Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: win 7 home security 2011, trojaner, spyware

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 15.05.2011, 12:46   #1
schneekappe
 
win 7 home security 2011, trojaner, spyware - Standard

win 7 home security 2011, trojaner, spyware



Hallo, ich habe wie viele anderen auch das Win 7 Home Security 2011 Problem. Ich hab das Malwarebytesprogramm wie vorgeschlagen installiert, und die Fehldateien gefunden und gelöscht. Nun läuft der Rechner immernoch langsamer als gewohnt und ich bin mir nicht sicher ob das Problem behoben wurde. Ich habe weiterhin noch 2 OTL-Berichte erstellt ...

Hier der aktuellste Bericht von Malware:

Datenbank Version: 6576
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
15.05.2011 13:42:06
mbam-log-2011-05-15 (13-42-06).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 169590
Laufzeit: 4 Minute(n), 23 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Alt 15.05.2011, 12:57   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
win 7 home security 2011, trojaner, spyware - Standard

win 7 home security 2011, trojaner, spyware



Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.
__________________

__________________

Alt 15.05.2011, 13:13   #3
schneekappe
 
win 7 home security 2011, trojaner, spyware - Standard

win 7 home security 2011, trojaner, spyware



Hi, Wow Danke für die schnelle Antwort ...

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6575

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.05.2011 11:20:42
mbam-log-2011-05-14 (11-20-42).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 169631
Laufzeit: 11 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 4
Infizierte Verzeichnisse: 1
Infizierte Dateien: 2

Infizierte Speicherprozesse:
c:\Users\di giorgio\AppData\Local\idt.exe (Trojan.ExeShell.Gen) -> 2364 -> Failed to unload process.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Value: (default) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Di Giorgio\AppData\Local\idt.exe" -a "C:\Program Files (x86)\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Di Giorgio\AppData\Local\idt.exe" -a "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Di Giorgio\AppData\Local\idt.exe" -a "C:\Program Files (x86)\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\exefile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("C:\Users\Di Giorgio\AppData\Local\idt.exe" -a "%1" %*) Good: ("%1" %*) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
c:\program files (x86)\relevantknowledge (Spyware.MarketScore) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\Users\di giorgio\AppData\Local\idt.exe (Trojan.ExeShell.Gen) -> Quarantined and deleted successfully.
c:\Users\di giorgio\downloads\adobeflashplayer_10.7.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.


******************************************


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6575

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.05.2011 14:34:50
mbam-log-2011-05-14 (14-34-50).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|J:\|)
Durchsuchte Objekte: 938247
Laufzeit: 2 Stunde(n), 5 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\di giorgio\AppData\Local\jbi.exe (Trojan.ExeShell.Gen) -> Quarantined and deleted successfully.



***************************************


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6575

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.05.2011 14:41:47
mbam-log-2011-05-14 (14-41-47).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 169231
Laufzeit: 3 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)




*************************************


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6576

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.05.2011 14:45:22
mbam-log-2011-05-14 (14-45-22).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 169347
Laufzeit: 2 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


****************************************

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6576

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.05.2011 16:02:49
mbam-log-2011-05-14 (16-02-49).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|J:\|)
Durchsuchte Objekte: 631688
Laufzeit: 1 Stunde(n), 17 Minute(n), 3 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


***********************

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6576

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

15.05.2011 13:42:06
mbam-log-2011-05-15 (13-42-06).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 169590
Laufzeit: 4 Minute(n), 23 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
__________________

Alt 15.05.2011, 14:31   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
win 7 home security 2011, trojaner, spyware - Standard

win 7 home security 2011, trojaner, spyware



CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Starte bitte die OTL.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere nun den Inhalt in die Textbox.
Code:
ATTFilter
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Klick auf .
  • Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 15.05.2011, 15:24   #5
schneekappe
 
win 7 home security 2011, trojaner, spyware - Standard

win 7 home security 2011, trojaner, spyware



Hab die files hochgeladen ...


Alt 15.05.2011, 15:36   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
win 7 home security 2011, trojaner, spyware - Standard

win 7 home security 2011, trojaner, spyware



Wo hochgeladen?
__________________
--> win 7 home security 2011, trojaner, spyware

Alt 15.05.2011, 16:29   #7
schneekappe
 
win 7 home security 2011, trojaner, spyware - Standard

win 7 home security 2011, trojaner, spyware



Habs als Anhang angehängt ---> logfiles

Alt 15.05.2011, 16:30   #8
schneekappe
 
win 7 home security 2011, trojaner, spyware - Standard

win 7 home security 2011, trojaner, spyware



OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 15.05.2011 15:53:06 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\Di Giorgio\Downloads
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 62,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 342,43 Gb Total Space | 276,11 Gb Free Space | 80,63% Space Free | Partition Type: NTFS
Drive D: | 342,43 Gb Total Space | 157,77 Gb Free Space | 46,07% Space Free | Partition Type: NTFS
Drive E: | 395,06 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive G: | 465,65 Gb Total Space | 439,32 Gb Free Space | 94,35% Space Free | Partition Type: FAT32
Drive J: | 298,09 Gb Total Space | 261,07 Gb Free Space | 87,58% Space Free | Partition Type: NTFS
 
