| |
| |||||||
Log-Analyse und Auswertung: AKM Trojaner hat mich erwischt, wie vorgehen?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
11.06.2012, 22:15
| #1 |
| |  AKM Trojaner hat mich erwischt, wie vorgehen? Hallo, ich habe mir heute nen Virus eingefangen, der Vorgibt AKM habe meinen PC gesperrt. Ich solle 50€ via PaySafeCard einzahlen um ihn wieder zu entsperren. Ich habe mich schon ein wenig umgeschaut und mit OTL einen Scan gemacht, auf dem gleichen PC wo dieser Trojaner ist aber nicht auf der gleichen Partition, da die eine nicht funktioniert musste ich den Scan auf der anderen partition machen. Hoffe es nutzt euch was. Vielen dank schon mal für die hilfe!! OTL Logfile: Code:
ATTFilter OTL logfile created on: 11.06.2012 23:03:50 - Run 1 OTL by OldTimer - Version 3.2.48.0 Folder = C:\Users\carlos\Desktop Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation Internet Explorer (Version = 7.0.6000.16982) Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 0,95 Gb Available Physical Memory | 47,47% Memory free 4,20 Gb Paging File | 3,14 Gb Available in Paging File | 74,67% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 698,63 Gb Total Space | 597,90 Gb Free Space | 85,58% Space Free | Partition Type: NTFS Drive D: | 698,63 Gb Total Space | 400,05 Gb Free Space | 57,26% Space Free | Partition Type: NTFS Drive E: | 520,68 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: CARLOS-PC | User Name: carlos | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.06.11 23:02:56 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\carlos\Desktop\OTL.exe PRC - [2012.05.13 18:14:03 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2012.02.16 15:21:06 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2011.06.15 15:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe PRC - [2011.05.19 09:51:52 | 002,629,632 | R--- | M] (Brother Industries, Ltd.) -- C:\Program Files\Browny02\Brother\BrStMonW.exe PRC - [2011.04.27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe PRC - [2011.04.20 17:58:02 | 001,204,224 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\ControlCenter4\BrCcUxSys.exe PRC - [2011.04.20 17:53:10 | 000,335,872 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\ControlCenter4\BrCtrlCntr.exe PRC - [2011.01.24 02:40:57 | 000,139,944 | ---- | M] () -- C:\Program Files\Dell V715w\ezprint.exe PRC - [2011.01.24 02:40:55 | 000,770,728 | ---- | M] () -- C:\Program Files\Dell V715w\dleemon.exe PRC - [2010.05.21 22:02:55 | 000,598,696 | ---- | M] ( ) -- C:\Windows\System32\dleecoms.exe PRC - [2010.03.09 00:42:02 | 000,029,984 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\Nuance\PaperPort\pptd40nt.exe PRC - [2010.03.09 00:40:36 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe PRC - [2010.01.25 08:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Browny02\BrYNSvc.exe PRC - [2009.09.18 16:17:56 | 000,360,448 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe PRC - [2009.09.18 16:17:28 | 000,172,032 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe PRC - [2009.09.04 17:33:56 | 000,417,792 | ---- | M] () -- C:\Program Files\ASUS\GamerOSD\ATKFastUserSwitching.exe PRC - [2009.07.30 19:10:04 | 000,380,928 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files\ASUS\GamerOSD\GamerOSD.exe PRC - [2009.05.06 11:41:48 | 000,060,928 | ---- | M] (ASUSTeK COMPUTER INC.) -- C:\Windows\System32\ATKFUSService.exe PRC - [2009.05.05 16:06:06 | 000,222,496 | ---- | M] (Acresso Corporation) -- C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe PRC - [2007.04.23 15:51:42 | 004,435,968 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe ========== Modules (No Company Name) ========== MOD - [2012.05.13 18:14:02 | 001,911,768 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll MOD - [2012.02.17 20:55:35 | 000,166,912 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll MOD - [2012.02.16 16:29:04 | 011,796,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\03858406f9a9514402888707e8b93abe\System.Web.ni.dll MOD - [2012.02.16 16:28:56 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\23281812ddf7a1fab881b5322e577ac4\System.Runtime.Remoting.ni.dll MOD - [2012.02.16 16:28:50 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e6001d416f7c468334934a2c6a41c631\System.Configuration.ni.dll MOD - [2012.02.16 16:27:30 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\7208ffa39630e9b923331f9df0947a12\System.Xml.ni.dll MOD - [2012.02.16 16:27:13 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1941d7639299344ae28fb6b23da65247\System.Windows.Forms.ni.dll MOD - [2012.02.16 16:27:04 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6312464f64727a2a50d5ce3fd73ad1bb\System.Drawing.ni.dll MOD - [2012.02.16 16:25:58 | 007,868,416 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\52e1ea3c7491e05cda766d7b3ce3d559\System.ni.dll MOD - [2012.02.16 16:25:35 | 011,486,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\17f572b09facdc5fda9431558eb7a26e\mscorlib.ni.dll MOD - [2012.02.16 04:47:44 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll MOD - [2012.02.15 07:23:54 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2012.02.15 06:11:00 | 000,364,544 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3548.36811__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll MOD - [2012.02.15 06:11:00 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3548.36825__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll MOD - [2012.02.15 06:10:58 | 001,695,744 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Wizard\2.0.3548.36931__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Wizard.dll MOD - [2012.02.15 06:10:58 | 000,204,800 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3548.36831__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll MOD - [2012.02.15 06:10:58 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3548.36820__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll MOD - [2012.02.15 06:10:55 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3548.36882__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll MOD - [2012.02.15 06:10:54 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3548.36863__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll MOD - [2012.02.15 06:10:54 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3548.36854__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll MOD - [2012.02.15 06:10:52 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3548.36901__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll MOD - [2012.02.15 06:10:51 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3548.36820__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll MOD - [2012.02.15 06:10:50 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3548.36902__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll MOD - [2012.02.15 06:10:47 | 000,356,352 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3548.36868__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll MOD - [2012.02.15 06:10:47 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3548.36869__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll MOD - [2012.02.15 06:10:46 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3548.36868__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll MOD - [2012.02.15 06:10:43 | 000,643,072 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Dashboard\2.0.3548.36912__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll MOD - [2012.02.15 06:10:42 | 000,823,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3548.36856__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll MOD - [2012.02.15 06:10:42 | 000,409,600 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3548.36877__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll MOD - [2012.02.15 06:10:42 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.3548.36912__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.dll MOD - [2012.02.15 06:10:41 | 000,196,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3548.36831__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll MOD - [2012.02.15 06:10:41 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3548.36855__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll MOD - [2012.02.15 06:10:40 | 001,122,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Dashboard\2.0.3548.36928__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Dashboard.dll MOD - [2012.02.15 06:10:40 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3548.36861__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll MOD - [2012.02.15 06:10:40 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3548.36861__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll MOD - [2012.02.15 06:10:39 | 000,573,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3548.36832__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll MOD - [2012.02.15 06:10:39 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3548.36836__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll MOD - [2012.02.15 06:10:37 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3548.36862__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll MOD - [2012.02.15 06:10:36 | 000,360,448 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3548.36850__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll MOD - [2012.02.15 06:10:36 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3548.36854__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll MOD - [2012.02.15 