| |
| |||||||
Log-Analyse und Auswertung: http://www.searchnu.com/406 als startseite! Trojana?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
11.06.2012, 17:14
| #1 |
| |  http://www.searchnu.com/406 als startseite! Trojana? Hallo an alles User! ich bin neu hier und hoffe ihr könnt mir helfen, und zwar habe ich das Problem das sich meine Startseite "google" immer wieder in hxxp://www.searchnu.com/406 ändert! Habe nach stunden langer suche im Netz nur rausgefunden das es ein Trojana ist! Auf der suche den wieder weg zubekommen bin ich auch auf euch gestoßen und habe mich mal drann gesetzt eure Schritte zu bearbeiten! ps: Der Rechner heißt Party-Pc Malwarebytes Anti-Malware (Test) 1.61.0.1400 www.malwarebytes.org Datenbank Version: v2012.06.11.06 Windows 7 x64 NTFS Internet Explorer 8.0.7600.16385 Party :: PARTY-PC [Administrator] Schutz: Aktiviert 11.06.2012 17:43:04 mbam-log-2012-06-11 (17-43-04).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 219923 Laufzeit: 32 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Users\Party\Downloads\setup(1).exe (PUP.BundleInstaller.VG) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Party\Downloads\setup.exe (PUP.BundleInstaller.VG) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) da war ich leider etwas zu schnell! Es hat sich aber nichts geändert mit der Startseite!!! OTL Logfile: Code:
ATTFilter OTL logfile created on: 11.06.2012 17:49:06 - Run 1 OTL by OldTimer - Version 3.2.48.0 Folder = C:\Users\Party\Downloads 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,50 Gb Available Physical Memory | 62,51% Memory free 8,00 Gb Paging File | 5,96 Gb Available in Paging File | 74,48% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,66 Gb Total Space | 405,66 Gb Free Space | 87,12% Space Free | Partition Type: NTFS Drive D: | 2,10 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Drive E: | 5,75 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: PARTY-PC | User Name: Party | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.06.11 17:48:54 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Party\Downloads\OTL.exe PRC - [2012.06.03 22:53:14 | 000,529,232 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe PRC - [2012.06.03 22:42:01 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\Steam.exe PRC - [2012.06.01 17:55:05 | 001,564,368 | ---- | M] () -- C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe PRC - [2012.06.01 17:53:36 | 000,127,040 | ---- | M] (ICQ, LLC.) -- C:\Program Files (x86)\ICQ7.7\ICQ.exe PRC - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012.05.15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2012.05.02 00:31:35 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.04.21 03:16:21 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2010.08.03 09:43:02 | 000,522,824 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\GamePanel Software\Applets\LCDMedia.exe PRC - [2009.07.14 03:14:47 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe ========== Modules (No Company Name) ========== MOD - [2012.06.03 22:53:14 | 020,313,384 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\libcef.dll MOD - [2012.06.03 22:53:13 | 001,099,576 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avcodec-53.dll MOD - [2012.06.03 22:53:13 | 000,895,312 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\chromehtml.DLL MOD - [2012.06.03 22:53:13 | 000,190,776 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avformat-53.dll MOD - [2012.06.03 22:53:13 | 000,123,192 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avutil-51.dll MOD - [2012.06.01 17:55:05 | 001,564,368 | ---- | M] () -- C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe MOD - [2012.05.15 02:21:26 | 000,368,448 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll MOD - [2012.04.21 03:16:53 | 001,952,696 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.06.03 22:53:14 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.06.01 18:13:09 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.06.01 17:55:05 | 001,564,368 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe -- (Guard.Mail.ru) SRV - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.05.15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012.05.03 08:31:10 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.05.02 15:24:12 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2012.04.27 10:20:04 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.04.25 00:32:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.04.18 19:08:03 | 000,188,736 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2009.11.23 17:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid) DRV:64bit: - [2009.11.23 17:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum) DRV:64bit: - [2009.09.17 13:04:18 | 001,250,816 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV:64bit: - [2009.07.14 03:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2009.07.14 03:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 22:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.04 18:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://mystart.incredibar.com/mb155?a=6R8viKOAgT&i=26 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 28 78 4A B2 DB 3F CD 01 [binary data] IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms} IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb155/?search={searchTerms}&loc=IB_DS&a=6R8viKOAgT&i=26 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Search Results" FF - prefs.js..browser.search.order.1: "Search Results" FF - prefs.js..browser.search.selectedEngine: "Search Results" FF - prefs.js..browser.startup.homepage: "hxxp://www.searchnu.com/406" FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=101&systemid=406&sr=0&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.11 17:51:05 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.01 18:15:32 | 000,000,000 | ---D | M] [2012.06.07 20:53:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Party\AppData\Roaming\mozilla\Extensions [2012.06.07 22:05:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Party\AppData\Roaming\mozilla\Firefox\Profiles\7d0vfsnj.default\extensions [2012.06.07 20:51:40 | 000,002,203 | ---- | M] () -- C:\Users\Party\AppData\Roaming\Mozilla\Firefox\Profiles\7d0vfsnj.default\searchplugins\MyStart Search.xml [2012.06.07 20:48:38 | 000,002,519 | ---- | M] () -- C:\Users\Party\AppData\Roaming\Mozilla\Firefox\Profiles\7d0vfsnj.default\searchplugins\Search_Results.xml [2012.06.10 15:34:42 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.04.21 03:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.12.09 19:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2012.06.01 18:33:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.06.01 18:33:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.06.01 18:33:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.06.01 18:33:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.07 20:48:38 | 000,002,519 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml [2012.06.01 18:33:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.01 18:33:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (ICQ Sparberater) - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - C:\Program Files (x86)\icq\Internet Explorer\icq.dll (solute gmbh) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll File not found O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll File not found O3 - HKLM\..\Toolbar: (Reg Error: Value error.) - 10 - Reg Error: Value error. File not found O4:64bit: - HKLM..\Run: [Launch LCDMon] C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Guard.Mail.ru.gui] C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe () O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.) O4 - HKCU..\Run: [ICQ] "C:\PROGRA~2\ICQ7.7\ICQ.exe" silent loginmode=4 File not found O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files (x86)\ICQ7.7\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files (x86)\ICQ7.7\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{71BF2F39-2800-4F81-9800-C3B2CD046034}: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007.06.28 19:48:59 | 000,000,000 | R--D | M] - D:\AutoRun -- [ UDF ] O32 - AutoRun File - [2005.11.01 06:09:50 | 000,729,088 | R--- | M] (Electronic Arts Inc.) - D:\AutoRun.exe -- [ UDF ] O32 - AutoRun File - [2005.11.01 06:43:36 | 000,000,160 | R--- | M] () - D:\autorun.inf -- [ UDF ] O32 - AutoRun File - [2005.10.14 11:02:16 | 000,585,728 | R--- | M] (Electronic Arts Inc.) - D:\AutoRunGUI.dll -- [ UDF ] O32 - AutoRun File - [2007.10.25 01:29:17 | 000,000,000 | ---D | M] - E:\autorun -- [ CDFS ] O32 - AutoRun File - [2007.07.19 16:53:44 | 000,000,058 | R--- | M] () - E:\Autorun.inf -- [ CDFS ] O32 - AutoRun File - [2007.10.25 00:11:40 | 004,318,432 | R--- | M] (Crytek) - E:\AutoRunCD.exe -- [ CDFS ] O33 - MountPoints2\{2b48b3ed-ab9a-11e1-83a3-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{2b48b3ed-ab9a-11e1-83a3-806e6f6e6963}\Shell\AutoRun\command - "" = D:\cdstart.exe O33 - MountPoints2\{87e207c5-ae60-11e1-aa73-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{87e207c5-ae60-11e1-aa73-806e6f6e6963}\Shell\AutoRun\command - "" = E:\AutoRunCD.exe -- [2007.10.25 00:11:40 | 004,318,432 | R--- | M] (Crytek) O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.06.11 17:28:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.06.11 17:28:44 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.06.11 17:28:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.06.10 18:48:51 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\Malwarebytes [2012.06.10 18:48:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.06.08 18:41:13 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\Amazon [2012.06.08 18:39:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Amazon [2012.06.08 16:23:48 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Local\GIANTS Editor 4.1.7 [2012.06.08 16:23:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIANTS Software [2012.06.08 16:23:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GIANTS Software [2012.06.08 15:16:32 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Local\NFS Underground 2 [2012.06.08 00:05:10 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess [2012.06.07 23:56:02 | 000,000,000 | ---D | C] -- C:\ProgramData\IObit [2012.06.07 23:04:07 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\Need for Speed World [2012.06.07 21:10:39 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Local\Electronic_Arts_Inc [2012.06.07 21:10:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts [2012.06.07 20:50:23 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Local\Ilivid Player [2012.06.07 18:05:53 