\AppData\Local\Temp\Xtx.exe
O4 - HKCU\..\Run: [X3EKEPXJP2] C:\Windows\Xwovia.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O8 - Extra context menu item: &Block This Image (ABP) - D:\Program Files\Adblock Pro\blockimg.html
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - d:ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - d:ICQ6.5\ICQ.exe
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
O20 - Winlogon Notify: spba - C:\Program Files\Common Files\SPBA\homefus2.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iGroupTec Service (IGBASVC) - Unknown owner - C:\Program Files\Acer\Acer Bio Protection\BASVC.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Realtek11nSU - Realtek - C:\Program Files\Realtek\11n USB Wireless LAN Utility\RtlService.exe
O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9177 bytes

Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:

Zitat:

"Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
- da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
- also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
Charakteristische Merkmale/Profilinformationen:
- aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] ersetzen
Die Systemprüfung und Bereinigung:
- kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
Innerhalb der Betreuungszeit:
- ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
Die Reihenfolge:
- genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
Ansonsten unsere Forumsregeln:
- Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?

Alle Logfile mit einem vB Code Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen:)

Zitat:

Wenn ein System kompromittiert wurde, ist das System nicht mehr vertrauenswürdig
Eine Neuinstallation garantiert die rückstandsfreie Entfernung der Infektion - Sicherheitskonzept v. SETI@home/Punkt 1.

Falls du doch für die Systemreinigung entscheidest - Ein System zu bereinigen kann ein paar Tage dauern (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst::

1.
- Lade dir RSIT - Random's System Information Tool (RSIT) von random/random herunter
- an einen Ort deiner Wahl und führe die rsit.exe aus
- wird "Hijackthis" auch von Rsit installiert und ausgeführt
- RSIT erstellt 2 Logfiles (C:\rsit\log.txt und C:\rsit\info.txt) mit erweiterten Infos von deinem System - diese beide bitte komplett hier posten
**Kannst Du das Log in Textdatei speichern und hier anhängen (auf "Erweitert" klicken)

2.
Bitte Versteckte - und Systemdateien sichtbar machen den Link hier anklicken:
System-Dateien und -Ordner unter XP und Vista sichtbar machen
Am Ende unserer Arbeit, kannst wieder rückgängig machen!

3.
→ Lade Dir HJTscanlist.zip herunter
→ entpacke die Datei auf deinem Desktop
→ Bei WindowsXP Home musst vor dem Scan zusätzlich tasklist.zip installieren
→ per Doppelklick starten
→ Wähle dein Betriebsystem aus - bei Win7 wähle Vista
→ Wenn Du gefragt wirst, die Option "Einstellung" (1) - scanlist" wählen
→ Nach kurzer Zeit sollte sich Dein Editor öffnen und die Datei hjtscanlist.txt präsentieren
→ Bitte kopiere den Inhalt hier in Deinen Thread.

4.
Ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool "Ccleaner" herunter
installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ falls nötig - unter Options settings-> "german" einstellen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

5.
→ besuche die Seite von virustotal und die Datei/en aus Codebox bitte prüfen lassen - nklusive Dateigröße und Name, MD5 und SHA1 auch mitkopieren:
→ Tipps für die Suche nach Dateien

Code:

C:\Windows\Xwovia.exe

→ Klicke auf "Durchsuchen"
→ Suche die Datei auf deinem Rechner→ Doppelklick auf die zu prüfende Datei (oder kopiere den Inhalt ab aus der Codebox)
→ "Senden der Datei" und Warte, bis der Scandurchlauf aller Virenscanner beendet ist
→ das Ergebnis wie Du es bekommst (NICHT AUSLASSEN!) da reinkoperen (inklusive <geprüfter Dateiname> + Dateigröße und Name, MD5 und SHA1)

** Beispiel - das zu postende Logfile von Virustotal soll so wie hier aussehen Also nicht auslassen, sondern wie Du es bekommst da reinkopieren!:

Code:

Datei  File name:
 <hier kommt die Dateiname>

Submission date:

2010-10-22 03:34:01 (UTC)

Current status:

queued queued analysing finished

Result:

.....%

    

VT Community
 

goodware/badware

 Safety score: 100.0% 

Compact

Print results

Antivirus     Version     Last Update     Result

AhnLab-V3    2010.10.22.00    2010.10.21    -

AntiVir    7.10.13.15    2010.10.21    -

Antiy-AVL    2.0.3.7    2010.10.22    -

Authentium    5.2.0.5    2010.10.22    -

Avast    4.8.1351.0    2010.10.21    -

Avast5    5.0.594.0    2010.10.21    -

usw........
 

...werden gepprüft v. mehr wie 40 Online Virus Scanner...also Geduld!!

Zitat:

Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B hjtsanlist o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]

** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw

gruß
Coverflow

Hallo danke für deine Hilfe . Hier sind die folgenden logs reihe nach:

C:\rsit\log.txt

RSIT Logfile:

Code:

Logfile of random's system information tool 1.08 (written by random/random)

Run by Kerim at 2010-10-25 19:01:28

Microsoft® Windows Vista™ Home Premium  Service Pack 2

System drive C: has 92 GB (62%) free of 148 GB

Total RAM: 3066 MB (51% free)
 
 

======Scheduled tasks folder======
 

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

C:\Windows\tasks\User_Feed_Synchronization-{5A0D5830-462D-4450-901E-10C1E3C1B043}.job

C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job

C:\Windows\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
 

======Registry dump======
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]

Spybot-S&D IE Protection - D:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}]

ShowBarObj Class - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll [2008-05-14 312880]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{90EFF544-3981-4d46-85C9-C0361D0931D6}]

af0.Adblock.BHO - C:\Windows\system32\mscoree.dll [2009-11-08 297808]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-12 278192]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]

Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll [2010-09-29 842296]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-10-24 41760]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll [2008-05-14 142896]

{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-12 278192]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]

"eRecoveryService"= []

"LManager"=D:\Program Files\Launch Manager\LManager.exe [2009-03-05 805384]

"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-03-02 282792]

"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]

"KOO9RV9K4Z"=C:\Users\Kerim\AppData\Local\Temp\Xtx.exe [2010-10-23 274432]

"X3EKEPXJP2"=C:\Windows\Xwovia.exe [2010-10-23 266240]

"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-12-01 68856]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2007-03-08 40048]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]

D:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2008-09-02 205256]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcadeDeluxeAgent]

C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [2008-07-24 147456]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]

C:\Program Files\Cyberlink\Shared files\brs.exe [2010-03-13 75048]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BkupTray]

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe [2008-04-25 28672]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]

C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe [2008-07-24 167936]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

D:\Program Files\DAEMON Tools Lite\DTLite.exe -autorun []
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eAudio]

C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe [2008-05-30 544768]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]

C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe [2008-05-14 526896]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]

C:\Windows\ehome\ehTray.exe [2008-01-21 125952]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]

C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [2008-08-01 405504]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-12-01 24064]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]

C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2008-07-20 182808]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

D:\Program Files\iTunes\iTunesHelper.exe [2010-07-21 141608]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]

C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE [2008-06-04 817672]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

C:\Windows\system32\NvCpl.dll [2008-07-18 13543968]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

C:\Windows\system32\NvMcTray.dll [2008-07-18 92704]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]

D:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe -onlytray []
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlayMovie]

C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe [2008-07-18 167936]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PLFSetI]

C:\Windows\PLFSetI.exe [2007-10-23 200704]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

D:\QuickTime\QTTask.exe [2010-03-17 421888]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl10]

D:\Program Files\CyberLink\PowerDVD10\PowerDVD10\PDVD10Serv.exe [2010-02-03 87336]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]

C:\Windows\RtHDVCpl.exe [2008-05-07 6139904]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]

C:\Windows\Skytel.exe [2007-11-20 1826816]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-12-01 68856]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-04-25 1049896]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TQ566808]

F:\Setup.exe []
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WarReg_PopUp]

C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe [2008-01-29 303104]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WheelMouse]

C:\ADVANC~1\wh_exec.exe [2007-11-10 98304]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

d:\Winamp\winampa.exe [2008-08-04 36352]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZPdtWzdVitaKey MC3000]

C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe [2008-10-11 3676160]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk]

C:\PROGRA~1\Acer\ACERVC~1\AcerVCM.exe [2008-03-05 1216512]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Kerim^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Orion.lnk]

C:\PROGRA~1\CONVES~1\Orion\MESSEN~1.EXE  []
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"="C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AWinNotifyVitaKey MC3000]

C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll [2008-10-11 3197952]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\spba]

C:\Program Files\Common Files\SPBA\homefus2.dll [2008-03-25 567560]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]

"notification packages"=scecli

C:\Program Files\Acer\Acer Bio Protection\PwdFilter
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

"EnableUIADesktopToggle"=0

"DisableCAD"=1
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"BindDirectlyToPropertySetStorage"=0
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
 

======File associations======
 

.js - edit - C:\Windows\System32\Notepad.exe %1

.js - open - C:\Windows\System32\WScript.exe "%1" %*
 

======List of files/folders created in the last 1 months======
 

2010-10-25 19:01:29 ----D---- C:\Program Files\trend micro

2010-10-25 19:01:28 ----D---- C:\rsit

2010-10-24 12:50:04 ----SHD---- C:\Config.Msi

2010-10-24 11:45:39 ----N---- C:\Windows\system32\MpSigStub.exe

2010-10-24 02:44:48 ----D---- C:\Program Files\Common Files\Java

2010-10-24 02:44:15 ----A---- C:\Windows\system32\javaws.exe

2010-10-24 02:44:15 ----A---- C:\Windows\system32\javaw.exe

2010-10-24 02:44:15 ----A---- C:\Windows\system32\java.exe

2010-10-24 02:08:40 ----D---- C:\Users\Kerim\AppData\Roaming\Avira

2010-10-24 01:55:49 ----A---- C:\Windows\system32\drivers\ssmdrv.sys

2010-10-24 01:55:45 ----A---- C:\Windows\system32\drivers\avipbb.sys

2010-10-24 01:55:45 ----A---- C:\Windows\system32\drivers\avgntmgr.sys

2010-10-24 01:55:45 ----A---- C:\Windows\system32\drivers\avgntflt.sys

2010-10-24 01:55:45 ----A---- C:\Windows\system32\drivers\avgntdd.sys

2010-10-24 01:55:43 ----D---- C:\ProgramData\Avira

2010-10-24 01:55:43 ----D---- C:\Program Files\Avira

2010-10-24 01:09:15 ----A---- C:\Windows\Xwovib.exe

2010-10-23 23:45:00 ----D---- C:\ProgramData\Spybot - Search & Destroy

2010-10-23 22:14:09 ----A---- C:\Windows\Xwovia.exe

2010-10-20 21:21:47 ----A---- C:\Windows\system32\auth.dll

2010-10-20 21:21:47 ----A---- C:\Windows\system32\advd.dll

2010-10-20 21:21:46 ----A---- C:\Windows\system32\NCTAudioTransform2.dll

2010-10-20 21:21:46 ----A---- C:\Windows\system32\NCTAudioRecord2.dll

2010-10-20 21:21:46 ----A---- C:\Windows\system32\NCTAudioPlayer2.dll

2010-10-20 21:21:46 ----A---- C:\Windows\system32\NCTAudioEditor2.dll

2010-10-20 21:21:45 ----A---- C:\Windows\system32\NCTAudioInformation2.dll

2010-10-20 21:21:45 ----A---- C:\Windows\system32\NCTAudioFile2.dll

2010-10-20 21:21:45 ----A---- C:\Windows\system32\lame_enc.dll

2010-10-20 21:21:44 ----D---- C:\Users\Kerim\AppData\Roaming\concept design

2010-10-20 20:55:39 ----A---- C:\Windows\system32\drivers\sptd.sys

2010-10-20 20:54:48 ----D---- C:\Users\Kerim\AppData\Roaming\DAEMON Tools Lite

2010-10-20 20:54:46 ----D---- C:\ProgramData\DAEMON Tools Lite

2010-10-20 20:48:53 ----A---- C:\Windows\ODBC.INI

2010-10-20 20:48:51 ----A---- C:\Windows\system32\mdimon.dll

2010-10-20 20:46:41 ----D---- C:\Program Files\Common Files\DESIGNER

2010-10-20 20:29:43 ----D---- C:\Users\Kerim\AppData\Roaming\Template

2010-10-13 18:14:00 ----A---- C:\Windows\system32\wmp.dll

2010-10-13 18:13:57 ----A---- C:\Windows\system32\wmploc.DLL

2010-10-13 18:13:32 ----A---- C:\Windows\system32\srvsvc.dll

2010-10-13 18:13:32 ----A---- C:\Windows\system32\drivers\srvnet.sys

2010-10-13 18:13:32 ----A---- C:\Windows\system32\drivers\srv2.sys

2010-10-13 18:13:32 ----A---- C:\Windows\system32\drivers\srv.sys

2010-10-13 18:13:29 ----A---- C:\Windows\system32\netevent.dll

2010-10-13 18:13:07 ----A---- C:\Windows\system32\schannel.dll

2010-10-13 18:13:04 ----A---- C:\Windows\system32\ole32.dll

2010-10-13 18:13:01 ----A---- C:\Windows\system32\t2embed.dll

2010-10-13 18:12:57 ----A---- C:\Windows\system32\mshtml.dll

2010-10-13 18:12:56 ----A---- C:\Windows\system32\msfeeds.dll

2010-10-13 18:12:56 ----A---- C:\Windows\system32\ieframe.dll

2010-10-13 18:12:55 ----A---- C:\Windows\system32\licmgr10.dll

2010-10-13 18:12:54 ----A---- C:\Windows\system32\urlmon.dll

2010-10-13 18:12:53 ----A---- C:\Windows\system32\wininet.dll

2010-10-13 18:12:53 ----A---- C:\Windows\system32\mstime.dll

2010-10-13 18:12:53 ----A---- C:\Windows\system32\mshtmled.dll

2010-10-13 18:12:53 ----A---- C:\Windows\system32\iertutil.dll

2010-10-13 18:12:53 ----A---- C:\Windows\system32\iedkcs32.dll

2010-10-13 18:12:50 ----A---- C:\Windows\system32\occache.dll

2010-10-13 18:12:50 ----A---- C:\Windows\system32\msfeedssync.exe

2010-10-13 18:12:50 ----A---- C:\Windows\system32\msfeedsbs.dll

2010-10-13 18:12:50 ----A---- C:\Windows\system32\jsproxy.dll

2010-10-13 18:12:50 ----A---- C:\Windows\system32\ieUnatt.exe

2010-10-13 18:12:50 ----A---- C:\Windows\system32\ieui.dll

2010-10-13 18:12:50 ----A---- C:\Windows\system32\iesysprep.dll

2010-10-13 18:12:50 ----A---- C:\Windows\system32\iesetup.dll

2010-10-13 18:12:50 ----A---- C:\Windows\system32\iernonce.dll

2010-10-13 18:12:50 ----A---- C:\Windows\system32\iepeers.dll

2010-10-13 18:12:50 ----A---- C:\Windows\system32\ie4uinit.exe

2010-10-13 18:10:37 ----A---- C:\Windows\system32\mfc40u.dll

2010-10-13 18:10:37 ----A---- C:\Windows\system32\mfc40.dll

2010-10-13 18:10:18 ----A---- C:\Windows\system32\win32k.sys

2010-10-13 18:10:15 ----A---- C:\Windows\system32\msshsq.dll

2010-10-13 18:10:12 ----A---- C:\Windows\system32\wmpmde.dll

2010-10-13 18:10:09 ----A---- C:\Windows\system32\comctl32.dll

2010-09-29 17:25:13 ----A---- C:\Windows\system32\tzres.dll
 

======List of files/folders modified in the last 1 months======
 

2010-10-25 19:01:41 ----D---- C:\Windows\system32\Tasks

2010-10-25 19:01:40 ----D---- C:\Windows\Tasks

2010-10-25 19:01:29 ----D---- C:\Program Files

2010-10-25 19:01:04 ----D---- C:\Windows\Temp

2010-10-24 13:32:54 ----SHD---- C:\System Volume Information

2010-10-24 12:50:51 ----SHD---- C:\Windows\Installer

2010-10-24 12:50:10 ----A---- C:\Windows\win.ini

2010-10-24 12:47:37 ----D---- C:\Program Files\Common Files\microsoft shared

2010-10-24 12:41:41 ----RSD---- C:\Windows\assembly

2010-10-24 11:45:39 ----D---- C:\Windows\System32

2010-10-24 11:40:55 ----D---- C:\Windows

2010-10-24 02:44:48 ----D---- C:\Program Files\Common Files

2010-10-24 02:43:27 ----A---- C:\Windows\system32\deployJava1.dll

2010-10-24 02:06:09 ----D---- C:\ProgramData\McAfee

2010-10-24 02:03:31 ----HD---- C:\ProgramData

2010-10-24 02:02:50 ----D---- C:\Windows\system32\drivers

2010-10-24 01:55:01 ----D---- C:\Windows\winsxs

2010-10-24 01:36:53 ----D---- C:\Windows\system32\WDI

2010-10-24 01:15:05 ----D---- C:\Windows\inf

2010-10-24 01:15:05 ----A---- C:\Windows\system32\PerfStringBackup.INI

2010-10-24 01:05:49 ----RSD---- C:\Windows\Fonts

2010-10-24 00:56:50 ----A---- C:\Windows\WinInit.Ini

2010-10-24 00:14:50 ----SD---- C:\Users\Kerim\AppData\Roaming\Microsoft

2010-10-24 00:03:23 ----D---- C:\Users\Kerim\AppData\Roaming\Winamp

2010-10-24 00:03:19 ----D---- C:\Windows\Debug

2010-10-23 23:52:45 ----HD---- C:\Program Files\InstallShield Installation Information

2010-10-23 23:47:30 ----A---- C:\Windows\system32\msxml3a.dll

2010-10-23 23:47:29 ----A---- C:\Windows\system32\msvcr71.dll

2010-10-23 23:47:29 ----A---- C:\Windows\system32\msvcp71.dll

2010-10-23 22:06:38 ----AD---- C:\ProgramData\Temp

2010-10-23 21:58:33 ----D---- C:\ProgramData\CyberLink

2010-10-23 21:44:40 ----D---- C:\Users\Kerim\AppData\Roaming\vlc

2010-10-23 21:34:40 ----D---- C:\Users\Kerim\AppData\Roaming\dvdcss

2010-10-23 21:33:15 ----D---- C:\Program Files\Common Files\DVDVideoSoft

2010-10-23 21:33:00 ----D---- C:\Program Files\Cyberlink

2010-10-22 10:28:20 ----D---- C:\Windows\system32\catroot2

2010-10-20 20:50:37 ----DC---- C:\Windows\system32\DRVSTORE

2010-10-20 20:47:13 ----D---- C:\Windows\ShellNew

2010-10-20 20:46:25 ----D---- C:\Program Files\Common Files\System

2010-10-20 20:46:04 ----SD---- C:\ProgramData\Microsoft

2010-10-20 20:46:04 ----D---- C:\Program Files\Microsoft.NET

2010-10-20 20:43:40 ----D---- C:\Windows\system

2010-10-20 20:40:09 ----A---- C:\Windows\NeroDigital.ini

2010-10-20 20:39:24 ----D---- C:\Windows\Prefetch

2010-10-20 20:26:14 ----D---- C:\Program Files\Acer GameZone

2010-10-20 20:25:37 ----SHD---- C:\Users\Kerim\AppData\Roaming\.#

2010-10-20 20:10:30 ----D---- C:\ProgramData\Microsoft Help

2010-10-20 20:09:54 ----D---- C:\Program Files\Microsoft Works

2010-10-15 21:53:07 ----D---- C:\Program Files\Common Files\Blizzard Entertainment

2010-10-14 23:12:11 ----D---- C:\Windows\rescache

2010-10-14 20:12:16 ----D---- C:\Windows\system32\de-DE

2010-10-14 20:12:16 ----D---- C:\Program Files\Windows Media Player

2010-10-14 20:12:13 ----D---- C:\Windows\system32\migration

2010-10-14 20:12:13 ----D---- C:\Program Files\Internet Explorer

2010-10-14 15:41:25 ----A---- C:\Windows\system32\mrt.exe

2010-10-13 18:09:50 ----D---- C:\Windows\system32\catroot

2010-10-11 21:08:04 ----D---- C:\Users\Kerim\AppData\Roaming\ICQ

2010-10-09 03:12:25 ----D---- C:\Windows\Microsoft.NET

2010-10-09 02:07:22 ----D---- C:\Windows\system32\drivers\etc
 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R0 AlfaFF;AlfaFF File System mini-filter; C:\Windows\system32\Drivers\AlfaFF.sys [2008-10-11 42608]

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2008-07-20 324120]

R0 PSDFilter;PSDFilter; C:\Windows\system32\DRIVERS\psdfilter.sys [2008-05-14 18992]

R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-10-20 691696]

R0 UBHelper;UBHelper; C:\Windows\system32\drivers\UBHelper.sys [2008-01-30 13824]

R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2010-03-01 124784]

R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]

R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/10/23 21:56:08]; \??\D:\Program Files\CyberLink\PowerDVD10\PowerDVD10\NavFilter\000.fcl [2010-08-26 87536]

R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; \??\C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [2008-07-18 61424]

R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2010-02-16 60936]

R2 int15;int15; \??\C:\Windows\system32\drivers\int15.sys [2007-01-26 69632]

R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]

R2 NTIPPKernel;NTIPPKernel; \??\C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [2008-01-16 122368]

R2 PSDNServ;PSDNServ; C:\Windows\system32\DRIVERS\PSDNServ.sys [2008-05-14 16944]

R2 psdvdisk;PSDVdisk; C:\Windows\system32\DRIVERS\PSDVdisk.sys [2008-05-14 60464]

R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-10-19 8704]

R3 DKbFltr;Dritek Keyboard Filter Driver; C:\Windows\system32\DRIVERS\DKbFltr.sys [2006-11-02 21264]

R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]

R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2008-03-26 980992]

R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2008-03-26 207872]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-05-07 2134424]

R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1E60x86.sys [2008-05-19 47104]

R3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-05-05 3658752]

R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2008-01-30 14848]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2008-06-25 44064]

R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-07-18 7545824]

R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter; C:\Windows\system32\DRIVERS\RTL8192su.sys [2010-02-15 515584]

R3 RTSTOR;Realtek USB 2.0 Card Reader; C:\Windows\system32\drivers\RTSTOR.SYS [2008-03-26 61440]

R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-04-25 199472]

R3 TcUsb;TC USB Kernel Driver; C:\Windows\System32\Drivers\tcusb.sys [2008-04-28 50576]

R3 usbvideo;USB-Videogerät (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]

R3 whfltr2k;WheelMouse USB Lower Filter Driver; C:\Windows\system32\DRIVERS\whfltr2k.sys [2007-01-26 6784]

R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2008-03-26 661504]

R3 winbondcir;Winbond IR Transceiver; C:\Windows\system32\DRIVERS\winbondcir.sys [2007-03-28 43008]

S3 ab9me7q9;ab9me7q9; C:\Windows\system32\drivers\ab9me7q9.sys []

S3 adfyscdy;adfyscdy; C:\Windows\system32\drivers\adfyscdy.sys []

S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\Windows\System32\Drivers\btcusb.sys [2007-05-09 36496]

S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]

S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]

S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2008-01-21 200704]

S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]

S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]

S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]

S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]

S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]

S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys []

S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2010-04-19 41984]

S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]

S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]

S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]

S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-04-01 267432]

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-06-10 144176]

R2 Bonjour Service;Dienst "Bonjour"; C:\Program Files\Bonjour\mDNSResponder.exe [2010-05-18 345376]

R2 BUNAgentSvc;NTI Backup Now 5 Agent Service; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]

R2 CLHNService;CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-01-16 81504]

R2 eDataSecurity Service;eDataSecurity Service; C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe [2008-05-14 500784]

R2 ETService;Empowering Technology Service; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [2008-06-02 24576]

R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2008-07-20 354840]

R2 IGBASVC;iGroupTec Service; C:\Program Files\Acer\Acer Bio Protection\BASVC.exe [2008-10-11 3602432]

R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]

R2 MobilityService;MobilityService; C:\Acer\Mobility Center\MobilityService.exe [2007-12-06 110592]

R2 NTIBackupSvc;NTI Backup Now 5 Backup Service; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-25 45056]

R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-25 131072]

R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-07-18 196608]

