| |
| |||||||
Log-Analyse und Auswertung: IE ist infiziertWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
27.12.2010, 12:29
| #1 |
| |  IE ist infiziert Hallo. Ich bin neu hier und habe echt 0 Ahnung von Registry Log und dem Kram. Ich habe folgendes Problem: Mein IE öffnet alle 30 min eine Werbeseite. Diese ist jedes mal eine andere. Ich habe bisher probiert : Avira (ich weis ist dumb) Malwarebites : nach dem scan öffnete sich ein editor,da stand das drinn : Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4052 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 01.10.2010 12:24:05 mbam-log-2010-10-01 (12-24-05).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 120784 Laufzeit: 6 Minute(n), 47 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) HILFE  |
|
27.12.2010, 12:38
| #2 |
| /// Malware-holic   | IE ist infiziert Systemscan mit OTL
__________________download otl: http://filepony.de/download-otl/ Doppelklick auf die OTL.exe (user von Windows 7 und Vista: Rechtsklick als Administrator ausführen) 1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output 2. Hake an "scan all users" 3. Unter "Extra Registry wähle: "Use Safelist" "LOP Check" "Purity Check" 4. Kopiere in die Textbox: netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll winlogon.exe logevent.dll user32.DLL explorer.exe iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT 5. Klicke "Scan" 6. 2 reporte werden erstellt: OTL.Txt Extras.Txt beide posten.
__________________ |
|
27.12.2010, 13:51
| #3 |
| | IE ist infiziert OTL Logfile:
__________________Code:
ATTFilter OTL Extras logfile created on: 01.10.2010 13:18:21 - Run 1
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Tom\Downloads
Enterprise Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 29,00% Memory free
3,00 Gb Paging File | 1,00 Gb Available in Paging File | 42,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 139,05 Gb Total Space | 23,53 Gb Free Space | 16,93% Space Free | Partition Type: NTFS
Drive D: | 9,00 Gb Total Space | 8,92 Gb Free Space | 99,08% Space Free | Partition Type: NTFS
Drive F: | 1020,00 Mb Total Space | 1019,71 Mb Free Space | 99,97% Space Free | Partition Type: FAT32
Drive I: | 477,25 Mb Total Space | 476,97 Mb Free Space | 99,94% Space Free | Partition Type: FAT
Computer Name: TOM-PC | User Name: Tom | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-1383492580-2228963269-1490800487-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Orbitdownloader\orbitdm.exe" = C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Program Files\Orbitdownloader\orbitnet.exe" = C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{0B9E0BD1-328D-415C-80A5-6B0028F0C104}" = Call of Duty(R) 2 Patch 1.2
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 22
"{361AA6F2-124E-4E98-9402-83B1445B8448}" = GameSpy Comrade
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = HP Webcam
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{46A2A2C6-2EDE-11D7-AAED-001060294115}" = Furry
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F624839-947D-46EA-BD63-FD847C1AC6F1}" = BearShare
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{842BEE12-CCCB-43F4-ABAF-CBA6DFE2583D}" = Nero BurnLite 10
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}" = Microsoft Games for Windows - LIVE Redistributable
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"{974C4B12-4D02-4879-85E0-61C95CC63E9E}" = Fallout 3
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{AB627AF2-9C7E-4DBD-816B-3B2646B81E89}" = Nero BurnLite 10
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{EE510252-96FC-49C1-AE63-36E1C49314CD}" = Moongamer's CoD2 Patch Switcher
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Age of Mythology 1.0" = Age of Mythology
"BearShare" = BearShare
"BearShare MediaBar" = MediaBar
"CCleaner" = CCleaner
"CoD RconTool" = CoD RconTool
"DivX Setup.divx.com" = DivX-Setup
"Foxit Reader" = Foxit Reader
"HyperCam 2" = HyperCam 2
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Orbit_is1" = Orbit Downloader
"PowerISO" = PowerISO
"PunkBusterSvc" = PunkBuster Services
"RouterControl" = RouterControl 2.0
"TuneUp Utilities 2011" = TuneUp Utilities 2011
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.4
"WinRAR archiver" = WinRAR
"Wise Registry Cleaner_is1" = Wise Registry Cleaner Free 5.72
"Xfire" = Xfire (remove only)
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1383492580-2228963269-1490800487-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes
"TeamSpeak 3 Client" = TeamSpeak 3 Client
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 25.09.2010 14:09:17 | Computer Name = Tom-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iw3mp.exe, Version: 0.0.0.0, Zeitstempel:
0x4859a219 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
0x00000000 Ausnahmecode: 0xc0000096 Fehleroffset: 0x0ef1bf04 ID des fehlerhaften Prozesses:
0xb68 Startzeit der fehlerhaften Anwendung: 0x01cb5cd240c07982 Pfad der fehlerhaften
Anwendung: C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe
Pfad
des fehlerhaften Moduls: unknown Berichtskennung: 02ba13cd-c8d0-11df-99c8-0024816cc13b
Error - 25.09.2010 14:09:18 | Computer Name = Tom-PC | Source = Application Error | ID = 1005
Description = Aus einem der folgenden Gründe kann nicht auf die Datei "" zugegriffen
werden: Es besteht ein Problem mit der Netzwerkverbindung, dem Datenträger mit der
gespeicherten Datei bzw. den auf dem Computer installierten Speichertreibern, oder
der Datenträger fehlt. Das Programm iw3mp.exe wurde wegen dieses Fehlers geschlossen.
Programm:
iw3mp.exe Datei: Der Fehlerwert ist im Abschnitt "Zusätzliche Dateien" aufgelistet.
Benutzeraktion
1.
Öffnen Sie die Datei erneut. Diese Situation ist eventuell ein temporäres Problem,
das selbstständig behoben wird, wenn das Programm erneut ausgeführt wird. 2. Wenn
Sie weiterhin nicht auf die Datei zugreifen können und - diese sich im Netzwerk
befindet, dann sollte der Netzwerkadministrator überprüfen, dass kein Netzwerkproblem
besteht und dass eine Verbindung mit dem Server hergestellt werden kann. - diese
sich auf einem Wechseldatenträger, wie z. B. einer Diskette oder einer CD, befindet,
überprüfen Sie, ob der Datenträger richtig in den Computer eingelegt ist. 3. Überprüfen
und reparieren Sie das Dateisystem, indem Sie CHKDSK ausführen. Klicken Sie dazu
im Menü "Start" auf "Ausführen", geben Sie CMD ein, und klicken Sie auf "OK". Geben
Sie an der Eingabeaufforderung CHKDSK /F ein, und drücken Sie die EINGABETASTE.
4.
Stellen Sie die Datei von einer Sicherungskopie wieder her, wenn das Problem weiterhin
besteht. 5. Überprüfen Sie, ob andere Dateien auf demselben Datenträger geöffnet
werden können. Falls dies nicht möglich ist, ist der Datenträger eventuell beschädigt.