06:10:35 | 000,393,216 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3548.36855__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll MOD - [2012.02.15 06:10:35 | 000,270,336 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll MOD - [2012.02.15 06:10:35 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3548.36855__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll MOD - [2012.02.15 06:10:33 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3531.24440__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll MOD - [2012.02.15 06:10:33 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3531.24439__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll MOD - [2012.02.15 06:10:33 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3531.24478__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll MOD - [2012.02.15 06:10:33 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3531.24559__90ba9c70f846762e\AEM.Plugin.REG.Shared.dll MOD - [2012.02.15 06:10:33 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3531.24552__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll MOD - [2012.02.15 06:10:33 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3531.24471__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll MOD - [2012.02.15 06:10:33 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3531.24549__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll MOD - [2012.02.15 06:10:33 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll MOD - [2012.02.15 06:10:32 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3531.24410__90ba9c70f846762e\LOG.Foundation.dll MOD - [2012.02.15 06:10:32 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3531.24412__90ba9c70f846762e\NEWAEM.Foundation.dll MOD - [2012.02.15 06:10:32 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3531.24466__90ba9c70f846762e\MOM.Foundation.dll MOD - [2012.02.15 06:10:31 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll MOD - [2012.02.15 06:10:31 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.dll MOD - [2012.02.15 06:10:31 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll MOD - [2012.02.15 06:10:31 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3531.24494__90ba9c70f846762e\DEM.Graphics.dll MOD - [2012.02.15 06:10:31 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll MOD - [2012.02.15 06:10:30 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3531.24636__90ba9c70f846762e\CLI.Foundation.XManifest.dll MOD - [2012.02.15 06:10:29 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3531.24414__90ba9c70f846762e\CLI.Foundation.dll MOD - [2012.02.15 06:10:29 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3531.24442__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll MOD - [2012.02.15 06:10:29 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3531.24449__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll MOD - [2012.02.15 06:10:29 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3531.24455__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll MOD - [2012.02.15 06:10:28 | 000,139,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3531.24451__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll MOD - [2012.02.15 06:10:28 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3531.24426__90ba9c70f846762e\CLI.Component.Client.Shared.dll MOD - [2012.02.15 06:10:28 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3531.24498__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll MOD - [2012.02.15 06:10:26 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3531.24510__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll MOD - [2012.02.15 06:10:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3531.24538__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll MOD - [2012.02.15 06:10:26 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3531.24460__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll MOD - [2012.02.15 06:10:25 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3531.24511__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll MOD - [2012.02.15 06:10:25 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.3531.24556__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.dll MOD - [2012.02.15 06:10:25 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3531.24504__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll MOD - [2012.02.15 06:10:25 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3531.24503__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll MOD - [2012.02.15 06:10:25 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3531.24502__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll MOD - [2012.02.15 06:10:25 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3531.24509__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll MOD - [2012.02.15 06:10:25 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3531.24476__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll MOD - [2012.02.15 06:10:25 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3531.24499__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll MOD - [2012.02.15 06:10:25 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3531.24495__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll MOD - [2012.02.15 06:10:25 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3531.24467__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll MOD - [2012.02.15 06:10:25 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3531.24506__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll MOD - [2012.02.15 06:10:25 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3531.24472__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll MOD - [2012.02.15 06:10:24 | 000,651,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Implementation\2.0.3548.36926__90ba9c70f846762e\ResourceManagement.Foundation.Implementation.dll MOD - [2012.02.15 06:10:24 | 000,106,496 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3548.36896__90ba9c70f846762e\MOM.Implementation.dll MOD - [2012.02.15 06:10:24 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3548.36907__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll MOD - [2012.02.15 06:10:24 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3531.24435__90ba9c70f846762e\ResourceManagement.Foundation.Private.dll MOD - [2012.02.15 06:10:24 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.3531.24469__90ba9c70f846762e\APM.Foundation.dll MOD - [2012.02.15 06:10:24 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3531.24441__90ba9c70f846762e\AEM.Server.Shared.dll MOD - [2012.02.15 06:10:24 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3548.36809__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll MOD - [2012.02.15 06:10:23 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3548.36894__90ba9c70f846762e\LOG.Foundation.Implementation.dll MOD - [2012.02.15 06:10:23 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3531.24420__90ba9c70f846762e\CLI.Foundation.Private.dll MOD - [2012.02.15 06:10:23 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3531.24429__90ba9c70f846762e\LOG.Foundation.Private.dll MOD - [2012.02.15 06:10:23 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3531.24459__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll MOD - [2012.02.15 06:10:22 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3531.24462__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll MOD - [2012.02.15 06:10:21 | 000,561,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3548.36890__90ba9c70f846762e\CLI.Component.Systemtray.dll MOD - [2012.02.15 06:10:21 | 000,405,504 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3548.36825__90ba9c70f846762e\CLI.Component.Wizard.dll MOD - [2012.02.15 06:10:21 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3548.36810__90ba9c70f846762e\CLI.Component.SkinFactory.dll MOD - [2012.02.15 06:10:21 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3531.24457__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll MOD - [2012.02.15 06:10:19 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3548.36809__90ba9c70f846762e\CLI.Component.Runtime.dll MOD - [2012.02.15 06:10:19 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3531.24463__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll MOD - [2012.02.15 06:10:18 | 001,220,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3548.36816__90ba9c70f846762e\CLI.Component.Dashboard.dll MOD - [2012.02.15 06:10:18 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3531.24445__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll MOD - [2012.02.15 06:10:18 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll MOD - [2012.02.15 06:10:18 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3531.24513__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll MOD - [2012.02.15 06:10:18 | 000,019,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3548.36896__90ba9c70f846762e\CCC.Implementation.dll MOD - [2012.02.15 06:10:17 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3548.36807__90ba9c70f846762e\APM.Server.dll MOD - [2012.02.15 06:10:17 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3548.36808__90ba9c70f846762e\AEM.Server.dll MOD - [2011.11.02 00:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.11.02 00:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011.01.24 02:40:57 | 000,139,944 | ---- | M] () -- C:\Program Files\Dell V715w\ezprint.exe MOD - [2011.01.24 02:40:55 | 000,770,728 | ---- | M] () -- C:\Program Files\Dell V715w\dleemon.exe MOD - [2010.04.01 19:24:28 | 001,159,168 | ---- | M] () -- C:\Program Files\Dell V715w\dleeDRS.dll MOD - [2010.04.01 19:23:27 | 000,389,120 | ---- | M] () -- C:\Program Files\Dell V715w\dleescw.dll MOD - [2009.11.26 10:50:24 | 000,086,183 | ---- | M] () -- C:\Program Files\Dell V715w\dleecfg.dll MOD - [2009.09.04 17:33:56 | 000,417,792 | ---- | M] () -- C:\Program Files\ASUS\GamerOSD\ATKFastUserSwitching.exe MOD - [2009.06.23 13:13:33 | 000,221,184 | ---- | M] () -- C:\Program Files\Dell V715w\EPOEMDll.dll MOD - [2009.06.23 13:13:02 | 000,045,056 | ---- | M] () -- C:\Program Files\Dell V715w\epstring.dll MOD - [2009.06.23 13:11:53 | 002,203,648 | ---- | M] () -- C:\Program Files\Dell V715w\EPWizRes.dll MOD - [2009.05.27 14:16:50 | 000,192,512 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\dleedatr.dll MOD - [2009.04.29 21:46:20 | 001,077,248 | ---- | M] () -- C:\Program Files\ASUS\GamerOSD\ImageTransform.dll MOD - [2009.04.28 09:57:02 | 000,032,768 | ---- | M] () -- C:\Windows\System32\DLEEsmr.dll MOD - [2009.04.07 21:25:27 | 000,409,600 | ---- | M] () -- C:\Program Files\Dell V715w\iptk.dll MOD - [2009.03.30 14:40:26 | 000,708,608 | ---- | M] () -- C:\Program Files\Dell V715w\Epwizard.DLL MOD - [2009.03.30 14:38:36 | 000,159,744 | ---- | M] () -- C:\Program Files\Dell V715w\customui.dll MOD - [2009.03.30 14:38:16 | 000,061,440 | ---- | M] () -- C:\Program Files\Dell V715w\Epfunct.DLL MOD - [2009.03.30 14:38:11 | 000,114,688 | ---- | M] () -- C:\Program Files\Dell V715w\Eputil.DLL MOD - [2009.03.30 14:37:58 | 000,139,264 | ---- | M] () -- C:\Program Files\Dell V715w\Imagutil.DLL MOD - [2009.03.10 07:43:49 | 000,155,648 | ---- | M] () -- C:\Program Files\Dell V715w\dleecaps.dll MOD - [2009.03.05 19:55:33 | 000,059,904 | ---- | M] () -- C:\Program Files\Dell V715w\dleecnv4.dll MOD - [2009.03.02 16:25:47 | 000,151,552 | ---- | M] () -- C:\Program Files\Dell V715w\dleeptp.dll MOD - [2009.02.27 16:38:20 | 000,139,264 | R--- | M] () -- C:\Program Files\Brother\BrUtilities\BrLogAPI.dll MOD - [2009.02.17 19:22:10 | 000,184,320 | ---- | M] () -- C:\Program Files\ASUS\GamerOSD\AudioOnVistaDLL.dll MOD - [2009.02.12 13:33:15 | 000,299,008 | ---- | M] () -- C:\Windows\System32\DLEEsm.dll MOD - [2008.12.10 12:19:08 | 000,430,080 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll ========== Win32 Services (SafeList) ========== SRV - [2012.02.16 15:38:51 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV - [2011.04.27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc) SRV - [2010.05.21 22:02:55 | 000,598,696 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\dleecoms.exe -- (dlee_device) SRV - [2010.05.21 22:02:50 | 000,193,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\spool\DRIVERS\W32X86\3\\dleeserv.exe -- (dleeCATSCustConnectService) SRV - [2010.03.09 00:40:36 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) [Auto | Running] -- C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe -- (PDFProFiltSrvPP) SRV - [2010.01.25 08:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) [On_Demand | Running] -- C:\Program Files\Browny02\BrYNSvc.exe -- (BrYNSvc) SRV - [2009.09.18 16:17:28 | 000,172,032 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2009.05.06 11:41:48 | 000,060,928 | ---- | M] (ASUSTeK COMPUTER INC.) [Auto | Running] -- C:\Windows\System32\ATKFUSService.exe -- (ATKFUSService) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) DRV - [2011.04.18 13:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon) DRV - [2009.09.18 18:31:54 | 005,157,376 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2009.08.23 04:00:52 | 000,101,904 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV - [2009.02.17 19:22:14 | 000,030,976 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKDispLowFilter.sys -- (atkdisplf) DRV - [2009.02.17 19:22:14 | 000,015,232 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\asusgsb.sys -- (asusgsb) DRV - [2007.04.03 11:43:28 | 001,131,136 | ---- | M] (Philips Semiconductors GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Ph3xIB32.sys -- (Ph3xIB32) DRV - [2007.02.01 12:44:18 | 000,223,616 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R) DRV - [2007.01.29 18:12:52 | 000,018,432 | ---- | M] (ASUSTeK COMPUTER INC.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AsusVRC.sys -- (ASUSVRC) DRV - [2007.01.25 13:16:46 | 000,218,112 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\sis163u.sys -- (SIS163u) DRV - [2006.08.25 02:10:00 | 000,197,632 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\V0060Vid.sys -- (V0060VID) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?FORM=IEFM1&q={searchTerms}&src={referrer:source?} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.05.13 18:14:04 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.16 16:41:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\carlos\AppData\Roaming\mozilla\Extensions [2012.06.01 16:50:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\carlos\AppData\Roaming\mozilla\Firefox\Profiles\qa0frpfg.default\extensions [2012.02.16 17:22:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions [2012.05.13 18:14:03 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.02.08 19:36:16 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.02.08 19:21:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.02.08 19:36:16 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.02.08 19:36:16 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.02.08 19:36:16 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.02.08 19:36:16 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Dell Symbolleiste) - {09B71986-2AC5-482d-B6CB-42EA34F4F85B} - C:\Program Files\Dell Toolbar\toolband.dll () O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (Dell Symbolleiste) - {09B71986-2AC5-482d-B6CB-42EA34F4F85B} - C:\Program Files\Dell Toolbar\toolband.dll () O3 - HKCU\..\Toolbar\ShellBrowser: (Dell Symbolleiste) - {09B71986-2AC5-482D-B6CB-42EA34F4F85B} - C:\Program Files\Dell Toolbar\toolband.dll () O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [ControlCenter4] C:\Program Files\ControlCenter4\BrCcBoot.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [Dell V715w Fax Server] C:\Program Files\Dell V715w\fm3032.exe () O4 - HKLM..\Run: [dleemon.exe] C:\Program Files\Dell V715w\dleemon.exe () O4 - HKLM..\Run: [EzPrint] C:\Program Files\Dell V715w\ezprint.exe () O4 - HKLM..\Run: [IndexSearch] C:\Program Files\Nuance\PaperPort\IndexSearch.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\Nuance\PaperPort\pptd40nt.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [PPort12reminder] C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe (ASUSTeK Inc.) O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation) O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0) O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2AFBCF18-BA85-46F1-9251-F0C0DB38E749}: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2009.10.20 07:14:28 | 000,000,043 | R--- | M] () - E:\autorun.inf -- [ CDFS ] O33 - MountPoints2\{d13becc4-5712-11e1-8fa8-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{d13becc4-5712-11e1-8fa8-806e6f6e6963}\Shell\AutoRun\command - "" = E:\start.exe -- [2010.11.05 09:10:02 | 001,914,303 | R--- | M] (Macromedia, Inc.) O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.06.11 23:02:50 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\carlos\Desktop\OTL.exe [2012.06.11 22:54:31 | 000,000,000 | ---D | C] -- C:\28e44ff0bd347dd086 [2012.06.01 16:49:16 | 000,000,000 | ---D | C] -- C:\Users\carlos\AppData\Roaming\ControlCenter4 [2012.06.01 16:48:54 | 000,000,000 | ---D | C] -- C:\Users\carlos\AppData\Roaming\FLEXnet [2012.06.01 16:43:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother [2012.06.01 16:37:58 | 000,000,000 | ---D | C] -- C:\Brother [2012.06.01 16:37:58 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\BrFaxRx [2012.06.01 16:37:56 | 000,073,728 | ---- | C] (Brother Industories Ltd. P&S Company) -- C:\Windows\System32\BRCrypt.dll [2012.06.01 16:37:49 | 000,000,000 | ---D | C] -- C:\Program Files\Browny02 [2012.06.01 16:37:48 | 000,000,000 | ---D | C] -- C:\ProgramData\ControlCenter4 [2012.06.01 16:37:40 | 000,000,000 | ---D | C] -- C:\Program Files\ControlCenter4 [2012.06.01 16:37:35 | 000,118,784 | ---- | C] (Brother Industries,LTD.) -- C:\Windows\System32\BrMfNt.dll [2012.06.01 16:37:34 | 000,225,280 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\System32\BrfxD05c.dll [2012.06.01 16:37:32 | 000,180,224 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\System32\BrMuSNMP.dll [2012.06.01 16:37:32 | 000,074,752 | R--- | C] (Brother Industries,Ltd.) -- C:\Windows\System32\BrWiaNCp.dll [2012.06.01 16:37:32 | 000,074,752 | R--- | C] (Brother Industries, Ltd.) -- C:\Windows\System32\BrNetSti.dll [2012.06.01 16:37:32 | 000,051,200 | R--- | C] (Brother Industries,Ltd) -- C:\Windows\System32\Brnsplg.dll [2012.06.01 16:37:26 | 001,476,608 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\System32\BrWi211a.dll [2012.06.01 16:37:26 | 000,217,088 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\System32\BrJDec.dll [2012.06.01 16:37:11 | 000,103,792 | ---- | C] (Brother Industries Ltd) -- C:\Windows\System32\BRRBI100.EXE [2012.06.01 16:37:11 | 000,050,176 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\BRPRTINK.DLL [2012.06.01 16:37:09 | 000,180,224 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\System32\BROSNMP.DLL [2012.06.01 16:37:09 | 000,077,824 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\System32\BRLMW03A.DLL [2012.06.01 16:37:09 | 000,025,299 | ---- | C] (Brother Industries, Ltd) -- C:\Windows\System32\BRLM03A.DLL [2012.06.01 16:37:03 | 000,241,664 | ---- | C] (brother) -- C:\Windows\System32\NSSearch.dll [2012.06.01 16:37:03 | 000,073,728 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\BrDctF2.dll [2012.06.01 16:37:03 | 000,005,632 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\BrDctF2L.dll [2012.06.01 16:37:03 | 000,003,072 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\BrDctF2S.dll [2012.06.01 16:37:03 | 000,000,000 | ---D | C] -- C:\Program Files\Brother [2012.06.01 16:35:12 | 000,000,000 | ---D | C] -- C:\Users\carlos\AppData\Roaming\InstallShield [2012.06.01 16:30:25 | 000,000,000 | ---D | C] -- C:\Users\carlos\AppData\Roaming\Nuance [2012.06.01 16:29:56 | 000,000,000 | ---D | C] -- C:\ProgramData\ScanSoft [2012.06.01 16:29:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nuance PaperPort 12 [2012.06.01 16:29:10 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ScanSoft Shared [2012.06.01 16:29:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Nuance [2012.06.01 16:29:10 | 000,000,000 | ---D | C] -- C:\Program Files\Nuance [2012.06.01 16:29:10 | 000,000,000 | ---D | C] -- C:\Users\carlos\Documents\MeineWebSeiten [2012.06.01 16:29:10 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet [2012.06.01 16:27:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Brother [2012.05.13 17:53:01 | 000,000,000 | ---D | C] -- C:\Users\carlos\AppData\Roaming\WinRAR [2012.05.13 17:53:01 | 000,000,000 | ---D | C] -- C:\Users\carlos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR [2012.05.13 17:53:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR [2012.05.13 17:52:57 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR [2012.05.13 17:47:52 | 000,000,000 | ---D | C] -- C:\Users\carlos\AppData\Roaming\abgx360 [2012.05.13 16:17:13 | 000,000,000 | ---D | C] -- C:\Users\carlos\Desktop\xbox360 [2012.05.13 16:15:59 | 000,000,000 | ---D | C] -- C:\Users\carlos\Desktop\LeagueOfLegends [2012.05.13 16:15:50 | 000,000,000 | ---D | C] -- C:\Users\carlos\Desktop\BEWERBUNGEN ANDRES WICHTIG ! [2012.05.13 16:15:04 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent [2012.05.13 16:14:12 | 000,000,000 | ---D | C] -- C:\Users\carlos\AppData\Roaming\uTorrent [2012.05.13 16:14:12 | 000,000,000 | ---D | C] -- C:\Users\carlos\AppData\Local\uTorrent [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.06.11 23:02:56 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\carlos\Desktop\OTL.exe [2012.06.11 22:58:01 | 000,641,106 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.06.11 22:58:01 | 000,609,944 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.06.11 22:58:01 | 000,116,500 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.06.11 22:58:01 | 000,103,726 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.06.11 22:57:41 | 000,002,113 | ---- | M] () -- C:\Windows\epplauncher.mif [2012.06.11 22:55:09 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{71992B96-63C2-47F3-850D-5DD54FCBE917}.job [2012.06.11 22:50:52 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.06.11 22:50:51 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.06.11 22:50:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.06.01 16:48:07 | 000,280,920 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.06.01 16:43:33 | 000,001,933 | ---- | M] () -- C:\Users\Public\Desktop\Brother Creative Center.lnk [2012.06.01 16:43:09 | 000,000,248 | ---- | M] () -- C:\Windows\Brpfx04a.ini [2012.06.01 16:43:09 | 000,000,093 | ---- | M] () -- C:\Windows\brpcfx.ini [2012.06.01 16:41:31 | 000,002,944 | ---- | M] () -- C:\Windows\BRPARAM.INI [2012.06.01 16:37:58 | 000,000,066 | ---- | M] () -- C:\Windows\Brfaxrx.ini [2012.05.28 15:03:56 | 000,000,764 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk [2012.05.13 17:44:26 | 000,000,504 | ---- | M] () -- C:\Users\carlos\Desktop\ANdyCarlosAlkan - Verknüpfung.lnk [2012.05.13 17:35:40 | 169,181,186 | ---- | M] () -- C:\Windows\MEMORY.DMP [2012.05.13 16:20:28 | 000,001,356 | ---- | M] () -- C:\Users\carlos\AppData\Local\d3d9caps.dat [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.06.11 22:57:05 | 000,001,820 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk [2012.06.01 16:43:33 | 000,001,933 | ---- | C] () -- C:\Users\Public\Desktop\Brother Creative Center.lnk [2012.06.01 16:43:09 | 000,000,248 | ---- | C] () -- C:\Windows\Brpfx04a.ini [2012.06.01 16:43:09 | 000,000,093 | ---- | C] () -- C:\Windows\brpcfx.ini [2012.06.01 16:41:17 | 000,002,944 | ---- | C] () -- C:\Windows\BRPARAM.INI [2012.06.01 16:37:35 | 000,000,066 | ---- | C] () -- C:\Windows\Brfaxrx.ini [2012.06.01 16:37:34 | 000,000,000 | ---- | C] () -- C:\Windows\brdfxspd.dat [2012.06.01 16:37:14 | 000,045,056 | ---- | C] () -- C:\Windows\System32\BRTCPCON.DLL [2012.06.01 16:37:09 | 000,000,114 | ---- | C] () -- C:\Windows\System32\BRLMW03A.INI [2012.05.28 15:03:56 | 000,000,764 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk [2012.05.13 17:44:26 | 000,000,504 | ---- | C] () -- C:\Users\carlos\Desktop\ANdyCarlosAlkan - Verknüpfung.lnk [2012.05.13 17:35:32 | 169,181,186 | ---- | C] () -- C:\Windows\MEMORY.DMP [2012.05.13 16:16:17 | 007,838,808 | ---- | C] () -- C:\Users\carlos\Desktop\01 Turn to You (Mother's Day Dedication).m4a [2012.03.16 04:57:14 | 000,040,960 | ---- | C] () -- C:\Windows\System32\dleevs.dll [2012.03.16 04:57:07 | 000,442,368 | ---- | C] ( ) -- C:\Windows\System32\dleecoin.dll [2012.03.16 04:56:49 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dleegcfg.dll [2012.03.16 04:56:44 | 000,294,912 | ---- | C] () -- C:\Windows\System32\dleecui.dll [2012.03.16 04:56:44 | 000,110,592 | ---- | C] () -- C:\Windows\System32\dleecuir.dll [2012.03.16 04:54:41 | 000,049,152 | ---- | C] () -- C:\Windows\System32\DLEEPMON.DLL [2012.03.16 04:54:41 | 000,032,768 | ---- | C] () -- C:\Windows\System32\DLEEFXPU.DLL [2012.03.16 04:54:20 | 005,709,824 | ---- | C] () -- C:\Windows\System32\DLEEoem.dll [2012.03.16 04:53:59 | 000,372,736 | ---- | C] () -- C:\Windows\System32\DLEEwupd.dll [2012.03.16 04:53:59 | 000,213,672 | ---- | C] () -- C:\Windows\System32\DLEEwupd.exe [2012.03.16 04:51:04 | 000,356,352 | ---- | C] ( ) -- C:\Windows\System32\DLEEhcp.dll [2012.03.16 04:51:04 | 000,331,776 | ---- | C] () -- C:\Windows\System32\DLEEinst.dll [2012.03.16 04:51:03 | 000,364,544 | ---- | C] ( ) -- C:\Windows\System32\dleeinpa.dll [2012.03.16 04:51:02 | 000,344,064 | ---- | C] ( ) -- C:\Windows\System32\dleeiesc.dll [2012.03.16 04:51:01 | 000,847,872 | ---- | C] ( ) -- C:\Windows\System32\dleeusb1.dll [2012.03.16 04:51:00 | 001,048,576 | ---- | C] ( ) -- C:\Windows\System32\dleeserv.dll [2012.03.16 04:50:58 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\dleepmui.dll [2012.03.16 04:50:57 | 000,577,536 | ---- | C] ( ) -- C:\Windows\System32\dleelmpm.dll [2012.03.16 04:50:56 | 000,323,584 | ---- | C] () -- C:\Windows\System32\dleeins.dll [2012.03.16 04:50:56 | 000,262,144 | ---- | C] () -- C:\Windows\System32\dleeinsb.dll [2012.03.16 04:50:56 | 000,114,688 | ---- | C] () -- C:\Windows\System32\dleeinsr.dll [2012.03.16 04:50:56 | 000,057,344 | ---- | C] () -- C:\Windows\System32\dleejswr.dll [2012.03.16 04:50:55 | 000,688,128 | ---- | C] ( ) -- C:\Windows\System32\dleehbn3.dll [2012.03.16 04:50:55 | 000,324,264 | ---- | C] ( ) -- C:\Windows\System32\dleeih.exe [2012.03.16 04:50:54 | 000,208,896 | ---- | C] () -- C:\Windows\System32\dleegrd.dll [2012.03.16 04:50:54 | 000,090,112 | ---- | C] () -- C:\Windows\System32\dleecub.dll [2012.03.16 04:50:54 | 000,036,864 | ---- | C] () -- C:\Windows\System32\dleecur.dll [2012.03.16 04:50:53 | 000,598,696 | ---- | C] ( ) -- C:\Windows\System32\dleecoms.exe [2012.03.16 04:50:53 | 000,253,952 | ---- | C] () -- C:\Windows\System32\dleecu.dll [2012.03.16 04:50:52 | 000,372,736 | ---- | C] ( ) -- C:\Windows\System32\dleecomm.dll [2012.03.16 04:50:51 | 000,802,816 | ---- | C] ( ) -- C:\Windows\System32\dleecomc.dll [2012.03.16 04:50:50 | 000,373,416 | ---- | C] ( ) -- C:\Windows\System32\dleecfg.exe [2012.03.16 04:50:50 | 000,086,183 | ---- | C] () -- C:\Windows\System32\DLEEcfg.dll [2012.03.16 04:49:54 | 000,299,008 | ---- | C] () -- C:\Windows\System32\DLEEsm.dll [2012.03.16 04:49:54 | 000,032,768 | ---- | C] () -- C:\Windows\System32\DLEEsmr.dll [2012.02.15 06:38:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asrussian.dll [2012.02.15 06:38:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\askorean.dll [2012.02.15 06:38:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asjapan.dll [2012.02.15 06:38:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asgerman.dll [2012.02.15 06:38:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asfrench.dll [2012.02.15 06:38:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\aseng.dll [2012.02.15 06:38:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\ASCHT.dll [2012.02.15 06:38:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\aschs.dll [2012.02.15 06:38:57 | 000,761,856 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2012.02.15 06:38:57 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2012.02.15 06:16:33 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.02.15 00:47:51 | 000,641,106 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2012.02.15 00:47:51 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2012.02.15 00:47:51 | 000,116,500 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2012.02.15 00:47:51 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2012.02.14 16:10:21 | 000,001,356 | ---- | C] () -- C:\Users\carlos\AppData\Local\d3d9caps.dat < End of report > ok habe es geschafft die angegriffene partition im abgesicherten modus (mit netzwerkfunktionen) hoch zu fahren das ist der OTL Logfile von der partition wo der Trojaner ist. OTL Logfile: Code:
ATTFilter OTL logfile created on: 12.06.2012 00:19:56 - Run 1 OTL by OldTimer - Version 3.2.48.0 Folder = C:\Users\ANdyCarlosAlkan\Desktop\computer.retten Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,53 Gb Available Physical Memory | 76,69% Memory free 4,23 Gb Paging File | 3,91 Gb Available in Paging File | 92,41% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 698,63 Gb Total Space | 400,06 Gb Free Space | 57,26% Space Free | Partition Type: NTFS Drive D: | 698,63 Gb Total Space | 595,95 Gb Free Space | 85,30% Space Free | Partition Type: NTFS Drive E: | 520,68 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive K: | 7,45 Gb Total Space | 7,45 Gb Free Space | 99,99% Space Free | Partition Type: FAT32 Computer Name: ANDYCARLOSAL-PC | User Name: ANdyCarlosAlkan | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.06.11 23:02:58 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\ANdyCarlosAlkan\Desktop\computer.retten\OTL.exe PRC - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\MsMpEng.exe PRC - [2009.04.11 08:28:15 | 000,117,248 | ---- | M] () -- \\?\C:\Windows\System32\wbem\WMIADAP.EXE PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe ========== Modules (No Company Name) ========== MOD - [2011.05.28 22:04:56 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll ========== Win32 Services (SafeList) ========== SRV - [2012.06.01 17:08:29 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.05.20 00:34:40 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.05.03 08:31:10 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.02 00:55:21 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService) SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.04.21 03:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.03.26 17:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv) SRV - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV - [2011.07.29 21:31:40 | 001,249,064 | ---- | M] () [Auto | Stopped] -- C:\ProgramData\TVersity\Media Server\MediaServer.exe -- (TVersityMediaServer) SRV - [2011.05.24 23:03:26 | 000,176,128 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2010.04.28 07:44:02 | 000,704,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc) SRV - [2010.03.09 00:40:36 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) [Auto | Stopped] -- C:\Programme\Nuance\PaperPort\PDFProFiltSrvPP.exe -- (PDFProFiltSrvPP) SRV - [2010.01.25 08:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) [On_Demand | Stopped] -- C:\Programme\Browny02\BrYNSvc.exe -- (BrYNSvc) SRV - [2009.07.27 11:13:28 | 000,061,440 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\ASDR.exe -- (ASDR) SRV - [2009.07.20 11:51:52 | 000,935,208 | ---- | M] (Nero AG) [Auto | Stopped] -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2009.05.06 10:41:48 | 000,060,928 | ---- | M] (ASUSTeK COMPUTER INC.) [Auto | Stopped] -- C:\Windows\System32\ATKFUSService.exe -- (ATKFUSService) SRV - [2008.01.18 23:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008.01.18 23:33:40 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | System | Stopped] -- C:\Windows\system32\drivers\nxmojkjg.sys -- (nxmojkjg) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | System | Stopped] -- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3804D58F-5F85-41B6-9457-DADA236A8B5D}\MpKsl7ca842e3.sys -- (MpKsl7ca842e3) DRV - File not found [Kernel | System | Stopped] -- C:\Windows\system32\drivers\lemajinz.sys -- (lemajinz) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | System | Stopped] -- C:\Windows\system32\drivers\hourqwua.sys -- (hourqwua) DRV - File not found [Kernel | System | Stopped] -- C:\Windows\system32\drivers\dtsqhnkd.sys -- (dtsqhnkd) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) DRV - [2012.04.27 10:20:04 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012.04.25 00:32:27 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012.04.16 21:17:40 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2012.03.20 20:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv) DRV - [2012.02.03 19:51:33 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\seehcri.sys -- (seehcri) DRV - [2012.02.03 19:50:37 | 000,025,512 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ggsemc.sys -- (ggsemc) DRV - [2012.02.03 19:50:37 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ggflt.sys -- (ggflt) DRV - [2011.09.16 07:29:28 | 000,014,336 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\EIO.sys -- (EIO) DRV - [2011.05.25 00:25:48 | 007,800,832 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2011.05.25 00:25:48 | 007,800,832 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag) DRV - [2011.05.24 22:25:20 | 000,245,760 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap) DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.08.23 04:00:52 | 000,101,904 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV - [2009.04.11 06:42:52 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUSB) DRV - [2009.02.17 18:22:14 | 000,030,976 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ATKDispLowFilter.sys -- (atkdisplf) DRV - [2009.02.17 18:22:14 | 000,015,232 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\asusgsb.sys -- (asusgsb) DRV - [2007.04.03 10:43:28 | 001,131,136 | ---- | M] (Philips Semiconductors GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Ph3xIB32.sys -- (Ph3xIB32) DRV - [2007.02.01 12:44:18 | 000,223,616 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R) DRV - [2007.01.29 17:12:52 | 000,018,432 | ---- | M] (ASUSTeK COMPUTER INC.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AsusVRC.sys -- (ASUSVRC) DRV - [2007.01.25 13:16:46 | 000,218,112 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\sis163u.sys -- (SIS163u) DRV - [2005.11.03 16:40:07 | 000,063,488 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x) DRV - [2005.08.10 14:44:04 | 000,050,688 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x) DRV - [2005.05.16 15:20:39 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x) DRV - [2002.07.17 03:53:02 | 000,016,877 | ---- | M] (Adaptec) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ASPI32.SYS -- (ASPI32) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.avira.com/?l=dis&o=APN10397&gct=hp&dc=EU&locale=de_AT IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 00 F0 C2 01 B3 7F CC 01 [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) IE - HKCU\..\SearchScopes,DefaultScope = {48AD92AE-2685-4CB8-B94E-678EA4DBC1A6} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?FORM=IEFM1&q={searchTerms}&src={referrer:source?} IE - HKCU\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=111304&babsrc=SP_ss&mntrId=14e7ce63000000000000003005de491c IE - HKCU\..\SearchScopes\{48AD92AE-2685-4CB8-B94E-678EA4DBC1A6}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={sear IE - HKCU\..\SearchScopes\{8879B614-A55A-4208-8B9E-0CD30B2AD97D}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10397&src=kw&q={searchTerms}&locale=&apn_ptnrs=^ABV&apn_dtid=^YYYYYY^YY^AT&apn_uid=F3A55980-877A-48C1-A9EA-F541AC50AF20&apn_sauid=1850ADAE-4A83-4B80-A365-212C7E2B6708 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Ask.com" FF - prefs.js..browser.search.update: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.at/" FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?affID=111304&babsrc=KW_ss&mntrId=14e7ce63000000000000003005de491c&q=" FF - prefs.js..network.proxy.type: 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\ANdyCarlosAlkan\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.04 21:59:35 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\ANdyCarlosAlkan\AppData\Roaming\11004 [2012.03.28 19:14:19 | 000,000,000 | ---D | M] [2011.09.16 11:50:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\mozilla\Extensions [2012.06.01 17:09:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\mozilla\Firefox\Profiles\rf1t508w.default\extensions [2011.09.19 23:44:38 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\mozilla\Firefox\Profiles\rf1t508w.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.06.01 17:10:24 | 000,000,000 | ---D | M] (Avira SearchFree Toolbar plus Web Protection) -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\mozilla\Firefox\Profiles\rf1t508w.default\extensions\toolbar@ask.com [2012.06.04 21:59:35 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.05.28 03:09:47 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.03.28 19:14:19 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\ANDYCARLOSALKAN\APPDATA\ROAMING\11004 [2011.09.16 12:20:46 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [2012.04.21 03:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.04.21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.05.11 16:02:07 | 000,002,313 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml [2012.04.21 03:54:08 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.04.21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.10.28 22:54:33 | 000,002,048 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml [2012.04.21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.04.21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.04.21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.52\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.52\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.52\pdf.dll CHR - plugin: RoboForm Plugin for Google Chrome/Opera/etc. (Enabled) = C:\Program Files\Siber Systems\AI RoboForm\Chrome\plugin/rf-np-plugin.