R2 Realtek11nSU;Realtek11nSU; C:\Program Files\Realtek\11n USB Wireless LAN Utility\RtlService.exe [2009-04-24 36864]

R2 RS_Service;Raw Socket Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [2008-01-10 233472]

R2 StarWindServiceAE;StarWind AE Service; D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]

R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-10-19 386560]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-06 135664]

S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]

S3 GoogleDesktopManager-080708-050100;Google Desktop Manager 5.7.808.7150; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-12-01 24064]

S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-22 182768]

S3 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2010-07-21 540968]

S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-06-02 637952]

S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
 

-----------------EOF-----------------

--- --- ---

C:\rsit\info.txt

info.txtRSIT Logfile:

Code:

logfile of random's system information tool 1.08 2010-10-25 19:01:48
 

======Uninstall list======
 

-->D:\DivX\DivXConverterUninstall.exe /CONVERTER

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A450831D-25F6-4F42-9662-D000B25E0D82}\Setup.exe"  -uninstall

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA4BF92B-2AAF-11DA-9D78-000129760D75}\Setup.exe"  -uninstall

Acer Arcade Deluxe-->"C:\Program Files\InstallShield Installation Information\{2637C347-9DAD-11D6-9EA2-00055D0CA761}\Setup.exe" /z-uninstall

Acer Arcade Deluxe-->"C:\Program Files\InstallShield Installation Information\{2637C347-9DAD-11D6-9EA2-00055D0CA761}\Setup.exe" /z-uninstall

Acer Bio Protection
 

AAU 6.0.00.17-->"C:\Program Files\Acer\Acer Bio Protection\uninstall.exe"

Acer Crystal Eye Webcam 2.0.8-->C:\Program Files\InstallShield Installation Information\{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}\setup.exe -runfromtemp -l0x0007 -removeonly

Acer eAudio Management-->"C:\Program Files\InstallShield Installation Information\{57265292-228A-41FA-9AEC-4620CBCC2739}\Setup.exe" -uninstall

Acer eDataSecurity Management-->C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSnstHelper.exe -Operation UNINSTALL

Acer Empowering Technology-->"C:\Program Files\InstallShield Installation Information\{8F1B6239-FEA0-450A-A950-B05276CE177C}\setup.exe" -runfromtemp -l0x0007 -removeonly

Acer ePower Management-->"C:\Program Files\InstallShield Installation Information\{58E5844B-7CE2-413D-83D1-99294BF6C74F}\setup.exe" -runfromtemp -l0x0007 -removeonly

Acer eRecovery Management-->"C:\Program Files\InstallShield Installation Information\{7F811A54-5A09-4579-90E1-C93498E230D9}\setup.exe" -runfromtemp -l0x0007 -removeonly

Acer eSettings Management-->"C:\Program Files\InstallShield Installation Information\{13D85C14-2B85-419F-AC41-C7F21E68B25D}\setup.exe" -runfromtemp -l0x0007 -removeonly

Acer GridVista-->C:\Windows\GVUni.exe GridV.UNI

Acer Mobility Center Plug-In-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{11316260-6666-467B-AC34-183FCB5D4335}\setup.exe" -l0x7  -removeonly

Acer ScreenSaver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}\setup.exe" -l0x9  -removeonly

Acer VCM-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}\setup.exe" -l0x7  -removeonly

AdblockIE-->MsiExec.exe /I{5508128A-2C7B-46B5-81F9-58E8E8115F0B}

Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\FlashUtil10i_Plugin.exe -maintain plugin

Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe

Adobe Reader 8.1.0-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003}

Advanced Wheel Mouse 6.0.0.002-->C:\ADVANC~1\uninst.exe

Apple Application Support-->MsiExec.exe /I{B2D328BE-45AD-4D92-96F9-2151490A203E}

Apple Mobile Device Support-->MsiExec.exe /I{85991ED2-010C-4930-96FA-52F43C2CE98A}

Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}

Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver-->"C:\Program Files\InstallShield Installation Information\{3108C217-BE83-42E4-AE9E-A56A2A92E549}\setup.exe" -runfromtemp -l0x0007 -removeonly

Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE

Azureus-->d:\Azureus\Uninstall.exe

Bluesoleil2.6.0.8 Release 070517-->MsiExec.exe /X{438BB9B4-65FE-4626-91D9-A8F57B18001D}

Bonjour-->MsiExec.exe /X{0CB9668D-F979-4F31-B8B8-67FE90F929F8}

CCleaner-->"D:\Program Files\CCleaner\uninst.exe"

Cisco EAP-FAST Module-->MsiExec.exe /I{BF53252E-4AB2-4C7F-A0FD-6100755745E3}

Cisco LEAP Module-->MsiExec.exe /I{76F9CF97-FC4B-4E20-B363-D127C888448F}

Cisco PEAP Module-->MsiExec.exe /I{4E5386F5-C0F6-4532-A54A-374865AEAB71}

concept/design onlineTV 5-->"D:\Program Files\concept design\onlineTV 5\unins000.exe"

CyberLink PowerDVD 10-->"C:\Program Files\InstallShield Installation Information\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}\Setup.exe" /z-uninstall

CyberLink PowerDVD 10-->"C:\Program Files\InstallShield Installation Information\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}\Setup.exe" /z-uninstall

DivX Codec-->D:\DivX\DivXCodecUninstall.exe /CODEC

DivX Converter-->D:\DivX\DivXConverterUninstall.exe /CONVERTER

DivX Player-->D:\DivX\DivXPlayerUninstall.exe /PLAYER

DivX Web Player-->D:\DivX\DivXWebPlayerUninstall.exe /PLUGIN

eMule-->"d:\eMule\Uninstall.exe"

EVEREST Home Edition v2.20-->"d:\Lavalys\EVEREST Home Edition\unins000.exe"

FLV Player 2.0 (build 25)-->D:\Program Files\FLV Player\uninst.exe

Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall

Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}

Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_223E2B8E7BAD9544.exe" /uninstall

Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}

Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDA_HSF\UIU32m.exe -U -IAcrZUn32z.INF

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""

ICQ6.5-->"C:\Program Files\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly

Intel® Matrix Storage Manager-->C:\Program Files\Intel\Intel Matrix Storage Manager\Uninstall\imsmudlg.exe -uninstall

iTunes-->MsiExec.exe /I{91F7F3F3-CE80-48C3-8327-7D24A0A5716A}

Java(TM) 6 Update 22-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216022FF}

Launch Manager-->C:\Windows\UnInst32.exe LManager.UNI

LOGO!Soft Comfort V6.1-->"D:\LogoSoft\UninstallerData\Uninstall.exe"

Messenger Plus! Live-->"D:\Program Files\Messenger Plus! Live\Uninstall.exe"

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - deu\setup.exe

Microsoft .NET Framework 3.5 Language Pack SP1 - deu-->MsiExec.exe /I{052FDD78-A6EA-3187-8386-C82F4CA3A929}

Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe

Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}

Microsoft .NET Framework 4 Client Profile-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /parameterfolder Client

Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{3C3901C5-3455-3E0A-A214-0B093A5070A6}

Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}

Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110407-6000-11D3-8CFE-0150048383C9}

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}

Microsoft Works-->MsiExec.exe /I{4EA2F95F-A537-4D17-9E7F-6B3FF8D9BBE3}

Mozilla Firefox (3.0.4)-->d:\Mozilla Firefox\uninstall\helper.exe

MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}

MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}

Nero 8 Lite 8.2.8.0-->"d:\Nero\unins000.exe"

NTI Backup Now 5-->C:\Program Files\InstallShield Installation Information\{12EFA1A4-AC3B-443C-8143-237EDE760403}\setup.exe -runfromtemp -l0x0407

NTI Media Maker 8-->C:\Program Files\InstallShield Installation Information\{2413930C-8309-47A6-BC61-5EF27A4222BC}\setup.exe -runfromtemp -l0x0407

NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI

PC Connectivity Solution-->MsiExec.exe /I{0C973594-7DDF-4BD0-84ED-3517F7622037}

PDFCreator-->D:\Program Files\PDFCreator\unins000.exe

QuickTime-->MsiExec.exe /I{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}

REALTEK 11n USB Wireless LAN Driver and Utility-->C:\Program Files\InstallShield Installation Information\{9C049499-055C-4a0c-A916-1D8CA1FF45EB}\Install.exe -uninst -l0x7 

Realtek High Definition Audio Driver-->RtlUpd.exe -r -m -nrg2709

Realtek USB 2.0 Card Reader-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.exe" -l0x9  -removeonly

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A8894F19-59C8-38D2-8A75-36C0CCE56A5B} /qb+ REBOOTPROMPT=""

SopCast 3.2.9-->D:\Program Files\SopCast\uninst.exe

SPBA 5.8-->MsiExec.exe /I{ECCD28B2-8798-4D16-8126-625D728294A1}

sPlan 6.0 (Demo)-->"D:\sPlan60\unins000.exe"

Spybot - Search & Destroy-->"D:\Program Files\Spybot - Search & Destroy\unins000.exe"

SUPER © Version 2009.bld.36 (June 10, 2009)-->D:\PROGRA~1\ERIGHT~1\SUPER\Setup.exe /remove /q0

Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall

TeamSpeak 2 RC2-->d:\Teamspeak2_RC2\unins000.exe

TeamSpeak 3 Client-->"d:\Program Files\TeamSpeak 3 Client\uninstall.exe"

TubeBox!-->MsiExec.exe /I{4527481F-E36D-408E-9F40-89E2630E2120}

TVUPlayer 2.5.2.1-->d:\Program Files\TVUPlayer\uninst.exe

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""

Veetle TV 0.9.18-->D:\Program Files\Veetle\UninstallVeetleTV.exe

VLC media player 1.0.5-->D:\VLC\uninstall.exe

Winamp-->"d:\Winamp\UninstWA.exe"

Winbond CIR Device Drivers-->MsiExec.exe /I{10F498FF-5392-4DF3-8F73-FE172A9F3800}

Windows Live Anmelde-Assistent-->MsiExec.exe /I{52B97218-98CB-4B8B-9283-D213C85E1AA4}

Windows Live Call-->MsiExec.exe /I{5FC68772-6D56-41C6-9DF1-24E868198AE6}

Windows Live Communications Platform-->MsiExec.exe /I{ED00D08A-3C5F-488D-93A0-A04F21F23956}

Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe

Windows Live Essentials-->MsiExec.exe /I{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}

Windows Live Messenger-->MsiExec.exe /X{41E654A9-26D0-4EAC-854B-0FA824FFFABB}

Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}

Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}

WinRAR-->D:\Winrar\uninstall.exe

World of Warcraft-->C:\Program Files\Common Files\Blizzard Entertainment\WORLD OF WARCRAFT\Uninstall.exe
 

======Security center information======
 

AS: Windows Defender
 

======System event log======
 

Computer Name: Kerim-PC

Event Code: 7036

Message: Dienst "DHCP-Client" befindet sich jetzt im Status "Ausgeführt".

Record Number: 193411

Source Name: Service Control Manager

Time Written: 20100606092523.000000-000

Event Type: Informationen

User: 
 

Computer Name: Kerim-PC

Event Code: 7036

Message: Dienst "Netzwerkspeicher-Schnittstellendienst" befindet sich jetzt im Status "Ausgeführt".

Record Number: 193410

Source Name: Service Control Manager

Time Written: 20100606092523.000000-000

Event Type: Informationen

User: 
 

Computer Name: Kerim-PC

Event Code: 7036

Message: Dienst "CNG-Schlüsselisolation" befindet sich jetzt im Status "Ausgeführt".

Record Number: 193409

Source Name: Service Control Manager

Time Written: 20100606092523.000000-000

Event Type: Informationen

User: 
 

Computer Name: Kerim-PC

Event Code: 7036

Message: Dienst "TCP/IP-NetBIOS-Hilfsdienst" befindet sich jetzt im Status "Ausgeführt".

Record Number: 193408

Source Name: Service Control Manager

Time Written: 20100606092523.000000-000

Event Type: Informationen

User: 
 

Computer Name: Kerim-PC

Event Code: 7036

Message: Dienst "Windows Driver Foundation - Benutzermodus-Treiberframework" befindet sich jetzt im Status "Ausgeführt".

Record Number: 193407

Source Name: Service Control Manager

Time Written: 20100606092523.000000-000

Event Type: Informationen

User: 
 

=====Application event log=====
 

Computer Name: Kerim-PC

Event Code: 8194

Message: Der Wiederherstellungspunkt wurde erfolgreich erstellt (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update).

Record Number: 13100

Source Name: System Restore

Time Written: 20090827145303.000000-000

Event Type: Informationen

User: 
 

Computer Name: Kerim-PC

Event Code: 1

Message: Der Windows-Sicherheitscenterdienst wurde gestartet.

Record Number: 13099

Source Name: SecurityCenter

Time Written: 20090827145104.000000-000

Event Type: Informationen

User: 
 

Computer Name: Kerim-PC

Event Code: 1

Message: Der Zertifikatdiensteclient wurde erfolgreich gestartet.

Record Number: 13098

Source Name: Microsoft-Windows-CertificateServicesClient

Time Written: 20090827145002.328387-000

Event Type: Informationen

User: NT-AUTORITÄT\SYSTEM
 

Computer Name: Kerim-PC

Event Code: 0

Message: 

Record Number: 13097

Source Name: gusvc

Time Written: 20090827144935.000000-000

Event Type: Informationen

User: 
 

Computer Name: Kerim-PC

Event Code: 10

Message: Ereignisfilter mit Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" nicht reaktiviert werden aufgrund des Fehlers 0x80041003. Ereignisse können nicht durch diesen Filter geschickt werden, bis dieses Problem gelöst ist.

Record Number: 13096

Source Name: Microsoft-Windows-WMI

Time Written: 20090827144931.000000-000

Event Type: Fehler

User: 
 

=====Security event log=====
 

Computer Name: Kerim-PC

Event Code: 5032

Message: Der Windows-Firewalldienst konnte den Benutzer nicht darüber benachrichtigen, dass eine Anwendung blockiert wurde und keine eingehenden Verbindungen im Netzwerk annehmen kann.
 

Fehlercode:        2

Record Number: 32569

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20091209233308.696856-000

Event Type: Überwachung gescheitert

User: 
 

Computer Name: Kerim-PC

Event Code: 5032

Message: Der Windows-Firewalldienst konnte den Benutzer nicht darüber benachrichtigen, dass eine Anwendung blockiert wurde und keine eingehenden Verbindungen im Netzwerk annehmen kann.
 

Fehlercode:        2

Record Number: 32568

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20091209233304.999656-000

Event Type: Überwachung gescheitert

User: 
 

Computer Name: Kerim-PC

Event Code: 4624

Message: Ein Konto wurde erfolgreich angemeldet.
 

Antragsteller:

        Sicherheits-ID:                S-1-0-0

        Kontoname:                -

        Kontodomäne:                -

        Anmelde-ID:                0x0
 

Anmeldetyp:                        3
 

Neue Anmeldung:

        Sicherheits-ID:                S-1-5-7

        Kontoname:                ANONYMOUS-ANMELDUNG

        Kontodomäne:                NT-AUTORITÄT

        Anmelde-ID:                0x357d2

        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}
 

Prozessinformationen:

        Prozess-ID:                0x0

        Prozessname:                -
 

Netzwerkinformationen:

        Arbeitsstationsname:        

        Quellnetzwerkadresse:        -

        Quellport:                -
 

Detaillierte Authentifizierungsinformationen:

        Anmeldeprozess:                NtLmSsp 

        Authentifizierungspaket:        NTLM

        Übertragene Dienste:        -

        Paketname (nur NTLM):        NTLM V1

        Schlüssellänge:                0
 

Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.
 

Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".
 

Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).
 

Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.
 

Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.
 

Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.

         - Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.

        - Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.

        - Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.

        - Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.

Record Number: 32567

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20091209233304.999656-000

Event Type: Überwachung erfolgreich

User: 
 

Computer Name: Kerim-PC

Event Code: 5024

Message: Der Windows-Firewalldienst wurde erfolgreich gestartet.

Record Number: 32566

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20091209233258.728456-000

Event Type: Überwachung erfolgreich

User: 
 

Computer Name: Kerim-PC

Event Code: 5033

Message: Der Windows-Firewalltreiber wurde erfolgreich gestartet.

Record Number: 32565

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20091209233258.463256-000

Event Type: Überwachung erfolgreich

User: 
 

======Environment variables======
 

"ComSpec"=%SystemRoot%\system32\cmd.exe

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"Path"=C:\Program Files\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Acer\Empowering Technology\eDataSecurity\;C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86;C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64;D:\QuickTime\QTSystem\

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

"PROCESSOR_ARCHITECTURE"=x86

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

"USERNAME"=SYSTEM

"windir"=%SystemRoot%

"PROCESSOR_LEVEL"=6

"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel

"PROCESSOR_REVISION"=0f0d

"NUMBER_OF_PROCESSORS"=2

"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat

"DFSTRACINGON"=FALSE

"Pathtem"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Acer\Empowering Technology\eDataSecurity\;C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86;C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64

"NTIPath"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Acer\Empowering Technology\eDataSecurity\;C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86;C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64;C:\Program Files\NewTech Infosystems\NTI Backup Now 5\;

"asl.log"=Destination=file;OnFirstLog=command,environment

"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip

"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
 

-----------------EOF-----------------

--- --- ---

hjtscanlist.txt

Code:

 

                        $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ 

                        º                                    º 

                                    hjtscanlist v2.0              

                        º                                    º 

                        $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ 
 

Microsoft Windows [Version 6.0.6002]

 

 

C:
 

  25.10.2010 19:01     C:\rsit --------- 0   

  25.10.2010 19:01     C:\Program Files --------- 20480   

       C:\hiberfil.sys ---------    

       C:\pagefile.sys ---------    

  24.10.2010 17:07     C:\Config.Msi --------- 0   

  24.10.2010 13:32     C:\System Volume Information --------- 28672   

  24.10.2010 11:40     C:\Windows --------- 32768   

  24.10.2010 02:03     C:\ProgramData --------- 12288   

  09.06.2010 18:01     C:\Advanced Wheel Mouse --------- 4096   

  17.01.2010 18:01     C:\Boot --------- 4096   

  11.04.2009 08:36     C:\bootmgr --------- 333257   

  05.12.2008 23:57     C:\IO.SYS --------- 0   

  05.12.2008 23:57     C:\MSDOS.SYS --------- 0   

  05.12.2008 21:57     C:\ACER --------- 4096   

  01.12.2008 21:37     C:\$RECYCLE.BIN --------- 0   

  01.12.2008 21:35     C:\ACERSW --------- 0   

  01.12.2008 21:34     C:\Users --------- 4096   

  01.12.2008 21:31     C:\Programme --------- 0   

  01.12.2008 21:31     C:\Dokumente und Einstellungen --------- 0   

  11.10.2008 02:04     C:\CLSetup --------- 0   

  11.10.2008 02:04     C:\Medion.ini --------- 20   

  11.10.2008 01:58     C:\Partition.txt --------- 60   

  30.07.2008 12:23     C:\BOOTSECT.BAK --------- 8192   

  30.07.2008 04:41     C:\book --------- 0   

  30.07.2008 03:26     C:\RHDSetup.log --------- 426   

  30.07.2008 03:15     C:\Intel --------- 0   

  11.06.2008 07:55     C:\TEMP --------- 0   

  21.01.2008 04:32     C:\PerfLogs --------- 0   

  02.11.2006 15:02     C:\Documents and Settings --------- 0   

  18.09.2006 23:43     C:\config.sys --------- 10   

  18.09.2006 23:43     C:\autoexec.bat --------- 24   

----------------------------------------
 

 

C:\Windows
 

  25.10.2010 18:32     C:\Windows\WindowsUpdate.log --------- 1201239   

  25.10.2010 18:26     C:\Windows\bootstat.dat --------- 67584   

  25.10.2010 18:26     C:\Windows\PFRO.log --------- 27464   

  24.10.2010 12:50     C:\Windows\win.ini --------- 240   

  24.10.2010 00:56     C:\Windows\WinInit.Ini --------- 802   

  23.10.2010 22:26     C:\Windows\Xwovib.exe --------- 266240   

  23.10.2010 22:14     C:\Windows\Xwovia.exe --------- 266240   

  20.10.2010 20:48     C:\Windows\ODBC.INI --------- 400   

  20.10.2010 20:40     C:\Windows\NeroDigital.ini --------- 69   

  20.06.2010 13:11     C:\Windows\LManager.UNI --------- 83   

  15.02.2010 13:01     C:\Windows\RtlUI2.exe --------- 380928   

  15.02.2010 13:01     C:\Windows\Rtlihvs.dll --------- 614400   

  15.02.2010 13:01     C:\Windows\RTLExtUI.dll --------- 188416   

  28.12.2009 16:36     C:\Windows\popcinfo.dat --------- 10   

  23.11.2009 19:06     C:\Windows\d3dx.dat --------- 4096   

  29.04.2009 15:46     C:\Windows\RtlIhvOid.dll --------- 208896   

  11.04.2009 08:27     C:\Windows\explorer.exe --------- 2926592   

  30.12.2008 22:35     C:\Windows\0 --------- 32   

  06.12.2008 17:52     C:\Windows\nsreg.dat --------- 0   

  05.12.2008 23:57     C:\Windows\uninst.exe --------- 283648   

  24.10.2008 17:39     C:\Windows\UNINST32.EXE --------- 309768   

  11.10.2008 01:53     C:\Windows\GridV.UNI --------- 92   

  11.10.2008 01:52     C:\Windows\QtZgAcer.UNI --------- 83   

  02.09.2008 04:13     C:\Windows\MOD01SET000000005J.enc --------- 1976   

  02.09.2008 04:13     C:\Windows\CSUP.TXT --------- 10   

  14.08.2008 09:33     C:\Windows\MOD01SET0S00860004.enc --------- 2176   

  30.07.2008 03:25     C:\Windows\DIFxAPI.dll --------- 319456   

  30.07.2008 03:25     C:\Windows\HideWin.exe --------- 315392   

  30.07.2008 02:42     C:\Windows\ocsetup_install_OEMHelpCustomization.etl --------- 16449536   

  30.07.2008 02:42     C:\Windows\ocsetup_cbs_install_OEMHelpCustomization.perf --------- 196608   

  30.07.2008 02:42     C:\Windows\ocsetup_cbs_install_OEMHelpCustomization.dpx --------- 65536   

  22.07.2008 10:02     C:\Windows\MOD01SET07EN000004.enc --------- 2392   

  18.07.2008 04:59     C:\Windows\ReleaseNotes.txt --------- 2006   

  17.07.2008 06:27     C:\Windows\AcerStore.exe --------- 380928   

  11.06.2008 07:55     C:\Windows\MOD01OPK0400860001.enc --------- 2400   

  20.05.2008 09:57     C:\Windows\Acer Crystal Eye webcam.EXE --------- 262144   

  09.05.2008 07:45     C:\Windows\MOD01SET07EN000002.enc --------- 2392   

  08.05.2008 23:58     C:\Windows\Interop.IWshRuntimeLibrary.dll --------- 49152   

  07.05.2008 10:19     C:\Windows\RtHDVCpl.exe --------- 6139904   

  25.04.2008 07:11     C:\Windows\MOD01SET0J00860003.enc --------- 1996   

  02.04.2008 03:27     C:\Windows\RtlUpd.exe --------- 1196032   

  13.03.2008 11:48     C:\Windows\RTKVADDA.EXE --------- 290816   

  05.03.2008 12:07     C:\Windows\RtlExUpd.dll --------- 520192   

  25.02.2008 11:13     C:\Windows\Suyin.reg --------- 4838   

  31.01.2008 15:18     C:\Windows\RtDefLvl.ini --------- 1694   

  21.01.2008 04:43     C:\Windows\WindowsShell.Manifest --------- 749   

  21.01.2008 04:24     C:\Windows\regedit.exe --------- 134656   

  21.01.2008 04:24     C:\Windows\bfsvc.exe --------- 58880   

  21.01.2008 04:24     C:\Windows\fveupdate.exe --------- 13312   

  21.01.2008 04:24     C:\Windows\HelpPane.exe --------- 498176   

  21.01.2008 04:23     C:\Windows\notepad.exe --------- 151040   

  10.01.2008 05:44     C:\Windows\GVUni.exe --------- 199176   

  20.11.2007 12:15     C:\Windows\SkyTel.exe --------- 1826816   

  14.11.2007 09:18     C:\Windows\USetup.iss --------- 553   

  29.10.2007 13:35     C:\Windows\PidList.ini --------- 36   

  23.10.2007 10:56     C:\Windows\PLFSetI.exe --------- 200704   

  20.04.2007 06:30     C:\Windows\Acer Crystal Eye webcam.ico --------- 222382   

  29.03.2007 16:48     C:\Windows\Image.dll --------- 626688   

  02.11.2006 14:35     C:\Windows\WMSysPr9.prx --------- 316640   

  02.11.2006 14:34     C:\Windows\twunk_16.exe --------- 49680   

  02.11.2006 14:34     C:\Windows\twunk_32.exe --------- 31232   

  02.11.2006 14:34     C:\Windows\twain_32.dll --------- 50688   

  02.11.2006 14:34     C:\Windows\twain.dll --------- 94784   

  02.11.2006 11:45     C:\Windows\winhlp32.exe --------- 9216   

  02.11.2006 11:45     C:\Windows\hh.exe --------- 14848   

  02.11.2006 09:46     C:\Windows\mib.bin --------- 43131   

  19.09.2006 13:41     C:\Windows\HomePremium.xml --------- 8328   

  18.09.2006 23:46     C:\Windows\system.ini --------- 219   

  18.09.2006 23:43     C:\Windows\_default.pif --------- 707   

  18.09.2006 23:43     C:\Windows\winhelp.exe --------- 256192   

  18.09.2006 23:30     C:\Windows\msdfmap.ini --------- 1405   

----------------------------------------
 

 