Wenden Sie sich an den Administrator oder den Hersteller der Computerhardware,
um weitere Unterstützung zu erhalten, wenn es sich um eine Festplatte handelt. Zusätzliche
Daten Fehlerwert: 00000000 Datenträgertyp: 0
Error - 26.09.2010 06:07:24 | Computer Name = Tom-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: BFHeroes.exe, Version: 0.0.0.0, Zeitstempel:
0x4d00cb1d Name des fehlerhaften Moduls: BFHeroes.exe, Version: 0.0.0.0, Zeitstempel:
0x4d00cb1d Ausnahmecode: 0x80000003 Fehleroffset: 0x0046520d ID des fehlerhaften Prozesses:
0x85c Startzeit der fehlerhaften Anwendung: 0x01cb5d61da902973 Pfad der fehlerhaften
Anwendung: C:\Program Files\EA Games\Battlefield Heroes\BFHeroes.exe Pfad des fehlerhaften
Moduls: C:\Program Files\EA Games\Battlefield Heroes\BFHeroes.exe Berichtskennung:
db880314-c955-11df-91e9-0024816cc13b
Error - 26.09.2010 06:20:15 | Computer Name = Tom-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: BFHeroes.exe, Version: 0.0.0.0, Zeitstempel:
0x4d00cb1d Name des fehlerhaften Moduls: BFHeroes.exe, Version: 0.0.0.0, Zeitstempel:
0x4d00cb1d Ausnahmecode: 0x80000003 Fehleroffset: 0x0046520d ID des fehlerhaften Prozesses:
0xb48 Startzeit der fehlerhaften Anwendung: 0x01cb5d63632d2fbf Pfad der fehlerhaften
Anwendung: C:\Program Files\EA Games\Battlefield Heroes\BFHeroes.exe Pfad des fehlerhaften
Moduls: C:\Program Files\EA Games\Battlefield Heroes\BFHeroes.exe Berichtskennung:
a730a244-c957-11df-91e9-0024816cc13b
Error - 26.09.2010 06:23:36 | Computer Name = Tom-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: BFHeroes.exe, Version: 0.0.0.0, Zeitstempel:
0x4d00cb1d Name des fehlerhaften Moduls: BFHeroes.exe, Version: 0.0.0.0, Zeitstempel:
0x4d00cb1d Ausnahmecode: 0x80000003 Fehleroffset: 0x0046520d ID des fehlerhaften Prozesses:
0xe04 Startzeit der fehlerhaften Anwendung: 0x01cb5d649240d989 Pfad der fehlerhaften
Anwendung: C:\Program Files\EA Games\Battlefield Heroes\BFHeroes.exe Pfad des fehlerhaften
Moduls: C:\Program Files\EA Games\Battlefield Heroes\BFHeroes.exe Berichtskennung:
1efd2256-c958-11df-91e9-0024816cc13b
Error - 26.09.2010 08:34:42 | Computer Name = Tom-PC | Source = VSS | ID = 8194
Description =
Error - 26.09.2010 09:15:08 | Computer Name = Tom-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: gta_sa.exe, Version: 0.0.0.0, Zeitstempel:
0x42f34ed4 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x53ff8b90 ID des fehlerhaften Prozesses:
0xc98 Startzeit der fehlerhaften Anwendung: 0x01cb5d7a247adda5 Pfad der fehlerhaften
Anwendung: C:\Program Files\Rockstar Games\Grand Theft Auto San Andreas\gta_sa.exe
Pfad
des fehlerhaften Moduls: unknown Berichtskennung: 1592e9a5-c970-11df-91e9-0024816cc13b
Error - 28.09.2010 11:44:43 | Computer Name = Tom-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 1.9.2.3989 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 11e8 Startzeit:
01cb5f237c255655 Endzeit: 39 Anwendungspfad: C:\Program Files\Mozilla Firefox\firefox.exe
Berichts-ID:
49b17c90-cb17-11df-ae72-0024816cc13b
Error - 28.09.2010 19:31:24 | Computer Name = Tom-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: atieclxx.exe, Version: 6.14.11.1033,
Zeitstempel: 0x4a8a13b1 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0145a008 ID des fehlerhaften
Prozesses: 0x524 Startzeit der fehlerhaften Anwendung: 0x01cb5de0175301d6 Pfad der
fehlerhaften Anwendung: C:\Windows\system32\atieclxx.exe Pfad des fehlerhaften Moduls:
unknown Berichtskennung: 8152e5a4-cb58-11df-ae72-0024816cc13b
Error - 30.09.2010 07:45:20 | Computer Name = Tom-PC | Source = VSS | ID = 8194
Description =
[ System Events ]
Error - 16.10.2010 10:01:15 | Computer Name = Tom-PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 16.10.2010 10:01:43 | Computer Name = Tom-PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 16.10.2010 10:01:45 | Computer Name = Tom-PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 16.10.2010 10:04:26 | Computer Name = Tom-PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 16.10.2010 10:07:25 | Computer Name = Tom-PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 16.10.2010 10:08:11 | Computer Name = Tom-PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 16.10.2010 10:08:36 | Computer Name = Tom-PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 16.10.2010 10:08:55 | Computer Name = Tom-PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 16.10.2010 10:10:38 | Computer Name = Tom-PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 16.10.2010 10:10:47 | Computer Name = Tom-PC | Source = atikmdag | ID = 43029
Description = Display is not active
< End of report >
... und ... OTL Logfile: Code:
ATTFilter OTL logfile created on: 01.10.2010 13:18:21 - Run 1 OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Tom\Downloads Enterprise Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 29,00% Memory free 3,00 Gb Paging File | 1,00 Gb Available in Paging File | 42,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 139,05 Gb Total Space | 23,53 Gb Free Space | 16,93% Space Free | Partition Type: NTFS Drive D: | 9,00 Gb Total Space | 8,92 Gb Free Space | 99,08% Space Free | Partition Type: NTFS Drive F: | 1020,00 Mb Total Space | 1019,71 Mb Free Space | 99,97% Space Free | Partition Type: FAT32 Drive I: | 477,25 Mb Total Space | 476,97 Mb Free Space | 99,94% Space Free | Partition Type: FAT Computer Name: TOM-PC | User Name: Tom | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe (TuneUp Software) PRC - C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (TuneUp Software) PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - C:\Programme\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe (MusicLab, LLC) PRC - C:\Users\Tom\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Windows\System32\rpcnet.exe (Absolute Software Corp.) PRC - C:\Programme\Nero\Update\NASvc.exe (Nero AG) PRC - C:\Programme\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.) PRC - C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\atieclxx.exe (AMD) PRC - C:\Windows\System32\atiesrxx.exe (AMD) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Users\Tom\Music\lst.exe () PRC - C:\Programme\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe () PRC - C:\Programme\RocketDock\RocketDock.exe () PRC - C:\Users\Tom\Desktop\Injectors\DrUnKeN ChEeTaH Injector\DCInjector.exe () ========== Modules (SafeList) ========== MOD - C:\Users\Tom\Downloads\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation) MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation) MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation) MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation) MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation) MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation) MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation) MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation) MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation) MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (TuneUp Software) SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software) SRV - (rpcnet) Remote Procedure Call (RPC) -- C:\Windows\System32\rpcnet.exe (Absolute Software Corp.) SRV - (NAUpdate) -- C:\Program Files\Nero\Update\NASvc.exe (Nero AG) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.) SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD) SRV - (WLMS) -- C:\Windows\System32\wlms\wlms.exe (Microsoft Corporation) SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation) SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation) SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation) SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation) SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation) SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation) SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation) SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation) SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation) SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation) SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation) SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation) SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation) SRV - (AxInstSV) ActiveX-Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation) SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation) SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (TuneUpUtilitiesDrv) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys (TuneUp Software) DRV - (PnkBstrK) -- C:\Windows\System32\drivers\PnkBstrK.sys () DRV - (SCDEmu) -- C:\Windows\System32\drivers\scdemu.sys (PowerISO Computing, Inc.) DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.) DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.) DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.) DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.) DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.) DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.) DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices) DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.) DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices) DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.) DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation) DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation) DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation) DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation) DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation) DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation) DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation) DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation) DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation) DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation) DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex) DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.) DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company) DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation) DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation) DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation) DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation) DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation) DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation) DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation) DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.) DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation) DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation) DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation) DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems) DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation) DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.) DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology) DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.) DRV - (rdpbus) -- C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation) DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation) DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation) DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation) DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation) DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation) DRV - (vwififlt) -- C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation) DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation) DRV - (1394ohci) -- C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation) DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation) DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation) DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation) DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation) DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation) DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation) DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation) DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation) DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation) DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation) DRV - (AmdPPM) -- C:\Windows\System32\drivers\amdppm.sys (Microsoft Corporation) DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.) DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.) DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (LSI Corp) DRV - (yukonw7) -- C:\Windows\System32\drivers\yk62x86.sys (Marvell) DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation) DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation) DRV - (BCM43XX) -- C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation) DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation) DRV - (HBtnKey) -- C:\Windows\System32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1383492580-2228963269-1490800487-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.bearshare.com/ IE - HKU\S-1-5-21-1383492580-2228963269-1490800487-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-1383492580-2228963269-1490800487-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-1383492580-2228963269-1490800487-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = BC C4 96 5D E2 4C CB 01 [binary data] IE - HKU\S-1-5-21-1383492580-2228963269-1490800487-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "BearShare Web Search" FF - prefs.js..browser.search.order.1: "BearShare Web Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.8.0.99999 FF - prefs.js..extensions.enabledItems: {35379F86-8CCB-4724-AE33-4278DE266C70}:1.0.5 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8 FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.7.1.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2 FF - prefs.js..extensions.enabledItems: {1FD91A9C-410C-4090-BBCC-55D3450EF433}:2.0 FF - prefs.js..extensions.enabledItems: {E84D42CA-64EB-11DE-A65F-8C3656D89593}:3.1 FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.31.0 FF - prefs.js..keyword.URL: "hxxp://search.bearshare.com/web?src=ffb&systemid=2&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.09.25 18:06:51 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.09.25 18:06:51 | 000,000,000 | ---D | M] [2010.10.03 20:21:10 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\mozilla\Extensions [2010.10.26 18:16:45 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\mozilla\Firefox\Profiles\g50tb7h2.default\extensions [2010.09.05 14:25:17 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Tom\AppData\Roaming\mozilla\Firefox\Profiles\g50tb7h2.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2010.09.05 15:08:02 | 000,000,000 | ---D | M] (softonic-de3 Toolbar) -- C:\Users\Tom\AppData\Roaming\mozilla\Firefox\Profiles\g50tb7h2.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} [2010.10.03 20:03:26 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Tom\AppData\Roaming\mozilla\Firefox\Profiles\g50tb7h2.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.10.03 20:21:12 | 000,000,000 | ---D | M] (MediaBar) -- C:\Users\Tom\AppData\Roaming\mozilla\Firefox\Profiles\g50tb7h2.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593} [2010.10.20 15:37:28 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\mozilla\Firefox\Profiles\g50tb7h2.default\extensions\battlefieldheroespatcher@ea.com [2010.10.01 17:57:40 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\mozilla\Firefox\Profiles\g50tb7h2.default\extensions\engine@conduit.com [2010.10.26 18:16:50 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\mozilla\Firefox\Profiles\g50tb7h2.default\extensions\toolbar@ask.com [2010.09.14 14:41:12 | 000,002,506 | ---- | M] () -- C:\Users\Tom\AppData\Roaming\Mozilla\FireFox\Profiles\g50tb7h2.default\searchplugins\BearShareWebSearch.xml [2010.10.03 20:21:10 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.09.18 19:12:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.10.01 18:05:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010.09.15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.09.12 11:14:30 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Programme\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll [2010.09.25 18:06:48 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.09.14 14:41:12 | 000,002,506 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\BearShareWebSearch.xml [2010.09.25 18:06:48 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.09.25 18:06:48 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.09.25 18:06:48 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.09.25 18:06:48 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programme\Orbitdownloader\orbitcth.dll (Orbitdownloader.com) O2 - BHO: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Programme\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll () O2 - BHO: (UrlHelper Class) - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Programme\BearShare Applications\MediaBar\Datamngr\IEBHO.dll (MusicLab, LLC) O3 - HKLM\..\Toolbar: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Programme\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll () O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll () O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKU\S-1-5-21-1383492580-2228963269-1490800487-1001\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll () O4 - HKLM..