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_7.dll [2012.06.07 18:05:53 | 000,518,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_7.dll [2012.06.07 18:05:53 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_7.dll [2012.06.07 18:05:53 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_7.dll [2012.06.07 18:05:53 | 000,077,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_5.dll [2012.06.07 18:05:53 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_5.dll [2012.06.07 18:05:52 | 002,526,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_43.dll [2012.06.07 18:05:52 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_43.dll [2012.06.07 18:05:51 | 001,907,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_43.dll [2012.06.07 18:05:51 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_43.dll [2012.06.07 18:05:51 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_43.dll [2012.06.07 18:05:51 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_43.dll [2012.06.07 18:05:51 | 000,276,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_43.dll [2012.06.07 18:05:51 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_43.dll [2012.06.07 18:05:50 | 002,401,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_43.dll [2012.06.07 18:05:50 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_43.dll [2012.06.07 18:05:50 | 000,530,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_6.dll [2012.06.07 18:05:50 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_6.dll [2012.06.07 18:05:50 | 000,078,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_4.dll [2012.06.07 18:05:50 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_4.dll [2012.06.07 18:05:49 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_6.dll [2012.06.07 18:05:49 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_6.dll [2012.06.07 18:05:48 | 000,517,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_5.dll [2012.06.07 18:05:48 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_5.dll [2012.06.07 18:05:48 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_7.dll [2012.06.07 18:05:48 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_7.dll [2012.06.07 18:05:47 | 002,582,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_42.dll [2012.06.07 18:05:47 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_42.dll [2012.06.07 18:05:47 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_5.dll [2012.06.07 18:05:47 | 000,176,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_5.dll [2012.06.07 18:05:46 | 005,554,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_42.dll [2012.06.07 18:05:46 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_42.dll [2012.06.07 18:05:45 | 000,523,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_42.dll [2012.06.07 18:05:45 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_42.dll [2012.06.07 18:05:45 | 000,285,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_42.dll [2012.06.07 18:05:45 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_42.dll [2012.06.07 18:05:44 | 002,475,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_42.dll [2012.06.07 18:05:44 | 002,430,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_41.dll [2012.06.07 18:05:44 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_41.dll [2012.06.07 18:05:44 | 000,520,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_41.dll [2012.06.07 18:05:44 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_41.dll [2012.06.07 18:05:43 | 005,425,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_41.dll [2012.06.07 18:05:43 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_41.dll [2012.06.07 18:05:42 | 000,521,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_4.dll [2012.06.07 18:05:42 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_4.dll [2012.06.07 18:05:42 | 000,073,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_3.dll [2012.06.07 18:05:42 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_3.dll [2012.06.07 18:05:41 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_4.dll [2012.06.07 18:05:41 | 000,174,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_4.dll [2012.06.07 18:05:41 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_6.dll [2012.06.07 18:05:41 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_6.dll [2012.06.07 18:05:40 | 002,605,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_40.dll [2012.06.07 18:05:40 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_40.dll [2012.06.07 18:05:40 | 000,519,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_40.dll [2012.06.07 18:05:40 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_40.dll [2012.06.07 18:05:39 | 005,631,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_40.dll [2012.06.07 18:05:39 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_40.dll [2012.06.07 18:05:39 | 000,518,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_3.dll [2012.06.07 18:05:39 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_3.dll [2012.06.07 18:05:39 | 000,074,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_2.dll [2012.06.07 18:05:39 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_2.dll [2012.06.07 18:05:38 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_3.dll [2012.06.07 18:05:38 | 000,175,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_3.dll [2012.06.07 18:05:38 | 000,025,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_5.dll [2012.06.07 18:05:38 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_5.dll [2012.06.07 18:05:37 | 000,513,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_2.dll [2012.06.07 18:05:37 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_2.dll [2012.06.07 18:05:37 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_2.dll [2012.06.07 18:05:37 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_2.dll [2012.06.07 18:05:37 | 000,072,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_1.dll [2012.06.07 18:05:37 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_1.dll [2012.06.07 18:05:36 | 004,992,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_39.dll [2012.06.07 18:05:36 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_39.dll [2012.06.07 18:05:36 | 001,942,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_39.dll [2012.06.07 18:05:36 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_39.dll [2012.06.07 18:05:36 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_39.dll [2012.06.07 18:05:36 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_39.dll [2012.06.07 18:05:35 | 000,511,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_1.dll [2012.06.07 18:05:35 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_1.dll [2012.06.07 18:05:35 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_1.dll [2012.06.07 18:05:35 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_1.dll [2012.06.07 18:05:35 | 000,068,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_0.dll [2012.06.07 18:05:35 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_0.dll [2012.06.07 18:05:35 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_4.dll [2012.06.07 18:05:35 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_4.dll [2012.06.07 18:05:34 | 004,991,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_38.dll [2012.06.07 18:05:34 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_38.dll [2012.06.07 18:05:34 | 001,941,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_38.dll [2012.06.07 18:05:34 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_38.dll [2012.06.07 18:05:34 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_38.dll [2012.06.07 18:05:34 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_38.dll [2012.06.07 18:05:33 | 000,489,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_0.dll [2012.06.07 18:05:33 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_0.dll [2012.06.07 18:05:32 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_0.dll [2012.06.07 18:05:32 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_0.dll [2012.06.07 18:05:32 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_3.dll [2012.06.07 18:05:32 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_3.dll [2012.06.07 18:05:31 | 004,910,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_37.dll [2012.06.07 18:05:31 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_37.dll [2012.06.07 18:05:31 | 001,860,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_37.dll [2012.06.07 18:05:31 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_37.dll [2012.06.07 18:05:31 | 000,529,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_37.dll [2012.06.07 18:05:31 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_37.dll [2012.06.07 18:05:30 | 000,411,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_10.dll [2012.06.07 18:05:30 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_10.dll [2012.06.07 18:05:29 | 002,006,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_36.dll [2012.06.07 18:05:29 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_36.dll [2012.06.07 18:05:29 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_36.dll [2012.06.07 18:05:29 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_36.dll [2012.06.07 18:05:27 | 005,081,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_36.dll [2012.06.07 18:05:27 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_36.dll [2012.06.07 18:05:26 | 000,411,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_9.dll [2012.06.07 18:05:26 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_9.dll [2012.06.07 18:05:22 | 000,409,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_8.dll [2012.06.07 18:05:22 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_8.dll [2012.06.07 18:05:22 | 000,021,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_2.dll [2012.06.07 18:05:22 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_2.dll [2012.06.07 18:05:17 | 004,494,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_33.dll [2012.06.07 18:05:17 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_33.dll [2012.06.07 18:05:17 | 001,400,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_33.dll [2012.06.07 18:05:17 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_33.dll [2012.06.07 18:05:17 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_33.dll [2012.06.07 18:05:17 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_33.dll [2012.06.07 18:05:17 | 000,403,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_7.dll [2012.06.07 18:05:17 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_7.dll [2012.06.07 18:05:16 | 000,393,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_6.dll [2012.06.07 18:05:16 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_6.dll [2012.06.07 18:05:15 | 004,398,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_32.dll [2012.06.07 18:05:15 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_32.dll [2012.06.07 18:05:15 | 000,469,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10.dll [2012.06.07 18:05:15 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10.dll [2012.06.07 18:05:15 | 000,390,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_5.dll [2012.06.07 18:05:15 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_5.dll [2012.06.07 18:05:14 | 000,364,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_4.dll [2012.06.07 18:05:14 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_4.dll [2012.06.07 18:05:14 | 000,017,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_1.dll [2012.06.07 18:05:14 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_1.dll [2012.06.07 18:05:13 | 003,977,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_31.dll [2012.06.07 18:05:13 | 000,363,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_3.dll [2012.06.07 18:05:13 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_3.dll [2012.06.07 18:05:13 | 000,083,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_2.dll [2012.06.07 18:05:13 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_2.dll [2012.06.07 18:05:12 | 000,354,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_2.dll [2012.06.07 18:05:12 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_2.dll [2012.06.07 18:05:12 | 000,083,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_1.dll [2012.06.07 18:05:12 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_1.dll [2012.06.07 18:05:11 | 000,352,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_1.dll [2012.06.07 18:05:11 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_1.dll [2012.06.07 18:05:05 | 003,927,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_30.dll [2012.06.07 18:05:05 | 003,830,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_29.dll [2012.06.07 18:05:05 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_30.dll [2012.06.07 18:05:05 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_29.dll [2012.06.07 18:05:05 | 000,355,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_0.dll [2012.06.07 18:05:05 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_0.dll [2012.06.07 18:05:05 | 000,016,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_0.dll [2012.06.07 18:05:05 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_0.dll [2012.06.07 18:05:04 | 003,815,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_28.dll [2012.06.07 18:05:04 | 003,807,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_27.dll [2012.06.07 18:05:04 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_28.dll [2012.06.07 18:05:04 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_27.dll [2012.06.07 18:05:02 | 003,823,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_25.dll [2012.06.07 18:05:02 | 003,544,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_24.dll [2012.06.07 18:05:02 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_25.dll [2012.06.07 18:05:02 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_24.dll [2012.06.05 18:25:19 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Local\TechSmith [2012.06.05 18:19:18 | 000,000,000 | ---D | C] -- C:\Users\Party\Documents\Camtasia Studio [2012.06.05 18:19:00 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\QuickTime [2012.06.05 18:19:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Camtasia Studio 7 [2012.06.05 18:18:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime [2012.06.05 18:18:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\TechSmith Shared [2012.06.05 18:18:43 | 000,000,000 | ---D | C] -- C:\ProgramData\TechSmith [2012.06.05 18:18:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TechSmith [2012.06.05 16:10:47 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Local\GameSpy [2012.06.05 16:09:57 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Local\ApplicationHistory [2012.06.04 21:25:38 | 000,000,000 | R--D | C] -- C:\Users\Party\Desktop\Games [2012.06.04 20:08:11 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\URTTEMP [2012.06.04 20:08:00 | 000,000,000 | RH-D | C] -- C:\Users\Party\AppData\Roaming\SecuROM [2012.06.04 20:06:49 | 005,073,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_35.dll [2012.06.04 20:06:49 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_35.dll [2012.06.04 20:06:49 | 001,985,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_35.dll [2012.06.04 20:06:49 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_35.dll [2012.06.04 20:06:49 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_35.dll [2012.06.04 20:06:49 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_35.dll [2012.06.04 20:06:48 | 004,496,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_34.dll [2012.06.04 20:06:48 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_34.dll [2012.06.04 20:06:48 | 001,401,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_34.dll [2012.06.04 20:06:48 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_34.dll [2012.06.04 20:06:48 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_34.dll [2012.06.04 20:06:48 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_34.dll [2012.06.04 20:06:47 | 000,107,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_3.dll [2012.06.04 20:06:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Electronic Arts [2012.06.04 19:56:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Electronic Arts [2012.06.04 19:07:45 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Local\Logitech [2012.06.04 19:07:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech [2012.06.04 19:07:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Logitech [2012.06.04 19:07:24 | 000,000,000 | ---D | C] -- C:\Program Files\Logitech [2012.06.04 19:07:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Logitech [2012.06.03 23:21:37 | 000,000,000 | ---D | C] -- C:\Users\Party\Documents\NFS Most Wanted [2012.06.03 23:04:12 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam [2012.06.03 22:41:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Steam [2012.06.03 22:41:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam [2012.06.03 22:41:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Steam [2012.06.03 22:40:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA GAMES [2012.06.03 22:36:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EA GAMES [2012.06.03 22:36:26 | 003,767,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_26.dll [2012.06.03 22:36:26 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_26.dll [2012.06.01 18:16:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Winamp [2012.06.01 18:16:13 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_31.dll [2012.06.01 18:16:13 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_42.dll [2012.06.01 18:15:32 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Winamp Erkennungs-Plug-in [2012.06.01 18:15:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp Detect [2012.06.01 18:15:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine [2012.06.01 18:15:28 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\Winamp [2012.06.01 18:15:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp [2012.06.01 18:07:53 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Local\Mozilla [2012.06.01 18:07:11 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\Avira [2012.06.01 18:01:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2012.06.01 18:01:49 | 000,132,832 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2012.06.01 18:01:49 | 000,098,848 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2012.06.01 18:01:49 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys [2012.06.01 18:01:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2012.06.01 18:01:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira [2012.06.01 17:55:15 | 000,000,000 | ---D | C] -- C:\Windows\extensions [2012.06.01 17:55:15 | 000,000,000 | ---D | C] -- C:\extensions [2012.06.01 17:55:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\icq [2012.06.01 17:55:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.7 [2012.06.01 17:55:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Guard-ICQ [2012.06.01 17:55:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ6Toolbar [2012.06.01 17:55:02 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\Mozilla [2012.06.01 17:55:02 | 000,000,000 | ---D | C] -- C:\ProgramData\ICQ [2012.06.01 17:54:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla [2012.06.01 17:54:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012.06.01 17:53:38 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\ICQ [2012.06.01 17:53:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ7.7 [2012.06.01 17:53:28 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\Skype [2012.06.01 17:53:24 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype [2012.06.01 17:53:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2012.06.01 17:53:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype [2012.06.01 17:53:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2012.06.01 17:27:50 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\.minecraft [2012.06.01 13:02:22 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\NVIDIA [2012.06.01 12:52:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation [2012.06.01 12:49:48 | 006,151,488 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcpl.dll [2012.06.01 12:49:48 | 003,149,632 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvc64.dll [2012.06.01 12:49:48 | 002,561,856 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvcr.dll [2012.06.01 12:49:48 | 000,118,080 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvmctray.dll [2012.06.01 12:49:48 | 000,063,296 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvshext.dll [2012.06.01 12:49:37 | 000,068,928 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2012.06.01 12:49:37 | 000,061,248 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll [2012.06.01 12:49:29 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation [2012.06.01 12:49:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation [2012.06.01 12:49:10 | 025,743,168 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll [2012.06.01 12:49:10 | 019,607,872 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll [2012.06.01 12:49:10 | 010,194,752 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvwgf2umx.dll [2012.06.01 12:49:10 | 008,105,280 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvwgf2um.dll [2012.06.01 12:49:10 | 