C:\Windows\System
 

 27.09.2007 15:32      C:\Windows\System\ms.ico --------- 34530 

 27.09.2007 15:17      C:\Windows\System\sm.ico --------- 37041 

 27.09.2007 15:12      C:\Windows\System\sd.ico --------- 38660 

 27.09.2007 15:04      C:\Windows\System\cf.ico --------- 37300 

 02.08.2007 22:32      C:\Windows\System\DriveIcon.dll --------- 5631520 

 02.11.2006 14:34      C:\Windows\System\mciwave.drv --------- 28160 

 02.11.2006 14:34      C:\Windows\System\mciseq.drv --------- 25264 

 02.11.2006 14:34      C:\Windows\System\avicap.dll --------- 69584 

 02.11.2006 14:34      C:\Windows\System\avifile.dll --------- 109456 

 02.11.2006 14:34      C:\Windows\System\mciavi.drv --------- 73376 

 02.11.2006 14:34      C:\Windows\System\msvideo.dll --------- 126912 

 02.11.2006 09:10      C:\Windows\System\OLESVR.DLL --------- 24064 

 02.11.2006 09:10      C:\Windows\System\WFWNET.DRV --------- 12704 

 02.11.2006 09:10      C:\Windows\System\COMMDLG.DLL --------- 32816 

 02.11.2006 09:10      C:\Windows\System\TIMER.DRV --------- 4048 

 02.11.2006 09:10      C:\Windows\System\MMSYSTEM.DLL --------- 68992 

 02.11.2006 09:10      C:\Windows\System\mmtask.tsk --------- 1152 

 02.11.2006 09:10      C:\Windows\System\mouse.drv --------- 2032 

 02.11.2006 09:10      C:\Windows\System\vga.drv --------- 2176 

 02.11.2006 09:10      C:\Windows\System\sound.drv --------- 1744 

 02.11.2006 09:10      C:\Windows\System\keyboard.drv --------- 2000 

 02.11.2006 09:10      C:\Windows\System\SHELL.DLL --------- 5120 

 02.11.2006 09:10      C:\Windows\System\system.drv --------- 3360 

 18.09.2006 23:43      C:\Windows\System\ver.dll --------- 9008 

 18.09.2006 23:43      C:\Windows\System\olecli.dll --------- 82944 

 18.09.2006 23:43      C:\Windows\System\lzexpand.dll --------- 9936 

 18.09.2006 23:35      C:\Windows\System\stdole.tlb --------- 5532 

 30.06.2004 16:24      C:\Windows\System\MyMulti.ico --------- 5430 

----------------------------------------
 

 

C:\Windows\System32
 

 25.10.2010 19:02     C:\Windows\system32\Tasks --------- 4096  

 25.10.2010 18:26     C:\Windows\system32\LogConfigTemp.xml --------- 0  

 25.10.2010 18:26     C:\Windows\system32\agent.log --------- 147  

 25.10.2010 18:26     C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 --------- 3216  

 25.10.2010 18:26     C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 --------- 3216  

 24.10.2010 02:43     C:\Windows\system32\javaws.exe --------- 153376  

 24.10.2010 02:43     C:\Windows\system32\javaw.exe --------- 145184  

 24.10.2010 02:43     C:\Windows\system32\java.exe --------- 145184  

 24.10.2010 02:43     C:\Windows\system32\deployJava1.dll --------- 472808  

 24.10.2010 02:02     C:\Windows\system32\drivers --------- 81920  

 24.10.2010 01:36     C:\Windows\system32\WDI --------- 4096  

 24.10.2010 01:15     C:\Windows\system32\perfh009.dat --------- 591320  

 24.10.2010 01:15     C:\Windows\system32\perfc009.dat --------- 103194  

 24.10.2010 01:15     C:\Windows\system32\perfh007.dat --------- 623280  

 24.10.2010 01:15     C:\Windows\system32\perfc007.dat --------- 125378  

 24.10.2010 01:15     C:\Windows\system32\PerfStringBackup.INI --------- 1432888  

 24.10.2010 01:10     C:\Windows\system32\GDIPFONTCACHEV1.DAT --------- 85696  

 24.10.2010 01:09     C:\Windows\system32\FNTCACHE.DAT --------- 345512  

 23.10.2010 23:47     C:\Windows\system32\msxml3a.dll --------- 29480  

 23.10.2010 23:47     C:\Windows\system32\msvcr71.dll --------- 353576  

 23.10.2010 23:47     C:\Windows\system32\msvcp71.dll --------- 505128  

 22.10.2010 10:28     C:\Windows\system32\catroot2 --------- 4096  

 20.10.2010 20:50     C:\Windows\system32\DRVSTORE --------- 0  

 19.10.2010 11:41     C:\Windows\system32\MpSigStub.exe --------- 222080  

 14.10.2010 20:12     C:\Windows\system32\de-DE --------- 655360  

 14.10.2010 20:12     C:\Windows\system32\migration --------- 8192  

 14.10.2010 15:41     C:\Windows\system32\mrt.exe --------- 35385288  

 13.10.2010 18:09     C:\Windows\system32\catroot --------- 4096  

 13.09.2010 17:46     C:\Windows\system32\wmp.dll --------- 10628096  

 13.09.2010 15:56     C:\Windows\system32\wmploc.DLL --------- 8147456  

 08.09.2010 08:01     C:\Windows\system32\wininet.dll --------- 916480  

 08.09.2010 08:01     C:\Windows\system32\urlmon.dll --------- 1210880  

 08.09.2010 07:59     C:\Windows\system32\occache.dll --------- 206848  

 08.09.2010 07:58     C:\Windows\system32\mstime.dll --------- 611840  

 08.09.2010 07:57     C:\Windows\system32\mshtmled.dll --------- 66560  

 08.09.2010 07:57     C:\Windows\system32\mshtml.dll --------- 5957120  

 08.09.2010 07:57     C:\Windows\system32\msfeeds.dll --------- 602112  

 08.09.2010 07:57     C:\Windows\system32\msfeedsbs.dll --------- 55296  

 08.09.2010 07:57     C:\Windows\system32\licmgr10.dll --------- 43520  

 08.09.2010 07:57     C:\Windows\system32\jsproxy.dll --------- 25600  

 08.09.2010 07:57     C:\Windows\system32\inetcpl.cpl --------- 1469440  

 08.09.2010 07:56     C:\Windows\system32\ieui.dll --------- 164352  

 08.09.2010 07:56     C:\Windows\system32\iesysprep.dll --------- 109056  

 08.09.2010 07:56     C:\Windows\system32\iertutil.dll --------- 1986560  

 08.09.2010 07:56     C:\Windows\system32\iesetup.dll --------- 71680  

 08.09.2010 07:56     C:\Windows\system32\iernonce.dll --------- 55808  

 08.09.2010 07:56     C:\Windows\system32\iepeers.dll --------- 184320  

 08.09.2010 07:56     C:\Windows\system32\ieframe.dll --------- 11080192  

 08.09.2010 07:56     C:\Windows\system32\iedkcs32.dll --------- 387584  

 08.09.2010 07:04     C:\Windows\system32\html.iec --------- 385024  

 08.09.2010 06:26     C:\Windows\system32\ieUnatt.exe --------- 133632  

 08.09.2010 06:26     C:\Windows\system32\ie4uinit.exe --------- 173056  

 08.09.2010 06:25     C:\Windows\system32\msfeedssync.exe --------- 13312  

 08.09.2010 06:25     C:\Windows\system32\mshtml.tlb --------- 1638912  

 06.09.2010 18:20     C:\Windows\system32\srvsvc.dll --------- 125952  

 06.09.2010 18:19     C:\Windows\system32\netevent.dll --------- 17920  

 31.08.2010 17:46     C:\Windows\system32\mfc40u.dll --------- 954288  

 31.08.2010 17:46     C:\Windows\system32\mfc40.dll --------- 954752  

 31.08.2010 17:44     C:\Windows\system32\comctl32.dll --------- 531968  

 31.08.2010 15:27     C:\Windows\system32\win32k.sys --------- 2038272  

 26.08.2010 18:37     C:\Windows\system32\t2embed.dll --------- 157184  

 20.08.2010 18:05     C:\Windows\system32\wmpmde.dll --------- 867328  

 17.08.2010 16:11     C:\Windows\system32\spoolsv.exe --------- 128000  

 10.08.2010 17:53     C:\Windows\system32\schannel.dll --------- 274944  

 26.07.2010 17:51     C:\Windows\system32\shell32.dll --------- 11584512  

 28.06.2010 19:00     C:\Windows\system32\ole32.dll --------- 1316864  

 26.06.2010 00:27     C:\Windows\system32\en-US --------- 8192  

 22.06.2010 15:30     C:\Windows\system32\tzres.dll --------- 2048  

 18.06.2010 19:31     C:\Windows\system32\rtutils.dll --------- 36864  

 11.06.2010 18:15     C:\Windows\system32\msxml3.dll --------- 1248768  

 11.06.2010 16:15     C:\Windows\system32\wbem --------- 81920  

 08.06.2010 19:35     C:\Windows\system32\ntoskrnl.exe --------- 3548040  

 08.06.2010 19:35     C:\Windows\system32\ntkrnlpa.exe --------- 3600768  

 27.05.2010 22:08     C:\Windows\system32\inetcomm.dll --------- 739328  

 27.05.2010 22:08     C:\Windows\system32\iccvid.dll --------- 81920  

 26.05.2010 19:06     C:\Windows\system32\atmlib.dll --------- 34304  

 26.05.2010 16:47     C:\Windows\system32\atmfd.dll --------- 289792  

 18.05.2010 16:35     C:\Windows\system32\dns-sd.exe --------- 107808  

 18.05.2010 16:35     C:\Windows\system32\dnssd.dll --------- 91424  

 04.05.2010 21:13     C:\Windows\system32\msshsq.dll --------- 231424  

 19.04.2010 20:47     C:\Windows\system32\usbaaplrc.dll --------- 3062048  

 16.04.2010 18:46     C:\Windows\system32\usp10.dll --------- 502272  

 16.04.2010 18:43     C:\Windows\system32\Apphlpdm.dll --------- 28672  

 16.04.2010 16:39     C:\Windows\system32\GameUXLegacyGDFs.dll --------- 4240384  

 05.04.2010 19:02     C:\Windows\system32\MP4SDECD.DLL --------- 317952  

 05.04.2010 19:01     C:\Windows\system32\asycfilt.dll --------- 67072  

 18.03.2010 13:16     C:\Windows\system32\msvcr100_clr0400.dll --------- 771424  

 17.03.2010 21:53     C:\Windows\system32\QuickTime.qts --------- 69632  

 17.03.2010 21:53     C:\Windows\system32\QuickTimeVR.qtx --------- 94208  

 05.03.2010 16:01     C:\Windows\system32\vbscript.dll --------- 420352  

 21.02.2010 01:06     C:\Windows\system32\nshhttp.dll --------- 24064  

 21.02.2010 01:05     C:\Windows\system32\httpapi.dll --------- 30720  

 18.02.2010 15:30     C:\Windows\system32\iphlpsvc.dll --------- 200704  

 15.02.2010 13:01     C:\Windows\system32\RtlUI2.exe --------- 380928  

 15.02.2010 13:01     C:\Windows\system32\Rtlihvs.dll --------- 614400  

 15.02.2010 13:01     C:\Windows\system32\RTLExtUI.dll --------- 188416  

 12.02.2010 12:32     C:\Windows\system32\browserchoice.exe --------- 293376  

 10.02.2010 19:13     C:\Windows\system32\unrar.dll --------- 165376  

 25.01.2010 14:00     C:\Windows\system32\secproc_ssp_isv.dll --------- 152576  

 25.01.2010 14:00     C:\Windows\system32\secproc_ssp.dll --------- 152064  

----------------------------------------
 

 

C:\Windows\Prefetch
 

----------------------------------------
 

 

C:\Windows\Tasks
 

 25.10.2010 19:02     C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job --------- 286  

 25.10.2010 19:01     C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job --------- 286  

 25.10.2010 18:32     C:\Windows\Tasks\User_Feed_Synchronization-{5A0D5830-462D-4450-901E-10C1E3C1B043}.job --------- 426  

 25.10.2010 18:27     C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job --------- 1092  

 25.10.2010 18:26     C:\Windows\Tasks\SA.DAT --------- 6  

 25.10.2010 00:15     C:\Windows\Tasks\SCHEDLGU.TXT --------- 32510  

 24.10.2010 23:23     C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job --------- 1096  

----------------------------------------
 

 

C:\Windows\Temp
 

 25.10.2010 18:31     C:\Windows\Temp\GoogleToolbarInstaller1.log --------- 270  

 24.10.2010 17:06     C:\Windows\Temp\fwtsqmfile01.sqm --------- 632  

 24.10.2010 11:45     C:\Windows\Temp\MpSigStub.log --------- 3462  

 24.10.2010 02:45     C:\Windows\Temp\History --------- 0  

 24.10.2010 02:45     C:\Windows\Temp\Cookies --------- 0  

 24.10.2010 02:45     C:\Windows\Temp\Temporary Internet Files --------- 0  

 24.10.2010 01:10     C:\Windows\Temp\sqlite_070nLscDkgxjJWi --------- 0  

 24.10.2010 01:10     C:\Windows\Temp\sqlite_PM4QmVm1ZKRcrHe --------- 0  

 24.10.2010 01:07     C:\Windows\Temp\sqlite_MsthssROtao7E8z --------- 0  

 24.10.2010 01:06     C:\Windows\Temp\fwtsqmfile00.sqm --------- 632  

 23.10.2010 19:59     C:\Windows\Temp\sqlite_jTVaEfgVxPrV7bZ --------- 0  

 23.10.2010 19:59     C:\Windows\Temp\sqlite_64E437p97W39gO2 --------- 0  

 23.10.2010 19:58     C:\Windows\Temp\mcmsc_sjRSqLaubsuLAD1 --------- 0  

 23.10.2010 14:36     C:\Windows\Temp\sqlite_oFmrmafAsL3u9kL --------- 0  

 23.10.2010 14:36     C:\Windows\Temp\sqlite_NJSteGJ9jaucOyP --------- 0  

 23.10.2010 10:44     C:\Windows\Temp\sqlite_ZXULdca65eSgkgJ --------- 0  

 23.10.2010 10:44     C:\Windows\Temp\sqlite_iGPhYyQHJLifuKG --------- 0  

----------------------------------------
 

 

C:\Users\Kerim\AppData\Local\Temp
 

 25.10.2010 19:09     C:\Users\Kerim\AppData\Local\Temp\~DF71BA.tmp --------- 16384  

 25.10.2010 19:09     C:\Users\Kerim\AppData\Local\Temp\~DF5D05.tmp --------- 16384  

 25.10.2010 19:08     C:\Users\Kerim\AppData\Local\Temp\fla254E.tmp --------- 6617782  

 25.10.2010 19:04     C:\Users\Kerim\AppData\Local\Temp\Low --------- 4096  

 25.10.2010 18:32     C:\Users\Kerim\AppData\Local\Temp\jusched.log --------- 5509  

 25.10.2010 18:27     C:\Users\Kerim\AppData\Local\Temp\WPDNSE --------- 0  

 25.10.2010 18:27     C:\Users\Kerim\AppData\Local\Temp\Kerim.bmp --------- 31832  

 24.10.2010 18:04     C:\Users\Kerim\AppData\Local\Temp\veetlea --------- 0  

 24.10.2010 18:04     C:\Users\Kerim\AppData\Local\Temp\veetleb --------- 0  

 24.10.2010 17:05     C:\Users\Kerim\AppData\Local\Temp\plugtmp --------- 0  

 24.10.2010 16:04     C:\Users\Kerim\AppData\Local\Temp\MessengerCache --------- 0  

 24.10.2010 13:55     C:\Users\Kerim\AppData\Local\Temp\CLUpdater8.ini --------- 296  

 24.10.2010 12:50     C:\Users\Kerim\AppData\Local\Temp\hsperfdata_Kerim --------- 0  

 24.10.2010 12:50     C:\Users\Kerim\AppData\Local\Temp\CFG34E6.tmp --------- 123  

 24.10.2010 12:50     C:\Users\Kerim\AppData\Local\Temp\CFGA4A8.tmp --------- 123  

 24.10.2010 03:32     C:\Users\Kerim\AppData\Local\Temp\AUCHECK_PARSER.txt --------- 440  

 24.10.2010 03:32     C:\Users\Kerim\AppData\Local\Temp\AUCHECK_CORE.txt --------- 302  

 24.10.2010 02:44     C:\Users\Kerim\AppData\Local\Temp\JAUReg.log --------- 504  

 24.10.2010 02:44     C:\Users\Kerim\AppData\Local\Temp\java_install_reg.log --------- 3582  

 24.10.2010 02:44     C:\Users\Kerim\AppData\Local\Temp\java_install.log --------- 28989  

 24.10.2010 01:56     C:\Users\Kerim\AppData\Local\Temp\RarSFX0 --------- 40960  

 24.10.2010 01:55     C:\Users\Kerim\AppData\Local\Temp\dd_vcredistUI6673.txt --------- 12554  

 24.10.2010 01:55     C:\Users\Kerim\AppData\Local\Temp\dd_vcredistMSI6673.txt --------- 432520  

 24.10.2010 01:27     C:\Users\Kerim\AppData\Local\Temp\Cookies --------- 4096  

 24.10.2010 01:09     C:\Users\Kerim\AppData\Local\Temp\History --------- 0  

 24.10.2010 01:09     C:\Users\Kerim\AppData\Local\Temp\Temporary Internet Files --------- 0  

 24.10.2010 00:15     C:\Users\Kerim\AppData\Local\Temp\eDatasecurity --------- 0  

 24.10.2010 00:12     C:\Users\Kerim\AppData\Local\Temp\CLUpdater7.ini --------- 296  

 24.10.2010 00:07     C:\Users\Kerim\AppData\Local\Temp\CLUpdater6.ini --------- 296  

 24.10.2010 00:03     C:\Users\Kerim\AppData\Local\Temp\Google Toolbar --------- 4096  

 23.10.2010 23:56     C:\Users\Kerim\AppData\Local\Temp\CLUpdater5.ini --------- 296  

 23.10.2010 23:53     C:\Users\Kerim\AppData\Local\Temp\CLUpdater4.ini --------- 296  

 23.10.2010 23:22     C:\Users\Kerim\AppData\Local\Temp\CLUpdater3.ini --------- 296  

 23.10.2010 23:11     C:\Users\Kerim\AppData\Local\Temp\CLUpdater2.ini --------- 296  

 23.10.2010 23:11     C:\Users\Kerim\AppData\Local\Temp\wmplog07.sqm --------- 1672  

 23.10.2010 22:30     C:\Users\Kerim\AppData\Local\Temp\CLUpdater1.ini --------- 296  

 23.10.2010 22:29     C:\Users\Kerim\AppData\Local\Temp\Xt0..bat --------- 246  

 23.10.2010 22:29     C:\Users\Kerim\AppData\Local\Temp\Xuj.exe --------- 249856  

 23.10.2010 22:27     C:\Users\Kerim\AppData\Local\Temp\CLUpdater0.ini --------- 296  

 23.10.2010 22:26     C:\Users\Kerim\AppData\Local\Temp\Xtz..bat --------- 246  

 23.10.2010 22:26     C:\Users\Kerim\AppData\Local\Temp\Xui.exe --------- 249856  

 23.10.2010 22:26     C:\Users\Kerim\AppData\Local\Temp\Xuh.exe --------- 274432  

 23.10.2010 22:26     C:\Users\Kerim\AppData\Local\Temp\Xug.exe --------- 266240  

 23.10.2010 22:26     C:\Users\Kerim\AppData\Local\Temp\Xuf.exe --------- 401408  

 23.10.2010 22:22     C:\Users\Kerim\AppData\Local\Temp\Xue.exe --------- 274432  

 23.10.2010 22:22     C:\Users\Kerim\AppData\Local\Temp\Xud.exe --------- 266240  

 23.10.2010 22:22     C:\Users\Kerim\AppData\Local\Temp\Xuc.exe --------- 401408  

 23.10.2010 22:20     C:\Users\Kerim\AppData\Local\Temp\Xtv..bat --------- 246  

 23.10.2010 22:20     C:\Users\Kerim\AppData\Local\Temp\Xub.exe --------- 249856  

 23.10.2010 22:18     C:\Users\Kerim\AppData\Local\Temp\CLUpdater.ini --------- 296  

 23.10.2010 22:18     C:\Users\Kerim\AppData\Local\Temp\Xua.exe --------- 274432  

 23.10.2010 22:18     C:\Users\Kerim\AppData\Local\Temp\Xt9.exe --------- 266240  

 23.10.2010 22:18     C:\Users\Kerim\AppData\Local\Temp\Xt8.exe --------- 401408  

 23.10.2010 22:17     C:\Users\Kerim\AppData\Local\Temp\Xty..bat --------- 246  

 23.10.2010 22:17     C:\Users\Kerim\AppData\Local\Temp\Xtx..bat --------- 244  

 23.10.2010 22:17     C:\Users\Kerim\AppData\Local\Temp\Xt7.exe --------- 249856  

 23.10.2010 22:17     C:\Users\Kerim\AppData\Local\Temp\Xtw..bat --------- 244  

 23.10.2010 22:16     C:\Users\Kerim\AppData\Local\Temp\Xt6.exe --------- 249856  

 23.10.2010 22:15     C:\Users\Kerim\AppData\Local\Temp\Xt5.exe --------- 274432  

 23.10.2010 22:15     C:\Users\Kerim\AppData\Local\Temp\Xt4.exe --------- 266240  

 23.10.2010 22:15     C:\Users\Kerim\AppData\Local\Temp\Xt3.exe --------- 274432  

 23.10.2010 22:15     C:\Users\Kerim\AppData\Local\Temp\Xt2.exe --------- 266240  

 23.10.2010 22:15     C:\Users\Kerim\AppData\Local\Temp\Xt1.exe --------- 401408  

 23.10.2010 22:14     C:\Users\Kerim\AppData\Local\Temp\Xt0.exe --------- 401408  

 23.10.2010 22:14     C:\Users\Kerim\AppData\Local\Temp\Xtz.exe --------- 274432  

 23.10.2010 22:14     C:\Users\Kerim\AppData\Local\Temp\Xty.exe --------- 266240  

 23.10.2010 22:14     C:\Users\Kerim\AppData\Local\Temp\Xtx.exe --------- 274432  

 23.10.2010 22:14     C:\Users\Kerim\AppData\Local\Temp\Xtw.exe --------- 266240  

 23.10.2010 22:13     C:\Users\Kerim\AppData\Local\Temp\Xtv.exe --------- 401408  

 23.10.2010 21:34     C:\Users\Kerim\AppData\Local\Temp\wmplog06.sqm --------- 1672  

 23.10.2010 21:24     C:\Users\Kerim\AppData\Local\Temp\{DF7E20AB-2765-416E-8344-A38E08101D22} --------- 12288  