\Run: [DATAMNGR] C:\Programme\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe (MusicLab, LLC) O4 - HKLM..\Run: [DiskMgr] C:\Windows\diskmgr.exe () O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Programme\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.) O4 - HKU\S-1-5-21-1383492580-2228963269-1490800487-1001..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe () O4 - HKU\S-1-5-21-1383492580-2228963269-1490800487-1001..\Run: [System] C:\Users\Tom\Music\lst.exe () O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Moongamers Patch Switcher.lnk = C:\Users\Tom\AppData\Roaming\Microsoft\Installer\{EE510252-96FC-49C1-AE63-36E1C49314CD}\_154754de.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O20 - AppInit_DLLs: (C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll) - C:\Programme\BearShare Applications\MediaBar\Datamngr\datamngr.dll (MusicLab, LLC) O20 - AppInit_DLLs: (C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll) - C:\Programme\BearShare Applications\MediaBar\Datamngr\IEBHO.dll (MusicLab, LLC) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2010.10.27 11:22:24 | 000,000,053 | ---- | M] () - F:\autorun.inf -- [ FAT32 ] O32 - AutoRun File - [2010.10.27 11:22:26 | 000,000,053 | ---- | M] () - I:\autorun.inf -- [ FAT ] O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\Setup.exe -- File not found O33 - MountPoints2\G\Shell\setup\command - "" = G:\setup.exe -- File not found O33 - MountPoints2\H\Shell - "" = AutoRun O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\_aom.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation) NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation) SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Power - C:\Windows\System32\umpo.dll (Microsoft Corporation) SafeBootMin: Primary disk - Driver Group SafeBootMin: RpcEptMapper - C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation) SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: Dhcp - C:\Windows\System32\dhcpcore.dll (Microsoft Corporation) SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: ndiscap - C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation) SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Power - C:\Windows\System32\umpo.dll (Microsoft Corporation) SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: RpcEptMapper - C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation) SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.) Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com) Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com) Drivers32: VIDC.XFR1 - C:\Windows\System32\xfcodec.dll () Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.) ========== Files/Folders - Created Within 30 Days ========== [2010.10.27 12:01:23 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\TS3Client [2010.10.27 11:58:28 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\TeamSpeak 3 Client [2010.10.26 14:16:09 | 000,000,000 | ---D | C] -- C:\Users\Tom\Desktop\Supernatural 5!! [2010.10.25 18:11:23 | 000,000,000 | ---D | C] -- C:\Users\Tom\Desktop\Injectors [2010.10.25 17:23:58 | 000,000,000 | ---D | C] -- C:\Users\Tom\Desktop\CoD4 1.7 AIMBOT [2010.10.25 16:49:48 | 000,000,000 | ---D | C] -- C:\Users\Tom\Desktop\musik [2010.10.25 16:49:36 | 000,000,000 | ---D | C] -- C:\Users\Tom\Desktop\Müll+exen [2010.10.22 13:04:04 | 000,000,000 | ---D | C] -- C:\Users\Tom\Documents\GTA Vice City User Files [2010.10.22 03:57:42 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2010.10.22 03:57:34 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010.10.22 03:57:31 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2010.10.22 03:57:31 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2010.10.22 03:57:31 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2010.10.22 03:57:31 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010.10.22 03:57:31 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010.10.22 03:57:31 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2010.10.22 03:57:31 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2010.10.22 03:57:31 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2010.10.22 03:57:31 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2010.10.22 03:57:31 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2010.10.22 03:57:28 | 000,496,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll [2010.10.22 03:57:28 | 000,351,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll [2010.10.22 03:57:27 | 000,305,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll [2010.10.22 03:57:27 | 000,294,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2010.10.22 03:57:27 | 000,179,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\schtasks.exe [2010.10.22 03:57:27 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2010.10.22 03:57:26 | 000,314,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webio.dll [2010.10.22 03:56:38 | 000,101,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe [2010.10.22 03:56:27 | 002,327,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2010.10.20 16:10:03 | 000,000,000 | ---D | C] -- C:\Users\Tom\Documents\Battlefield Heroes [2010.10.20 15:38:02 | 000,000,000 | ---D | C] -- C:\Programme\EA Games [2010.10.17 16:55:01 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\Gearbox Software [2010.10.11 20:54:27 | 000,000,000 | ---D | C] -- C:\Programme\OpenOffice [2010.10.11 13:43:59 | 000,000,000 | ---D | C] -- C:\Programme\Rockstar Games [2010.10.11 10:05:31 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2010.10.11 10:02:25 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools [2010.10.10 06:44:53 | 000,209,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tabctl32.ocx [2010.10.10 06:44:52 | 000,109,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mswinsck.ocx [2010.10.10 06:44:51 | 002,271,152 | ---- | C] (Codejock Software) -- C:\Windows\System32\Codejock.CommandBars.Unicode.v12.1.1.ocx [2010.10.10 06:44:51 | 000,132,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSINET.OCX [2010.10.10 06:44:46 | 001,779,632 | ---- | C] (Codejock Software) -- C:\Windows\System32\Codejock.Controls.v12.1.1.ocx [2010.10.10 06:44:44 | 000,000,000 | ---D | C] -- C:\Programme\CoD RconTool [2010.10.07 21:21:19 | 000,000,000 | ---D | C] -- C:\Users\Tom\Documents\GTA San Andreas User Files [2010.10.05 17:47:57 | 000,031,552 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe [2010.10.05 17:47:53 | 000,029,504 | ---- | C] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll [2010.10.05 17:47:53 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll [2010.10.05 17:46:36 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\TuneUp Software [2010.10.05 17:46:21 | 000,000,000 | ---D | C] -- C:\Programme\TuneUp Utilities 2011 [2010.10.05 17:45:11 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software [2010.10.05 17:44:49 | 000,000,000 | -HSD | C] -- C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16} [2010.10.05 17:38:14 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\Malwarebytes [2010.10.05 17:37:55 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.10.05 17:37:54 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.10.05 17:37:54 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.10.05 17:37:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.10.03 20:19:09 | 000,000,000 | ---D | C] -- C:\Users\Tom\Documents\My Received Files [2010.10.03 20:19:09 | 000,000,000 | ---D | C] -- C:\Users\Tom\Documents\BearShare [2010.10.03 20:19:09 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\BearShare [2010.10.03 20:17:38 | 000,000,000 | ---D | C] -- C:\Programme\BearShare Applications [2010.10.03 20:17:38 | 000,000,000 | ---D | C] -- C:\ProgramData\BearShare [2010.10.03 20:17:10 | 000,000,000 | -H-D | C] -- C:\ProgramData\{A471C4AE-B27B-4761-9BCF-82FAAAAA2D01} [2010.10.03 20:16:56 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\PackageAware [2010.10.01 18:05:20 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2010.10.01 18:05:20 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2010.10.01 18:05:20 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2010.10.01 07:25:55 | 000,641,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CPFilters.dll [2010.10.01 07:25:55 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdri.dll [2010.10.01 07:25:54 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax [2010.10.01 07:25:54 