001,738,048 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco64.dll [2012.06.01 12:49:10 | 001,468,224 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvgenco64.dll [2012.06.01 12:49:10 | 001,451,840 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdagenco6420103.dll [2012.06.01 12:49:10 | 000,949,056 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvumdshimx.dll [2012.06.01 12:49:10 | 000,818,496 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvumdshim.dll [2012.06.01 12:49:10 | 000,246,592 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvinitx.dll [2012.06.01 12:49:10 | 000,202,048 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvinit.dll [2012.06.01 12:49:10 | 000,188,736 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\drivers\nvhda64v.sys [2012.06.01 12:49:10 | 000,031,040 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdap64.dll [2012.06.01 12:49:09 | 025,248,064 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll [2012.06.01 12:49:09 | 018,044,224 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll [2012.06.01 12:49:09 | 017,551,680 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll [2012.06.01 12:49:09 | 015,322,432 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvd3dum.dll [2012.06.01 12:49:09 | 008,139,072 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll [2012.06.01 12:49:09 | 005,982,528 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll [2012.06.01 12:49:09 | 002,881,856 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll [2012.06.01 12:49:09 | 002,741,568 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvapi64.dll [2012.06.01 12:49:09 | 002,681,664 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll [2012.06.01 12:49:09 | 002,524,992 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll [2012.06.01 12:49:09 | 002,445,120 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvenc.dll [2012.06.01 12:49:09 | 002,368,832 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvapi.dll [2012.06.01 12:49:09 | 000,364,352 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdecodemft.dll [2012.06.01 12:49:09 | 000,301,376 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvdecodemft.dll [2012.06.01 12:48:57 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation [2012.06.01 12:48:36 | 000,000,000 | ---D | C] -- C:\NVIDIA [2012.06.01 12:16:27 | 000,000,000 | ---D | C] -- C:\Users\Party\Documents\My Games [2012.06.01 12:11:51 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_3.dll [2012.06.01 12:11:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Landwirtschafts Simulator 2011 [2012.06.01 12:10:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Landwirtschafts Simulator 2011 [2012.06.01 12:07:41 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information [2012.06.01 12:06:59 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA [2012.06.01 12:05:14 | 001,250,816 | ---- | C] (VIA Technologies, Inc.) -- C:\Windows\SysNative\drivers\viahduaa.sys [2012.06.01 12:05:14 | 001,011,712 | ---- | C] (VIA Technologies, Inc.) -- C:\Windows\SysNative\VIAPropPageExt.dll [2012.06.01 12:05:14 | 000,601,088 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysNative\VMAPO64.DLL [2012.06.01 12:05:14 | 000,531,968 | ---- | C] (VIA Technologies, Inc.) -- C:\Windows\SysNative\VIASysFx.dll [2012.06.01 12:05:14 | 000,524,288 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysWow64\VMAPO32.DLL [2012.06.01 12:05:14 | 000,242,176 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysNative\Dts2APO.dll [2012.06.01 12:05:14 | 000,193,024 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysNative\ViaMicArrayAPO.dll [2012.06.01 12:05:14 | 000,086,016 | ---- | C] (QSound Labs, Inc.) -- C:\Windows\SysNative\nQPropPageExt.dll [2012.06.01 12:05:14 | 000,084,992 | ---- | C] (VIA Technologies, Inc.) -- C:\Windows\SysNative\Dts2PropPageExt.dll [2012.06.01 12:05:14 | 000,082,432 | ---- | C] (QSound Labs, Inc.) -- C:\Windows\SysNative\nQAPO.dll [2012.06.01 12:05:14 | 000,076,288 | ---- | C] (VIA Technologies,Inc.) -- C:\Windows\SysNative\ViaMicArrayPropPageExt.dll [2012.06.01 12:05:14 | 000,072,704 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysNative\VMWRP64.DLL [2012.06.01 12:05:14 | 000,057,856 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysNative\VMPPLD64.DLL [2012.06.01 12:05:14 | 000,053,760 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysNative\VMPPCN64.DLL [2012.06.01 12:04:47 | 000,414,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\difxapi.dll [2012.06.01 12:04:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VIA [2012.06.01 12:04:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield [2012.06.01 11:58:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2012.06.01 11:58:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2012.06.01 11:58:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Oracle [2012.06.01 11:58:02 | 000,772,504 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll [2012.06.01 11:58:02 | 000,687,504 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll [2012.06.01 11:58:02 | 000,227,720 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe [2012.06.01 11:57:57 | 000,174,024 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe [2012.06.01 11:57:57 | 000,174,024 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe [2012.06.01 11:57:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java [2012.06.01 11:57:15 | 000,016,440 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\drivers\AtiPcie.sys [2012.06.01 11:56:58 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2012.06.01 11:56:49 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies [2012.06.01 11:56:44 | 000,000,000 | ---D | C] -- C:\Program Files\ATI [2012.06.01 11:54:56 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\Macromedia [2012.06.01 11:54:52 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\Adobe [2012.06.01 11:54:36 | 000,419,488 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.06.01 11:54:36 | 000,070,304 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.06.01 11:54:35 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed [2012.06.01 11:54:34 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed [2012.06.01 05:31:14 | 000,000,000 | -HSD | C] -- C:\System Volume Information [2012.06.01 05:31:09 | 000,000,000 | ---D | C] -- C:\Windows\CSC [2012.05.31 23:43:14 | 000,000,000 | R--D | C] -- C:\Users\Party\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2012.05.31 23:43:14 | 000,000,000 | R--D | C] -- C:\Users\Party\Searches [2012.05.31 23:43:14 | 000,000,000 | R--D | C] -- C:\Users\Party\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2012.05.31 23:43:06 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\Identities [2012.05.31 23:43:04 | 000,000,000 | R--D | C] -- C:\Users\Party\Contacts [2012.05.31 23:43:02 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Local\VirtualStore [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\Vorlagen [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\AppData\Local\Verlauf [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\AppData\Local\Temporary Internet Files [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\Startmenü [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\SendTo [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\Recent [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\Netzwerkumgebung [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\Lokale Einstellungen [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\Documents\Eigene Videos [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\Documents\Eigene Musik [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\Eigene Dateien [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\Documents\Eigene Bilder [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\Druckumgebung [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\Cookies [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\AppData\Local\Anwendungsdaten [2012.05.31 23:42:50 | 000,000,000 | -HSD | C] -- C:\Users\Party\Anwendungsdaten [2012.05.31 23:42:49 | 000,000,000 | --SD | C] -- C:\Users\Party\AppData\Roaming\Microsoft [2012.05.31 23:42:49 | 000,000,000 | R--D | C] -- C:\Users\Party\Videos [2012.05.31 23:42:49 | 000,000,000 | R--D | C] -- C:\Users\Party\Saved Games [2012.05.31 23:42:49 | 000,000,000 | R--D | C] -- C:\Users\Party\Pictures [2012.05.31 23:42:49 | 000,000,000 | R--D | C] -- C:\Users\Party\Music [2012.05.31 23:42:49 | 000,000,000 | R--D | C] -- C:\Users\Party\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2012.05.31 23:42:49 | 000,000,000 | R--D | C] -- C:\Users\Party\Links [2012.05.31 23:42:49 | 000,000,000 | R--D | C] -- C:\Users\Party\Favorites [2012.05.31 23:42:49 | 000,000,000 | R--D | C] -- C:\Users\Party\Downloads [2012.05.31 23:42:49 | 000,000,000 | R--D | C] -- C:\Users\Party\Documents [2012.05.31 23:42:49 | 000,000,000 | R--D | C] -- C:\Users\Party\Desktop [2012.05.31 23:42:49 | 000,000,000 | R--D | C] -- C:\Users\Party\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2012.05.31 23:42:49 | 000,000,000 | -H-D | C] -- C:\Users\Party\AppData [2012.05.31 23:42:49 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Local\Temp [2012.05.31 23:42:49 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Local\Microsoft [2012.05.31 23:42:49 | 000,000,000 | ---D | C] -- C:\Users\Party\AppData\Roaming\Media Center Programs [2012.05.31 23:41:03 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2012.05.31 23:40:17 | 000,000,000 | -HSD | C] -- C:\Recovery [2012.05.31 23:40:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2012.05.31 23:40:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2012.05.31 23:40:16 | 000,000,000 | -HSD | C] -- C:\Programme [2012.05.31 23:40:16 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2012.05.31 23:40:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2012.05.31 23:40:16 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2012.05.31 23:40:16 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2012.05.31 23:40:16 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2012.05.31 23:40:16 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2012.05.31 23:40:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2012.05.31 23:40:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Desktop [2012.05.31 23:40:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten ========== Files - Modified Within 30 Days ========== [2012.06.11 17:47:40 | 000,000,000 | ---- | M] () -- C:\Users\Party\defogger_reenable [2012.06.11 17:40:43 | 001,501,000 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.06.11 17:40:43 | 000,654,096 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.06.11 17:40:43 | 000,615,760 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.06.11 17:40:43 | 000,130,952 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.06.11 17:40:43 | 000,107,396 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.06.11 17:39:37 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.06.11 17:39:37 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.06.11 17:34:26 | 000,067,584 | ---- | M] () -- C:\Windows\bootstat.dat [2012.06.11 17:34:22 | 3220,676,608 | -HS- | M] () -- C:\hiberfil.sys [2012.06.11 17:31:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.06.11 17:28:45 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.06.10 19:38:28 | 000,107,396 | ---- | M] () -- C:\Windows\SysNative\perfc009(43).dat [2012.06.10 19:31:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat(38).dat [2012.06.10 14:23:34 | 001,016,772 | ---- | M] () -- C:\Users\Party\Documents\Manian_Hold me tonight_013_Manian_Hold me tonight (Rob Ma22.mp3 [2012.06.07 20:51:49 | 000,000,447 | ---- | M] () -- C:\user.js [2012.06.07 15:46:21 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2012.06.05 22:23:47 | 000,048,854 | ---- | M] () -- C:\Users\Party\Documents\id31xnrf.bmp [2012.06.05 22:22:49 | 000,033,974 | ---- | M] () -- C:\Users\Party\Documents\s0oaonwl.bmp [2012.06.05 22:21:18 | 000,096,274 | ---- | M] () -- C:\Users\Party\Documents\blondi.jpg [2012.06.05 20:40:28 | 000,838,671 | ---- | M] () -- C:\Users\Party\Documents\2012-06-05_20.11.00.png [2012.06.05 19:16:18 | 000,273,016 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.06.05 18:30:57 | 000,640,867 | ---- | M] () -- C:\Users\Party\Documents\2012-06-05_18.30.07.png [2012.06.05 18:28:11 | 000,005,120 | ---- | M] () -- C:\Users\Party\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.06.05 18:19:00 | 000,001,168 | ---- | M] () -- C:\Users\Public\Desktop\Camtasia Studio 7.lnk [2012.06.05 16:09:58 | 000,000,093 | ---- | M] () -- C:\Users\Party\AppData\Local\fusioncache.dat [2012.06.04 20:08:49 | 001,526,730 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.06.04 19:07:44 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_lgSSBW_01_00_00.Wdf [2012.06.04 19:07:36 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_lgSSQVGA_01_00_00.Wdf [2012.06.03 22:41:37 | 000,000,917 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk [2012.06.01 18:26:16 | 000,000,560 | ---- | M] () -- C:\Users\Party\Desktop\Technobase.fm.pls [2012.06.01 18:16:14 | 000,000,979 | ---- | M] () -- C:\Users\Public\Desktop\Winamp.lnk [2012.06.01 18:13:09 | 000,419,488 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.06.01 18:13:09 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.06.01 18:01:55 | 000,002,066 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2012.06.01 17:55:09 | 000,001,824 | ---- | M] () -- C:\Users\Public\Desktop\ICQ7.7.lnk [2012.06.01 17:54:02 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.06.01 17:53:24 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2012.06.01 12:05:26 | 000,001,202 | ---- | M] () -- C:\Users\Public\Desktop\HD VDeck.lnk [2012.06.01 11:57:53 | 000,174,024 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe [2012.06.01 11:57:53 | 000,174,024 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe [2012.06.01 05:33:33 | 000,057,050 | ---- | M] () -- C:\Windows\SysWow64\license.rtf [2012.06.01 05:33:33 | 000,057,050 | ---- | M] () -- C:\Windows\SysNative\license.rtf [2012.05.15 12:48:00 | 025,743,168 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll [2012.05.15 12:48:00 | 025,248,064 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll [2012.05.15 12:48:00 | 019,607,872 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll [2012.05.15 12:48:00 | 018,044,224 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll [2012.05.15 12:48:00 | 017,551,680 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll [2012.05.15 12:48:00 | 015,322,432 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvd3dum.dll [2012.05.15 12:48:00 | 010,194,752 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvwgf2umx.dll [2012.05.15 12:48:00 | 008,139,072 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll [2012.05.15 12:48:00 | 008,105,280 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvwgf2um.dll [2012.05.15 12:48:00 | 005,982,528 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll [2012.05.15 12:48:00 | 002,881,856 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll [2012.05.15 12:48:00 | 002,741,568 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvapi64.dll [2012.05.15 12:48:00 | 002,681,664 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll [2012.05.15 12:48:00 | 002,524,992 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll [2012.05.15 12:48:00 | 002,445,120 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvenc.dll [2012.05.15 12:48:00 | 002,368,832 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvapi.dll [2012.05.15 12:48:00 | 001,738,048 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco64.dll [2012.05.15 12:48:00 | 001,468,224 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvgenco64.dll [2012.05.15 12:48:00 | 000,949,056 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvumdshimx.dll [2012.05.15 12:48:00 | 000,818,496 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvumdshim.dll [2012.05.15 12:48:00 | 000,364,352 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdecodemft.dll [2012.05.15 12:48:00 | 000,301,376 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvdecodemft.dll [2012.05.15 12:48:00 | 000,246,592 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvinitx.dll [2012.05.15 12:48:00 | 000,202,048 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvinit.dll [2012.05.15 12:48:00 | 000,068,928 | ---- | M] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2012.05.15 12:48:00 | 000,061,248 | ---- | M] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll [2012.05.15 12:48:00 | 000,014,324 | ---- | M] () -- C:\Windows\SysNative\nvinfo.pb [2012.05.15 11:29:46 | 002,561,856 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvcr.dll [2012.05.15 11:29:46 | 000,118,080 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvmctray.dll [2012.05.15 11:29:46 | 000,063,296 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvshext.dll [2012.05.15 11:29:45 | 002,621,723 | ---- | M] () -- C:\Windows\SysNative\nvcoproc.bin [2012.05.15 11:29:25 | 003,149,632 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvc64.dll [2012.05.15 11:28:42 | 006,151,488 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcpl.dll [2012.05.15 02:21:50 | 000,423,744 | ---- | M] () -- C:\Windows\SysWow64\nvStreaming.exe ========== Files Created - No Company Name ========== [2012.06.11 17:47:40 | 000,000,000 | ---- | C] () -- C:\Users\Party\defogger_reenable [2012.06.11 17:28:45 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.06.10 14:37:30 | 000,238,528 | ---- | C] () -- C:\Users\Party\Documents\[1.2.4]ReiMinimap_v3.0_04.zip [2012.06.10 14:23:32 | 001,016,772 | ---- | C] () -- C:\Users\Party\Documents\Manian_Hold me tonight_013_Manian_Hold me tonight (Rob Ma22.mp3 [2012.06.07 20:51:48 | 000,000,447 | ---- | C] () -- C:\user.js [2012.06.07 15:46:21 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2012.06.05 22:23:09 | 000,048,854 | ---- | C] () -- C:\Users\Party\Documents\id31xnrf.bmp [2012.06.05 22:22:31 | 000,033,974 | ---- | C] () -- C:\Users\Party\Documents\s0oaonwl.bmp [2012.06.05 22:20:08 | 000,096,274 | ---- | C] () -- C:\Users\Party\Documents\blondi.jpg [2012.06.05 20:40:17 | 000,838,671 | ---- | C] () -- C:\Users\Party\Documents\2012-06-05_20.11.00.png [2012.06.05 18:30:12 | 000,640,867 | ---- | C] () -- C:\Users\Party\Documents\2012-06-05_18.30.07.png [2012.06.05 18:27:30 | 000,005,120 | ---- | C] () -- C:\Users\Party\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.06.05 18:19:00 | 000,001,168 | ---- | C] () -- C:\Users\Public\Desktop\Camtasia Studio 7.lnk [2012.06.05 16:09:58 | 000,000,093 | ---- | C] () -- C:\Users\Party\AppData\Local\fusioncache.dat [2012.06.04 20:08:46 | 001,526,730 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.06.04 19:07:44 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_lgSSBW_01_00_00.Wdf [2012.06.04 19:07:36 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_lgSSQVGA_01_00_00.Wdf [2012.06.03 22:41:37 | 000,000,917 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk [2012.06.01 18:26:16 | 000,000,560 | ---- | C] () -- C:\Users\Party\Desktop\Technobase.fm.pls [2012.06.01 18:16:14 | 000,000,979 | ---- | C] () -- C:\Users\Public\Desktop\Winamp.lnk [2012.06.01 18:01:55 | 000,002,066 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2012.06.01 17:55:09 | 000,001,824 | ---- | C] () -- C:\Users\Public\Desktop\ICQ7.7.lnk [2012.06.01 17:54:02 | 000,001,142 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.06.01 17:54:02 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.06.01 17:53:24 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2012.06.01 12:49:48 | 002,621,723 | ---- | C] () -- C:\Windows\SysNative\nvcoproc.bin [2012.06.01 12:49:10 | 000,014,324 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb [2012.06.01 12:05:26 | 000,001,279 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD VDeck.lnk [2012.06.01 12:05:26 | 000,001,202 | ---- | C] () -- C:\Users\Public\Desktop\HD VDeck.lnk [2012.06.01 11:54:36 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.06.01 05:30:48 | 3220,676,608 | -HS- | C] () -- C:\hiberfil.sys [2012.05.31 23:43:23 | 000,001,405 | ---- | C] () -- C:\Users\Party\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk [2012.05.31 23:43:17 | 000,001,439 | ---- | C] () -- C:\Users\Party\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2012.05.15 02:21:50 | 000,423,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe < End of report > OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 11.06.2012 17:49:06 - Run 1
OTL by OldTimer - Version 3.2.48.0 Folder = C:\Users\Party\Downloads
64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,50 Gb Available Physical Memory | 62,51% Memory free
8,00 Gb Paging File | 5,96 Gb Available in Paging File | 74,48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 405,66 Gb Free Space | 87,12% Space Free | Partition Type: NTFS
Drive D: | 2,10 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive E: | 5,75 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: PARTY-PC | User Name: Party | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02FDCDDA-A165-4C16-AD8F-9C9ED0BC18EC}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{0A4636AC-F57B-43E3-AB90-0A53E23765DF}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{13158D72-A4E0-44D3-A766-7CAABA2CA6EE}" = rport=139 | protocol=6 | dir=out | app=system |