 11.10.2008 02:28     C:\Users\Kerim\AppData\Local\Temp\4894c1.mst --------- 38912  

 20.12.2006 08:53     C:\Users\Kerim\AppData\Local\Temp\Set6F37.tmp --------- 171568  

----------------------------------------
 

 

C:\Program Files
 

 25.10.2010 19:01     C:\Program Files\trend micro --------- 0  

 24.10.2010 02:44     C:\Program Files\Common Files --------- 4096  

 24.10.2010 01:55     C:\Program Files\Avira --------- 0  

 23.10.2010 23:52     C:\Program Files\InstallShield Installation Information --------- 12288  

 23.10.2010 21:33     C:\Program Files\Cyberlink --------- 0  

 20.10.2010 20:46     C:\Program Files\Microsoft.NET --------- 0  

 20.10.2010 20:26     C:\Program Files\Acer GameZone --------- 0  

 20.10.2010 20:09     C:\Program Files\Microsoft Works --------- 28672  

 14.10.2010 20:12     C:\Program Files\Windows Media Player --------- 4096  

 14.10.2010 20:12     C:\Program Files\Internet Explorer --------- 4096  

 16.09.2010 23:49     C:\Program Files\Windows Mail --------- 4096  

 12.08.2010 20:44     C:\Program Files\Movie Maker --------- 8192  

 04.08.2010 20:09     C:\Program Files\iPod --------- 0  

 17.06.2010 22:00     C:\Program Files\Bonjour --------- 4096  

 06.06.2010 11:52     C:\Program Files\World of Warcraft --------- 0  

 06.03.2010 16:58     C:\Program Files\Google --------- 4096  

 15.02.2010 13:03     C:\Program Files\Cisco --------- 0  

 15.02.2010 13:02     C:\Program Files\Realtek --------- 0  

 18.01.2010 04:20     C:\Program Files\Windows Portable Devices --------- 0  

 17.01.2010 17:53     C:\Program Files\Windows Calendar --------- 0  

 17.01.2010 17:53     C:\Program Files\Windows Sidebar --------- 4096  

 17.01.2010 17:53     C:\Program Files\Windows Collaboration --------- 4096  

 17.01.2010 17:53     C:\Program Files\Windows Journal --------- 4096  

 17.01.2010 17:53     C:\Program Files\Windows Photo Gallery --------- 4096  

 17.01.2010 17:53     C:\Program Files\Windows Defender --------- 4096  

 11.11.2009 18:48     C:\Program Files\DIFX --------- 0  

 11.11.2009 18:48     C:\Program Files\PC Connectivity Solution --------- 12288  

 06.11.2009 16:58     C:\Program Files\Microsoft --------- 0  

 06.11.2009 16:58     C:\Program Files\Windows Live --------- 0  

 06.11.2009 16:58     C:\Program Files\Windows Live SkyDrive --------- 0  

 07.10.2009 19:33     C:\Program Files\AviSynth 2.5 --------- 0  

 06.12.2008 18:34     C:\Program Files\Zero G Registry --------- 0  

 06.12.2008 17:27     C:\Program Files\Apple Software Update --------- 4096  

 06.12.2008 17:04     C:\Program Files\QuickTime --------- 0  

 01.12.2008 22:59     C:\Program Files\Java --------- 0  

 01.12.2008 22:09     C:\Program Files\MSXML 4.0 --------- 0  

 01.12.2008 21:35     C:\Program Files\Acer --------- 4096  

 01.12.2008 21:31     C:\Program Files\Windows NT --------- 4096  

 01.12.2008 21:31     C:\Program Files\Gemeinsame Dateien --------- 0  

 11.10.2008 02:29     C:\Program Files\Acer Incorporated --------- 0  

 11.10.2008 02:14     C:\Program Files\Acer Arcade Deluxe --------- 4096  

 11.10.2008 01:53     C:\Program Files\Acer Inc --------- 0  

 11.10.2008 01:52     C:\Program Files\Launch Manager --------- 4096  

 30.07.2008 04:15     C:\Program Files\Convesoft --------- 0  

 30.07.2008 04:14     C:\Program Files\Adobe --------- 0  

 30.07.2008 04:13     C:\Program Files\NewTech Infosystems --------- 0  

 30.07.2008 04:10     C:\Program Files\Big Kahuna Reef --------- 0  

 30.07.2008 03:31     C:\Program Files\Winbond Electronics Corporation --------- 0  

 30.07.2008 03:31     C:\Program Files\Synaptics --------- 0  

 30.07.2008 03:27     C:\Program Files\CONEXANT --------- 0  

 30.07.2008 03:23     C:\Program Files\Intel --------- 0  

 21.01.2008 04:43     C:\Program Files\desktop.ini --------- 174  

 02.11.2006 15:01     C:\Program Files\Uninstall Information --------- 0  

 02.11.2006 14:37     C:\Program Files\Microsoft Games --------- 4096  

 02.11.2006 14:37     C:\Program Files\MSBuild --------- 0  

 02.11.2006 14:37     C:\Program Files\Reference Assemblies --------- 0  

----------------------------------------
 

 

C:\ProgramData\.. 
 

Public    

Kerim    

Default    

desktop.ini    

Default User    

All Users    

----------------------------------------
 

 

C:\Windows\system32\drivers\etc\hosts
 

127.0.0.1       localhost

::1             localhost
 

----------------------------------------
 

 
 

Abbildname                     PID Sitzungsname       Sitz.-Nr. Speichernutzung

========================= ======== ================ =========== ===============

System Idle Process              0 Services                   0            24 K

System                           4 Services                   0         1.000 K

smss.exe                       488 Services                   0           576 K

csrss.exe                      620 Services                   0         6.472 K

wininit.exe                    672 Services                   0         3.480 K

csrss.exe                      684 Console                    1         9.804 K

services.exe                   716 Services                   0         6.092 K

lsass.exe                      732 Services                   0         2.404 K

lsm.exe                        740 Services                   0         3.452 K

svchost.exe                    880 Services                   0         5.808 K

nvvsvc.exe                     944 Services                   0         2.836 K

svchost.exe                    972 Services                   0         6.060 K

svchost.exe                   1008 Services                   0        28.268 K

svchost.exe                   1060 Services                   0        12.592 K

svchost.exe                   1088 Services                   0        79.740 K

svchost.exe                   1104 Services                   0       121.884 K

audiodg.exe                   1188 Services                   0         8.980 K

svchost.exe                   1208 Services                   0         4.080 K

SLsvc.exe                     1224 Services                   0         3.968 K

svchost.exe                   1272 Services                   0        11.916 K

winlogon.exe                  1372 Console                    1         4.700 K

svchost.exe                   1436 Services                   0        12.660 K

spoolsv.exe                   1648 Services                   0         7.144 K

sched.exe                     1672 Services                   0         1.568 K

svchost.exe                   1684 Services                   0        15.152 K

avguard.exe                   1868 Services                   0        16.196 K

AppleMobileDeviceService.     1912 Services                   0         3.180 K

mDNSResponder.exe             1932 Services                   0         4.468 K

Agentsvc.exe                  1944 Services                   0         3.204 K

CLHNService.exe               2020 Services                   0         3.340 K

avshadow.exe                  2044 Services                   0         3.424 K

eDSService.exe                 312 Services                   0         3.536 K

rundll32.exe                   412 Console                    1         4.884 K

ETService.exe                  600 Services                   0        11.052 K

upeksvr.exe                   1216 Console                    1         6.972 K

IAANTmon.exe                  1740 Services                   0         5.036 K

BASVC.exe                     2068 Services                   0         4.708 K

LSSrvc.exe                    2208 Services                   0         2.944 K

MobilityService.exe           2340 Services                   0         7.520 K

CompPtcVUI.exe                2396 Console                    1         7.108 K

BackupSvc.exe                 2420 Services                   0         4.108 K

SchedulerSvc.exe              2464 Services                   0         4.188 K

svchost.exe                   2488 Services                   0         4.456 K

RtlService.exe                2564 Services                   0         4.108 K

RS_Service.exe                2640 Services                   0         2.644 K

RtWLan.exe                    2660 Console                    1         8.888 K

StarWindServiceAE.exe         2688 Services                   0         4.072 K

svchost.exe                   2720 Services                   0         4.904 K

svchost.exe                   2760 Services                   0         1.904 K

SearchIndexer.exe             2780 Services                   0        20.544 K

XAudio.exe                    2856 Services                   0         2.332 K

taskeng.exe                   3184 Services                   0         5.172 K

WmiPrvSE.exe                  3396 Services                   0         5.132 K

dwm.exe                       3988 Console                    1        72.592 K

taskeng.exe                   4024 Console                    1        10.864 K

explorer.exe                  2132 Console                    1        50.848 K

MSASCui.exe                    712 Console                    1        13.720 K

LManager.exe                  2588 Console                    1         5.272 K

avgnt.exe                     2968 Console                    1         3.968 K

jusched.exe                   3904 Console                    1         3.536 K

wmpnscfg.exe                  3912 Console                    1         4.240 K

GoogleToolbarNotifier.exe     2684 Console                    1         2.652 K

wmpnetwk.exe                  4016 Services                   0        18.736 K

unsecapp.exe                  4160 Console                    1         5.108 K

Xwovia.exe                    5980 Console                    1       102.180 K

Xwovia.exe                    4224 Console                    1        91.888 K

Xwovia.exe                    7020 Console                    1        87.468 K

Xwovia.exe                    7032 Console                    1        68.504 K

Xwovia.exe                    7104 Console                    1        80.324 K

Xwovia.exe                    7156 Console                    1        99.856 K

Xwovia.exe                    7428 Console                    1        84.224 K

firefox.exe                   7452 Console                    1        89.540 K

Xuj.exe                       1884 Console                    1        23.636 K

Xtx.exe                       6164 Console                    1        29.296 K

notepad.exe                   3028 Console                    1         5.944 K

notepad.exe                   4404 Console                    1         6.040 K

cmd.exe                       4604 Console                    1         3.016 K

conime.exe                    2776 Console                    1         3.956 K

SearchFilterHost.exe          2636 Services                   0         5.328 K

SearchProtocolHost.exe        5392 Services                   0         8.060 K

iexplore.exe                  2908 Console                    1        15.544 K

iexplore.exe                  6916 Console                    1        23.996 K

GoogleToolbarUser_32.exe      5516 Console                    1        10.940 K

tasklist.exe                  3604 Console                    1         4.792 K

WmiPrvSE.exe                  6644 Services                   0         5.712 K
 

 

***** Ende des Scans 25.10.2010 um 19:09:26,30 ***

INSTALL

Acer Arcade Deluxe CyberLink Corp. 10.10.2008 83,0MB 2.0.5529
Acer Bio Protection

AAU 6.0.00.17 10.10.2008 183,2MB
Acer Crystal Eye Webcam 2.0.8 SuYin 10.10.2008 2,95MB 2.0.8
Acer eAudio Management CyberLink Corp. 10.10.2008 4,71MB 3.0.3008
Acer eDataSecurity Management Egis Inc. 29.07.2008 69,3MB 3.0.3062
Acer Empowering Technology Acer Incorporated 10.10.2008 147,8MB 3.0.3009
Acer ePower Management Acer Incorporated 10.10.2008 9,84MB 3.0.3014
Acer eRecovery Management Acer Incorporated 10.10.2008 27,6MB 3.0.3014
Acer eSettings Management Acer Incorporated 29.07.2008 27,4MB 3.0.3007
Acer GridVista 10.10.2008 1,51MB 2.72.317
Acer Mobility Center Plug-In Acer Inc. 29.07.2008 4,13MB 3.0.3000
Acer ScreenSaver Acer Incorporated 10.10.2008 1.11.0701
Acer VCM Acer Incorporated 10.10.2008 22,9MB 3.1.3000
AdblockIE af0.net 23.10.2010 9,46MB 1.2
Adobe Flash Player 10 Plugin Adobe Systems Incorporated 15.08.2010 10.1.82.76
Adobe Flash Player ActiveX Adobe Systems Incorporated 10.10.2008 9.0.124.0
Adobe Reader 8.1.0 Adobe Systems Incorporated 29.07.2008 87,9MB 8.1.0
Advanced Wheel Mouse 6.0.0.002 08.06.2010 0,46MB
Apple Application Support Apple Inc. 16.06.2010 42,8MB 1.3.0
Apple Mobile Device Support Apple Inc. 16.06.2010 19,9MB 3.1.0.62
Apple Software Update Apple Inc. 05.12.2008 2,16MB 2.1.1.116
Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver Atheros Communications Inc. 29.07.2008 2,93MB 1.0.0.30
Avira AntiVir Personal - Free Antivirus Avira GmbH 23.10.2010 122,7MB 10.0.0.567
Azureus 05.12.2008 15,9MB 2.5.0.4
Bluesoleil2.6.0.8 Release 070517 IVT Corporation 29.12.2008 11,4MB 2.6.0.8 Release 070517
Bonjour Apple Inc. 16.06.2010 0,76MB 2.0.2.0
CCleaner Piriform 22.10.2010 2,96MB 2.36
Cisco EAP-FAST Module Cisco Systems, Inc. 14.02.2010 2,98MB 2.0.26
Cisco LEAP Module Cisco Systems, Inc. 14.02.2010 1,04MB 1.0.11
Cisco PEAP Module Cisco Systems, Inc. 14.02.2010 0,84MB 1.0.12
concept/design onlineTV 5 concept/design GmbH 19.10.2010 8,13MB onlineTV 5
CyberLink PowerDVD 10 CyberLink Corp. 22.10.2010 237,7MB 10.0.2113
DivX Codec DivX, Inc. 05.12.2008 1,40MB 6.8.5
DivX Converter DivX, Inc. 05.12.2008 30,4MB 6.6.1
DivX Player 05.12.2008 15,4MB 6.8.2
DivX Web Player DivX,Inc. 05.12.2008 2,92MB 1.4.2
eMule 05.12.2008 10,6MB
EVEREST Home Edition v2.20 Lavalys Inc 12.12.2008 6,58MB 2.20
FLV Player 2.0 (build 25) Martijn de Visser 24.05.2009 1,95MB 2.0 (build 25)
Google Desktop Google 30.11.2008 30,2MB 5.7.0808.07150
Google Earth Google 12.12.2008 25,3MB 4.3.7284.3916
Google Toolbar for Internet Explorer Google Inc. 11.07.2010 34,9MB
HDAUDIO Soft Data Fax Modem with SmartCP Conexant Systems 29.07.2008 0,98MB 7.73.00.52
ICQ6.5 ICQ 03.01.2009 48,0MB 6.5
Intel® Matrix Storage Manager Intel Corporation 10.10.2008 49,7MB
iTunes Apple Inc. 03.08.2010 161,9MB 9.2.1.5
Java(TM) 6 Update 22 Oracle 23.10.2010 97,1MB 6.0.220
Launch Manager Acer Inc. 19.06.2010 2,66MB 2.0.02
LOGO!Soft Comfort V6.1 Siemens AG 05.12.2008 104,6MB 6.1.0.0
Messenger Plus! Live Patchou 12.08.2009 12,8MB 4.82.0.368
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU Microsoft Corporation 07.08.2009 37,0MB
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 20.05.2009 37,0MB
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 25.06.2010 120,3MB 4.0.30319
Microsoft Office Professional Edition 2003 Microsoft Corporation 23.10.2010 401,9MB 11.0.8173.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 06.11.2009 0,25MB 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 29.07.2008 0,41MB 8.0.56336
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Corporation 12.11.2009 0,19MB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Corporation 10.11.2009 0,45MB 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 05.07.2010 0,58MB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 23.10.2010 0,58MB 9.0.30729.4148
Microsoft Works Microsoft Corporation 09.12.2009 282,6MB 08.05.0822
Mozilla Firefox (3.0.4) Mozilla 05.12.2008 26,4MB 3.0.4 (de)
Mozilla Firefox (3.6.11) Mozilla 19.10.2010 32,7MB 3.6.11 (de)
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 30.11.2008 1,28MB 4.20.9870.0
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 25.11.2009 1,34MB 4.20.9876.0
Nero 8 Lite 8.2.8.0 Updatepack.nl 07.12.2008 55,5MB 8.2.8.0
NTI Backup Now 5 NewTech Infosystems 29.07.2008 28,6MB 5.1.2.606
NTI Media Maker 8 NewTech Infosystems 29.07.2008 187,0MB 8.0.2.6329
NVIDIA Drivers 16.01.2010
PC Connectivity Solution Nokia 10.11.2009 12,1MB 9.23.3.0
PDFCreator Frank Heindörfer, Philip Chinery 22.05.2010 21,1MB 0.9.9
QuickTime Apple Inc. 15.05.2010 73,8MB 7.66.71.0
REALTEK 11n USB Wireless LAN Driver and Utility REALTEK Semiconductor Corp. 14.02.2010 5,08MB 1.00.0106
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 29.07.2008 21,6MB 6.0.1.5618
Realtek USB 2.0 Card Reader Realtek Semiconductor Corp. 29.07.2008 2,97MB
SopCast 3.2.9 www.sopcast.com 22.10.2010 8,44MB 3.2.9
SPBA 5.8 UPEK Inc. 10.10.2008 20,1MB 5.8.2.4218
sPlan 6.0 (Demo) 04.12.2008 5,50MB
Spybot - Search & Destroy Safer Networking Limited 22.10.2010 50,3MB 1.6.2
SUPER © Version 2009.bld.36 (June 10, 2009) eRightSoft 06.10.2009 27,2MB Version 2009.bld.36 (June 10, 2009)
Synaptics Pointing Device Driver Synaptics 29.07.2008 14,4MB 11.1.4.0
TeamSpeak 2 RC2 Dominating Bytes Design 12.12.2008 2.0.32.60
TeamSpeak 3 Client TeamSpeak Systems GmbH 05.07.2010 30,3MB
TubeBox! Jens Lorek 05.05.2010 14,4MB 3.3.10
TVUPlayer 2.5.2.1 TVU networks 13.03.2010 14,6MB 2.5.2.1
Veetle TV 0.9.18 Veetle, Inc 23.10.2010 36,3MB 0.9.18
VLC media player 1.0.5 VideoLAN Team 19.03.2010 60,0MB 1.0.5
Winamp Nullsoft, Inc 12.12.2008 29,2MB 5.541
Winbond CIR Device Drivers Winbond Electronics Corporation 29.07.2008 2,25MB 7.60.1012
Windows Live Anmelde-Assistent Microsoft Corporation 05.11.2009 1,93MB 5.000.818.5
Windows Live Essentials Microsoft Corporation 05.11.2009 44,0MB 14.0.8089.0726
Windows Live-Uploadtool Microsoft Corporation 05.11.2009 0,22MB 14.0.8014.1029
Windows Media Player Firefox Plugin Microsoft Corp 07.06.2010 0,29MB 1.0.0.8
WinRAR 04.12.2008 3,73MB
World of Warcraft Blizzard Entertainment 14.10.2010 26.734,1MB 4.0.1.13164

[code]

File name:
Xwovia.exe
Submission date:
2010-10-25 17:14:10 (UTC)
Current status:
queued (#10) queued (#10) analysing finished
Result:
23/ 43 (53.5%)

Antivirus Version Last Update Result
AhnLab-V3 2010.10.25.00 2010.10.25 -
AntiVir 7.10.13.35 2010.10.25 -
Antiy-AVL 2.0.3.7 2010.10.25 -
Authentium 5.2.0.5 2010.10.24 W32/Renos.A!Generic
Avast 4.8.1351.0 2010.10.25 Win32:Malware-gen
Avast5 5.0.594.0 2010.10.25 Win32:Malware-gen
AVG 9.0.0.851 2010.10.25 Downloader.Generic10.AFTP
BitDefender 7.2 2010.10.25 Gen:Variant.Kazy.2182
CAT-QuickHeal 11.00 2010.10.25 -
ClamAV 0.96.2.0-git 2010.10.25 -
Comodo 6504 2010.10.25 MalCrypt.Indus!
DrWeb 5.0.2.03300 2010.10.25 Trojan.DownLoader1.28144
Emsisoft 5.0.0.50 2010.10.25 -
eSafe 7.0.17.0 2010.10.25 -
eTrust-Vet 36.1.7933 2010.10.25 Win32/Renos.D!generic
F-Prot 4.6.2.117 2010.10.24 W32/Renos.A!Generic
F-Secure 9.0.16160.0 2010.10.25 Gen:Variant.Kazy.2182
Fortinet 4.2.249.0 2010.10.25 -
GData 21 2010.10.25 Gen:Variant.Kazy.2182
Ikarus T3.1.1.90.0 2010.10.25 -
Jiangmin 13.0.900 2010.10.25 -
K7AntiVirus 9.66.2830 2010.10.25 Virus
Kaspersky 7.0.0.125 2010.10.25 -
McAfee 5.400.0.1158 2010.10.25 Downloader-CEW.b
McAfee-GW-Edition 2010.1C 2010.10.25 Heuristic.BehavesLike.Win32.Obfuscated.H
Microsoft 1.6301 2010.10.25 TrojanDownloader:Win32/Renos.LX
NOD32 5561 2010.10.25 a variant of Win32/Kryptik.HQN
Norman 6.06.10 2010.10.25 -
nProtect 2010-10-25.01 2010.10.25 Gen:Variant.Kazy.2182
Panda 10.0.2.7 2010.10.25 Suspicious file
PCTools 7.0.3.5 2010.10.25 -
Prevx 3.0 2010.10.25 Medium Risk Malware
Rising 22.70.06.04 2010.10.25 -
Sophos 4.58.0 2010.10.25 Mal/FakeAV-CX
Sunbelt 7138 2010.10.25 VirTool.Win32.Obfuscator.hg!b1 (v)
SUPERAntiSpyware 4.40.0.1006 2010.10.25 -
Symantec 20101.2.0.161 2010.10.25 -
TheHacker 6.7.0.1.066 2010.10.25 Trojan/Kryptik.hqn
TrendMicro 9.120.0.1004 2010.10.25 -
TrendMicro-HouseCall 9.120.0.1004 2010.10.25 -
VBA32 3.12.14.1 2010.10.25 BScope.Trojan.MTA.01049
ViRobot 2010.10.25.4110 2010.10.25 -
VirusBuster 12.70.4.0 2010.10.25 -

Additional information

MD5 : 3376afd9723e67e714e08a7f9abd56e4
SHA1 : c7c7064028faf36d1c5930da3ae647c20ac0e15d
SHA256: 6aad83e0cdaf33b7665299ab9d89cded58e34995bc86dac926dce39d3df244de

ssdeep: 6144:ZBK2I+i+Nzv5fxUqLO5+kgtH/jekcpiRNmi6:K2IM8qLUgs3pONo
File size : 266240 bytes
First seen: 2010-10-25 17:14:10
Last seen : 2010-10-25 17:14:10
TrID:
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: Trend Micro Inc.
copyright....: CopyGolds
product......: Golds
description..: Golds
original name: Golds.exe
internal name: Golds
file version.: 3.3.0.348
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x1000
timedatestamp....: 0x4A3828D9 (Tue Jun 16 23:20:57 2009)
machinetype......: 0x14c (I386)

[[ 6 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
CODE, 0x1000, 0x16AFE, 0x17000, 4.98, 0b8958deb0cdafe0d326c7bf80521dd8
.rdata, 0x18000, 0x310C, 0x4000, 4.03, 91170cdc34e444e77f1a109fc745bfd1
.data, 0x1C000, 0x6C7, 0x1000, 0.00, 620f0b67a91f7f74151bc5be745b7110
.bss, 0x1D000, 0x16CF, 0x2000, 3.44, c406c45a20cd3c46df48975da192df89
.gdata, 0x1F000, 0x1F38F, 0x20000, 7.30, d9fd7e88823213969b4e8645e4bfe354
.rsrc, 0x3F000, 0x1EA4, 0x2000, 3.42, f017022343b7b9be4486be047c12052a