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax [2010.10.01 07:25:36 | 000,026,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\Diskdump.sys [2010.09.22 20:02:18 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll [2010.09.22 20:02:12 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll [2010.09.22 20:02:12 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll [2010.09.22 20:01:59 | 012,625,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL [2010.09.22 20:01:55 | 000,738,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll [2010.09.22 20:01:49 | 000,363,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\StructuredQuery.dll [2010.09.20 15:28:38 | 000,000,000 | ---D | C] -- C:\Programme\Wise Registry Cleaner [2010.09.20 14:02:45 | 000,000,000 | ---D | C] -- C:\Programme\Moongamer's [2010.09.20 13:43:52 | 000,000,000 | -HSD | C] -- C:\Windows\ftpcache [2010.09.18 19:14:24 | 000,000,000 | ---D | C] -- C:\Programme\Risk [2010.09.18 19:12:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2010.09.18 19:12:32 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java [2010.09.18 19:12:12 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll [2010.09.18 19:11:52 | 000,000,000 | ---D | C] -- C:\Programme\Java [2010.09.17 21:23:39 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\Google [2010.09.16 12:29:21 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft.NET [2010.09.15 18:24:43 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_33.dll [2010.09.15 18:24:43 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_33.dll [2010.09.15 18:24:43 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_33.dll [2010.09.15 18:24:43 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_7.dll [2010.09.15 18:24:43 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_6.dll [2010.09.15 18:24:43 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_5.dll [2010.09.15 18:24:42 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_32.dll [2010.09.15 18:24:42 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10.dll [2010.09.15 18:24:42 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_4.dll [2010.09.15 18:24:42 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_3.dll [2010.09.15 18:24:42 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_2.dll [2010.09.15 18:24:42 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_1.dll [2010.09.15 18:24:42 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_2.dll [2010.09.15 18:24:42 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_1.dll [2010.09.15 18:24:42 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\x3daudio1_1.dll [2010.09.15 18:24:37 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_30.dll [2010.09.15 18:24:37 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_29.dll [2010.09.15 18:24:37 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_28.dll [2010.09.15 18:24:37 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_27.dll [2010.09.15 18:24:37 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_26.dll [2010.09.15 18:24:37 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_0.dll [2010.09.15 18:24:37 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\x3daudio1_0.dll [2010.09.15 18:24:36 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_24.dll [2010.09.15 03:00:28 | 000,000,000 | ---D | C] -- C:\Programme\MSXML 4.0 [2010.09.14 19:04:59 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt [2010.09.14 16:42:10 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\InstallShield [2010.09.14 14:43:43 | 000,000,000 | ---D | C] -- C:\Users\Tom\Documents\My Games [2010.09.14 14:28:15 | 000,000,000 | ---D | C] -- C:\Users\Tom\Documents\My Downloads [2010.09.14 14:24:53 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\GameSpy [2010.09.14 14:24:44 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\ApplicationHistory [2010.09.14 14:24:10 | 000,000,000 | ---D | C] -- C:\Programme\GameSpy [2010.09.14 14:22:17 | 000,000,000 | ---D | C] -- C:\Windows\System32\URTTEMP [2010.09.14 14:20:59 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_35.dll [2010.09.14 14:20:58 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_35.dll [2010.09.14 14:20:58 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_34.dll [2010.09.14 14:20:58 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_35.dll [2010.09.14 14:20:58 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_34.dll [2010.09.14 14:20:58 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_34.dll [2010.09.14 14:20:57 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_3.dll [2010.09.14 12:08:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts [2010.09.13 17:15:52 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\Nero [2010.09.13 17:15:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero [2010.09.13 17:14:59 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Nero [2010.09.13 17:14:52 | 000,000,000 | ---D | C] -- C:\Programme\Nero [2010.09.13 17:11:13 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Silverlight [2010.09.13 17:01:06 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\Canneverbe Limited [2010.09.13 17:01:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited [2010.09.13 16:48:33 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\DeepBurner [2010.09.13 16:48:27 | 000,000,000 | ---D | C] -- C:\Programme\Astonsoft [2010.09.13 12:06:11 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft WSE [2010.09.13 12:05:05 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_31.dll [2010.09.13 11:55:22 | 000,000,000 | ---D | C] -- C:\Programme\Electronic Arts [2010.09.12 19:03:09 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\Fallout3 [2010.09.12 12:30:58 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\Diagnostics [2010.09.12 12:29:31 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\ElevatedDiagnostics [2010.09.12 11:32:18 | 000,000,000 | ---D | C] -- C:\Programme\PeerGuardian2 [2010.09.12 11:15:40 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\Foxit Software [2010.09.12 02:13:36 | 000,000,000 | ---D | C] -- C:\Programme\Bethesda Softworks [2010.09.12 02:13:35 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_1.dll [2010.09.12 02:13:35 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_1.dll [2010.09.12 02:13:35 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_0.dll [2010.09.12 02:13:35 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_4.dll [2010.09.12 02:13:34 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_38.dll [2010.09.12 02:13:34 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_38.dll [2010.09.12 02:13:34 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_0.dll [2010.09.12 02:13:34 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_38.dll [2010.09.12 02:13:34 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_0.dll [2010.09.12 02:13:34 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_3.dll [2010.09.12 02:13:33 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_37.dll [2010.09.12 02:13:33 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_36.dll [2010.09.12 02:13:33 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_37.dll [2010.09.12 02:13:33 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_36.dll [2010.09.12 02:13:33 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_37.dll [2010.09.12 02:13:33 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_36.dll [2010.09.12 02:13:33 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_10.dll [2010.09.12 02:13:32 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_9.dll [2010.09.12 02:13:29 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_8.dll [2010.09.12 02:13:29 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_2.dll [2010.09.12 02:10:43 | 000,000,000 | ---D | C] -- C:\Programme\Furry [2010.09.12 02:03:47 | 000,000,000 | ---D | C] -- C:\Windows\System32\xlive [2010.09.11 16:26:36 | 000,000,000 | ---D | C] -- C:\Windows\Minidump [2010.09.10 17:14:10 | 000,330,344 | ---- | C] (Mirko Böer) -- C:\Windows\RCoUn.EXE [2010.09.10 17:13:18 | 000,000,000 | ---D | C] -- C:\Programme\RouterControl [2010.09.09 22:06:35 | 000,190,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ks.sys [2010.09.08 18:10:44 | 000,000,000 | ---D | C] -- C:\Programme\Turok3 [2010.09.07 21:06:39 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Games [2010.09.07 19:07:36 | 000,186,920 | ---- | C] ( ) -- C:\Windows\System32\rsnp2uvc.dll [2010.09.07 19:07:35 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\SNP2UVC [2010.09.07 19:07:32 | 000,000,000 | -H-D | C] -- C:\Programme\InstallShield