"{14916811-DF60-490D-B758-01BAA6BF5BB1}" = lport=445 | protocol=6 | dir=in | app=system |
"{2B945014-5917-4B4D-B937-7038B8490F7B}" = lport=10243 | protocol=6 | dir=in | app=system |
"{359AF8F1-A6FF-4BE0-85A0-08D62859C013}" = lport=2869 | protocol=6 | dir=in | app=system |
"{60962CF2-A69F-4A90-87E7-2119DF6E75F7}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7ACC55D5-D641-4491-B858-AFB08590D9B4}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7CB119ED-F98F-43C5-BA8C-33486AF73A48}" = rport=138 | protocol=17 | dir=out | app=system |
"{7FDD5979-CDE1-4818-ACD2-1CB2003236BB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{81B452DA-3DD3-4255-BECA-E523F7EB6B0B}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{B3F96B04-4A28-484E-9408-F776A76CF674}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{CC7AF0E5-9B2A-498D-8289-1FD59878850F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D849EBA6-2475-4362-B172-5CEE707D8C6B}" = lport=137 | protocol=17 | dir=in | app=system |
"{E63B1CAE-10AE-46C3-87E8-33FF47617426}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EA8A4FDC-D8C8-4CFB-8562-5FB64DCB15C9}" = lport=139 | protocol=6 | dir=in | app=system |
"{EBE6654D-3C84-4F3F-B13E-C92EA1872629}" = rport=10243 | protocol=6 | dir=out | app=system |
"{EDDDF7B2-B31A-42F2-95C8-68E9CA2F41BF}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F42AC7DF-5AA0-4960-9055-F15C662867AC}" = rport=137 | protocol=17 | dir=out | app=system |
"{F6BDFEAC-962D-412C-876F-E36DAEDDE6CA}" = rport=445 | protocol=6 | dir=out | app=system |
"{F8DFCB23-16AC-4CDF-8CF8-87797DC52631}" = lport=138 | protocol=17 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{000DBA89-1585-49A5-9133-2850B6E4BF4F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{0534E0D5-55D4-410A-9B29-D59D1AFBA7B9}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe |
"{0AE8BEAA-1643-4F76-AFCC-07B65031AF0B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{15B7BB89-AA85-48C4-943E-E4DD1FE6AF23}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{1B540652-6B2E-4EAC-9ED3-C45D2321C0A5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{26FDD068-965B-4D1E-BE34-FF3C6AA24663}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{2D81ACD1-96F1-46BE-9692-43B6C0E92E70}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3458D516-AF7E-4B58-BA0F-33743D2C25DE}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.7\icq.exe |
"{38476CE8-2BD1-4F30-8D1B-F8BBECB36CC5}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{3CE7598A-A7B3-4C36-A47F-23BA63F97B50}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysis.exe |
"{3CECF679-6490-42B9-93D1-F6E026EB316B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{40FAC363-F6EF-45A8-B412-ECC06FA989A4}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{44CF29D5-58B3-4A5F-915A-D031F9365CF0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4FB804D7-B69B-49B5-A95D-50C3CEC15BDC}" = protocol=6 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2011\farmingsimulator2011.exe |
"{501ED45A-E999-4E4A-A133-751B1C55C9E9}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{53A3AB5A-0D24-4FFD-8485-B665DD10DF59}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis.exe |
"{5A72C6BC-DE17-4A1C-A7F2-2B9EFB7A79F1}" = protocol=6 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2011\game.exe |
"{5ACFECFB-D6F0-4E34-9F27-FF287FBA5D60}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5D84116C-D33B-45D2-9D33-E90297AA2F3F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{600B4757-1B97-430D-8A5D-822B95E0CD71}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{60353068-7A6C-4A99-BDD3-1A5ABBEC9A0B}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysisdedicatedserver.exe |
"{6546529B-D620-468C-AAE3-765A9C95C97E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
"{68AC287C-7F65-47DD-9CD5-7220AE9863B1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{707AD82C-C2DF-4A2A-8724-528547F079B7}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysisdedicatedserver.exe |
"{73266E12-E1E5-42CB-83B6-FFDD64860E53}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{744B9DB8-6C5C-47D8-BA07-7F93C166A58A}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe |
"{74A8F869-062B-483B-B1AE-24F93AC7BC20}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{79FBEE5B-3040-4449-9865-32069FAAB18E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{800FA3C0-630B-4086-82B8-BF317A5E4922}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis.exe |
"{80E21510-9969-4528-A523-00D9CBABC54B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{880AD463-D44C-4B6C-8160-0C152923F25F}" = protocol=17 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2011\farmingsimulator2011.exe |
"{9BC4C0A4-1DFC-408E-875C-301BCC06FA43}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
"{9DB550BE-2507-4F69-9916-9E3F31ECDD89}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A30C1750-66B9-452C-A53B-5F2D78338F25}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\partystylerz315\counter-strike source\hl2.exe |
"{A626D3FF-527C-4627-B699-045CE6D32CAA}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.7\icq.exe |
"{A9F5EAAF-8879-4C93-A696-7EB4CFEF2B99}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe |
"{C30F299F-AD71-464A-B078-E8F40077ECAF}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{C7CDC80D-8E11-49DB-BF1A-3143DD70A0A0}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe |
"{D1ACC2E0-A169-4A92-897E-ADD644BD50C2}" = protocol=6 | dir=out | app=system |
"{D48557C5-14EC-47A2-BD3F-3C518343682C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{D573FB62-D2F9-4470-9253-7C11A5344872}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\partystylerz315\counter-strike source\hl2.exe |
"{DCA5C2FA-F466-4B18-BBBC-F10A05C87768}" = protocol=17 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2011\game.exe |
"{E5F4B726-FE34-482E-9212-0F65E81A004C}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{E5FF34F7-3B93-4162-BCEA-E4D900577C0B}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysis.exe |
"{F500D2AD-006D-4DAD-AE64-29529D30B0C6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{FACB262C-FAC7-430C-9257-4EA3E3F4A5F5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{FCC09113-C31B-415E-AFDC-5C6A2EE8AEBC}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.7\icq.exe |
"{FFCC7616-45A1-402F-9FB1-D2769179732D}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.7\icq.exe |
"TCP Query User{0F642060-B720-40D7-859A-8E9E99745691}C:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis64.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis64.exe |
"TCP Query User{8EB49096-FFF7-4400-A4A1-1BFDDD632CE9}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"TCP Query User{EB043512-8FF3-422C-8A57-CC6D2403EC04}C:\programdata\electronic arts\need for speed world\data\nfsw.exe" = protocol=6 | dir=in | app=c:\programdata\electronic arts\need for speed world\data\nfsw.exe |
"UDP Query User{7C43D958-DAFB-46A3-B8BC-6B0B914F8777}C:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis64.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis64.exe |
"UDP Query User{B284038C-02CA-4986-9A8D-C06A0D2DF7AF}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"UDP Query User{C64D99B3-8FF5-40A1-909A-48F569B4BE7C}C:\programdata\electronic arts\need for speed world\data\nfsw.exe" = protocol=17 | dir=in | app=c:\programdata\electronic arts\need for speed world\data\nfsw.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{A1E85B9A-AFAD-4D38-AF01-6B020DD5213A}" = Logitech GamePanel Software 3.06.109
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.8.15
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.16.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{D3364347-0A05-CA85-1DAD-80A7A75BF677}" = ATI Catalyst Install Manager
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R)
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD}" = ICQ Sparberater
"{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{26A24AE4-039D-4CA4-87B4-2F83217004FF}" = Java(TM) 7 Update 4
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7
"{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A48B9CD8-C2BA-4EC9-0081-7260D238C7CF}" = Need for Speed™ Most Wanted
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DE042823-C359-4B87-B66B-308057E8B6AF}" = Camtasia Studio 7
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.9
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"FarmingSimulator2011DE_is1" = Landwirtschafts Simulator 2011
"Guard.Mail.ru" = Guard.ICQ
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Steam App 240" = Counter-Strike: Source
"Steam App 42680" = Call of Duty: Modern Warfare 3
"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer
"Winamp" = Winamp
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Erkennungs-Plug-in
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 10.06.2012 09:29:02 | Computer Name = Party-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 8.0.7600.16385 kann nicht mehr unter
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
zu suchen. Prozess-ID: dc4 Startzeit: 01cd470cd8ef615e Endzeit: 29 Anwendungspfad:
C:\Program Files (x86)\Internet Explorer\iexplore.exe Berichts-ID: 3c8dd839-b300-11e1-b41d-002522f5de3b
Error - 10.06.2012 09:29:33 | Computer Name = Party-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 8.0.7600.16385 kann nicht mehr unter
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
zu suchen. Prozess-ID: 13fc Startzeit: 01cd470d01601c71 Endzeit: 23 Anwendungspfad:
C:\Program Files (x86)\Internet Explorer\iexplore.exe Berichts-ID: 4ed567c1-b300-11e1-b41d-002522f5de3b
Error - 10.06.2012 14:31:04 | Computer Name = Party-PC | Source = System Restore | ID = 8210
Description =
Error - 10.06.2012 14:36:03 | Computer Name = Party-PC | Source = System Restore | ID = 8210
Description =
[ System Events ]
Error - 10.06.2012 13:19:11 | Computer Name = Party-PC | Source = NetBT | ID = 4321
Description = Der Name "PARTY-PC :0" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.1.100 registriert werden. Der Computer mit IP-Adresse 192.168.1.106
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 10.06.2012 13:19:28 | Computer Name = Party-PC | Source = Server | ID = 2505
Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht
\Device\NetBT_Tcpip_{71BF2F39-2800-4F81-9800-C3B2CD046034} vom Serverdienst nicht
gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error - 10.06.2012 13:19:28 | Computer Name = Party-PC | Source = NetBT | ID = 4321
Description = Der Name "PARTY-PC :20" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.1.100 registriert werden. Der Computer mit IP-Adresse 192.168.1.106
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 10.06.2012 13:31:31 | Computer Name = Party-PC | Source = NetBT | ID = 4321