[[ 18 import(s) ]]
SHLWAPI.dll: SHGetValueA, PathIsDirectoryA, PathIsContentTypeA, SHQueryValueExA, PathFileExistsA, SHDeleteKeyA, SHStrDupA
MSVCRT.dll: memcpy, wcsncmp, exit, sqrt, exp
MSVCRT.dll: srand, asin, strlen
OLEAUT32.dll: SysStringLen, VariantCopyInd, SysAllocStringLen, SafeArrayUnaccessData, VariantChangeType
VERSION.dll: GetFileVersionInfoA, VerFindFileA
COMCTL32.dll: ImageList_Write, ImageList_DrawEx
SHELL32.dll: SHGetFolderPathA, SHGetSpecialFolderLocation, SHFileOperationA, Shell_NotifyIconA
OLE32.dll: CreateBindCtx, StgCreateDocfileOnILockBytes, OleRegGetUserType, CoRegisterClassObject, StgOpenStorage, CoRevokeClassObject
comdlg32.dll: GetFileTitleA
gdi32.dll: GetClipBox
version.dll: VerQueryValueA, GetFileVersionInfoSizeA
user32.dll: RegisterWindowMessageA, IsIconic, RedrawWindow, MessageBoxA, GetParent, WaitMessage, SetScrollPos, GetScrollInfo, GetMenuItemID, GetWindow, SetClipboardData, PeekMessageW, KillTimer, GetActiveWindow, DestroyMenu, GetSysColor, GetClientRect, InsertMenuA, DispatchMessageW, GetKeyboardLayout, GetPropA, CharToOemA, GetMenuState, ScrollWindow, CharLowerBuffA, SetCapture, IsWindowEnabled
gdi32.dll: CreateBitmap, SaveDC, SetPixel, CopyEnhMetaFileA, CreateCompatibleBitmap, CreateCompatibleDC, SelectPalette, CreateDIBSection, GetClipBox, GetBitmapBits
kernel32.dll: GetFileAttributesA, CloseHandle, lstrlenA, DeleteCriticalSection, LocalReAlloc, lstrcatA, CompareStringA, WaitForSingleObject, GetFullPathNameA, VirtualAllocEx, HeapAlloc, GetFileType, SetEvent, DeleteFileA, GetLocaleInfoA, GetModuleFileNameA, GetCurrentProcessId, ExitThread, GetProcAddress, LoadLibraryExA, GetCommandLineW, CreateFileA, GetUserDefaultLCID, WideCharToMultiByte, GetSystemDefaultLangID, SetHandleCount, ExitProcess, VirtualQuery, LoadResource, HeapDestroy, GetStringTypeW, GetLocalTime, VirtualAlloc, GetOEMCP, GlobalAlloc, LockResource, GetCommandLineA, ResetEvent, GetACP, GlobalFindAtomA, GetProcessHeap, EnterCriticalSection, LocalAlloc, EnumCalendarInfoA, CreateEventA, SetFilePointer, GetCurrentProcess, lstrlenW, IsBadReadPtr, GetStdHandle, IsBadHugeReadPtr, GetModuleHandleA
VERSION.dll: VerQueryValueA
ADVAPI32.dll: GetLengthSid, RegQueryInfoKeyA, RegDeleteKeyA, RegCreateKeyA
SHLWAPI.dll: SHStrDupA, PathFileExistsA, SHQueryInfoKeyA, SHDeleteValueA, SHQueryValueExA, PathIsContentTypeA, SHGetValueA, PathIsDirectoryA, SHSetValueA, PathGetCharTypeA
gdi32.dll: GetObjectA, SaveDC, RestoreDC, CreateBitmap, CreateBrushIndirect, CreatePalette, SelectObject, SetTextColor
Prevx Info:
Prevx
ExifTool:
file metadata
CharacterSet: Unicode
CodeSize: 94208
CompanyName: Trend Micro Inc.
EntryPoint: 0x1000
FileDescription: Golds
FileFlagsMask: 0x003f
FileOS: Win32
FileSize: 260 kB
FileSubtype: 0
FileType: Win32 EXE
FileVersion: 3.3.0.348
FileVersionNumber: 3.3.0.348
ImageVersion: 0.0
InitializedDataSize: 167936
InternalName: Golds
LanguageCode: English (U.S.)
LegalCopyright: CopyGolds
LinkerVersion: 3.6
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 4.0
ObjectFileType: Executable application
OriginalFilename: Golds.exe
PEType: PE32
ProductName: Golds
ProductVersion: 3.3.0.348
ProductVersionNumber: 3.3.0.348
Subsystem: Windows GUI
SubsystemVersion: 4.0
TimeStamp: 2009:06:17 01:20:57+02:00
UninitializedDataSize: 0
Symantec reputation:Suspicious.Insight

Code:

Azureus

Zitat:

Internet-Tauschbörsen gehören leider zu den unseriösesten Anbietern, und dort werden sehr viele Schädlinge verbreitet, hierbei sollte deshalb, wenn überhaupt, nur ganz besonders vorsichtig umgegangen werden ! Laut Studien sind bei den Tauschbörsen bei 45% der zum Download angebotenen Dateien, Viren oder Würmer und sonstige Schädlinge enthalten!
Hinzu kommt noch, dass die meisten Downloads von diesen Tauschbörsen eh illegal sind, und damit die Nutzer verleitet werden, „Straftaten“ zu begehen!

Selbst wenn du ein „sicheres“ P2P Programm verwendest, ist es nur das Programm, das sicher ist.Du wirst Daten von "uncertified Quellen" teilen, und diese werden häufig angesteckt...;)
Ausserdem nicht nur trojanische Pferde oder andere Virentypen eine direkt Verbindung brauchen, sondern der Verwendung von diverse Filesharing-Programme & Co, "telefonieren auch nach Hause", wenn auch noch keine Beweise vorliegen und solchen Clients erlaubt, würde ich nicht empfehlen!http://www.world-of-smilies.com/wos_teufel/teu96.gif

2.
Der Messenger Plus! Live enthält einige Komponenten (Sponsorprogramm), die deinen Rechner ausspionieren, deshalb wird von diesem Programm abgeraten.
Immer die benutzerdefinierte Installation wählen, nicht die Standardinstallation, weil da oft Sachen mitinstalliert werden, die man nicht braucht oder nicht möchte.
also deinstalliere Messenger Plus! Live unter `Start→ Systemsteuereung→ Ändern/Entfernen...` - ► achte aber darauf, ob da etwas beim Deinstallieren mit da steht, wie "Partner/Sponsorenprogramme entfernen"!
- es ist besser ein Spy- und Adware freies Messenger Tool einzusetzen - wie z.B Trillian,kann man in der Basisversion von Trillian die Instant Messenger ICQ, AIM, Yahoo! Messenger, Windows Live Messenger (MSN) und IRC vereinen) oder Miranda
wenn Du ihn doch nochmal installieren möchtest, Sponsorprogramm bitte abwählen!

3.
Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org

Installieren und per Doppelklick starten.
Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
"Komplett Scan durchführen" wählen (überall Haken setzen)
wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
alle Funde markieren und auf "Löschen" - "Ausgewähltes entfernen") klicken.
Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"

eine bebilderte Anleitung findest Du hier: Anleitung

4.
poste erneut - nach der vorgenommenen Reinigungsaktion:
TrendMicro™ HijackThis™ -Logfile - Keine offenen Fenster, solang bis HijackThis läuft!!
hjtscanlist v2.0 - Dateiliste

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4953

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18975

26.10.2010 20:32:22
mbam-log-2010-10-26 (20-32-22).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 266025
Laufzeit: 1 Stunde(n), 16 Minute(n), 28 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 5
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 26

Infizierte Speicherprozesse:
C:\Users\Kerim\AppData\Local\Temp\Xtx.exe (Rootkit.TDSS) -> Unloaded process successfully.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\KOO9RV9K4Z (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\X3EKEPXJP2 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koo9rv9k4z (Rootkit.TDSS) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Users\Kerim\AppData\Local\Temp\Xtx.exe (Rootkit.TDSS) -> Delete on reboot.
C:\Users\Kerim\AppData\Local\Temp\Xui.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xt0.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xt1.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xt2.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xt3.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xt4.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xt5.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xt6.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xt7.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xt8.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xt9.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xtv.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xtw.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xty.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xtz.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xua.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xub.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xuc.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xud.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xue.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xuf.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xug.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\Kerim\AppData\Local\Temp\Xuh.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Windows\Xwovib.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

-----------------------------------------------------------------

HiJackthis Logfile:

Code:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 20:39:31, on 26.10.2010

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18975)

Boot mode: Normal
 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

D:\Program Files\Launch Manager\LManager.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Users\Kerim\Desktop\HiJackThis204.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1008&m=aspire_6930g

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1008&m=aspire_6930g

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1008&m=aspire_6930g

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts: ::1 localhost

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [LManager] D:\Program Files\Launch Manager\LManager.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O8 - Extra context menu item: &Block This Image (ABP) - D:\Program Files\Adblock Pro\blockimg.html

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe

O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - d:ICQ6.5\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - d:ICQ6.5\ICQ.exe

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll

O20 - Winlogon Notify: spba - C:\Program Files\Common Files\SPBA\homefus2.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe

O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe

O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: iGroupTec Service (IGBASVC) - Unknown owner - C:\Program Files\Acer\Acer Bio Protection\BASVC.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe

O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: Realtek11nSU - Realtek - C:\Program Files\Realtek\11n USB Wireless LAN Utility\RtlService.exe

O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
 

--

End of file - 8775 bytes

--- --- ---

hjtscanlist v2.0 - Dateiliste - nicht vergessen!:)

upps :-D

Code:

 

                        $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ 

                        º                                    º 

                                    hjtscanlist v2.0              

                        º                                    º 

                        $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ 
 

Microsoft Windows [Version 6.0.6002]

 

 

C:
 

       C:\hiberfil.sys ---------    

       C:\pagefile.sys ---------    

  26.10.2010 20:32     C:\Windows --------- 32768   

  26.10.2010 19:12     C:\ProgramData --------- 12288   

  26.10.2010 18:50     C:\System Volume Information --------- 28672   

  25.10.2010 19:01     C:\rsit --------- 0   

  25.10.2010 19:01     C:\Program Files --------- 20480   

  09.06.2010 18:01     C:\Advanced Wheel Mouse --------- 4096   

  17.01.2010 18:01     C:\Boot --------- 4096   

  11.04.2009 08:36     C:\bootmgr --------- 333257   

  05.12.2008 23:57     C:\IO.SYS --------- 0   

  05.12.2008 23:57     C:\MSDOS.SYS --------- 0   

  05.12.2008 21:57     C:\ACER --------- 4096   

  01.12.2008 21:37     C:\$RECYCLE.BIN --------- 0   

  01.12.2008 21:35     C:\ACERSW --------- 0   

  01.12.2008 21:34     C:\Users --------- 4096   

  01.12.2008 21:31     C:\Programme --------- 0   

  01.12.2008 21:31     C:\Dokumente und Einstellungen --------- 0   

  11.10.2008 02:04     C:\CLSetup --------- 0   

  11.10.2008 02:04     C:\Medion.ini --------- 20   

  11.10.2008 01:58     C:\Partition.txt --------- 60   

  30.07.2008 12:23     C:\BOOTSECT.BAK --------- 8192   

  30.07.2008 04:41     C:\book --------- 0   

  30.07.2008 03:26     C:\RHDSetup.log --------- 426   

  30.07.2008 03:15     C:\Intel --------- 0   

  11.06.2008 07:55     C:\TEMP --------- 0   

  21.01.2008 04:32     C:\PerfLogs --------- 0   

  02.11.2006 15:02     C:\Documents and Settings --------- 0   

  18.09.2006 23:43     C:\config.sys --------- 10   

  18.09.2006 23:43     C:\autoexec.bat --------- 24   

----------------------------------------
 

 

C:\Windows
 

  26.10.2010 20:39     C:\Windows\WindowsUpdate.log --------- 1244658   

  26.10.2010 20:35     C:\Windows\bootstat.dat --------- 67584   

  26.10.2010 20:35     C:\Windows\PFRO.log --------- 35644   

  24.10.2010 12:50     C:\Windows\win.ini --------- 240   

  24.10.2010 00:56     C:\Windows\WinInit.Ini --------- 802   

  20.10.2010 20:48     C:\Windows\ODBC.INI --------- 400   

  20.10.2010 20:40     C:\Windows\NeroDigital.ini --------- 69   

  20.06.2010 13:11     C:\Windows\LManager.UNI --------- 83   

  15.02.2010 13:01     C:\Windows\RtlUI2.exe --------- 380928   

  15.02.2010 13:01     C:\Windows\Rtlihvs.dll --------- 614400   

  15.02.2010 13:01     C:\Windows\RTLExtUI.dll --------- 188416   

  28.12.2009 16:36     C:\Windows\popcinfo.dat --------- 10   

  23.11.2009 19:06     C:\Windows\d3dx.dat --------- 4096   

  29.04.2009 15:46     C:\Windows\RtlIhvOid.dll --------- 208896   

  11.04.2009 08:27     C:\Windows\explorer.exe --------- 2926592   

  30.12.2008 22:35     C:\Windows\0 --------- 32   

  06.12.2008 17:52     C:\Windows\nsreg.dat --------- 0   

  05.12.2008 23:57     C:\Windows\uninst.exe --------- 283648   

  24.10.2008 17:39     C:\Windows\UNINST32.EXE --------- 309768   

  11.10.2008 01:53     C:\Windows\GridV.UNI --------- 92   

  11.10.2008 01:52     C:\Windows\QtZgAcer.UNI --------- 83   

  02.09.2008 04:13     C:\Windows\MOD01SET000000005J.enc --------- 1976   

  02.09.2008 04:13     C:\Windows\CSUP.TXT --------- 10   

  14.08.2008 09:33     C:\Windows\MOD01SET0S00860004.enc --------- 2176   

  30.07.2008 03:25     C:\Windows\DIFxAPI.dll --------- 319456   

  30.07.2008 03:25     C:\Windows\HideWin.exe --------- 315392   

  30.07.2008 02:42     C:\Windows\ocsetup_install_OEMHelpCustomization.etl --------- 16449536   

  30.07.2008 02:42     C:\Windows\ocsetup_cbs_install_OEMHelpCustomization.perf --------- 196608   

  30.07.2008 02:42     C:\Windows\ocsetup_cbs_install_OEMHelpCustomization.dpx --------- 65536   

  22.07.2008 10:02     C:\Windows\MOD01SET07EN000004.enc --------- 2392   

  18.07.2008 04:59     C:\Windows\ReleaseNotes.txt --------- 2006   

  17.07.2008 06:27     C:\Windows\AcerStore.exe --------- 380928   

  11.06.2008 07:55     C:\Windows\MOD01OPK0400860001.enc --------- 2400   

  20.05.2008 09:57     C:\Windows\Acer Crystal Eye webcam.EXE --------- 262144   

  09.05.2008 07:45     C:\Windows\MOD01SET07EN000002.enc --------- 2392   

  08.05.2008 23:58     C:\Windows\Interop.IWshRuntimeLibrary.dll --------- 49152   

  07.05.2008 10:19     C:\Windows\RtHDVCpl.exe --------- 6139904   

  25.04.2008 07:11     C:\Windows\MOD01SET0J00860003.enc --------- 1996   

  02.04.2008 03:27     C:\Windows\RtlUpd.exe --------- 1196032   

  13.03.2008 11:48     C:\Windows\RTKVADDA.EXE --------- 290816   

  05.03.2008 12:07     C:\Windows\RtlExUpd.dll --------- 520192   

  25.02.2008 11:13     C:\Windows\Suyin.reg --------- 4838   

  31.01.2008 15:18     C:\Windows\RtDefLvl.ini --------- 1694   

  21.01.2008 04:43     C:\Windows\WindowsShell.Manifest --------- 749   

  21.01.2008 04:24     C:\Windows\regedit.exe --------- 134656   

  21.01.2008 04:24     C:\Windows\bfsvc.exe --------- 58880   

  21.01.2008 04:24     C:\Windows\fveupdate.exe --------- 13312   

  21.01.2008 04:24     C:\Windows\HelpPane.exe --------- 498176   

  21.01.2008 04:23     C:\Windows\notepad.exe --------- 151040   

  10.01.2008 05:44     C:\Windows\GVUni.exe --------- 199176   

  20.11.2007 12:15     C:\Windows\SkyTel.exe --------- 1826816   

  14.11.2007 09:18     C:\Windows\USetup.iss --------- 553   

  29.10.2007 13:35     C:\Windows\PidList.ini --------- 36   

  23.10.2007 10:56     C:\Windows\PLFSetI.exe --------- 200704   

  20.04.2007 06:30     C:\Windows\Acer Crystal Eye webcam.ico --------- 222382   

  29.03.2007 16:48     C:\Windows\Image.dll --------- 626688   

  02.11.2006 14:35     C:\Windows\WMSysPr9.prx --------- 316640   

  02.11.2006 14:34     C:\Windows\twunk_16.exe --------- 49680   

  02.11.2006 14:34     C:\Windows\twain_32.dll --------- 50688   

  02.11.2006 14:34     C:\Windows\twunk_32.exe --------- 31232   

  02.11.2006 14:34     C:\Windows\twain.dll --------- 94784   

  02.11.2006 11:45     C:\Windows\winhlp32.exe --------- 9216   

  02.11.2006 11:45     C:\Windows\hh.exe --------- 14848   

  02.11.2006 09:46     C:\Windows\mib.bin --------- 43131   

  19.09.2006 13:41     C:\Windows\HomePremium.xml --------- 8328   

  18.09.2006 23:46     C:\Windows\system.ini --------- 219   

  18.09.2006 23:43     C:\Windows\_default.pif --------- 707   

  18.09.2006 23:43     C:\Windows\winhelp.exe --------- 256192   

  18.09.2006 23:30     C:\Windows\msdfmap.ini --------- 1405   

----------------------------------------
 

 

C:\Windows\System
 

 27.09.2007 15:32      C:\Windows\System\ms.ico --------- 34530 

 27.09.2007 15:17      C:\Windows\System\sm.ico --------- 37041 

 27.09.2007 15:12      C:\Windows\System\sd.ico --------- 38660 

 27.09.2007 15:04      C:\Windows\System\cf.ico --------- 37300 

 02.08.2007 22:32      C:\Windows\System\DriveIcon.dll --------- 5631520 

 02.11.2006 14:34      C:\Windows\System\mciwave.drv --------- 28160 

 02.11.2006 14:34      C:\Windows\System\mciseq.drv --------- 25264 

 02.11.2006 14:34      C:\Windows\System\avicap.dll --------- 69584 

 02.11.2006 14:34      C:\Windows\System\avifile.dll --------- 109456 

 02.11.2006 14:34      C:\Windows\System\mciavi.drv --------- 73376 

 02.11.2006 14:34      C:\Windows\System\msvideo.dll --------- 126912 

 02.11.2006 09:10      C:\Windows\System\OLESVR.DLL --------- 24064 

 02.11.2006 09:10      C:\Windows\System\WFWNET.DRV --------- 12704 

 02.11.2006 09:10      C:\Windows\System\COMMDLG.DLL --------- 32816 

 02.11.2006 09:10      C:\Windows\System\TIMER.DRV --------- 4048 

 02.11.2006 09:10      C:\Windows\System\MMSYSTEM.DLL --------- 68992 

 02.11.2006 09:10      C:\Windows\System\mmtask.tsk --------- 1152 

 02.11.2006 09:10      C:\Windows\System\mouse.drv --------- 2032 

 02.11.2006 09:10      C:\Windows\System\vga.drv --------- 2176 

 02.11.2006 09:10      C:\Windows\System\sound.drv --------- 1744 

 02.11.2006 09:10      C:\Windows\System\keyboard.drv --------- 2000 

 02.11.2006 09:10      C:\Windows\System\SHELL.DLL --------- 5120 

 02.11.2006 09:10      C:\Windows\System\system.drv --------- 3360 

 18.09.2006 23:43      C:\Windows\System\ver.dll --------- 9008 

 18.09.2006 23:43      C:\Windows\System\olecli.dll --------- 82944 

 18.09.2006 23:43      C:\Windows\System\lzexpand.dll --------- 9936 

 18.09.2006 23:35      C:\Windows\System\stdole.tlb --------- 5532 

 30.06.2004 16:24      C:\Windows\System\MyMulti.ico --------- 5430 

----------------------------------------
 

 

C:\Windows\System32
 

 26.10.2010 20:35     C:\Windows\system32\LogConfigTemp.xml --------- 0  

 26.10.2010 20:35     C:\Windows\system32\agent.log --------- 147  

 26.10.2010 20:35     C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 --------- 3216  

 26.10.2010 20:35     C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 --------- 3216  