Installation Information [2010.09.07 19:07:05 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\InstallShield [2010.09.06 22:37:56 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe [2010.09.06 22:37:56 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll [2010.09.06 22:37:56 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll [2010.09.06 22:32:36 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe [2010.09.06 22:14:57 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\Xfire [2010.09.06 22:14:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Xfire [2010.09.06 22:14:49 | 000,000,000 | ---D | C] -- C:\Programme\Xfire [2010.09.06 16:18:43 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\WinRAR [2010.09.06 16:18:31 | 000,000,000 | ---D | C] -- C:\Programme\WinRAR [2010.09.06 03:12:00 | 000,197,632 | ---- | C] (Intel(R) Corporation) -- C:\Windows\System32\ir32_32.dll [2010.09.06 03:12:00 | 000,082,944 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll [2010.09.06 03:11:59 | 002,614,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe [2010.09.06 03:11:52 | 001,037,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\lsasrv.dll [2010.09.06 03:11:52 | 000,133,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ksecpkg.sys [2010.09.06 03:11:48 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll [2010.09.06 03:11:33 | 001,320,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CertEnroll.dll [2010.09.06 03:11:32 | 000,507,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winload.exe [2010.09.06 03:11:32 | 000,442,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winresume.exe [2010.09.06 03:11:25 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll [2010.09.06 03:11:20 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll [2010.09.06 03:11:14 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll [2010.09.06 03:11:09 | 001,328,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll [2010.09.06 03:11:09 | 000,091,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\avifil32.dll [2010.09.06 03:11:09 | 000,084,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciavi32.dll [2010.09.06 03:11:05 | 003,899,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2010.09.06 03:11:04 | 003,955,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2010.09.06 03:10:53 | 000,427,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll [2010.09.06 03:10:52 | 000,369,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll [2010.09.06 03:10:52 | 000,365,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll [2010.09.06 03:10:52 | 000,324,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe [2010.09.06 03:10:52 | 000,320,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe [2010.09.06 03:10:52 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll [2010.09.06 03:10:52 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll [2010.09.06 03:10:51 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe [2010.09.06 03:10:51 | 000,277,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe [2010.09.06 03:07:43 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll [2010.09.05 19:38:15 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\vlc [2010.09.05 19:37:23 | 000,000,000 | ---D | C] -- C:\Programme\VideoLAN [2010.09.05 18:07:35 | 000,000,000 | ---D | C] -- C:\Programme\PowerISO [2010.09.05 17:52:00 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\DivX [2010.09.05 17:51:37 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\PX Storage Engine [2010.09.05 17:50:57 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\DivX Shared [2010.09.05 17:49:01 | 000,000,000 | ---D | C] -- C:\Programme\DivX [2010.09.05 17:48:28 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX [2010.09.05 15:08:05 | 000,000,000 | ---D | C] -- C:\Programme\Conduit [2010.09.05 15:08:04 | 000,000,000 | ---D | C] -- C:\Programme\softonic-de3 [2010.09.05 15:07:19 | 000,000,000 | ---D | C] -- C:\Programme\HyCam2 [2010.09.05 14:39:37 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\ProgSense [2010.09.05 14:35:23 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\PunkBuster [2010.09.05 14:28:30 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\Macromedia [2010.09.05 14:28:30 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\Adobe [2010.09.05 14:28:21 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed [2010.09.05 14:28:06 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee Security Scan [2010.09.05 14:28:06 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee [2010.09.05 14:28:02 | 000,000,000 | ---D | C] -- C:\Programme\McAfee Security Scan [2010.09.05 14:18:58 | 000,000,000 | ---D | C] -- C:\Programme\uTorrent [2010.09.05 14:18:28 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\uTorrent [2010.09.05 14:16:45 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\GrabPro [2010.09.05 14:16:40 | 000,000,000 | ---D | C] -- C:\Programme\Orbitdownloader [2010.09.05 14:16:40 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\Orbit [2010.09.05 14:11:51 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner [2010.09.05 14:10:27 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2010.09.05 14:06:45 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\Mozilla [2010.09.05 14:06:45 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\Mozilla [2010.09.05 14:06:35 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox [2010.09.05 13:59:07 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\Skype [2010.09.05 13:56:45 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\OpenOffice.org [2010.09.05 11:45:09 | 000,222,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [2010.09.05 11:39:18 | 000,000,000 | ---D | C] -- C:\Windows\Panther [2010.09.05 11:29:51 | 000,000,000 | R--D | C] -- C:\Users\Tom\Searches [2010.09.05 11:29:27 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\Identities [2010.09.05 11:29:17 | 000,000,000 | R--D | C] -- C:\Users\Tom\Contacts [2010.09.05 11:28:37 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\VirtualStore [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\Vorlagen [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\AppData\Local\Verlauf [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\AppData\Local\Temporary Internet Files [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\Startmenü [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\SendTo [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\Recent [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\Netzwerkumgebung [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\Lokale Einstellungen [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\Documents\Eigene Videos [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\Documents\Eigene Musik [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\Eigene Dateien [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\Documents\Eigene Bilder [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\Druckumgebung [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\Cookies [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\AppData\Local\Anwendungsdaten [2010.09.05 11:28:32 | 000,000,000 | -HSD | C] -- C:\Users\Tom\Anwendungsdaten [2010.09.05 11:28:31 | 000,000,000 | --SD | C] -- C:\Users\Tom\AppData\Roaming\Microsoft [2010.09.05 11:28:31 | 000,000,000 | R--D | C] -- C:\Users\Tom\Videos [2010.09.05 11:28:31 | 000,000,000 | R--D | C] -- C:\Users\Tom\Saved Games [2010.09.05 11:28:31 | 000,000,000 | R--D | C] -- C:\Users\Tom\Pictures [2010.09.05 11:28:31 | 000,000,000 | R--D | C] -- C:\Users\Tom\Music [2010.09.05 11:28:31 | 000,000,000 | R--D | C] -- C:\Users\Tom\Links [2010.09.05 11:28:31 | 000,000,000 | R--D | C] -- C:\Users\Tom\Favorites [2010.09.05 11:28:31 | 000,000,000 | R--D | C] -- C:\Users\Tom\Downloads [2010.09.05 11:28:31 | 000,000,000 | R--D | C] -- C:\Users\Tom\Documents [2010.09.05 11:28:31 | 000,000,000 | R--D | C] -- C:\Users\Tom\Desktop [2010.09.05 11:28:31 | 000,000,000 | -H-D | C] -- C:\Users\Tom\AppData [2010.09.05 11:28:31 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\Temp [2010.09.05 11:28:31 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\Microsoft [2010.09.05 11:28:31 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\Media Center Programs [2010.09.05 11:27:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2010.09.05 11:27:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2010.09.05 11:27:52 | 000,000,000 | -HSD | C] -- C:\Recovery [2010.09.05 11:27:52 | 000,000,000 | -HSD | C] -- C:\Programme\Gemeinsame Dateien [2010.09.05 