Description = Der Name "PARTY-PC :0" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.1.100 registriert werden. Der Computer mit IP-Adresse 192.168.1.106
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 10.06.2012 13:31:32 | Computer Name = Party-PC | Source = Server | ID = 2505
Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht
\Device\NetBT_Tcpip_{71BF2F39-2800-4F81-9800-C3B2CD046034} vom Serverdienst nicht
gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error - 10.06.2012 13:31:31 | Computer Name = Party-PC | Source = NetBT | ID = 4321
Description = Der Name "PARTY-PC :0" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.1.100 registriert werden. Der Computer mit IP-Adresse 192.168.1.106
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 10.06.2012 13:31:31 | Computer Name = Party-PC | Source = NetBT | ID = 4321
Description = Der Name "PARTY-PC :20" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.1.100 registriert werden. Der Computer mit IP-Adresse 192.168.1.106
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 10.06.2012 14:23:27 | Computer Name = Party-PC | Source = Server | ID = 2505
Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht
\Device\NetBT_Tcpip_{71BF2F39-2800-4F81-9800-C3B2CD046034} vom Serverdienst nicht
gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error - 10.06.2012 14:23:27 | Computer Name = Party-PC | Source = NetBT | ID = 4321
Description = Der Name "PARTY-PC :0" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.1.100 registriert werden. Der Computer mit IP-Adresse 192.168.1.106
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 10.06.2012 14:23:27 | Computer Name = Party-PC | Source = NetBT | ID = 4321
Description = Der Name "PARTY-PC :20" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.1.100 registriert werden. Der Computer mit IP-Adresse 192.168.1.106
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
< End of report >
Hoffe das ihr damit was anfangen könnt  Geändert von Partystylerz (11.06.2012 um 17:19 Uhr) Grund: ... |
|
11.06.2012, 17:48
| #2 |
    | http://www.searchnu.com/406 als startseite! Trojana? Für Vista und Win7:
__________________Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen. Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen! Poste die Logfiles in Code-Tags Download AdwCleaner by Xplode zum Desktop. Start AdwCleaner und klicke Search Nach einiger zeit oeffnet ein logfile (C:\AdwCleaner[xx].txt) poste dessen Inhalt hier ins Forum. |
|
11.06.2012, 18:31
| #3 |
| | http://www.searchnu.com/406 als startseite! Trojana? Hoffe das dass richtig ist! Habe nicht genau verstanden was du willst! bin nur en Anfänger
__________________# AdwCleaner v1.609 - Logfile created 06/11/2012 at 19:29:07 # Updated 10/06/2012 by Xplode # Operating system : Windows 7 Ultimate (64 bits) # User : Party - PARTY-PC # Running from : C:\Users\Party\Downloads\adwcleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** Folder Found : C:\Users\Party\AppData\Local\Ilivid Player Folder Found : C:\Users\Party\AppData\LocalLow\Incredibar.com Folder Found : C:\Users\Party\AppData\LocalLow\searchquband Folder Found : C:\ProgramData\boost_interprocess File Found : C:\Users\Party\AppData\Local\Temp\Searchqu.ini File Found : C:\Users\Party\AppData\Local\Temp\searchqutoolbar-manifest.xml File Found : C:\Users\Party\AppData\Local\Temp\SetupDataMngr_Searchqu.exe File Found : C:\Users\Party\AppData\Roaming\Mozilla\Firefox\Profiles\7d0vfsnj.default\searchplugins\MyStart Search.xml File Found : C:\Users\Party\AppData\Roaming\Mozilla\Firefox\Profiles\7d0vfsnj.default\searchplugins\Search_Results.xml File Found : C:\Program Files (x86)\Mozilla FireFox\searchplugins\Search_Results.xml ***** [Registry] ***** Key Found : HKCU\Software\DataMngr Key Found : HKCU\Software\IM Key Found : HKCU\Software\ImInstaller Key Found : HKCU\Software\AppDataLow\Software\searchqutoolbar Key Found : HKLM\SOFTWARE\Conduit Key Found : HKLM\SOFTWARE\Web Assistant Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS Value Found : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}] [x64] Key Found : HKCU\Software\DataMngr [x64] Key Found : HKCU\Software\IM [x64] Key Found : HKCU\Software\ImInstaller [x64] Key Found : HKCU\Software\AppDataLow\Software\searchqutoolbar [x64] Key Found : HKLM\SOFTWARE\DataMngr [x64] Key Found : HKLM\SOFTWARE\Web Assistant [x64] Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd [x64] Value Found : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}] ***** [Registre - GUID] ***** Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Key Found : HKLM\SOFTWARE\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7} Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403a-B9D2-65C292C39087} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9639E4A-801B-4843-AEE3-03D9DA199E77} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9639E4A-801B-4843-AEE3-03D9DA199E77} Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{99079A25-328F-4BD4-BE04-00955ACAA0A7}] [x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} [x64] Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} [x64] Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A} [x64] Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} [x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403a-B9D2-65C292C39087} [x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} [x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7} [x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0} [x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9639E4A-801B-4843-AEE3-03D9DA199E77} [x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087} [x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} [x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7} [x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0} [x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9639E4A-801B-4843-AEE3-03D9DA199E77} ***** [Internet Browsers] ***** -\\ Internet Explorer v8.0.7600.16385 [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://mystart.incredibar.com/mb155?a=6R8viKOAgT&i=26 -\\ Mozilla Firefox v12.0 (de) Profile name : default File : C:\Users\Party\AppData\Roaming\Mozilla\Firefox\Profiles\7d0vfsnj.default\prefs.js Found : user_pref("browser.search.defaultenginename", "Search Results"); Found : user_pref("browser.search.order.1", "Search Results"); Found : user_pref("browser.search.selectedEngine", "Search Results"); Found : user_pref("browser.startup.homepage", "hxxp://www.searchnu.com/406"); Found : user_pref("extensions.incredibar.actvtyRptTime", "1339095995021"); Found : user_pref("extensions.incredibar.admin", false); Found : user_pref("extensions.incredibar.aflt", "orgnl"); Found : user_pref("extensions.incredibar.afterInstallRpt", "sent"); Found : user_pref("extensions.incredibar.cntry", "DE"); Found : user_pref("extensions.incredibar.dfltLng", ""); Found : user_pref("extensions.incredibar.dfltSrch", false); Found : user_pref("extensions.incredibar.dfltlng", "en"); Found : user_pref("extensions.incredibar.dfltsrch", "false"); Found : user_pref("extensions.incredibar.did", "10657"); Found : user_pref("extensions.incredibar.envrmnt", "production"); Found : user_pref("extensions.incredibar.excTlbr", false); Found : user_pref("extensions.incredibar.hdrMd5", "B4310DEA131EF4E25240520BAE61438B"); Found : user_pref("extensions.incredibar.hmpg", false); Found : user_pref("extensions.incredibar.hrdid", "0"); Found : user_pref("extensions.incredibar.id", "aced7c6b000000000000002522f5de3b"); Found : user_pref("extensions.incredibar.installerproductid", "26"); Found : user_pref("extensions.incredibar.instlDay", "15498"); Found : user_pref("extensions.incredibar.instlRef", ""); Found : user_pref("extensions.incredibar.instlday", "15498"); Found : user_pref("extensions.incredibar.instlref", ""); Found : user_pref("extensions.incredibar.isDcmntCmplt", true); Found : user_pref("extensions.incredibar.isdcmntcmplt", "false"); Found : user_pref("extensions.incredibar.keywordurl", ""); Found : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1420:51:48"); Found : user_pref("extensions.incredibar.mntrvrsn", "1.2.0"); Found : user_pref("extensions.incredibar.newTab", false); Found : user_pref("extensions.incredibar.newtab", "false"); Found : user_pref("extensions.incredibar.newtaburl", ""); Found : user_pref("extensions.incredibar.noFFXTlbr", false); Found : user_pref("extensions.incredibar.ppd", ""); Found : user_pref("extensions.incredibar.prdct", "incredibar"); Found : user_pref("extensions.incredibar.productid", "26"); Found : user_pref("extensions.incredibar.propectorlck", 77655995); Found : user_pref("extensions.incredibar.prtkHmpg", 1); Found : user_pref("extensions.incredibar.prtnrId", "Incredibar"); Found : user_pref("extensions.incredibar.prtnrid", "Incredibar"); Found : user_pref("extensions.incredibar.sg", "none"); Found : user_pref("extensions.incredibar.smplGrp", "none"); Found : user_pref("extensions.incredibar.smplgrp", "none"); Found : user_pref("extensions.incredibar.srch", ""); Found : user_pref("extensions.incredibar.srchprvdr", ""); Found : user_pref("extensions.incredibar.tlbrId", "base"); Found : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8viKOAgT&loc=IB_T[...] Found : user_pref("extensions.incredibar.tlbrid", "base"); Found : user_pref("extensions.incredibar.tlbrsrchurl", "hxxp://mystart.Incredibar.com/?a=6R8viKOAgT&loc=IB_T[...] Found : user_pref("extensions.incredibar.upn2", "6R8viKOAgT"); Found : user_pref("extensions.incredibar.upn2n", "92824495779891831"); Found : user_pref("extensions.incredibar.vrsn", "1.5.11.14"); Found : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1420:51:48"); Found : user_pref("extensions.incredibar.vrsni", "1.5.11.14"); Found : user_pref("extensions.incredibar.vrsnts", "1.5.11.1420:51:48"); Found : user_pref("extensions.incredibar_i.aflt", "orgnl"); Found : user_pref("extensions.incredibar_i.dfltLng", ""); Found : user_pref("extensions.incredibar_i.did", "10657"); Found : user_pref("extensions.incredibar_i.excTlbr", false); Found : user_pref("extensions.incredibar_i.id", "aced7c6b000000000000002522f5de3b"); Found : user_pref("extensions.incredibar_i.installerproductid", "26"); Found : user_pref("extensions.incredibar_i.instlDay", "15498"); Found : user_pref("extensions.incredibar_i.instlRef", ""); Found : user_pref("extensions.incredibar_i.ms_url_id", ""); Found : user_pref("extensions.incredibar_i.newTab", false); Found : user_pref("extensions.incredibar_i.ppd", ""); Found : user_pref("extensions.incredibar_i.prdct", "incredibar"); Found : user_pref("extensions.incredibar_i.productid", "26"); Found : user_pref("extensions.incredibar_i.prtnrId", "Incredibar"); Found : user_pref("extensions.incredibar_i.smplGrp", "none"); Found : user_pref("extensions.incredibar_i.tlbrId", "base"); Found : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8viKOAgT&loc=IB[...] Found : user_pref("extensions.incredibar_i.upn2", "6R8viKOAgT"); Found : user_pref("extensions.incredibar_i.upn2n", "92824495779891831"); Found : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14"); Found : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1420:51:48"); Found : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14"); Found : user_pref("keyword.URL", "hxxp://dts.search-results.com/sr?src=ffb&appid=101&systemid=406&sr=0&q="); ************************* AdwCleaner[R1].txt - [11471 octets] - [11/06/2012 19:29:07] ########## EOF - C:\AdwCleaner[R1].txt - [11600 octets] ########## |
|