 26.10.2010 20:35     C:\Windows\system32\drivers --------- 81920  

 26.10.2010 20:18     C:\Windows\system32\Tasks --------- 4096  

 24.10.2010 02:43     C:\Windows\system32\javaws.exe --------- 153376  

 24.10.2010 02:43     C:\Windows\system32\javaw.exe --------- 145184  

 24.10.2010 02:43     C:\Windows\system32\java.exe --------- 145184  

 24.10.2010 02:43     C:\Windows\system32\deployJava1.dll --------- 472808  

 24.10.2010 01:36     C:\Windows\system32\WDI --------- 4096  

 24.10.2010 01:15     C:\Windows\system32\perfh009.dat --------- 591320  

 24.10.2010 01:15     C:\Windows\system32\perfc009.dat --------- 103194  

 24.10.2010 01:15     C:\Windows\system32\perfh007.dat --------- 623280  

 24.10.2010 01:15     C:\Windows\system32\perfc007.dat --------- 125378  

 24.10.2010 01:15     C:\Windows\system32\PerfStringBackup.INI --------- 1432888  

 24.10.2010 01:10     C:\Windows\system32\GDIPFONTCACHEV1.DAT --------- 85696  

 24.10.2010 01:09     C:\Windows\system32\FNTCACHE.DAT --------- 345512  

 23.10.2010 23:47     C:\Windows\system32\msxml3a.dll --------- 29480  

 23.10.2010 23:47     C:\Windows\system32\msvcr71.dll --------- 353576  

 23.10.2010 23:47     C:\Windows\system32\msvcp71.dll --------- 505128  

 22.10.2010 10:28     C:\Windows\system32\catroot2 --------- 4096  

 20.10.2010 20:50     C:\Windows\system32\DRVSTORE --------- 0  

 19.10.2010 11:41     C:\Windows\system32\MpSigStub.exe --------- 222080  

 14.10.2010 20:12     C:\Windows\system32\de-DE --------- 655360  

 14.10.2010 20:12     C:\Windows\system32\migration --------- 8192  

 14.10.2010 15:41     C:\Windows\system32\mrt.exe --------- 35385288  

 13.10.2010 18:09     C:\Windows\system32\catroot --------- 4096  

 13.09.2010 17:46     C:\Windows\system32\wmp.dll --------- 10628096  

 13.09.2010 15:56     C:\Windows\system32\wmploc.DLL --------- 8147456  

 08.09.2010 08:01     C:\Windows\system32\wininet.dll --------- 916480  

 08.09.2010 08:01     C:\Windows\system32\urlmon.dll --------- 1210880  

 08.09.2010 07:59     C:\Windows\system32\occache.dll --------- 206848  

 08.09.2010 07:58     C:\Windows\system32\mstime.dll --------- 611840  

 08.09.2010 07:57     C:\Windows\system32\mshtmled.dll --------- 66560  

 08.09.2010 07:57     C:\Windows\system32\mshtml.dll --------- 5957120  

 08.09.2010 07:57     C:\Windows\system32\msfeeds.dll --------- 602112  

 08.09.2010 07:57     C:\Windows\system32\msfeedsbs.dll --------- 55296  

 08.09.2010 07:57     C:\Windows\system32\licmgr10.dll --------- 43520  

 08.09.2010 07:57     C:\Windows\system32\jsproxy.dll --------- 25600  

 08.09.2010 07:57     C:\Windows\system32\inetcpl.cpl --------- 1469440  

 08.09.2010 07:56     C:\Windows\system32\ieui.dll --------- 164352  

 08.09.2010 07:56     C:\Windows\system32\iesysprep.dll --------- 109056  

 08.09.2010 07:56     C:\Windows\system32\iertutil.dll --------- 1986560  

 08.09.2010 07:56     C:\Windows\system32\iesetup.dll --------- 71680  

 08.09.2010 07:56     C:\Windows\system32\iernonce.dll --------- 55808  

 08.09.2010 07:56     C:\Windows\system32\iepeers.dll --------- 184320  

 08.09.2010 07:56     C:\Windows\system32\ieframe.dll --------- 11080192  

 08.09.2010 07:56     C:\Windows\system32\iedkcs32.dll --------- 387584  

 08.09.2010 07:04     C:\Windows\system32\html.iec --------- 385024  

 08.09.2010 06:26     C:\Windows\system32\ieUnatt.exe --------- 133632  

 08.09.2010 06:26     C:\Windows\system32\ie4uinit.exe --------- 173056  

 08.09.2010 06:25     C:\Windows\system32\msfeedssync.exe --------- 13312  

 08.09.2010 06:25     C:\Windows\system32\mshtml.tlb --------- 1638912  

 06.09.2010 18:20     C:\Windows\system32\srvsvc.dll --------- 125952  

 06.09.2010 18:19     C:\Windows\system32\netevent.dll --------- 17920  

 31.08.2010 17:46     C:\Windows\system32\mfc40u.dll --------- 954288  

 31.08.2010 17:46     C:\Windows\system32\mfc40.dll --------- 954752  

 31.08.2010 17:44     C:\Windows\system32\comctl32.dll --------- 531968  

 31.08.2010 15:27     C:\Windows\system32\win32k.sys --------- 2038272  

 26.08.2010 18:37     C:\Windows\system32\t2embed.dll --------- 157184  

 20.08.2010 18:05     C:\Windows\system32\wmpmde.dll --------- 867328  

 17.08.2010 16:11     C:\Windows\system32\spoolsv.exe --------- 128000  

 10.08.2010 17:53     C:\Windows\system32\schannel.dll --------- 274944  

 26.07.2010 17:51     C:\Windows\system32\shell32.dll --------- 11584512  

 28.06.2010 19:00     C:\Windows\system32\ole32.dll --------- 1316864  

 26.06.2010 00:27     C:\Windows\system32\en-US --------- 8192  

 22.06.2010 15:30     C:\Windows\system32\tzres.dll --------- 2048  

 18.06.2010 19:31     C:\Windows\system32\rtutils.dll --------- 36864  

 11.06.2010 18:15     C:\Windows\system32\msxml3.dll --------- 1248768  

 11.06.2010 16:15     C:\Windows\system32\wbem --------- 81920  

 08.06.2010 19:35     C:\Windows\system32\ntoskrnl.exe --------- 3548040  

 08.06.2010 19:35     C:\Windows\system32\ntkrnlpa.exe --------- 3600768  

 27.05.2010 22:08     C:\Windows\system32\inetcomm.dll --------- 739328  

 27.05.2010 22:08     C:\Windows\system32\iccvid.dll --------- 81920  

 26.05.2010 19:06     C:\Windows\system32\atmlib.dll --------- 34304  

 26.05.2010 16:47     C:\Windows\system32\atmfd.dll --------- 289792  

 18.05.2010 16:35     C:\Windows\system32\dns-sd.exe --------- 107808  

 18.05.2010 16:35     C:\Windows\system32\dnssd.dll --------- 91424  

 04.05.2010 21:13     C:\Windows\system32\msshsq.dll --------- 231424  

 19.04.2010 20:47     C:\Windows\system32\usbaaplrc.dll --------- 3062048  

 16.04.2010 18:46     C:\Windows\system32\usp10.dll --------- 502272  

 16.04.2010 18:43     C:\Windows\system32\Apphlpdm.dll --------- 28672  

 16.04.2010 16:39     C:\Windows\system32\GameUXLegacyGDFs.dll --------- 4240384  

 05.04.2010 19:02     C:\Windows\system32\MP4SDECD.DLL --------- 317952  

 05.04.2010 19:01     C:\Windows\system32\asycfilt.dll --------- 67072  

 18.03.2010 13:16     C:\Windows\system32\msvcr100_clr0400.dll --------- 771424  

 17.03.2010 21:53     C:\Windows\system32\QuickTime.qts --------- 69632  

 17.03.2010 21:53     C:\Windows\system32\QuickTimeVR.qtx --------- 94208  

 05.03.2010 16:01     C:\Windows\system32\vbscript.dll --------- 420352  

 21.02.2010 01:06     C:\Windows\system32\nshhttp.dll --------- 24064  

 21.02.2010 01:05     C:\Windows\system32\httpapi.dll --------- 30720  

 18.02.2010 15:30     C:\Windows\system32\iphlpsvc.dll --------- 200704  

 15.02.2010 13:01     C:\Windows\system32\RtlUI2.exe --------- 380928  

 15.02.2010 13:01     C:\Windows\system32\Rtlihvs.dll --------- 614400  

 15.02.2010 13:01     C:\Windows\system32\RTLExtUI.dll --------- 188416  

 12.02.2010 12:32     C:\Windows\system32\browserchoice.exe --------- 293376  

 10.02.2010 19:13     C:\Windows\system32\unrar.dll --------- 165376  

 25.01.2010 14:00     C:\Windows\system32\secproc_ssp_isv.dll --------- 152576  

 25.01.2010 14:00     C:\Windows\system32\secproc_ssp.dll --------- 152064  

----------------------------------------
 

 

C:\Windows\Prefetch
 

----------------------------------------
 

 

C:\Windows\Tasks
 

 26.10.2010 21:23     C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job --------- 1096  

 26.10.2010 20:35     C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job --------- 1092  

 26.10.2010 20:35     C:\Windows\Tasks\SA.DAT --------- 6  

 26.10.2010 20:34     C:\Windows\Tasks\SCHEDLGU.TXT --------- 32510  

 26.10.2010 18:22     C:\Windows\Tasks\User_Feed_Synchronization-{5A0D5830-462D-4450-901E-10C1E3C1B043}.job --------- 426  

----------------------------------------
 

 

C:\Windows\Temp
 

 26.10.2010 18:26     C:\Windows\Temp\MpSigStub.log --------- 6752  

 26.10.2010 18:21     C:\Windows\Temp\GoogleToolbarInstaller1.log --------- 360  

 25.10.2010 23:11     C:\Windows\Temp\fwtsqmfile02.sqm --------- 632  

 24.10.2010 17:06     C:\Windows\Temp\fwtsqmfile01.sqm --------- 632  

 24.10.2010 02:45     C:\Windows\Temp\History --------- 0  

 24.10.2010 02:45     C:\Windows\Temp\Cookies --------- 0  

 24.10.2010 02:45     C:\Windows\Temp\Temporary Internet Files --------- 0  

 24.10.2010 01:10     C:\Windows\Temp\sqlite_070nLscDkgxjJWi --------- 0  

 24.10.2010 01:10     C:\Windows\Temp\sqlite_PM4QmVm1ZKRcrHe --------- 0  

 24.10.2010 01:07     C:\Windows\Temp\sqlite_MsthssROtao7E8z --------- 0  

 24.10.2010 01:06     C:\Windows\Temp\fwtsqmfile00.sqm --------- 632  

 23.10.2010 19:59     C:\Windows\Temp\sqlite_jTVaEfgVxPrV7bZ --------- 0  

 23.10.2010 19:59     C:\Windows\Temp\sqlite_64E437p97W39gO2 --------- 0  

 23.10.2010 19:58     C:\Windows\Temp\mcmsc_sjRSqLaubsuLAD1 --------- 0  

 23.10.2010 14:36     C:\Windows\Temp\sqlite_oFmrmafAsL3u9kL --------- 0  

 23.10.2010 14:36     C:\Windows\Temp\sqlite_NJSteGJ9jaucOyP --------- 0  

 23.10.2010 10:44     C:\Windows\Temp\sqlite_ZXULdca65eSgkgJ --------- 0  

 23.10.2010 10:44     C:\Windows\Temp\sqlite_iGPhYyQHJLifuKG --------- 0  

----------------------------------------
 

 

C:\Users\Kerim\AppData\Local\Temp
 

 26.10.2010 21:19     C:\Users\Kerim\AppData\Local\Temp\fla2600.tmp --------- 126470162  

 26.10.2010 21:18     C:\Users\Kerim\AppData\Local\Temp\plugtmp-2 --------- 0  

 26.10.2010 20:41     C:\Users\Kerim\AppData\Local\Temp\jusched.log --------- 6712  

 26.10.2010 20:38     C:\Users\Kerim\AppData\Local\Temp\Kerim.bmp --------- 31832  

 26.10.2010 20:36     C:\Users\Kerim\AppData\Local\Temp\WPDNSE --------- 0  

 26.10.2010 20:33     C:\Users\Kerim\AppData\Local\Temp\plugtmp-1 --------- 0  

 26.10.2010 20:03     C:\Users\Kerim\AppData\Local\Temp\Low --------- 4096  

 26.10.2010 19:12     C:\Users\Kerim\AppData\Local\Temp\hsperfdata_Kerim --------- 0  

 25.10.2010 23:09     C:\Users\Kerim\AppData\Local\Temp\CFGA1DF.tmp --------- 123  

 25.10.2010 21:26     C:\Users\Kerim\AppData\Local\Temp\MessengerCache --------- 0  

 24.10.2010 18:04     C:\Users\Kerim\AppData\Local\Temp\veetlea --------- 0  

 24.10.2010 18:04     C:\Users\Kerim\AppData\Local\Temp\veetleb --------- 0  

 24.10.2010 17:05     C:\Users\Kerim\AppData\Local\Temp\plugtmp --------- 0  

 24.10.2010 13:55     C:\Users\Kerim\AppData\Local\Temp\CLUpdater8.ini --------- 296  

 24.10.2010 12:50     C:\Users\Kerim\AppData\Local\Temp\CFG34E6.tmp --------- 123  

 24.10.2010 12:50     C:\Users\Kerim\AppData\Local\Temp\CFGA4A8.tmp --------- 123  

 24.10.2010 03:32     C:\Users\Kerim\AppData\Local\Temp\AUCHECK_PARSER.txt --------- 440  

 24.10.2010 03:32     C:\Users\Kerim\AppData\Local\Temp\AUCHECK_CORE.txt --------- 302  

 24.10.2010 02:44     C:\Users\Kerim\AppData\Local\Temp\JAUReg.log --------- 504  

 24.10.2010 02:44     C:\Users\Kerim\AppData\Local\Temp\java_install_reg.log --------- 3582  

 24.10.2010 02:44     C:\Users\Kerim\AppData\Local\Temp\java_install.log --------- 28989  

 24.10.2010 01:56     C:\Users\Kerim\AppData\Local\Temp\RarSFX0 --------- 40960  

 24.10.2010 01:55     C:\Users\Kerim\AppData\Local\Temp\dd_vcredistUI6673.txt --------- 12554  

 24.10.2010 01:55     C:\Users\Kerim\AppData\Local\Temp\dd_vcredistMSI6673.txt --------- 432520  

 24.10.2010 01:27     C:\Users\Kerim\AppData\Local\Temp\Cookies --------- 0  

 24.10.2010 01:09     C:\Users\Kerim\AppData\Local\Temp\History --------- 0  

 24.10.2010 01:09     C:\Users\Kerim\AppData\Local\Temp\Temporary Internet Files --------- 0  

 24.10.2010 00:15     C:\Users\Kerim\AppData\Local\Temp\eDatasecurity --------- 0  

 24.10.2010 00:12     C:\Users\Kerim\AppData\Local\Temp\CLUpdater7.ini --------- 296  

 24.10.2010 00:07     C:\Users\Kerim\AppData\Local\Temp\CLUpdater6.ini --------- 296  

 24.10.2010 00:03     C:\Users\Kerim\AppData\Local\Temp\Google Toolbar --------- 4096  

 23.10.2010 23:56     C:\Users\Kerim\AppData\Local\Temp\CLUpdater5.ini --------- 296  

 23.10.2010 23:53     C:\Users\Kerim\AppData\Local\Temp\CLUpdater4.ini --------- 296  

 23.10.2010 23:22     C:\Users\Kerim\AppData\Local\Temp\CLUpdater3.ini --------- 296  

 23.10.2010 23:11     C:\Users\Kerim\AppData\Local\Temp\CLUpdater2.ini --------- 296  

 23.10.2010 23:11     C:\Users\Kerim\AppData\Local\Temp\wmplog07.sqm --------- 1672  

 23.10.2010 22:30     C:\Users\Kerim\AppData\Local\Temp\CLUpdater1.ini --------- 296  

 23.10.2010 22:29     C:\Users\Kerim\AppData\Local\Temp\Xt0..bat --------- 246  

 23.10.2010 22:27     C:\Users\Kerim\AppData\Local\Temp\CLUpdater0.ini --------- 296  

 23.10.2010 22:26     C:\Users\Kerim\AppData\Local\Temp\Xtz..bat --------- 246  

 23.10.2010 22:20     C:\Users\Kerim\AppData\Local\Temp\Xtv..bat --------- 246  

 23.10.2010 22:18     C:\Users\Kerim\AppData\Local\Temp\CLUpdater.ini --------- 296  

 23.10.2010 22:17     C:\Users\Kerim\AppData\Local\Temp\Xty..bat --------- 246  

 23.10.2010 22:17     C:\Users\Kerim\AppData\Local\Temp\Xtx..bat --------- 244  

 23.10.2010 22:17     C:\Users\Kerim\AppData\Local\Temp\Xtw..bat --------- 244  

 23.10.2010 21:34     C:\Users\Kerim\AppData\Local\Temp\wmplog06.sqm --------- 1672  

 23.10.2010 21:24     C:\Users\Kerim\AppData\Local\Temp\{DF7E20AB-2765-416E-8344-A38E08101D22} --------- 0  

 30.06.2009 11:35     C:\Users\Kerim\AppData\Local\Temp\MsgPlusUninstall.exe --------- 905552  

 11.10.2008 02:28     C:\Users\Kerim\AppData\Local\Temp\4894c1.mst --------- 38912  

 20.12.2006 08:53     C:\Users\Kerim\AppData\Local\Temp\Set6F37.tmp --------- 171568  

----------------------------------------
 

 

C:\Program Files
 

 25.10.2010 19:01     C:\Program Files\trend micro --------- 0  

 24.10.2010 02:44     C:\Program Files\Common Files --------- 4096  

 24.10.2010 01:55     C:\Program Files\Avira --------- 0  

 23.10.2010 23:52     C:\Program Files\InstallShield Installation Information --------- 12288  

 23.10.2010 21:33     C:\Program Files\Cyberlink --------- 0  

 20.10.2010 20:46     C:\Program Files\Microsoft.NET --------- 0  

 20.10.2010 20:26     C:\Program Files\Acer GameZone --------- 0  

 20.10.2010 20:09     C:\Program Files\Microsoft Works --------- 28672  

 14.10.2010 20:12     C:\Program Files\Windows Media Player --------- 4096  

 14.10.2010 20:12     C:\Program Files\Internet Explorer --------- 4096  

 16.09.2010 23:49     C:\Program Files\Windows Mail --------- 4096  

 12.08.2010 20:44     C:\Program Files\Movie Maker --------- 8192  

 04.08.2010 20:09     C:\Program Files\iPod --------- 0  

 17.06.2010 22:00     C:\Program Files\Bonjour --------- 4096  

 06.06.2010 11:52     C:\Program Files\World of Warcraft --------- 0  

 06.03.2010 16:58     C:\Program Files\Google --------- 4096  

 15.02.2010 13:03     C:\Program Files\Cisco --------- 0  

 15.02.2010 13:02     C:\Program Files\Realtek --------- 0  

 18.01.2010 04:20     C:\Program Files\Windows Portable Devices --------- 0  

 17.01.2010 17:53     C:\Program Files\Windows Calendar --------- 0  

 17.01.2010 17:53     C:\Program Files\Windows Sidebar --------- 4096  

 17.01.2010 17:53     C:\Program Files\Windows Collaboration --------- 4096  

 17.01.2010 17:53     C:\Program Files\Windows Journal --------- 4096  

 17.01.2010 17:53     C:\Program Files\Windows Photo Gallery --------- 4096  

 17.01.2010 17:53     C:\Program Files\Windows Defender --------- 4096  

 11.11.2009 18:48     C:\Program Files\DIFX --------- 0  

 11.11.2009 18:48     C:\Program Files\PC Connectivity Solution --------- 12288  

 06.11.2009 16:58     C:\Program Files\Microsoft --------- 0  

 06.11.2009 16:58     C:\Program Files\Windows Live --------- 0  

 06.11.2009 16:58     C:\Program Files\Windows Live SkyDrive --------- 0  

 07.10.2009 19:33     C:\Program Files\AviSynth 2.5 --------- 0  

 06.12.2008 18:34     C:\Program Files\Zero G Registry --------- 0  

 06.12.2008 17:27     C:\Program Files\Apple Software Update --------- 4096  

 06.12.2008 17:04     C:\Program Files\QuickTime --------- 0  

 01.12.2008 22:59     C:\Program Files\Java --------- 0  

 01.12.2008 22:09     C:\Program Files\MSXML 4.0 --------- 0  

 01.12.2008 21:35     C:\Program Files\Acer --------- 4096  

 01.12.2008 21:31     C:\Program Files\Windows NT --------- 4096  

 01.12.2008 21:31     C:\Program Files\Gemeinsame Dateien --------- 0  

 11.10.2008 02:29     C:\Program Files\Acer Incorporated --------- 0  

 11.10.2008 02:14     C:\Program Files\Acer Arcade Deluxe --------- 4096  

 11.10.2008 01:53     C:\Program Files\Acer Inc --------- 0  

 11.10.2008 01:52     C:\Program Files\Launch Manager --------- 4096  

 30.07.2008 04:15     C:\Program Files\Convesoft --------- 0  

 30.07.2008 04:14     C:\Program Files\Adobe --------- 0  

 30.07.2008 04:13     C:\Program Files\NewTech Infosystems --------- 0  

 30.07.2008 04:10     C:\Program Files\Big Kahuna Reef --------- 0  

 30.07.2008 03:31     C:\Program Files\Winbond Electronics Corporation --------- 0  

 30.07.2008 03:31     C:\Program Files\Synaptics --------- 0  

 30.07.2008 03:27     C:\Program Files\CONEXANT --------- 0  

 30.07.2008 03:23     C:\Program Files\Intel --------- 0  

 21.01.2008 04:43     C:\Program Files\desktop.ini --------- 174  

 02.11.2006 15:01     C:\Program Files\Uninstall Information --------- 0  

 02.11.2006 14:37     C:\Program Files\Microsoft Games --------- 4096  

 02.11.2006 14:37     C:\Program Files\MSBuild --------- 0  

 02.11.2006 14:37     C:\Program Files\Reference Assemblies --------- 0  

----------------------------------------
 

 

C:\ProgramData\.. 
 

Public    

Kerim    

Default    

desktop.ini    

Default User    

All Users    

----------------------------------------
 

 

C:\Windows\system32\drivers\etc\hosts
 

127.0.0.1       localhost

::1             localhost
 

----------------------------------------
 

 
 

Abbildname                     PID Sitzungsname       Sitz.-Nr. Speichernutzung

========================= ======== ================ =========== ===============

System Idle Process              0 Services                   0            24 K

System                           4 Services                   0        19.228 K

smss.exe                       492 Services                   0           744 K

csrss.exe                      560 Services                   0         6.784 K

wininit.exe                    612 Services                   0         4.232 K

csrss.exe                      620 Console                    1         9.236 K

services.exe                   656 Services                   0         6.868 K

lsass.exe                      668 Services                   0         1.880 K

lsm.exe                        676 Services                   0         4.316 K

svchost.exe                    816 Services                   0         6.024 K

nvvsvc.exe                     880 Services                   0         3.396 K

svchost.exe                    908 Services                   0         6.452 K

svchost.exe                    944 Services                   0        44.524 K

svchost.exe                    992 Services                   0        12.076 K

svchost.exe                   1028 Services                   0       103.424 K

svchost.exe                   1072 Services                   0        52.252 K

audiodg.exe                   1128 Services                   0        13.720 K

svchost.exe                   1148 Services                   0         4.748 K

SLsvc.exe                     1164 Services                   0        11.464 K

svchost.exe                   1208 Services                   0        13.116 K

winlogon.exe                  1320 Console                    1         5.748 K

svchost.exe                   1392 Services                   0        15.668 K

spoolsv.exe                   1572 Services                   0         9.616 K

sched.exe                     1596 Services                   0           900 K

svchost.exe                   1608 Services                   0        19.960 K

avguard.exe                   1796 Services                   0        24.764 K

AppleMobileDeviceService.     1828 Services                   0         3.988 K

mDNSResponder.exe             1900 Services                   0         5.196 K

Agentsvc.exe                  1936 Services                   0         5.236 K

avshadow.exe                  1944 Services                   0         6.208 K

rundll32.exe                  2016 Console                    1         6.444 K

CLHNService.exe               2028 Services                   0         3.692 K

eDSService.exe                 344 Services                   0         4.532 K

ETService.exe                  416 Services                   0        16.036 K

IAANTmon.exe                  1156 Services                   0         6.080 K

upeksvr.exe                   1352 Console                    1         8.480 K

BASVC.exe                     1384 Services                   0         8.440 K

LSSrvc.exe                    2144 Services                   0         3.748 K

MobilityService.exe           2180 Services                   0        10.480 K

BackupSvc.exe                 2260 Services                   0         7.852 K

SchedulerSvc.exe              2300 Services                   0         6.100 K

svchost.exe                   2328 Services                   0         5.412 K

RtlService.exe                2372 Services                   0         4.752 K

CompPtcVUI.exe                2400 Console                    1        13.064 K

RS_Service.exe                2412 Services                   0         3.272 K

StarWindServiceAE.exe         2492 Services                   0         5.236 K

svchost.exe                   2552 Services                   0         6.388 K

svchost.exe                   2580 Services                   0         2.164 K

SearchIndexer.exe             2600 Services                   0        16.084 K

RtWLan.exe                    2616 Console                    1        12.588 K

XAudio.exe                    2660 Services                   0         2.768 K

taskeng.exe                   3068 Services                   0         5.824 K

taskeng.exe                   3360 Console                    1        11.448 K

dwm.exe                       3384 Console                    1        79.660 K

explorer.exe                  3440 Console                    1        52.436 K

WmiPrvSE.exe                  3800 Services                   0         5.604 K

MSASCui.exe                   4044 Console                    1         9.144 K

LManager.exe                   824 Console                    1        11.772 K

avgnt.exe                     3108 Console                    1         2.252 K

jusched.exe                    780 Console                    1         4.192 K

wmpnscfg.exe                  3064 Console                    1         5.100 K

GoogleToolbarNotifier.exe     3488 Console                    1         1.872 K

wmpnetwk.exe                  1988 Services                   0        18.620 K

unsecapp.exe                  2160 Console                    1         4.812 K

firefox.exe                    968 Console                    1       112.492 K

plugin-container.exe          3196 Console                    1        64.320 K

cmd.exe                       1520 Console                    1         3.048 K

conime.exe                    2288 Console                    1         3.776 K

SearchProtocolHost.exe        3408 Services                   0         8.036 K

SearchFilterHost.exe          2088 Services                   0         5.288 K

dllhost.exe                   2276 Console                    1         4.472 K

tasklist.exe                    12 Console                    1         4.736 K

WmiPrvSE.exe                  4076 Services                   0         5.716 K
 

 

***** Ende des Scans 26.10.2010 um 22:03:16,18 ***

Systemreinigung und Prüfung:

1.
läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit)
Achtung!:
WENN GMER NICHT AUSGEFÜHRT WERDEN KANN ODER PROBMLEME VERURSACHT, fahre mit dem nächsten Punkt fort!- Es ist NICHT sinnvoll einen zweiten Versuch zu starten!
Um einen tieferen Einblick in dein System, um eine mögliche Infektion mit einem Rootkit/Info v.wikipedia.org) aufzuspüren, werden wir ein Tool - Gmer - einsetzen :

- also lade Dir Gmer herunter und entpacke es auf deinen Desktop
- starte gmer.exe
- [b]schließe alle Programme, ausserdem Antiviren und andere Schutzprogramme usw müssen deaktiviert sein, keine Verbindung zum Internet, WLAN auch trennen)
- bitte nichts am Pc machen während der Scan läuft!
- klicke auf "Scan", um das Tool zu starten
- wenn der Scan fertig ist klicke auf "Copy" (das Log wird automatisch in die Zwischenablage kopiert) und mit STRG + V musst Du gleich da einfügen
- mit "Ok" wird Gmer beendet.
- das Log aus der Zwischenablage hier in Deinem Thread vollständig hineinkopieren

** keine Verbindung zu einem Netzwerk und Internet - WLAN nicht vergessen
Wenn der Scan beendet ist, bitte alle Programme und Tools wieder aktivieren!