11:27:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2010.09.05 11:27:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2010.09.05 11:27:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2010.09.05 11:27:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2010.09.05 11:27:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2010.09.05 11:27:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2010.09.05 11:18:22 | 000,000,000 | ---D | C] -- C:\Windows.old [2010.09.05 11:05:42 | 000,057,752 | ---- | C] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.exe [2010.09.05 11:05:42 | 000,057,752 | ---- | C] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.dll [2010.09.05 11:04:50 | 000,013,160 | ---- | C] (Absolute Software Corp.) -- C:\Windows\System32\Upgrd.exe [2010.09.05 10:44:29 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2010.09.05 10:41:03 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch ========== Files - Modified Within 30 Days ========== [2010.12.20 09:04:22 | 183,371,906 | ---- | M] () -- C:\Users\Tom\Desktop\sof_two.and.a.half.men.s07e14.avi [2010.11.19 16:53:50 | 000,031,552 | ---- | M] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe [2010.11.19 16:49:12 | 000,021,312 | ---- | M] (TuneUp Software) -- C:\Windows\System32\authuitu.dll [2010.11.19 16:49:04 | 000,029,504 | ---- | M] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll [2010.11.04 07:49:27 | 000,606,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010.11.04 07:49:13 | 000,599,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2010.11.04 07:49:13 | 000,064,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2010.11.04 07:48:36 | 000,044,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2010.11.04 07:48:31 | 000,048,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2010.11.04 07:48:19 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2010.11.04 07:48:18 | 000,185,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010.11.04 07:48:12 | 000,381,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010.11.04 07:46:06 | 000,012,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2010.11.04 06:41:26 | 000,386,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2010.11.04 06:08:54 | 001,638,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2010.11.02 06:41:12 | 000,351,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll [2010.11.02 06:40:36 | 000,496,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll [2010.11.02 06:40:36 | 000,305,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll [2010.11.02 06:34:33 | 000,179,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\schtasks.exe [2010.10.27 11:58:33 | 000,001,203 | ---- | M] () -- C:\Users\Tom\Desktop\TeamSpeak 3 Client.lnk [2010.10.27 06:32:36 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2010.10.26 11:12:21 | 000,894,464 | ---- | M] () -- C:\Users\Tom\Desktop\[OSH]CoD4Hack.exe [2010.10.22 23:23:25 | 000,280,168 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.10.22 19:48:05 | 000,214,520 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex1 [2010.10.20 16:09:27 | 000,138,056 | ---- | M] () -- C:\Users\Tom\AppData\Roaming\PnkBstrK.sys [2010.10.20 06:54:18 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2010.10.20 05:00:24 | 002,327,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2010.10.20 04:58:41 | 000,294,400 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2010.10.19 10:41:44 | 000,222,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [2010.10.18 09:29:18 | 000,011,603 | ---- | M] () -- C:\Users\Tom\pbgame.htm [2010.10.17 20:21:12 | 000,000,135 | ---- | M] () -- C:\Users\Tom\pbuser.htm [2010.10.16 22:26:48 | 000,017,408 | ---- | M] () -- C:\Windows\System32\rpcnetp.dll [2010.10.16 06:41:02 | 000,101,760 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\consent.exe [2010.10.16 06:36:10 | 000,314,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\webio.dll [2010.10.01 17:56:34 | 733,802,496 | ---- | M] () -- C:\Users\Tom\Desktop\Wolfman.avi [2010.10.01 12:41:41 | 000,138,160 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2010.10.01 12:41:29 | 000,271,200 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr [2010.10.01 12:41:26 | 000,271,200 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex0 [2010.10.01 12:28:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1383492580-2228963269-1490800487-1001UA.job [2010.10.01 12:14:06 | 000,011,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010.10.01 12:14:06 | 000,011,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010.10.01 12:13:11 | 000,664,634 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.10.01 12:13:11 | 000,624,776 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.10.01 12:13:11 | 000,134,770 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.10.01 12:13:11 | 000,110,414 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.10.01 12:09:00 | 000,017,408 | ---- | M] () -- C:\Windows\System32\rpcnetp.exe [2010.10.01 12:08:58 | 000,057,752 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.dll [2010.10.01 12:08:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.10.01 12:08:49 | 1406,820,352 | -HS- | M] () -- C:\hiberfil.sys [2010.09.30 21:28:00 | 000,001,058 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1383492580-2228963269-1490800487-1001Core.job [2010.09.26 14:34:38 | 000,001,978 | ---- | M] () -- C:\Users\Public\Desktop\GTA San Andreas.lnk [2010.09.26 00:26:11 | 000,002,955 | ---- | M] () -- C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Moongamers Patch Switcher.lnk [2010.09.25 22:50:23 | 105,082,760 | ---- | M] () -- C:\Users\Tom\Desktop\clip0004.avi [2010.09.20 19:06:25 | 1578,506,756 | ---- | M] () -- C:\Users\Tom\Troja.ob! [2010.09.20 13:30:06 | 000,000,287 | ---- | M] () -- C:\Windows\game.ini [2010.09.15 04:50:52 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2010.09.15 04:50:51 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2010.09.15 04:50:49 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2010.09.15 04:50:37 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll [2010.09.14 16:35:24 | 000,000,000 | ---- | M] () -- C:\Users\Tom\AppData\Roaming\chrtmp [2010.09.14 14:24:44 | 000,000,091 | ---- | M] () -- C:\Users\Tom\AppData\Local\fusioncache.dat [2010.09.14 14:21:02 | 000,669,184 | ---- | M] () -- C:\Windows\System32\pbsvc.exe [2010.09.13 17:15:36 | 000,000,000 | ---- | M] () -- C:\Users\Tom\AppData\Roaming\.NANotifyHere [2010.09.13 17:07:06 | 000,002,560 | ---- | M] () -- C:\Windows\_MSRSTRT.EXE [2010.09.10 17:14:10 | 000,002,222 | R--- | M] () -- C:\Windows\RouterControl_Uninstall.in [2010.09.06 18:59:50 | 000,846,336 | ---- | M] () -- C:\Users\Tom\pbsetup.exe [2010.09.06 18:31:57 | 000,001,810 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2010.09.05 17:26:23 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf [2010.09.05 15:22:16 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2010.09.05 11:39:04 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK [2010.09.05 11:05:18 | 000,013,160 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\Upgrd.exe [2010.09.05 11:04:45 | 000,057,752 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.exe [2010.09.05 10:47:13 | 000,043,797 | ---- | M] () -- C:\Windows\System32\license.rtf [2010.09.05 10:45:44 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin ========== Files Created - No Company Name ========== [2010.10.27 11:58:33 | 000,001,203 | ---- | C] () -- C:\Users\Tom\Desktop\TeamSpeak 3 Client.lnk [2010.10.26 19:36:20 | 000,049,152 | ---- | C] () -- C:\Users\Tom\Desktop\Sims-3-keygen.exe [2010.10.26 19:36:19 | 006,820,667 | ---- | C] () -- C:\Users\Tom\Desktop\justDeleteMe [2010.10.26 12:55:21 | 183,371,906 | ---- | C] () -- C:\Users\Tom\Desktop\sof_two.and.a.half.men.s07e14.avi [2010.10.26 11:12:20 | 000,894,464 | ---- | C] () -- C:\Users\Tom\Desktop\[OSH]CoD4Hack.exe [2010.10.24 20:30:16 | 733,802,496 | ---- | C] () -- C:\Users\Tom\Desktop\Wolfman.avi [2010.10.06 16:08:00 | 000,031,744 | ---- | C] () -- C:\Users\Tom\Desktop\CoD4Hack.exe [2010.09.30 21:27:55 | 000,045,056 | ---- | C] () -- C:\Users\Tom\Desktop\wallhack.dll [2010.09.26 14:34:38 | 000,001,978 | ---- | C] () -- C:\Users\Public\Desktop\GTA San Andreas.lnk [2010.09.26 00:26:11 | 000,002,955 | ---- | C] () -- C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Moongamers Patch Switcher.lnk [2010.09.25 22:48:36 | 105,082,760 | ---- | C] () -- C:\Users\Tom\Desktop\clip0004.avi [2010.09.20 19:05:40 | 1578,506,756 | ---- | C] () -- C:\Users\Tom\Troja.ob! [2010.09.17 21:23:42 | 000,001,110 