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\ANdyCarlosAlkan\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: Avira Toolbar = C:\Users\ANdyCarlosAlkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaangaohdajkgeopjhpbnlpkehbhmbj\7.14.1.21771_0\ CHR - Extension: YouTube = C:\Users\ANdyCarlosAlkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\ANdyCarlosAlkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: Skype Click to Call = C:\Users\ANdyCarlosAlkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.10.0.9560_0\ CHR - Extension: Google Mail = C:\Users\ANdyCarlosAlkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Programme\Nuance\PDF Viewer Plus\bin\PlusIEContextMenu.dll (Zeon Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {724D43A0-0D85-11D4-9908-00400523E39A} - No CLSID value found. O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [ASUSGamerOSD] C:\Programme\ASUS\GamerOSD\GamerOSD.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [ControlCenter4] C:\Program Files\ControlCenter4\BrCcBoot.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [IndexSearch] C:\Program Files\Nuance\PaperPort\IndexSearch.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\Nuance\PaperPort\pptd40nt.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Programme\Nuance\PDF Viewer Plus\RegistryController.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [PDFHook] C:\Programme\Nuance\PDF Viewer Plus\pdfPro5Hook.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [PPort12reminder] C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [Facebook Update] C:\Users\ANdyCarlosAlkan\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation) O4 - HKCU..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe () O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation) O4 - HKCU..\Run: [Userinit] C:\Users\ANdyCarlosAlkan\AppData\Roaming\appconf32.exe () O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.) O4 - Startup: C:\Users\ANdyCarlosAlkan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkg_0ll.exe.lnk = C:\Users\ANdyCarlosAlkan\AppData\Local\Temp\pkg_0ll.exe () O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Free YouTube Download - C:\Users\ANdyCarlosAlkan\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\ANdyCarlosAlkan\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000033 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F0308DDA-5088-42E3-A820-F8A48E6953BB}: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\ANdyCarlosAlkan\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Fotogalerie-Hintergrundbild.jpg O24 - Desktop BackupWallPaper: C:\Users\ANdyCarlosAlkan\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Fotogalerie-Hintergrundbild.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2009.10.20 07:14:28 | 000,000,043 | R--- | M] () - E:\autorun.inf -- [ CDFS ] O33 - MountPoints2\{03797def-00a8-11e1-8b87-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{03797def-00a8-11e1-8b87-806e6f6e6963}\Shell\AutoRun\command - "" = E:\start.exe -- [2010.11.05 09:10:02 | 001,914,303 | R--- | M] (Macromedia, Inc.) O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.06.12 00:19:42 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\Desktop\computer.retten [2012.06.08 02:53:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3 [2012.06.05 14:17:28 | 000,000,000 | ---D | C] -- C:\ProgramData\zeon [2012.06.05 14:16:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nuance PaperPort 12 [2012.06.05 14:16:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ScanSoft Shared [2012.06.05 14:16:16 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\Documents\MeineWebSeiten [2012.06.05 14:08:38 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012.06.04 21:59:40 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service [2012.06.04 21:59:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla [2012.06.01 18:20:49 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\Avira [2012.06.01 18:14:04 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\FLEXnet [2012.06.01 18:13:53 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\ControlCenter4 [2012.06.01 17:25:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother [2012.06.01 17:16:17 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\BrFaxRx [2012.06.01 17:16:16 | 000,073,728 | ---- | C] (Brother Industories Ltd. P&S Company) -- C:\Windows\System32\BRCrypt.dll [2012.06.01 17:16:16 | 000,000,000 | ---D | C] -- C:\Brother [2012.06.01 17:16:02 | 000,000,000 | ---D | C] -- C:\ProgramData\ControlCenter4 [2012.06.01 17:16:02 | 000,000,000 | ---D | C] -- C:\Program Files\Browny02 [2012.06.01 17:15:36 | 000,000,000 | ---D | C] -- C:\Program Files\ControlCenter4 [2012.06.01 17:15:35 | 000,118,784 | ---- | C] (Brother Industries,LTD.) -- C:\Windows\System32\BrMfNt.dll [2012.06.01 17:15:34 | 000,225,280 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\System32\BrfxD05c.dll [2012.06.01 17:15:33 | 000,074,752 | R--- | C] (Brother Industries,Ltd.) -- C:\Windows\System32\BrWiaNCp.dll [2012.06.01 17:15:33 | 000,074,752 | R--- | C] (Brother Industries, Ltd.) -- C:\Windows\System32\BrNetSti.dll [2012.06.01 17:15:33 | 000,051,200 | R--- | C] (Brother Industries,Ltd) -- C:\Windows\System32\Brnsplg.dll [2012.06.01 17:15:32 | 000,180,224 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\System32\BrMuSNMP.dll [2012.06.01 17:15:26 | 001,476,608 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\System32\BrWi211a.dll [2012.06.01 17:15:26 | 000,217,088 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\System32\BrJDec.dll [2012.06.01 17:15:14 | 000,103,792 | ---- | C] (Brother Industries Ltd) -- C:\Windows\System32\BRRBI100.EXE [2012.06.01 17:15:14 | 000,050,176 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\BRPRTINK.DLL [2012.06.01 17:15:12 | 000,180,224 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\System32\BROSNMP.DLL [2012.06.01 17:15:12 | 000,077,824 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\System32\BRLMW03A.DLL [2012.06.01 17:15:12 | 000,025,299 | ---- | C] (Brother Industries, Ltd) -- C:\Windows\System32\BRLM03A.DLL [2012.06.01 17:15:04 | 000,241,664 | ---- | C] (brother) -- C:\Windows\System32\NSSearch.dll [2012.06.01 17:15:04 | 000,073,728 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\BrDctF2.dll [2012.06.01 17:15:04 | 000,005,632 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\BrDctF2L.dll [2012.06.01 17:15:04 | 000,003,072 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\BrDctF2S.dll [2012.06.01 17:15:04 | 000,000,000 | ---D | C] -- C:\Program Files\Brother [2012.06.01 17:10:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2012.06.01 17:09:58 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com [2012.06.01 17:09:31 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\AppData\Local\APN [2012.06.01 17:08:48 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2012.06.01 17:08:42 | 000,137,928 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2012.06.01 17:08:42 | 000,083,392 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2012.06.01 17:08:42 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys [2012.06.01 17:07:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2012.06.01 17:07:57 | 000,000,000 | ---D | C] -- C:\Program Files\Avira [2012.06.01 17:05:30 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\InstallShield [2012.06.01 17:03:02 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\Nuance [2012.06.01 17:02:35 | 000,000,000 | ---D | C] -- C:\ProgramData\ScanSoft [2012.06.01 17:01:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Nuance [2012.06.01 17:01:39 | 000,000,000 | ---D | C] -- C:\Program Files\Nuance [2012.06.01 17:01:39 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet [2012.06.01 16:59:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Brother [2012.05.29 21:39:39 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\gtk-2.0 [2012.05.28 03:09:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2012.05.28 03:09:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2012.05.24 23:18:40 | 004,472,832 | ---- | C] (Google Inc.) -- C:\Windows\System32\GPhotos.scr [2012.05.24 23:05:35 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\LolClient2 [2012.05.22 22:48:11 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\Documents\FILSHtray [2012.05.22 22:48:11 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\AppData\Local\FILSH_Media_GmbH [2012.05.22 22:11:19 | 002,557,952 | ---- | C] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\Windows\System32\QtCore4.dll [2012.05.22 22:11:13 | 000,405,176 | ---- | C] (Newtonsoft) -- C:\Windows\System32\Newtonsoft.Json.Net20.dll [2012.05.19 16:54:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrackMania Nations ESWC [2012.05.19 16:53:56 | 000,000,000 | ---D | C] -- C:\Program Files\TrackMania Nations ESWC [2012.05.19 01:05:53 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_5.dll [2012.05.19 01:05:53 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll [2012.05.19 01:05:52 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_42.dll [2012.05.19 01:03:05 | 000,754,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webservices.dll [2012.05.19 01:01:03 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\AppData\Local\Windows Live [2012.05.15 23:27:30 | 000,278,528 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\System32\Oemdspif.dll [2012.05.15 23:27:29 | 017,940,992 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\atioglxx.dll [2012.05.15 23:27:29 | 007,800,832 | ---- | C] (ATI Technologies Inc.) -- C:\Windows\System32\drivers\atikmdag.sys [2012.05.15 23:27:29 | 006,847,488 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\System32\aticaldd.dll [2012.05.15 23:27:29 | 004,219,904 | ---- | C] (ATI Technologies Inc. ) -- C:\Windows\System32\atidxx32.dll [2012.05.15 23:27:29 | 001,828,864 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atiumdmv.dll [2012.05.15 23:27:29 | 000,688,128 | ---- | C] (ATI Technologies Inc. ) -- C:\Windows\System32\aticfx32.dll [2012.05.15 23:27:29 | 000,462,848 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\ATIDEMGX.dll [2012.05.15 23:27:29 | 000,401,408 | ---- | C] (AMD) -- C:\Windows\System32\atieclxx.exe [2012.05.15 23:27:29 | 000,319,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Difxapi.dll [2012.05.15 23:27:29 | 000,294,912 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\ATIODE.exe [2012.05.15 23:27:29 | 000,262,144 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\atiadlxx.dll [2012.05.15 23:27:29 | 000,245,760 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\drivers\atikmpag.sys [2012.05.15 23:27:29 | 000,176,128 | ---- | C] (AMD) -- C:\Windows\System32\atiesrxx.exe [2012.05.15 23:27:29 | 000,151,552 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\atiapfxx.exe [2012.05.15 23:27:29 | 000,053,248 | ---- | C] (ATI Technologies Inc.) -- C:\Windows\System32\drivers\ati2erec.dll [2012.05.15 23:27:29 | 000,052,736 | ---- | C] (AMD) -- C:\Windows\System32\coinst.dll [2012.05.15 23:27:29 | 000,052,736 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atimpc32.dll [2012.05.15 23:27:29 | 000,052,736 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\amdpcom32.dll [2012.05.15 23:27:29 | 000,046,080 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\System32\aticalrt.dll [2012.05.15 23:27:29 | 000,045,056 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\ATIODCLI.exe [2012.05.15 23:27:29 | 000,044,032 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\System32\aticalcl.dll [2012.05.15 23:27:29 | 000,043,520 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\System32\ati2edxx.dll [2012.05.15 23:27:29 | 000,032,768 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atigktxx.dll [2012.05.15 23:27:29 | 000,031,744 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atiuxpag.dll [2012.05.15 23:27:29 | 000,029,184 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atiu9pag.dll [2012.05.15 23:27:29 | 000,015,872 | ---- | C] (AMD) -- C:\Windows\System32\atimuixx.dll [2012.05.15 23:27:29 | 000,012,800 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\System32\atiglpxx.dll [2012.05.15 23:27:29 | 000,000,000 | ---D | C] -- C:\CIMTEMP [2012.05.15 23:23:22 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\Download Manager [2012.05.15 23:19:13 | 000,000,000 | ---D | C] -- C:\Program Files\GPU-Z [2012.05.15 16:12:17 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\Documents\Diablo III [2012.05.15 15:42:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III [2012.05.15 15:42:44 | 000,000,000 | ---D | C] -- C:\Program Files\Diablo III [2012.05.15 15:42:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment [2012.05.15 15:42:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Blizzard Entertainment [2012.05.15 15:41:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Battle.net [2012.05.15 13:51:57 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VirtualDJ [2012.05.15 13:51:49 | 000,000,000 | ---D | C] -- C:\Program Files\VirtualDJ [2012.05.15 13:51:48 | 000,000,000 | ---D | C] -- C:\Users\ANdyCarlosAlkan\Documents\VirtualDJ [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [2 C:\Users\ANdyCarlosAlkan\AppData\Roaming\*.tmp files -> C:\Users\ANdyCarlosAlkan\AppData\Roaming\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.06.12 00:21:11 | 000,672,568 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.06.12 00:21:11 | 000,633,634 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.06.12 00:21:11 | 000,144,812 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.06.12 00:21:11 | 000,119,160 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.06.12 00:18:29 | 000,001,356 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\AppData\Local\d3d9caps.dat [2012.06.12 00:16:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.06.11 22:45:05 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.06.11 22:43:40 | 000,000,766 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkg_0ll.exe.lnk [2012.06.11 22:43:23 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.06.11 22:43:22 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.06.11 22:43:02 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.06.11 22:17:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.06.11 21:47:18 | 000,001,971 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2012.06.11 21:47:06 | 000,000,968 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3646850395-1821765931-2421538927-1000UA.job [2012.06.11 18:47:00 | 000,000,946 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3646850395-1821765931-2421538927-1000Core.job [2012.06.09 22:46:16 | 007,454,918 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\Chris_Brown_-_Don_t_Wake_Me_Up__XclusiveMusic.com_.m4a [2012.06.09 20:04:35 | 025,526,753 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\09 Pyramids.mp3 [2012.06.09 11:58:22 | 000,000,475 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\Justin Bieber - Verknüpfung.lnk [2012.06.08 22:59:41 | 116,990,987 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\Brian Puspos Choreography - The PusWood Collection_ Tyga Edition - Bitch Im The Shit.mp4 [2012.06.08 22:23:03 | 033,987,963 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\MOS WANTED CREW AT SUMMER DROP 2012.mp4 [2012.06.08 22:18:06 | 006,473,088 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\ebrahim_ frank ocean - swim good (acoustic).mp3 [2012.06.08 21:36:17 | 007,499,137 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\David Bisbal & Cali & El Dandee - No Hay 2 Sin 3.mp3 [2012.06.08 03:32:31 | 000,061,440 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.06.08 02:53:35 | 000,000,899 | ---- | M] () -- C:\Users\Public\Desktop\Picasa 3.lnk [2012.06.06 21:03:11 | 092,059,939 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\instalador adobe photoshop cs5 en español por manututoriales.rar [2012.06.06 18:40:54 | 000,007,284 | -HS- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\Folder.jpg [2012.06.06 18:40:54 | 000,002,077 | -HS- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\AlbumArtSmall.jpg [2012.06.05 23:09:24 | 009,076,956 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\Frank_Ocean_-_Swim_Good.m4a [2012.06.05 14:28:06 | 000,302,736 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.06.05 14:24:22 | 000,001,921 | ---- | M] () -- C:\Users\Public\Desktop\Brother Creative Center.lnk [2012.06.05 14:23:59 | 000,000,248 | ---- | M] () -- C:\Windows\Brpfx04a.ini [2012.06.05 14:23:59 | 000,000,093 | ---- | M] () -- C:\Windows\brpcfx.ini [2012.06.05 14:22:11 | 000,002,944 | ---- | M] () -- C:\Windows\BRPARAM.INI [2012.06.04 22:33:03 | 000,009,177 | -HS- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\AlbumArt_{5308B0BF-A057-4083-96A8-1430F66BAB69}_Large.jpg [2012.06.04 22:33:03 | 000,002,768 | -HS- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\AlbumArt_{5308B0BF-A057-4083-96A8-1430F66BAB69}_Small.jpg [2012.06.04 21:59:42 | 000,000,846 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.06.04 00:23:08 | 000,000,752 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk [2012.06.01 17:16:17 | 000,000,066 | ---- | M] () -- C:\Windows\Brfaxrx.ini [2012.06.01 17:10:46 | 000,001,847 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2012.06.01 17:08:29 | 000,419,488 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2012.06.01 17:08:29 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2012.05.29 21:39:38 | 000,002,212 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\.recently-used.xbel [2012.05.28 03:09:16 | 000,001,880 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2012.05.28 03:03:51 | 000,009,373 | -HS- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\AlbumArt_{DB01DDBB-C8D4-4737-9558-03EA1F9B782C}_Large.jpg [2012.05.28 03:03:51 | 000,002,348 | -HS- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\AlbumArt_{DB01DDBB-C8D4-4737-9558-03EA1F9B782C}_Small.jpg [2012.05.28 03:02:44 | 000,008,206 | -HS- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\AlbumArt_{F47A62D9-FCE6-4EFF-8BF7-3AC3589CAA1E}_Large.jpg [2012.05.28 03:02:44 | 000,002,565 | -HS- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\AlbumArt_{F47A62D9-FCE6-4EFF-8BF7-3AC3589CAA1E}_Small.jpg [2012.05.24 23:18:40 | 004,472,832 | ---- | M] (Google Inc.) -- C:\Windows\System32\GPhotos.scr [2012.05.20 