2.
läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit)
Lade und installiere das Tool RootRepeal herunter

setze einen Hacken bei: "Drivers"-> "Scan"-> Save Report"...
"Stealth Objects" -> "Scan"-> Save Report"...
"Hidden Services" -> "Scan"-> Save Report"...
speichere das Logfile als "RootRepeal.txt" auf dem Desktop und Kopiere den Inhalt hier in den Thread

3.
Schliesse alle Programme einschliesslich Internet Explorer und fixe mit Hijackthis die Einträge aus der nachfolgenden Codebox (HijackThis starten→ Einträge auswählen→ Häckhen setzen→ "Fix checked"klicken→ PC neu aufstarten):

Zitat:

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

4.
Windows und die installierten Programme auf den neuesten Stand zu halten,sind Garanten für eine erhöhte Sicherheit!
Java aktualisieren `Start→ Systemsteuereung→ Java→ Aktualisierung...(Update 22 schon fällig!)

5.
den Java-Cache leeren - wie unter Punkt 7. u. 8. beschrieben *klick
über Systemsteuerung -> Java...

6.
um die neueste Version von Adobe zu erhalten klick hier: Adobe Reader - oder über das Programm selbst kannst auch die Updatefunktion aufrufen

7.
alle Anwendungen schließen → Ordner für temporäre Dateien bitte leeren
lösche nur den Inhalt der Ordner, nicht die Ordner selbst! - Dateien, die noch in Benutzung sind,nicht löschbar.
c:\windows\temp
- anschließend den Papierkorb leeren

8.
reinige dein System mit Ccleaner:

"Cleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
"Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
Starte dein System neu auf

lade Dir SUPERAntiSpyware FREE Edition herunter.
installiere das Programm und update online.
starte SUPERAntiSpyware und klicke auf "Ihren Computer durchsuchen"
setze ein Häkchen bei "Kompletter Scan" und klicke auf "Weiter"
anschließend alle gefundenen Schadprogramme werden aufgelistet, bei alle Funde Häkchen setzen und mit "OK" bestätigen
auf "Weiter" klicken dann "OK" und auf "Fertig stellen"
um die Ergebnisse anzuzeigen: auf "Präferenzen" dann auf den "Statistiken und Protokolle" klicken
drücke auf "Protokoll anzeigen" - anschließend diesen Bericht bitte speichern und hier posten

10.
Auch auf USB-Sticks, selbstgebrannten Datenträgern, externen Festplatten und anderen Datenträgern können Viren transportiert werden. Man muss daher durch regelmäßige Prüfungen auf Schäden, die durch Malware ("Worm.Win32.Autorun") verursacht worden sein können, überwacht werden. Hierfür sind ser gut geegnet und empfohlen, die auf dem Speichermedium gesicherten Daten, mit Hilfe des kostenlosen Online Scanners zu prüfen.
→ Also alle vorhandenen externen Laufwerke inkl. evtl. vorhandener USB-Sticks an den Rechner anschließen, aber dabei die Shift-Taste gedrückt halten, damit die Autorun-Funktion nicht ausgeführt wird.
Außerdem kann man die Autostarteigenschaft auch ausschalten:
→ Windows-Sicherheit: Datenträger-Autorun deaktivieren- bebilderte Anleitung v.Leonidas/3dcenter.org
→ Autorun/Autoplay gezielt für Laufwerkstypen oder -buchstaben abschalten/wintotal.de
→ Diese Silly -Beschreibung stützt die Annahme, dass er über einen USB-Stick kam. Die Ursache ist durch formatieren des Sticks aus der Welt geschafft, Du solltest darauf achten, dass dort keine Datei autorun.inf wieder auftaucht und etwas wählerisch sein, wo Du deinen Stick reinsteckst.
Achtung!:
>>Du sollst das Programm nicht installieren, sondern dein System nur online scannen<<
→ Den kompletten Rechner (also das ganze System) zu überprüfen (Systemprüfung ohne Säuberung) mit Kaspersky Online Scanner/klicke hier
→ um mit dem Vorgang fortzufahren klicke auf "Accept"
→ dann wähle "My computer" aus - Es dauert einige Zeit, bis ein Komplett-Scan durch gelaufen ist, also bitte um Geduld!
Es kann einige Zeit dauern, bis der Scan abgeschlossen ist - je nach Größe der Festplatte eine oder mehrere Stunden - also Geduld...
→ Report angezeigt, klicke auf "Save as" - den bitte kopieren und in deinem Thread hier einfügen
Vor dem Scan Einstellungen im Internet Explorer:
→ "Extras→ Internetoptionen→ Sicherheit":
→ alles auf Standardstufe stellen
→ Active X erlauben - damit die neue Virendefinitionen installiert werden können

** Gibt es weitere Auffälligkeiten/Probleme mit dem Rechner?

Die Werbungen kommen nicht mehr ! Aber seid dem der Virus da war, kann ich manche programme nicht öffnen (nur als admin kann die öffnen), es wird gesagt, dass mir die berechtigung fehlt, zudem kann ich auch keine einstellungen ändern wie Z.B. die Bildschirmauflösung, da wird auch gesagt dass ich keine berechtigung habe, obwohl ich der einzige nutzer admin bin ....

Gmer unterbricht während des scanvorgangs

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2010/10/27 20:29
Program Version: Version 1.3.5.0
Windows Version: Windows Vista SP2
==================================================

Drivers
-------------------
Name: 000.fcl
Image Path: D:\Program Files\CyberLink\PowerDVD10\PowerDVD10\NavFilter\000.fcl
Address: 0xA1D99000 Size: 180224 File Visible: - Signed: -
Status: -

Name: 000.fcl
Image Path: C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl
Address: 0xA1DC5000 Size: 135168 File Visible: - Signed: -
Status: -

Name: abmm9jlt.SYS
Image Path: C:\Windows\System32\Drivers\abmm9jlt.SYS
Address: 0x8A3C4000 Size: 221184 File Visible: - Signed: -
Status: -

Name: acpi.sys
Image Path: C:\Windows\system32\drivers\acpi.sys
Address: 0x807AF000 Size: 286720 File Visible: - Signed: -
Status: -

Name: ACPI_HAL
Image Path: \Driver\ACPI_HAL
Address: 0x82242000 Size: 3903488 File Visible: - Signed: -
Status: -

Name: afd.sys
Image Path: C:\Windows\system32\drivers\afd.sys
Address: 0x9195B000 Size: 294912 File Visible: - Signed: -
Status: -

Name: AlfaFF.sys
Image Path: C:\Windows\system32\Drivers\AlfaFF.sys
Address: 0x8A3BB000 Size: 35968 File Visible: - Signed: -
Status: -

Name: atapi.sys
Image Path: C:\Windows\system32\drivers\atapi.sys
Address: 0x8A34A000 Size: 32768 File Visible: - Signed: -
Status: -

Name: ataport.SYS
Image Path: C:\Windows\system32\drivers\ataport.SYS
Address: 0x8A352000 Size: 122880 File Visible: - Signed: -
Status: -

Name: aufuys0f.SYS
Image Path: C:\Windows\System32\Drivers\aufuys0f.SYS
Address: 0x8F60A000 Size: 233472 File Visible: - Signed: -
Status: -

Name: avgntflt.sys
Image Path: C:\Windows\system32\DRIVERS\avgntflt.sys
Address: 0x91D70000 Size: 86016 File Visible: - Signed: -
Status: -

Name: avipbb.sys
Image Path: C:\Windows\system32\DRIVERS\avipbb.sys
Address: 0x91D0D000 Size: 139264 File Visible: - Signed: -
Status: -

Name: BATTC.SYS
Image Path: C:\Windows\system32\DRIVERS\BATTC.SYS
Address: 0x805ED000 Size: 40960 File Visible: - Signed: -
Status: -

Name: Beep.SYS
Image Path: C:\Windows\System32\Drivers\Beep.SYS
Address: 0x8FD30000 Size: 28672 File Visible: - Signed: -
Status: -

Name: BOOTVID.dll
Image Path: C:\Windows\system32\BOOTVID.dll
Address: 0x8048E000 Size: 32768 File Visible: - Signed: -
Status: -

Name: bowser.sys
Image Path: C:\Windows\system32\DRIVERS\bowser.sys
Address: 0xA05A7000 Size: 102400 File Visible: - Signed: -
Status: -

Name: cdd.dll
Image Path: C:\Windows\System32\cdd.dll
Address: 0x9B480000 Size: 57344 File Visible: - Signed: -
Status: -

Name: cdfs.sys
Image Path: C:\Windows\system32\DRIVERS\cdfs.sys
Address: 0xA1DE6000 Size: 90112 File Visible: - Signed: -
Status: -

Name: cdrom.sys
Image Path: C:\Windows\system32\DRIVERS\cdrom.sys
Address: 0x8EFE4000 Size: 98304 File Visible: - Signed: -
Status: -

Name: CI.dll
Image Path: C:\Windows\system32\CI.dll
Address: 0x804D7000 Size: 917504 File Visible: - Signed: -
Status: -

Name: circlass.sys
Image Path: C:\Windows\system32\DRIVERS\circlass.sys
Address: 0x8F786000 Size: 57344 File Visible: - Signed: -
Status: -

Name: CLASSPNP.SYS
Image Path: C:\Windows\system32\drivers\CLASSPNP.SYS
Address: 0x8A7A3000 Size: 135168 File Visible: - Signed: -
Status: -

Name: CLFS.SYS
Image Path: C:\Windows\system32\CLFS.SYS
Address: 0x80496000 Size: 266240 File Visible: - Signed: -
Status: -

Name: CmBatt.sys
Image Path: C:\Windows\system32\DRIVERS\CmBatt.sys
Address: 0x8DEEF000 Size: 14208 File Visible: - Signed: -
Status: -

Name: compbatt.sys
Image Path: C:\Windows\system32\DRIVERS\compbatt.sys
Address: 0x807FD000 Size: 10496 File Visible: - Signed: -
Status: -

Name: crashdmp.sys
Image Path: C:\Windows\System32\Drivers\crashdmp.sys
Address: 0x91D2F000 Size: 53248 File Visible: - Signed: -
Status: -

Name: crcdisk.sys
Image Path: C:\Windows\system32\drivers\crcdisk.sys
Address: 0x8A7C4000 Size: 36864 File Visible: - Signed: -
Status: -

Name: dfsc.sys
Image Path: C:\Windows\System32\Drivers\dfsc.sys
Address: 0x91CF6000 Size: 94208 File Visible: - Signed: -
Status: -

Name: disk.sys
Image Path: C:\Windows\system32\drivers\disk.sys
Address: 0x8A792000 Size: 69632 File Visible: - Signed: -
Status: -

Name: DKbFltr.sys
Image Path: C:\Windows\system32\DRIVERS\DKbFltr.sys
Address: 0x8EFC2000 Size: 40960 File Visible: - Signed: -
Status: -

Name: drmk.sys
Image Path: C:\Windows\system32\drivers\drmk.sys
Address: 0x8FA3A000 Size: 151552 File Visible: - Signed: -
Status: -

Name: dump_iaStor.sys
Image Path: C:\Windows\System32\Drivers\dump_iaStor.sys
Address: 0x8DE00000 Size: 888832 File Visible: No Signed: -
Status: -

Name: Dxapi.sys
Image Path: C:\Windows\System32\drivers\Dxapi.sys
Address: 0x91D3C000 Size: 40960 File Visible: - Signed: -
Status: -

Name: dxgkrnl.sys
Image Path: C:\Windows\System32\drivers\dxgkrnl.sys
Address: 0x8E737000 Size: 659456 File Visible: - Signed: -
Status: -

Name: ecache.sys
Image Path: C:\Windows\System32\drivers\ecache.sys
Address: 0x8A76B000 Size: 159744 File Visible: - Signed: -
Status: -

Name: fileinfo.sys
Image Path: C:\Windows\system32\drivers\fileinfo.sys
Address: 0x8A3A2000 Size: 65536 File Visible: - Signed: -
Status: -

Name: fltmgr.sys
Image Path: C:\Windows\system32\drivers\fltmgr.sys
Address: 0x8A370000 Size: 204800 File Visible: - Signed: -
Status: -

Name: Fs_Rec.SYS
Image Path: C:\Windows\System32\Drivers\Fs_Rec.SYS
Address: 0x8FD20000 Size: 36864 File Visible: - Signed: -
Status: -

Name: fwpkclnt.sys
Image Path: C:\Windows\System32\drivers\fwpkclnt.sys
Address: 0x918F4000 Size: 110592 File Visible: - Signed: -
Status: -

Name: GEARAspiWDM.sys
Image Path: C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
Address: 0x8A7DA000 Size: 21120 File Visible: - Signed: -
Status: -

Name: hal.dll
Image Path: C:\Windows\system32\hal.dll
Address: 0x8220F000 Size: 208896 File Visible: - Signed: -
Status: -

Name: HDAudBus.sys
Image Path: C:\Windows\system32\DRIVERS\HDAudBus.sys
Address: 0x8DF3A000 Size: 577536 File Visible: - Signed: -
Status: -

Name: HIDCLASS.SYS
Image Path: C:\Windows\system32\DRIVERS\HIDCLASS.SYS
Address: 0x8FCE5000 Size: 65536 File Visible: - Signed: -
Status: -

Name: hidir.sys
Image Path: C:\Windows\system32\DRIVERS\hidir.sys
Address: 0x8FCDA000 Size: 45056 File Visible: - Signed: -
Status: -

Name: HIDPARSE.SYS
Image Path: C:\Windows\system32\DRIVERS\HIDPARSE.SYS
Address: 0x8FCF5000 Size: 28672 File Visible: - Signed: -
Status: -

Name: hidusb.sys
Image Path: C:\Windows\system32\DRIVERS\hidusb.sys
Address: 0x8FD64000 Size: 36864 File Visible: - Signed: -
Status: -

Name: HSX_CNXT.sys
Image Path: C:\Windows\system32\DRIVERS\HSX_CNXT.sys
Address: 0x8FC0A000 Size: 741376 File Visible: - Signed: -
Status: -

Name: HSX_DPV.sys
Image Path: C:\Windows\system32\DRIVERS\HSX_DPV.sys
Address: 0x8FA9C000 Size: 1056768 File Visible: - Signed: -
Status: -

Name: HSXHWAZL.sys
Image Path: C:\Windows\system32\DRIVERS\HSXHWAZL.sys
Address: 0x8FA5F000 Size: 249856 File Visible: - Signed: -
Status: -

Name: HTTP.sys
Image Path: C:\Windows\system32\drivers\HTTP.sys
Address: 0xA051D000 Size: 446464 File Visible: - Signed: -
Status: -

Name: i8042prt.sys
Image Path: C:\Windows\system32\DRIVERS\i8042prt.sys
Address: 0x8EFAF000 Size: 77824 File Visible: - Signed: -
Status: -

Name: iaStor.sys
Image Path: C:\Windows\system32\DRIVERS\iaStor.sys
Address: 0x8A271000 Size: 888832 File Visible: - Signed: -
Status: -

Name: iaStor.sys
Image Path: C:\Windows\system32\DRIVERS\iaStor.sys
Address: 0x00000000 Size: 0 File Visible: - Signed: -
Status: -

Name: int15.sys
Image Path: C:\Windows\system32\drivers\int15.sys
Address: 0xA1C4F000 Size: 69632 File Visible: - Signed: -
Status: -

Name: intelppm.sys
Image Path: C:\Windows\system32\DRIVERS\intelppm.sys
Address: 0x8F643000 Size: 61440 File Visible: - Signed: -
Status: -

Name: ipfltdrv.sys
Image Path: C:\Windows\system32\DRIVERS\ipfltdrv.sys
Address: 0xA04B4000 Size: 73728 File Visible: - Signed: -
Status: -

Name: kbdclass.sys
Image Path: C:\Windows\system32\DRIVERS\kbdclass.sys
Address: 0x8EFCC000 Size: 45056 File Visible: - Signed: -
Status: -

Name: kbdhid.sys
Image Path: C:\Windows\system32\DRIVERS\kbdhid.sys
Address: 0x8FCFC000 Size: 36864 File Visible: - Signed: -
Status: -

Name: kdcom.dll
Image Path: C:\Windows\system32\kdcom.dll
Address: 0x80406000 Size: 28672 File Visible: - Signed: -
Status: -

Name: ks.sys
Image Path: C:\Windows\system32\DRIVERS\ks.sys
Address: 0x8F75C000 Size: 172032 File Visible: - Signed: -
Status: -

Name: ksecdd.sys
Image Path: C:\Windows\system32\Drivers\ksecdd.sys
Address: 0x8A405000 Size: 462848 File Visible: - Signed: -
Status: -

Name: L1E60x86.sys
Image Path: C:\Windows\system32\DRIVERS\L1E60x86.sys
Address: 0x8EF8A000 Size: 65536 File Visible: - Signed: -
Status: -

Name: lltdio.sys
Image Path: C:\Windows\system32\DRIVERS\lltdio.sys
Address: 0xA04C6000 Size: 65536 File Visible: - Signed: -
Status: -

Name: luafv.sys
Image Path: C:\Windows\system32\drivers\luafv.sys
Address: 0x91D55000 Size: 110592 File Visible: - Signed: -
Status: -

Name: mcupdate_GenuineIntel.dll
Image Path: C:\Windows\system32\mcupdate_GenuineIntel.dll
Address: 0x8040D000 Size: 458752 File Visible: - Signed: -
Status: -

Name: mdmxsdk.sys
Image Path: C:\Windows\system32\DRIVERS\mdmxsdk.sys
Address: 0xA1C60000 Size: 12672 File Visible: - Signed: -
Status: -

Name: modem.sys
Image Path: C:\Windows\system32\drivers\modem.sys
Address: 0x8FCBF000 Size: 53248 File Visible: - Signed: -
Status: -

Name: monitor.sys
Image Path: C:\Windows\system32\DRIVERS\monitor.sys
Address: 0x91D46000 Size: 61440 File Visible: - Signed: -
Status: -

Name: mouclass.sys
Image Path: C:\Windows\system32\DRIVERS\mouclass.sys
Address: 0x8EFD9000 Size: 45056 File Visible: - Signed: -
Status: -

Name: mouhid.sys
Image Path: C:\Windows\system32\DRIVERS\mouhid.sys
Address: 0x8FD05000 Size: 32768 File Visible: - Signed: -
Status: -

Name: mountmgr.sys
Image Path: C:\Windows\System32\drivers\mountmgr.sys
Address: 0x8A259000 Size: 65536 File Visible: - Signed: -
Status: -

Name: mpsdrv.sys
Image Path: C:\Windows\System32\drivers\mpsdrv.sys
Address: 0xA05C0000 Size: 86016 File Visible: - Signed: -
Status: -

Name: mrxdav.sys
Image Path: C:\Windows\system32\drivers\mrxdav.sys
Address: 0xA05D5000 Size: 135168 File Visible: - Signed: -
Status: -

Name: mrxsmb.sys
Image Path: C:\Windows\system32\DRIVERS\mrxsmb.sys
Address: 0x91D85000 Size: 126976 File Visible: - Signed: -
Status: -

Name: mrxsmb10.sys
Image Path: C:\Windows\system32\DRIVERS\mrxsmb10.sys
Address: 0x91DA4000 Size: 233472 File Visible: - Signed: -
Status: -

Name: mrxsmb20.sys
Image Path: C:\Windows\system32\DRIVERS\mrxsmb20.sys
Address: 0x91DDD000 Size: 98304 File Visible: - Signed: -
Status: -

Name: Msfs.SYS
Image Path: C:\Windows\System32\Drivers\Msfs.SYS
Address: 0x8FD7F000 Size: 45056 File Visible: - Signed: -
Status: -

Name: msisadrv.sys
Image Path: C:\Windows\system32\drivers\msisadrv.sys
Address: 0x807F5000 Size: 32768 File Visible: - Signed: -
Status: -

Name: msiscsi.sys
Image Path: C:\Windows\system32\DRIVERS\msiscsi.sys
Address: 0x8F652000 Size: 192512 File Visible: - Signed: -
Status: -

Name: msrpc.sys
Image Path: C:\Windows\system32\drivers\msrpc.sys
Address: 0x8A581000 Size: 176128 File Visible: - Signed: -
Status: -

Name: mssmbios.sys
Image Path: C:\Windows\system32\DRIVERS\mssmbios.sys
Address: 0x8F794000 Size: 40960 File Visible: - Signed: -
Status: -

Name: mup.sys
Image Path: C:\Windows\System32\Drivers\mup.sys
Address: 0x8A75C000 Size: 61440 File Visible: - Signed: -
Status: -

Name: ndis.sys
Image Path: C:\Windows\system32\drivers\ndis.sys
Address: 0x8A476000 Size: 1093632 File Visible: - Signed: -
Status: -

Name: ndistapi.sys
Image Path: C:\Windows\system32\DRIVERS\ndistapi.sys
Address: 0x8F6E4000 Size: 45056 File Visible: - Signed: -
Status: -

Name: ndisuio.sys
Image Path: C:\Windows\system32\DRIVERS\ndisuio.sys
Address: 0xA0500000 Size: 40960 File Visible: - Signed: -
Status: -

Name: ndiswan.sys
Image Path: C:\Windows\system32\DRIVERS\ndiswan.sys
Address: 0x8F6EF000 Size: 143360 File Visible: - Signed: -
Status: -

Name: NDProxy.SYS
Image Path: C:\Windows\System32\Drivers\NDProxy.SYS
Address: 0x8F7E0000 Size: 69632 File Visible: - Signed: -
Status: -

Name: netbios.sys
Image Path: C:\Windows\system32\DRIVERS\netbios.sys
Address: 0x8FDB7000 Size: 57344 File Visible: - Signed: -
Status: -

Name: netbt.sys
Image Path: C:\Windows\System32\DRIVERS\netbt.sys
Address: 0x919A3000 Size: 204800 File Visible: - Signed: -
Status: -

Name: NETIO.SYS
Image Path: C:\Windows\system32\drivers\NETIO.SYS
Address: 0x8A5AC000 Size: 241664 File Visible: - Signed: -
Status: -

Name: NETw5v32.sys
Image Path: C:\Windows\system32\DRIVERS\NETw5v32.sys
Address: 0x8EC03000 Size: 3698688 File Visible: - Signed: -
Status: -

Name: Npfs.SYS
Image Path: C:\Windows\System32\Drivers\Npfs.SYS
Address: 0x8FD8A000 Size: 57344 File Visible: - Signed: -
Status: -

Name: nsiproxy.sys
Image Path: C:\Windows\system32\drivers\nsiproxy.sys
Address: 0x91CEC000 Size: 40960 File Visible: - Signed: -
Status: -

Name: Ntfs.sys
Image Path: C:\Windows\System32\Drivers\Ntfs.sys
Address: 0x8A60B000 Size: 1114112 File Visible: - Signed: -
Status: -

Name: NTIDrvr.sys
Image Path: C:\Windows\system32\DRIVERS\NTIDrvr.sys
Address: 0x8DFF7000 Size: 32768 File Visible: - Signed: -
Status: -

Name: NTIPPKernel.sys
Image Path: C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys
Address: 0xA1C64000 Size: 122368 File Visible: - Signed: -
Status: -

Name: ntkrnlpa.exe
Image Path: C:\Windows\system32\ntkrnlpa.exe
Address: 0x82242000 Size: 3903488 File Visible: - Signed: -
Status: -

Name: Null.SYS
Image Path: C:\Windows\System32\Drivers\Null.SYS
Address: 0x8FD29000 Size: 28672 File Visible: - Signed: -
Status: -

Name: nvhda32v.sys
Image Path: C:\Windows\system32\drivers\nvhda32v.sys
Address: 0x8FCCC000 Size: 57344 File Visible: - Signed: -
Status: -

Name: nvlddmkm.sys
Image Path: C:\Windows\system32\DRIVERS\nvlddmkm.sys
Address: 0x8E004000 Size: 7545824 File Visible: - Signed: -
Status: -

Name: nwifi.sys
Image Path: C:\Windows\system32\DRIVERS\nwifi.sys
Address: 0xA04D6000 Size: 172032 File Visible: - Signed: -
Status: -

Name: pacer.sys
Image Path: C:\Windows\system32\DRIVERS\pacer.sys
Address: 0x8FDA1000 Size: 90112 File Visible: - Signed: -
Status: -

Name: partmgr.sys
Image Path: C:\Windows\System32\drivers\partmgr.sys
Address: 0x805DE000 Size: 61440 File Visible: - Signed: -
Status: -

Name: pci.sys
Image Path: C:\Windows\system32\drivers\pci.sys
Address: 0x805B7000 Size: 159744 File Visible: - Signed: -
Status: -