11.06.2012, 19:02
| #4 |
| | http://www.searchnu.com/406 als startseite! Trojana? Schliesse alle offenstehende Fenster und starte AdwCleaner Klicke Delete Klicke bei:AdwCleaner-Information OK Klicke bei:AdwCleaner-Restart Required OK Alle ikone verschwinden vom Desktop,das ist normal. Dein Rechner wird jetzt neu gestartet und es oeffnet ein log(C:\AdwCleaner[xx].txt) poste dessen Inhalt hier ins Forum. Wenn die Startseite infiziert war,stelle sie neu ein auf Google.de oder nach deine Wahl. Notice: Dieses Tool kommt aus Frankreich daher wird die Startseite auf Google.fr zurueck gesetzt Starte AdwCleaner und klicke Uninstall und AdwCleaner wird entfernt. |
|
11.06.2012, 19:50
| #5 |
| | http://www.searchnu.com/406 als startseite! Trojana? habe ich gemacht und das kam raus! startseite ist wieder standart! großes danke schön # AdwCleaner v1.609 - Logfile created 06/11/2012 at 20:43:53 # Updated 10/06/2012 by Xplode # Operating system : Windows 7 Ultimate (64 bits) # User : Party - PARTY-PC # Running from : C:\Users\Party\Downloads\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** Deleted on reboot : C:\Users\Party\AppData\LocalLow\Incredibar.com Deleted on reboot : C:\Users\Party\AppData\LocalLow\searchquband Deleted on reboot : C:\ProgramData\boost_interprocess File Deleted : C:\Users\Party\AppData\Local\Temp\Searchqu.ini File Deleted : C:\Users\Party\AppData\Local\Temp\searchqutoolbar-manifest.xml File Deleted : C:\Users\Party\AppData\Local\Temp\SetupDataMngr_Searchqu.exe File Deleted : C:\Users\Party\AppData\Roaming\Mozilla\Firefox\Profiles\7d0vfsnj.default\searchplugins\MyStart Search.xml File Deleted : C:\Users\Party\AppData\Roaming\Mozilla\Firefox\Profiles\7d0vfsnj.default\searchplugins\Search_Results.xml File Deleted : C:\Program Files (x86)\Mozilla FireFox\searchplugins\Search_Results.xml ***** [Registry] ***** Key Deleted : HKCU\Software\DataMngr Key Deleted : HKCU\Software\IM Key Deleted : HKCU\Software\ImInstaller Key Deleted : HKCU\Software\AppDataLow\Software\searchqutoolbar Key Deleted : HKLM\SOFTWARE\Conduit Key Deleted : HKLM\SOFTWARE\Web Assistant Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}] [x64] Key Deleted : HKLM\SOFTWARE\DataMngr [x64] Key Deleted : HKLM\SOFTWARE\Web Assistant [x64] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd ***** [Registre - GUID] ***** Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403a-B9D2-65C292C39087} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9639E4A-801B-4843-AEE3-03D9DA199E77} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9639E4A-801B-4843-AEE3-03D9DA199E77} Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{99079A25-328F-4BD4-BE04-00955ACAA0A7}] [x64] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} ***** [Internet Browsers] ***** -\\ Internet Explorer v8.0.7600.16385 Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://mystart.incredibar.com/mb155?a=6R8viKOAgT&i=26 --> hxxp://www.google.com -\\ Mozilla Firefox v12.0 (de) Profile name : default File : C:\Users\Party\AppData\Roaming\Mozilla\Firefox\Profiles\7d0vfsnj.default\prefs.js C:\Users\Party\AppData\Roaming\Mozilla\Firefox\Profiles\7d0vfsnj.default\user.js ... Deleted ! Deleted : user_pref("browser.search.defaultenginename", "Search Results"); Deleted : user_pref("browser.search.order.1", "Search Results"); Deleted : user_pref("browser.search.selectedEngine", "Search Results"); Deleted : user_pref("browser.startup.homepage", "hxxp://www.searchnu.com/406"); Deleted : user_pref("extensions.incredibar.actvtyRptTime", "1339095995021"); Deleted : user_pref("extensions.incredibar.admin", false); Deleted : user_pref("extensions.incredibar.aflt", "orgnl"); Deleted : user_pref("extensions.incredibar.afterInstallRpt", "sent"); Deleted : user_pref("extensions.incredibar.cntry", "DE"); Deleted : user_pref("extensions.incredibar.dfltLng", ""); Deleted : user_pref("extensions.incredibar.dfltSrch", false); Deleted : user_pref("extensions.incredibar.dfltlng", "en"); Deleted : user_pref("extensions.incredibar.dfltsrch", "false"); Deleted : user_pref("extensions.incredibar.did", "10657"); Deleted : user_pref("extensions.incredibar.envrmnt", "production"); Deleted : user_pref("extensions.incredibar.excTlbr", false); Deleted : user_pref("extensions.incredibar.hdrMd5", "B4310DEA131EF4E25240520BAE61438B"); Deleted : user_pref("extensions.incredibar.hmpg", false); Deleted : user_pref("extensions.incredibar.hrdid", "0"); Deleted : user_pref("extensions.incredibar.id", "aced7c6b000000000000002522f5de3b"); Deleted : user_pref("extensions.incredibar.installerproductid", "26"); Deleted : user_pref("extensions.incredibar.instlDay", "15498"); Deleted : user_pref("extensions.incredibar.instlRef", ""); Deleted : user_pref("extensions.incredibar.instlday", "15498"); Deleted : user_pref("extensions.incredibar.instlref", ""); Deleted : user_pref("extensions.incredibar.isDcmntCmplt", true); Deleted : user_pref("extensions.incredibar.isdcmntcmplt", "false"); Deleted : user_pref("extensions.incredibar.keywordurl", ""); Deleted : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1420:51:48"); Deleted : user_pref("extensions.incredibar.mntrvrsn", "1.2.0"); Deleted : user_pref("extensions.incredibar.newTab", false); Deleted : user_pref("extensions.incredibar.newtab", "false"); Deleted : user_pref("extensions.incredibar.newtaburl", ""); Deleted : user_pref("extensions.incredibar.noFFXTlbr", false); Deleted : user_pref("extensions.incredibar.ppd", ""); Deleted : user_pref("extensions.incredibar.prdct", "incredibar"); Deleted : user_pref("extensions.incredibar.productid", "26"); Deleted : user_pref("extensions.incredibar.propectorlck", 77655995); Deleted : user_pref("extensions.incredibar.prtkHmpg", 1); Deleted : user_pref("extensions.incredibar.prtnrId", "Incredibar"); Deleted : user_pref("extensions.incredibar.prtnrid", "Incredibar"); Deleted : user_pref("extensions.incredibar.sg", "none"); Deleted : user_pref("extensions.incredibar.smplGrp", "none"); Deleted : user_pref("extensions.incredibar.smplgrp", "none"); Deleted : user_pref("extensions.incredibar.srch", ""); Deleted : user_pref("extensions.incredibar.srchprvdr", ""); Deleted : user_pref("extensions.incredibar.tlbrId", "base"); Deleted : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8viKOAgT&loc=IB_T[...] Deleted : user_pref("extensions.incredibar.tlbrid", "base"); Deleted : user_pref("extensions.incredibar.tlbrsrchurl", "hxxp://mystart.Incredibar.com/?a=6R8viKOAgT&loc=IB_T[...] Deleted : user_pref("extensions.incredibar.upn2", "6R8viKOAgT"); Deleted : user_pref("extensions.incredibar.upn2n", "92824495779891831"); Deleted : user_pref("extensions.incredibar.vrsn", "1.5.11.14"); Deleted : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1420:51:48"); Deleted : user_pref("extensions.incredibar.vrsni", "1.5.11.14"); Deleted : user_pref("extensions.incredibar.vrsnts", "1.5.11.1420:51:48"); Deleted : user_pref("extensions.incredibar_i.aflt", "orgnl"); Deleted : user_pref("extensions.incredibar_i.dfltLng", ""); Deleted : user_pref("extensions.incredibar_i.did", "10657"); Deleted : user_pref("extensions.incredibar_i.excTlbr", false); Deleted : user_pref("extensions.incredibar_i.id", "aced7c6b000000000000002522f5de3b"); Deleted : user_pref("extensions.incredibar_i.installerproductid", "26"); Deleted : user_pref("extensions.incredibar_i.instlDay", "15498"); Deleted : user_pref("extensions.incredibar_i.instlRef", ""); Deleted : user_pref("extensions.incredibar_i.ms_url_id", ""); Deleted : user_pref("extensions.incredibar_i.newTab", false); Deleted : user_pref("extensions.incredibar_i.ppd", ""); Deleted : user_pref("extensions.incredibar_i.prdct", "incredibar"); Deleted : user_pref("extensions.incredibar_i.productid", "26"); Deleted : user_pref("extensions.incredibar_i.prtnrId", "Incredibar"); Deleted : user_pref("extensions.incredibar_i.smplGrp", "none"); Deleted : user_pref("extensions.incredibar_i.tlbrId", "base"); Deleted : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8viKOAgT&loc=IB[...] Deleted : user_pref("extensions.incredibar_i.upn2", "6R8viKOAgT"); Deleted : user_pref("extensions.incredibar_i.upn2n", "92824495779891831"); Deleted : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14"); Deleted : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1420:51:48"); Deleted : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14"); Deleted : user_pref("keyword.URL", "hxxp://dts.search-results.com/sr?src=ffb&appid=101&systemid=406&sr=0&q="); ************************* AdwCleaner[R1].txt - [11558 octets] - [11/06/2012 19:29:07] AdwCleaner[R2].txt - [11560 octets] - [11/06/2012 20:42:06] AdwCleaner[S1].txt - [10112 octets] - [11/06/2012 20:43:53] ########## EOF - C:\AdwCleaner[S1].txt - [10241 octets] ########## |
|
11.06.2012, 19:59
| #6 |
| | http://www.searchnu.com/406 als startseite! Trojana? Man sollte auch Ilivid Player wieder entfernen ist Adware Happy Surfing again |
|
11.06.2012, 20:26
| #7 |
| | http://www.searchnu.com/406 als startseite! Trojana? jetzt hab ich so ein ähnliches Problem nur mit ner anderen Setie! hxxp://mail.ru/?ffsputnik=1 ist jetzt meine Startseite und die ändert sich immer wieder! also das gleiche wie vorhin! ich kriege noch en rappel |
|
11.06.2012, 20:33
| #8 |
| | http://www.searchnu.com/406 als startseite! Trojana? |
|
11.06.2012, 21:17
| #9 |
| | http://www.searchnu.com/406 als startseite! Trojana? pff noch mal alles? ich plätte den rechner das ist mir zu blöd |
|
| Themen zu http://www.searchnu.com/406 als startseite! Trojana? |
| adobe, antivir, autorun, avira, bho, call of duty, dateisystem, desktop, error, explorer, firefox, flash player, format, google, helper, heuristiks/extra, heuristiks/shuriken, http://www.searchnu.com/406, iexplore.exe, install.exe, installation, ip-adresse, langs, launch, logfile, mozilla, nvidia update, plug-in, problem, pup.bundleinstaller.vg, realtek, registry, rundll, searchqu toolbar, searchscopes, security, software, svchost.exe, udp, vdeck.exe, wieder weg |
Linear-Darstellung