15:54:59 | 000,000,012 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\urhtps.dat [2012.05.19 16:54:41 | 000,000,974 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\TmNations.lnk [2012.05.19 16:52:56 | 278,695,378 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\TmNationsESWC_Setup.zip [2012.05.15 16:08:44 | 000,000,955 | ---- | M] () -- C:\Users\Public\Desktop\Diablo III.lnk [2012.05.15 13:51:57 | 000,000,843 | ---- | M] () -- C:\Users\ANdyCarlosAlkan\Desktop\VirtualDJ Home FREE.lnk [2012.05.14 01:45:54 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2012.05.13 15:49:55 | 000,000,840 | ---- | M] () -- C:\Windows\tasks\Open URL by RoboForm.job [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [2 C:\Users\ANdyCarlosAlkan\AppData\Roaming\*.tmp files -> C:\Users\ANdyCarlosAlkan\AppData\Roaming\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.06.11 22:40:31 | 000,000,766 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkg_0ll.exe.lnk [2012.06.09 22:46:06 | 007,454,918 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\Chris_Brown_-_Don_t_Wake_Me_Up__XclusiveMusic.com_.m4a [2012.06.09 20:04:01 | 025,526,753 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\09 Pyramids.mp3 [2012.06.09 11:58:22 | 000,000,475 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\Justin Bieber - Verknüpfung.lnk [2012.06.08 22:58:43 | 116,990,987 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\Brian Puspos Choreography - The PusWood Collection_ Tyga Edition - Bitch Im The Shit.mp4 [2012.06.08 22:22:18 | 033,987,963 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\MOS WANTED CREW AT SUMMER DROP 2012.mp4 [2012.06.08 22:17:49 | 006,473,088 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\ebrahim_ frank ocean - swim good (acoustic).mp3 [2012.06.08 21:34:17 | 007,499,137 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\David Bisbal & Cali & El Dandee - No Hay 2 Sin 3.mp3 [2012.06.08 02:53:35 | 000,000,899 | ---- | C] () -- C:\Users\Public\Desktop\Picasa 3.lnk [2012.06.06 20:58:03 | 092,059,939 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\instalador adobe photoshop cs5 en español por manututoriales.rar [2012.06.05 23:09:16 | 009,076,956 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\Frank_Ocean_-_Swim_Good.m4a [2012.06.05 14:24:22 | 000,001,921 | ---- | C] () -- C:\Users\Public\Desktop\Brother Creative Center.lnk [2012.06.05 14:21:57 | 000,002,944 | ---- | C] () -- C:\Windows\BRPARAM.INI [2012.06.04 22:33:03 | 000,009,177 | -HS- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\AlbumArt_{5308B0BF-A057-4083-96A8-1430F66BAB69}_Large.jpg [2012.06.04 22:33:03 | 000,002,768 | -HS- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\AlbumArt_{5308B0BF-A057-4083-96A8-1430F66BAB69}_Small.jpg [2012.06.04 21:59:42 | 000,000,858 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.06.04 21:59:42 | 000,000,846 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.06.01 17:25:33 | 000,000,248 | ---- | C] () -- C:\Windows\Brpfx04a.ini [2012.06.01 17:25:33 | 000,000,093 | ---- | C] () -- C:\Windows\brpcfx.ini [2012.06.01 17:15:35 | 000,000,066 | ---- | C] () -- C:\Windows\Brfaxrx.ini [2012.06.01 17:15:34 | 000,000,000 | ---- | C] () -- C:\Windows\brdfxspd.dat [2012.06.01 17:15:16 | 000,045,056 | ---- | C] () -- C:\Windows\System32\BRTCPCON.DLL [2012.06.01 17:15:12 | 000,000,114 | ---- | C] () -- C:\Windows\System32\BRLMW03A.INI [2012.06.01 17:10:46 | 000,001,847 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2012.05.29 21:39:38 | 000,002,212 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\.recently-used.xbel [2012.05.28 03:03:51 | 000,009,373 | -HS- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\AlbumArt_{DB01DDBB-C8D4-4737-9558-03EA1F9B782C}_Large.jpg [2012.05.28 03:03:51 | 000,002,348 | -HS- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\AlbumArt_{DB01DDBB-C8D4-4737-9558-03EA1F9B782C}_Small.jpg [2012.05.28 03:02:44 | 000,008,206 | -HS- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\AlbumArt_{F47A62D9-FCE6-4EFF-8BF7-3AC3589CAA1E}_Large.jpg [2012.05.28 03:02:44 | 000,002,565 | -HS- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\AlbumArt_{F47A62D9-FCE6-4EFF-8BF7-3AC3589CAA1E}_Small.jpg [2012.05.20 15:54:59 | 000,000,012 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\urhtps.dat [2012.05.19 16:54:41 | 000,000,974 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\TmNations.lnk [2012.05.19 16:50:34 | 278,695,378 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\TmNationsESWC_Setup.zip [2012.05.15 23:27:29 | 001,127,552 | ---- | C] () -- C:\Windows\System32\atiumdva.cap [2012.05.15 23:27:29 | 000,233,765 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2012.05.15 23:27:29 | 000,166,624 | ---- | C] () -- C:\Windows\System32\atiapfxx.blb [2012.05.15 23:27:29 | 000,037,376 | ---- | C] () -- C:\Windows\System32\atitmpxx.dll [2012.05.15 23:27:29 | 000,032,635 | ---- | C] () -- C:\Windows\atiogl.xml [2012.05.15 23:27:29 | 000,003,929 | ---- | C] () -- C:\Windows\System32\atipblag.dat [2012.05.15 15:42:44 | 000,000,955 | ---- | C] () -- C:\Users\Public\Desktop\Diablo III.lnk [2012.05.15 13:51:57 | 000,000,843 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\Desktop\VirtualDJ Home FREE.lnk [2012.05.13 15:49:55 | 000,000,840 | ---- | C] () -- C:\Windows\tasks\Open URL by RoboForm.job [2012.03.26 16:24:22 | 000,005,624 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\BAcroIEHelpe092.dll [2012.03.26 01:17:15 | 000,005,624 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\BAcroIEHelpe.dll [2012.01.16 02:10:40 | 006,908,648 | ---- | C] () -- C:\Windows\System32\SpoonUninstall.exe [2012.01.16 02:10:40 | 000,017,680 | ---- | C] () -- C:\Windows\System32\SpoonUninstall-dBpoweramp Music Converter.dat [2012.01.03 09:28:06 | 002,570,286 | ---- | C] () -- C:\Windows\System32\abgx360.exe [2011.12.24 21:32:32 | 000,000,256 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\AppData\Roaming\default.rss [2011.12.11 14:28:26 | 000,000,552 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\AppData\Local\d3d8caps.dat [2011.12.08 11:05:34 | 001,024,000 | ---- | C] ( ) -- C:\Windows\System32\DKADIQlang.dll [2011.12.08 11:04:46 | 000,204,800 | ---- | C] ( ) -- C:\Windows\System32\DKADIQinpa.dll [2011.12.08 11:04:40 | 000,430,080 | ---- | C] ( ) -- C:\Windows\System32\DKADIQcomc.dll [2011.11.22 21:50:55 | 000,000,000 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\AppData\Local\{9EEC78EC-3B59-436E-933E-3AB4C12595B3} [2011.11.01 23:46:01 | 000,000,000 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\AppData\Local\{AF606C4A-66F2-41B8-993E-1DE0EB026F61} [2011.09.25 23:13:37 | 000,061,440 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.09.20 05:46:24 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2011.09.20 05:46:24 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2011.09.20 04:10:02 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2011.09.16 17:03:43 | 000,672,568 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2011.09.16 17:03:43 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2011.09.16 17:03:43 | 000,144,812 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2011.09.16 17:03:43 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2011.09.16 07:33:03 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.09.16 07:25:44 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2011.09.16 07:25:44 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asrussian.dll [2011.09.16 07:25:44 | 000,053,248 | ---- | C] () -- C:\Windows\System32\askorean.dll [2011.09.16 07:25:44 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asjapan.dll [2011.09.16 07:25:44 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asgerman.dll [2011.09.16 07:25:44 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asfrench.dll [2011.09.16 07:25:44 | 000,053,248 | ---- | C] () -- C:\Windows\System32\aseng.dll [2011.09.16 07:25:44 | 000,053,248 | ---- | C] () -- C:\Windows\System32\ASCHT.dll [2011.09.16 07:25:44 | 000,053,248 | ---- | C] () -- C:\Windows\System32\aschs.dll [2011.09.16 07:25:43 | 000,761,856 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2011.09.16 07:19:07 | 000,001,356 | ---- | C] () -- C:\Users\ANdyCarlosAlkan\AppData\Local\d3d9caps.dat < End of report > ich weiß dass man erst nach 3 tagen pushen soll wenn man keine antwort bekommt aber bitte ich habe am donnerstag meine abschlussprüfung und ohne den dateien auf dem pc bin ich extrem aufgeschmissen also wenn mir jemand bitte helfen könnte ich wäre ihm mein leben lang dankbar !!  (( |
|
13.06.2012, 14:41
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | AKM Trojaner hat mich erwischt, wie vorgehen?Zitat:
Hast du WIndows 2x installiert?
__________________ |
|
20.07.2012, 21:32
| #3 |
| | AKM Trojaner hat mich erwischt, wie vorgehen? push bitte help
__________________ |
|
23.07.2012, 11:39
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | AKM Trojaner hat mich erwischt, wie vorgehen?Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
| Themen zu AKM Trojaner hat mich erwischt, wie vorgehen? |
| akm trojaner, asus, autorun, avira searchfree toolbar, bacroiehelpe, bho, bonjour, branding, cdrom, defender, explorer, firefox, format, google earth, helper, home, langs, limited.com/facebook, logfile, microsoft, mozilla, pando media booster, plug-in, realtek, registry, scan, searchscopes, security, software, trojaner, version=1.0, virus, vista, wallpaper, winlogon |
Linear-Darstellung