Name: peauth.sys
Image Path: C:\Windows\system32\drivers\peauth.sys
Address: 0xA1C82000 Size: 909312 File Visible: - Signed: -
Status: -

Name: PnpManager
Image Path: \Driver\PnpManager
Address: 0x82242000 Size: 3903488 File Visible: - Signed: -
Status: -

Name: portcls.sys
Image Path: C:\Windows\system32\drivers\portcls.sys
Address: 0x8FA0D000 Size: 184320 File Visible: - Signed: -
Status: -

Name: psdfilter.sys
Image Path: C:\Windows\system32\DRIVERS\psdfilter.sys
Address: 0x8A3B2000 Size: 36864 File Visible: - Signed: -
Status: -

Name: PSDNServ.sys
Image Path: C:\Windows\system32\DRIVERS\PSDNServ.sys
Address: 0xA1D60000 Size: 36864 File Visible: - Signed: -
Status: -

Name: PSDVdisk.sys
Image Path: C:\Windows\system32\DRIVERS\PSDVdisk.sys
Address: 0xA1D69000 Size: 73728 File Visible: - Signed: -
Status: -

Name: PSHED.dll
Image Path: C:\Windows\system32\PSHED.dll
Address: 0x8047D000 Size: 69632 File Visible: - Signed: -
Status: -

Name: rasacd.sys
Image Path: C:\Windows\System32\DRIVERS\rasacd.sys
Address: 0x8FD98000 Size: 36864 File Visible: - Signed: -
Status: -

Name: rasl2tp.sys
Image Path: C:\Windows\system32\DRIVERS\rasl2tp.sys
Address: 0x8F6CD000 Size: 94208 File Visible: - Signed: -
Status: -

Name: raspppoe.sys
Image Path: C:\Windows\system32\DRIVERS\raspppoe.sys
Address: 0x8F712000 Size: 61440 File Visible: - Signed: -
Status: -

Name: raspptp.sys
Image Path: C:\Windows\system32\DRIVERS\raspptp.sys
Address: 0x8F721000 Size: 81920 File Visible: - Signed: -
Status: -

Name: rassstp.sys
Image Path: C:\Windows\system32\DRIVERS\rassstp.sys
Address: 0x8F735000 Size: 86016 File Visible: - Signed: -
Status: -

Name: RAW
Image Path: \FileSystem\RAW
Address: 0x82242000 Size: 3903488 File Visible: - Signed: -
Status: -

Name: rdbss.sys
Image Path: C:\Windows\system32\DRIVERS\rdbss.sys
Address: 0x91CB0000 Size: 245760 File Visible: - Signed: -
Status: -

Name: RDPCDD.sys
Image Path: C:\Windows\System32\DRIVERS\RDPCDD.sys
Address: 0x8FD6F000 Size: 32768 File Visible: - Signed: -
Status: -

Name: rdpencdd.sys
Image Path: C:\Windows\system32\drivers\rdpencdd.sys
Address: 0x8FD77000 Size: 32768 File Visible: - Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\Windows\system32\drivers\rootrepeal.sys
Address: 0x91C00000 Size: 49152 File Visible: No Signed: -
Status: -

Name: rspndr.sys
Image Path: C:\Windows\system32\DRIVERS\rspndr.sys
Address: 0xA050A000 Size: 77824 File Visible: - Signed: -
Status: -

Name: RTKVHDA.sys
Image Path: C:\Windows\system32\drivers\RTKVHDA.sys
Address: 0x8F805000 Size: 2129024 File Visible: - Signed: -
Status: -

Name: RTL8192su.sys
Image Path: C:\Windows\system32\DRIVERS\RTL8192su.sys
Address: 0x91C0F000 Size: 634880 File Visible: - Signed: -
Status: -

Name: RTSTOR.SYS
Image Path: C:\Windows\system32\drivers\RTSTOR.SYS
Address: 0x8FD0D000 Size: 77824 File Visible: - Signed: -
Status: -

Name: SASDIFSV.SYS
Image Path: C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
Address: 0x91CAA000 Size: 24576 File Visible: - Signed: -
Status: -

Name: SASKUTIL.SYS
Image Path: C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
Address: 0x8FDD8000 Size: 139264 File Visible: - Signed: -
Status: -

Name: SCSIPORT.SYS
Image Path: C:\Windows\System32\Drivers\SCSIPORT.SYS
Address: 0x80789000 Size: 155648 File Visible: - Signed: -
Status: -

Name: secdrv.SYS
Image Path: C:\Windows\System32\Drivers\secdrv.SYS
Address: 0xA1D7B000 Size: 40960 File Visible: - Signed: -
Status: -

Name: smb.sys
Image Path: C:\Windows\system32\DRIVERS\smb.sys
Address: 0x91947000 Size: 81920 File Visible: - Signed: -
Status: -

Name: spjf.sys
Image Path: C:\Windows\System32\Drivers\spjf.sys
Address: 0x8068D000 Size: 995328 File Visible: No Signed: -
Status: -

Name: spldr.sys
Image Path: C:\Windows\System32\Drivers\spldr.sys
Address: 0x8A754000 Size: 32768 File Visible: - Signed: -
Status: -

Name: spsys.sys
Image Path: C:\Windows\system32\drivers\spsys.sys
Address: 0xA0404000 Size: 720896 File Visible: - Signed: -
Status: -

Name: sptd
Image Path: \Driver\sptd
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -

Name: srv.sys
Image Path: C:\Windows\System32\DRIVERS\srv.sys
Address: 0xA1C01000 Size: 319488 File Visible: - Signed: -
Status: -

Name: srv2.sys
Image Path: C:\Windows\System32\DRIVERS\srv2.sys
Address: 0x8FB9E000 Size: 163840 File Visible: - Signed: -
Status: -

Name: srvnet.sys
Image Path: C:\Windows\System32\DRIVERS\srvnet.sys
Address: 0xA058A000 Size: 118784 File Visible: - Signed: -
Status: -

Name: ssmdrv.sys
Image Path: C:\Windows\system32\DRIVERS\ssmdrv.sys
Address: 0x919F6000 Size: 23040 File Visible: - Signed: -
Status: -

Name: storport.sys
Image Path: C:\Windows\system32\DRIVERS\storport.sys
Address: 0x8F681000 Size: 266240 File Visible: - Signed: -
Status: -

Name: swenum.sys
Image Path: C:\Windows\system32\DRIVERS\swenum.sys
Address: 0x8F75A000 Size: 4992 File Visible: - Signed: -
Status: -

Name: SynTP.sys
Image Path: C:\Windows\system32\DRIVERS\SynTP.sys
Address: 0x8DFC7000 Size: 192768 File Visible: - Signed: -
Status: -

Name: tcpip.sys
Image Path: C:\Windows\System32\drivers\tcpip.sys
Address: 0x9180A000 Size: 958464 File Visible: - Signed: -
Status: -

Name: tcpipreg.sys
Image Path: C:\Windows\System32\drivers\tcpipreg.sys
Address: 0xA1D85000 Size: 49152 File Visible: - Signed: -
Status: -

Name: tcusb.sys
Image Path: C:\Windows\System32\Drivers\tcusb.sys
Address: 0x9190F000 Size: 43904 File Visible: - Signed: -
Status: -

Name: TDI.SYS
Image Path: C:\Windows\system32\DRIVERS\TDI.SYS
Address: 0x8F6C2000 Size: 45056 File Visible: - Signed: -
Status: -

Name: tdx.sys
Image Path: C:\Windows\system32\DRIVERS\tdx.sys
Address: 0x9191A000 Size: 90112 File Visible: - Signed: -
Status: -

Name: termdd.sys
Image Path: C:\Windows\system32\DRIVERS\termdd.sys
Address: 0x8F74A000 Size: 65536 File Visible: - Signed: -
Status: -

Name: TSDDD.dll
Image Path: C:\Windows\System32\TSDDD.dll
Address: 0x9B460000 Size: 36864 File Visible: - Signed: -
Status: -

Name: tunmp.sys
Image Path: C:\Windows\system32\DRIVERS\tunmp.sys
Address: 0x8DEE6000 Size: 36864 File Visible: - Signed: -
Status: -

Name: tunnel.sys
Image Path: C:\Windows\system32\DRIVERS\tunnel.sys
Address: 0x8DEDB000 Size: 45056 File Visible: - Signed: -
Status: -

Name: UBHelper.sys
Image Path: C:\Windows\System32\Drivers\UBHelper.sys
Address: 0x8A269000 Size: 32768 File Visible: - Signed: -
Status: -

Name: umbus.sys
Image Path: C:\Windows\system32\DRIVERS\umbus.sys
Address: 0x8F79E000 Size: 53248 File Visible: - Signed: -
Status: -

Name: usbccgp.sys
Image Path: C:\Windows\system32\DRIVERS\usbccgp.sys
Address: 0x91930000 Size: 94208 File Visible: - Signed: -
Status: -

Name: USBD.SYS
Image Path: C:\Windows\system32\DRIVERS\USBD.SYS
Address: 0x8EFD7000 Size: 8192 File Visible: - Signed: -
Status: -

Name: usbehci.sys
Image Path: C:\Windows\system32\DRIVERS\usbehci.sys
Address: 0x8E7EF000 Size: 61440 File Visible: - Signed: -
Status: -

Name: usbhub.sys
Image Path: C:\Windows\system32\DRIVERS\usbhub.sys
Address: 0x8F7AB000 Size: 217088 File Visible: - Signed: -
Status: -

Name: USBPORT.SYS
Image Path: C:\Windows\system32\DRIVERS\USBPORT.SYS
Address: 0x8DEFC000 Size: 253952 File Visible: - Signed: -
Status: -

Name: usbuhci.sys
Image Path: C:\Windows\system32\DRIVERS\usbuhci.sys
Address: 0x8E7E4000 Size: 45056 File Visible: - Signed: -
Status: -

Name: usbvideo.sys
Image Path: C:\Windows\System32\Drivers\usbvideo.sys
Address: 0x919D5000 Size: 134016 File Visible: - Signed: -
Status: -

Name: vga.sys
Image Path: C:\Windows\System32\drivers\vga.sys
Address: 0x8FD37000 Size: 49152 File Visible: - Signed: -
Status: -

Name: VIDEOPRT.SYS
Image Path: C:\Windows\System32\drivers\VIDEOPRT.SYS
Address: 0x8FD43000 Size: 135168 File Visible: - Signed: -
Status: -

Name: volmgr.sys
Image Path: C:\Windows\system32\drivers\volmgr.sys
Address: 0x8A200000 Size: 61440 File Visible: - Signed: -
Status: -

Name: volmgrx.sys
Image Path: C:\Windows\System32\drivers\volmgrx.sys
Address: 0x8A20F000 Size: 303104 File Visible: - Signed: -
Status: -

Name: volsnap.sys
Image Path: C:\Windows\system32\drivers\volsnap.sys
Address: 0x8A71B000 Size: 233472 File Visible: - Signed: -
Status: -

Name: wanarp.sys
Image Path: C:\Windows\system32\DRIVERS\wanarp.sys
Address: 0x8FDC5000 Size: 77824 File Visible: - Signed: -
Status: -

Name: watchdog.sys
Image Path: C:\Windows\System32\drivers\watchdog.sys
Address: 0x8E7D8000 Size: 49152 File Visible: - Signed: -
Status: -

Name: Wdf01000.sys
Image Path: C:\Windows\system32\drivers\Wdf01000.sys
Address: 0x80604000 Size: 507904 File Visible: - Signed: -
Status: -

Name: WDFLDR.SYS
Image Path: C:\Windows\system32\drivers\WDFLDR.SYS
Address: 0x80680000 Size: 53248 File Visible: - Signed: -
Status: -

Name: whfltr2k.sys
Image Path: C:\Windows\system32\DRIVERS\whfltr2k.sys
Address: 0x8FD6D000 Size: 6784 File Visible: - Signed: -
Status: -

Name: Win32k
Image Path: \Driver\Win32k
Address: 0x9B240000 Size: 2109440 File Visible: - Signed: -
Status: -

Name: win32k.sys
Image Path: C:\Windows\System32\win32k.sys
Address: 0x9B240000 Size: 2109440 File Visible: - Signed: -
Status: -

Name: winbondcir.sys
Image Path: C:\Windows\system32\DRIVERS\winbondcir.sys
Address: 0x8EF9A000 Size: 86016 File Visible: - Signed: -
Status: -

Name: wmiacpi.sys
Image Path: C:\Windows\system32\DRIVERS\wmiacpi.sys
Address: 0x8DEF3000 Size: 36864 File Visible: - Signed: -
Status: -

Name: WMILIB.SYS
Image Path: C:\Windows\System32\Drivers\WMILIB.SYS
Address: 0x80780000 Size: 36864 File Visible: - Signed: -
Status: -

Name: WMIxWDM
Image Path: \Driver\WMIxWDM
Address: 0x82242000 Size: 3903488 File Visible: - Signed: -
Status: -

Name: xaudio.sys
Image Path: C:\Windows\system32\DRIVERS\xaudio.sys
Address: 0xA1D91000 Size: 32768 File Visible: - Signed: -
Status: -

---------------------------------------------------------------------
ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2010/10/27 20:30
Program Version: Version 1.3.5.0
Windows Version: Windows Vista SP2
==================================================

Stealth Objects
-------------------
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP]
Process: System Address: 0x855231f8 Size: 121

Object: Hidden Code [Driver: aufuys0fІ癅, IRP_MJ_CREATE]
Process: System Address: 0x873ee1f8 Size: 121

Object: Hidden Code [Driver: aufuys0fІ癅, IRP_MJ_CLOSE]
Process: System Address: 0x873ee1f8 Size: 121

Object: Hidden Code [Driver: aufuys0fІ癅, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x873ee1f8 Size: 121

Object: Hidden Code [Driver: aufuys0fІ癅, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x873ee1f8 Size: 121

Object: Hidden Code [Driver: aufuys0fІ癅, IRP_MJ_POWER]
Process: System Address: 0x873ee1f8 Size: 121

Object: Hidden Code [Driver: aufuys0fІ癅, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x873ee1f8 Size: 121

Object: Hidden Code [Driver: aufuys0fІ癅, IRP_MJ_PNP]
Process: System Address: 0x873ee1f8 Size: 121

Object: Hidden Code [Driver: abmm9jltІ癅, IRP_MJ_CREATE]
Process: System Address: 0x873da1f8 Size: 121

Object: Hidden Code [Driver: abmm9jltІ癅, IRP_MJ_CLOSE]
Process: System Address: 0x873da1f8 Size: 121

Object: Hidden Code [Driver: abmm9jltІ癅, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x873da1f8 Size: 121

Object: Hidden Code [Driver: abmm9jltІ癅, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x873da1f8 Size: 121

Object: Hidden Code [Driver: abmm9jltІ癅, IRP_MJ_POWER]
Process: System Address: 0x873da1f8 Size: 121

Object: Hidden Code [Driver: abmm9jltІ癅, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x873da1f8 Size: 121

Object: Hidden Code [Driver: abmm9jltІ癅, IRP_MJ_PNP]
Process: System Address: 0x873da1f8 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_CREATE]
Process: System Address: 0x855221f8 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_CLOSE]
Process: System Address: 0x855221f8 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x855221f8 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x855221f8 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_POWER]
Process: System Address: 0x855221f8 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x855221f8 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_PNP]
Process: System Address: 0x855221f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_CREATE]
Process: System Address: 0x872c91f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_CLOSE]
Process: System Address: 0x872c91f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x872c91f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x872c91f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_POWER]
Process: System Address: 0x872c91f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x872c91f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_PNP]
Process: System Address: 0x872c91f8 Size: 121

Object: Hidden Code [Driver: cdrom, IRP_MJ_CREATE]
Process: System Address: 0x874651f8 Size: 121

Object: Hidden Code [Driver: cdrom, IRP_MJ_CLOSE]
Process: System Address: 0x874651f8 Size: 121

Object: Hidden Code [Driver: cdrom, IRP_MJ_READ]
Process: System Address: 0x874651f8 Size: 121

Object: Hidden Code [Driver: cdrom, IRP_MJ_WRITE]
Process: System Address: 0x874651f8 Size: 121

Object: Hidden Code [Driver: cdrom, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x874651f8 Size: 121

Object: Hidden Code [Driver: cdrom, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x874651f8 Size: 121

Object: Hidden Code [Driver: cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x874651f8 Size: 121

Object: Hidden Code [Driver: cdrom, IRP_MJ_SHUTDOWN]
Process: System Address: 0x874651f8 Size: 121

Object: Hidden Code [Driver: cdrom, IRP_MJ_POWER]
Process: System Address: 0x874651f8 Size: 121

Object: Hidden Code [Driver: cdrom, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x874651f8 Size: 121

Object: Hidden Code [Driver: cdrom, IRP_MJ_PNP]
Process: System Address: 0x874651f8 Size: 121

Object: Hidden Code [Driver: Smb, IRP_MJ_CREATE]
Process: System Address: 0x913de500 Size: 121

Object: Hidden Code [Driver: Smb, IRP_MJ_CLOSE]
Process: System Address: 0x913de500 Size: 121

Object: Hidden Code [Driver: Smb, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x913de500 Size: 121

Object: Hidden Code [Driver: Smb, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x913de500 Size: 121

Object: Hidden Code [Driver: Smb, IRP_MJ_CLEANUP]
Process: System Address: 0x913de500 Size: 121

Object: Hidden Code [Driver: Smb, IRP_MJ_PNP]
Process: System Address: 0x913de500 Size: 121

Object: Hidden Code [Driver: netbtdeoЇ华牉偸ꔹ襠ꊠ᪠鄏, IRP_MJ_CREATE]
Process: System Address: 0x91452500 Size: 121

Object: Hidden Code [Driver: netbtdeoЇ华牉偸ꔹ襠ꊠ᪠鄏, IRP_MJ_CLOSE]
Process: System Address: 0x91452500 Size: 121

Object: Hidden Code [Driver: netbtdeoЇ华牉偸ꔹ襠ꊠ᪠鄏, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x91452500 Size: 121

Object: Hidden Code [Driver: netbtdeoЇ华牉偸ꔹ襠ꊠ᪠鄏, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x91452500 Size: 121

Object: Hidden Code [Driver: netbtdeoЇ华牉偸ꔹ襠ꊠ᪠鄏, IRP_MJ_CLEANUP]
Process: System Address: 0x91452500 Size: 121

Object: Hidden Code [Driver: netbtdeoЇ华牉偸ꔹ襠ꊠ᪠鄏, IRP_MJ_PNP]
Process: System Address: 0x91452500 Size: 121

Object: Hidden Code [Driver: iScsiPrtЂ穁摗, IRP_MJ_CREATE]
Process: System Address: 0x8741d1f8 Size: 121

Object: Hidden Code [Driver: iScsiPrtЂ穁摗, IRP_MJ_CLOSE]
Process: System Address: 0x8741d1f8 Size: 121

Object: Hidden Code [Driver: iScsiPrtЂ穁摗, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8741d1f8 Size: 121

Object: Hidden Code [Driver: iScsiPrtЂ穁摗, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8741d1f8 Size: 121

Object: Hidden Code [Driver: iScsiPrtЂ穁摗, IRP_MJ_POWER]
Process: System Address: 0x8741d1f8 Size: 121

Object: Hidden Code [Driver: iScsiPrtЂ穁摗, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8741d1f8 Size: 121

Object: Hidden Code [Driver: iScsiPrtЂ穁摗, IRP_MJ_PNP]
Process: System Address: 0x8741d1f8 Size: 121

Object: Hidden Code [Driver: volmgr, IRP_MJ_CREATE]
Process: System Address: 0x84b8f1f8 Size: 121

Object: Hidden Code [Driver: volmgr, IRP_MJ_READ]
Process: System Address: 0x84b8f1f8 Size: 121

Object: Hidden Code [Driver: volmgr, IRP_MJ_WRITE]
Process: System Address: 0x84b8f1f8 Size: 121

Object: Hidden Code [Driver: volmgr, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x84b8f1f8 Size: 121

Object: Hidden Code [Driver: volmgr, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x84b8f1f8 Size: 121

Object: Hidden Code [Driver: volmgr, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x84b8f1f8 Size: 121

Object: Hidden Code [Driver: volmgr, IRP_MJ_SHUTDOWN]
Process: System Address: 0x84b8f1f8 Size: 121

Object: Hidden Code [Driver: volmgr, IRP_MJ_CLEANUP]
Process: System Address: 0x84b8f1f8 Size: 121

Object: Hidden Code [Driver: volmgr, IRP_MJ_POWER]
Process: System Address: 0x84b8f1f8 Size: 121

Object: Hidden Code [Driver: volmgr, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x84b8f1f8 Size: 121

Object: Hidden Code [Driver: volmgr, IRP_MJ_PNP]
Process: System Address: 0x84b8f1f8 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE]
Process: System Address: 0x872661f8 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE]
Process: System Address: 0x872661f8 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x872661f8 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x872661f8 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER]
Process: System Address: 0x872661f8 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x872661f8 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP]
Process: System Address: 0x872661f8 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_CREATE]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_CREATE_NAMED_PIPE]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_CLOSE]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_READ]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_WRITE]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_QUERY_EA]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_SET_EA]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_SHUTDOWN]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_CLEANUP]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_CREATE_MAILSLOT]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_SET_SECURITY]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_POWER]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_DEVICE_CHANGE]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_SET_QUOTA]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: mrxsmb, IRP_MJ_PNP]
Process: System Address: 0x872af500 Size: 121

Object: Hidden Code [Driver: cdfsЈ敓摔ઐꧥ쟠蜋, IRP_MJ_CREATE]
Process: System Address: 0x89e1a500 Size: 121

Object: Hidden Code [Driver: cdfsЈ敓摔ઐꧥ쟠蜋, IRP_MJ_CLOSE]
Process: System Address: 0x89e1a500 Size: 121

Object: Hidden Code [Driver: cdfsЈ敓摔ઐꧥ쟠蜋, IRP_MJ_READ]
Process: System Address: 0x89e1a500 Size: 121

Object: Hidden Code [Driver: cdfsЈ敓摔ઐꧥ쟠蜋, IRP_MJ_WRITE]
Process: System Address: 0x89e1a500 Size: 121

Object: Hidden Code [Driver: cdfsЈ敓摔ઐꧥ쟠蜋, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x89e1a500 Size: 121

Object: Hidden Code [Driver: cdfsЈ敓摔ઐꧥ쟠蜋, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x89e1a500 Size: 121

Object: Hidden Code [Driver: cdfsЈ敓摔ઐꧥ쟠蜋, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x89e1a500 Size: 121

Object: Hidden Code [Driver: cdfsЈ敓摔ઐꧥ쟠蜋, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x89e1a500 Size: 121

Object: Hidden Code [Driver: cdfsЈ敓摔ઐꧥ쟠蜋, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x89e1a500 Size: 121

Object: Hidden Code [Driver: cdfsЈ敓摔ઐꧥ쟠蜋, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x89e1a500 Size: 121

Object: Hidden Code [Driver: cdfsЈ敓摔ઐꧥ쟠蜋, IRP_MJ_SHUTDOWN]
Process: System Address: 0x89e1a500 Size: 121

Object: Hidden Code [Driver: cdfsЈ敓摔ઐꧥ쟠蜋, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x89e1a500 Size: 121

Object: Hidden Code [Driver: cdfsЈ敓摔ઐꧥ쟠蜋, IRP_MJ_CLEANUP]
Process: System Address: 0x89e1a500 Size: 121

Object: Hidden Code [Driver: cdfsЈ敓摔ઐꧥ쟠蜋, IRP_MJ_PNP]
Process: System Address: 0x89e1a500 Size: 121

---------------------------------------------------------------
java , adobe kann ich nicht updaten, es kommt eine Fehler meldung keine berechtigung, ich weiß es auch nicht

arbeite bitte noch die weitere Punkte ab:-> http://www.trojaner-board.de/92181-m...tml#post582672

Hi, schritt 1 funktioniert nicht, 2)Hidden Services gibt es nicht, 3) fix funktioniert irgendwie nicht, datei ist immer noch da, obwohl ich es fixiert habe, nach dem ich 2 mal gescannt habe, 4-8) erledigt schritt 9) es waren 24 meldungen, den gespeicherten log datei kann ich nicht öffnen, habe jetzt nochmal begonnen zu suchen, 10) bin noch dabei zu suchen

ne leider , ich wusste , dass man die log dateien bei präferenzem findet, aber das programm öffnet die nicht, keine reaktion