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1383492580-2228963269-1490800487-1001UA.job [2010.09.17 21:23:41 | 000,001,058 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1383492580-2228963269-1490800487-1001Core.job [2010.09.15 18:24:25 | 000,000,287 | ---- | C] () -- C:\Windows\game.ini [2010.09.14 16:35:24 | 000,000,000 | ---- | C] () -- C:\Users\Tom\AppData\Roaming\chrtmp [2010.09.14 14:24:44 | 000,000,091 | ---- | C] () -- C:\Users\Tom\AppData\Local\fusioncache.dat [2010.09.14 14:21:27 | 000,138,056 | ---- | C] () -- C:\Users\Tom\AppData\Roaming\PnkBstrK.sys [2010.09.14 14:21:02 | 000,669,184 | ---- | C] () -- C:\Windows\System32\pbsvc.exe [2010.09.13 17:15:36 | 000,000,000 | ---- | C] () -- C:\Users\Tom\AppData\Roaming\.NANotifyHere [2010.09.13 17:07:05 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE [2010.09.10 19:35:18 | 000,000,135 | ---- | C] () -- C:\Users\Tom\pbuser.htm [2010.09.10 19:35:11 | 000,011,603 | ---- | C] () -- C:\Users\Tom\pbgame.htm [2010.09.10 17:14:10 | 000,002,222 | R--- | C] () -- C:\Windows\RouterControl_Uninstall.in [2010.09.06 19:10:06 | 000,138,160 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2010.09.06 19:09:59 | 000,271,200 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe [2010.09.06 19:09:59 | 000,271,200 | ---- | C] () -- C:\Windows\System32\PnkBstrB.ex0 [2010.09.06 19:09:59 | 000,214,520 | ---- | C] () -- C:\Windows\System32\PnkBstrB.ex1 [2010.09.06 19:09:47 | 000,271,200 | ---- | C] () -- C:\Windows\System32\PnkBstrB.xtr [2010.09.06 19:09:42 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe [2010.09.06 18:58:52 | 000,846,336 | ---- | C] () -- C:\Users\Tom\pbsetup.exe [2010.09.05 17:26:23 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf [2010.09.05 15:22:16 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2010.09.05 14:28:03 | 000,001,810 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2010.09.05 10:45:44 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2010.09.05 10:42:05 | 000,017,408 | ---- | C] () -- C:\Windows\System32\rpcnetp.dll [2010.09.05 10:40:27 | 1406,820,352 | -HS- | C] () -- C:\hiberfil.sys [2010.09.05 10:40:25 | 000,017,408 | ---- | C] () -- C:\Windows\System32\rpcnetp.exe [2010.09.05 10:13:47 | 000,008,192 | RHS- | C] () -- C:\BOOTSECT.BAK [2010.07.09 21:00:32 | 000,041,872 | ---- | C] () -- C:\Windows\System32\xfcodec.dll [2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2007.11.26 21:56:28 | 000,151,415 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat ========== LOP Check ========== [2010.10.11 20:55:30 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\OpenOffice.org [2010.10.14 23:31:19 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\Orbit [2010.10.11 20:50:03 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\ProgSense [2010.10.13 15:00:01 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\TuneUp Software [2010.09.13 17:01:06 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Canneverbe Limited [2010.09.13 16:57:16 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\DeepBurner [2010.09.12 11:15:40 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Foxit Software [2010.09.05 14:16:45 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\GrabPro [2010.09.05 13:56:45 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\OpenOffice.org [2010.10.01 01:08:48 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Orbit [2010.09.05 14:39:38 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\ProgSense [2010.10.27 12:03:12 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\TS3Client [2010.10.05 17:46:36 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\TuneUp Software [2010.10.26 21:46:32 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\uTorrent [2010.10.01 20:19:14 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2010.09.05 14:28:30 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Adobe [2010.09.13 17:01:06 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Canneverbe Limited [2010.09.13 16:57:16 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\DeepBurner [2010.09.06 12:21:11 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\DivX [2010.09.12 11:15:40 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Foxit Software [2010.09.05 14:16:45 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\GrabPro [2010.09.05 11:29:27 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Identities [2010.09.07 19:07:05 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\InstallShield [2010.09.05 14:28:30 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Macromedia [2010.10.05 17:38:14 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Malwarebytes [2009.07.14 11:05:46 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Media Center Programs [2010.09.13 17:04:31 | 000,000,000 | --SD | M] -- C:\Users\Tom\AppData\Roaming\Microsoft [2010.10.03 20:21:12 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Mozilla [2010.09.13 17:15:52 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Nero [2010.09.05 13:56:45 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\OpenOffice.org [2010.10.01 01:08:48 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Orbit [2010.09.05 14:39:38 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\ProgSense [2010.10.01 12:09:29 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Skype [2010.10.27 12:03:12 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\TS3Client [2010.10.05 17:46:36 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\TuneUp Software [2010.10.26 21:46:32 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\uTorrent [2010.10.11 17:14:55 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\vlc [2010.09.06 16:18:43 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\WinRAR [2010.10.10 16:34:00 | 000,000,000 | ---D | M] -- C:\Users\Tom\AppData\Roaming\Xfire < %APPDATA%\*.exe /s > [2010.09.13 12:06:11 | 000,010,134 | R--- | M] () -- C:\Users\Tom\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe [2010.09.26 00:26:10 | 000,003,638 | R--- | M] () -- C:\Users\Tom\AppData\Roaming\Microsoft\Installer\{EE510252-96FC-49C1-AE63-36E1C49314CD}\_124305e.exe [2010.09.26 00:26:11 | 000,003,638 | R--- | M] () -- C:\Users\Tom\AppData\Roaming\Microsoft\Installer\{EE510252-96FC-49C1-AE63-36E1C49314CD}\_154754de.exe [2010.09.26 00:26:10 | 000,001,078 | R--- | M] () -- C:\Users\Tom\AppData\Roaming\Microsoft\Installer\{EE510252-96FC-49C1-AE63-36E1C49314CD}\_440d491c.exe [2010.09.26 00:26:11 | 000,003,638 | R--- | M] () -- C:\Users\Tom\AppData\Roaming\Microsoft\Installer\{EE510252-96FC-49C1-AE63-36E1C49314CD}\_4d064db7.exe [2010.08.19 23:46:28 | 001,312,120 | ---- | M] (EA Digital Illusions CE AB) -- C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\g50tb7h2.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe [2010.10.27 17:59:59 | 003,056,008 | ---- | M] (Ask) -- C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\g50tb7h2.default\extensions\toolbar@ask.com\chrome\temp\askToolbar.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys [2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys [2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys [2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys [2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll < MD5 for: EXPLORER.EXE > [2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\explorer.exe [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe [2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe [2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe [2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe < MD5 for: IASTORV.SYS > [2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys [2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys [2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll [2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll < MD5 for: USERINIT.EXE > [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe < MD5 for: WINLOGON.EXE > [2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe [2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe [2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe [2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys [2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > < End of report > |
|
27.12.2010, 15:47
| #4 |
| /// Malware-holic | IE ist infiziert bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu IE ist infiziert |
| ahnung, anti-malware, bösartige, dateien, editor, explorer, folge, folgendes, gefunde, infiziert, log, min, minute, neu, objekte, probiert, problem, registry, scan, stand, version, verzeichnisse, öffnet |
Linear-Darstellung