Computer Name: DIGIORGIO-2010 | User Name: Di Giorgio | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.05.15 15:51:52 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Di Giorgio\Downloads\OTL.exe
PRC - [2011.04.30 21:21:08 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.22 20:37:06 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\Winamp\winampa.exe
PRC - [2011.03.21 12:29:30 | 000,145,504 | ---- | M] (B.H.A Corporation) -- C:\Windows\SysWOW64\bgsvcgen.exe
PRC - [2011.03.17 19:10:28 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.03.16 05:57:44 | 000,415,072 | ---- | M] () -- C:\Program Files (x86)\Dyyno\Dyyno Broadcaster\launcherd.exe
PRC - [2011.03.09 13:29:16 | 000,366,000 | ---- | M] (Eastman Kodak Company) -- C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
PRC - [2010.11.06 11:27:37 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2009.09.10 15:42:46 | 000,305,448 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
PRC - [2009.08.28 11:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
PRC - [2009.08.13 00:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2009.07.04 03:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2009.05.06 19:53:50 | 001,220,608 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.05.15 15:51:52 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Di Giorgio\Downloads\OTL.exe
MOD - [2010.08.21 07:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009.11.18 07:45:38 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2011.05.09 22:22:13 | 000,403,240 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.04.30 21:21:08 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.21 12:29:30 | 000,145,504 | ---- | M] (B.H.A Corporation) [Auto | Running] -- C:\Windows\SysWOW64\bgsvcgen.exe -- (bgsvcgen)
SRV - [2011.03.17 19:10:28 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.03.16 05:57:44 | 000,415,072 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Dyyno\Dyyno Broadcaster\launcherd.exe -- (Dyyno Launcher)
SRV - [2011.03.09 13:29:16 | 000,366,000 | ---- | M] (Eastman Kodak Company) [Auto | Running] -- C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe -- (Kodak AiO Network Discovery Service)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.09.10 15:42:46 | 000,305,448 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)
SRV - [2009.08.28 11:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009.08.25 19:38:06 | 000,935,208 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.08.13 00:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2009.07.04 03:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.05.06 19:53:50 | 001,220,608 | ---- | M] (MAGIX AG) [Unknown | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)
SRV - [2009.04.19 17:34:48 | 000,625,184 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM)
SRV - [2009.04.19 17:34:48 | 000,207,904 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)
SRV - [2008.08.07 12:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2007.12.04 19:31:02 | 000,020,480 | ---- | M] (Script Soft eK) [Auto | Running] -- C:\Program Files (x86)\LOADSTREET\WinSpeedUp 3\CleanRAMService.exe -- (WLCleanRAM)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.23 23:22:29 | 000,083,120 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2010.08.13 18:11:40 | 000,311,968 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2010.08.13 18:10:07 | 000,043,168 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2010.08.12 13:07:50 | 000,350,952 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2010.07.21 17:58:50 | 000,045,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2010.06.19 09:36:04 | 000,017,920 | ---- | M] (Siliten) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\InputFilter_FlexDef2b.sys -- (InputFilter_Hid_FlexDef2b) Siliten HID Devices(FlexDef2b)
DRV:64bit: - [2010.04.18 17:36:42 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010.03.02 13:35:01 | 000,116,568 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2009.11.18 08:21:18 | 006,171,136 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009.09.30 03:34:30 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009.06.10 22:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.02 13:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.02 13:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.02 13:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009.05.06 01:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009.05.06 01:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2007.03.19 17:02:32 | 000,049,664 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RLVrtAuCbl.sys -- (ReallusionVirtualAudio)
DRV - [2011.03.21 12:29:30 | 000,033,408 | ---- | M] (B.H.A Corporation) [Kernel | System | Stopped] -- C:\Windows\SysWow64\drivers\CDRBSDRV.SYS -- (cdrbsdrv)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360410kn07974580t65bh4j12w6p
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360410kn07974580t65bh4j12w6p
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360410kn07974580t65bh4j12w6p
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360410kn07974580t65bh4j12w6p
IE - HKLM\..\URLSearchHook: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Program Files (x86)\BittorrentBar_DE\tbBitt.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360410kn07974580t65bh4j12w6p
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\URLSearchHook: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Program Files (x86)\BittorrentBar_DE\tbBitt.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://google.de"
 
FF - HKLM\software\mozilla\Firefox\Extensions\\FFToolbar@bitdefender.com: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.01 11:02:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.27 17:03:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.14\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.01 11:02:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.14\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.27 17:03:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.01 11:02:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.27 17:03:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.01 11:02:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.27 17:03:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.01 11:02:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.27 17:03:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.01 11:02:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.27 17:03:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.04.29 01:30:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2011.04.21 19:15:59 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\Program Files\BitDefender\BitDefender 2010\bdtbext\
 
[2011.04.21 18:57:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Extensions
[2010.04.13 13:02:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.04.21 18:57:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Firefox\Profiles\3aylafpa.default\extensions
[2011.04.21 18:57:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Firefox\Profiles\3aylafpa.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2011.02.12 09:52:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Firefox\Profiles\74iw538f.default\extensions
[2011.02.12 09:52:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Firefox\Profiles\74iw538f.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2011.05.14 23:57:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Firefox\Profiles\spsnus7o.default\extensions
[2011.05.07 16:35:39 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Firefox\Profiles\spsnus7o.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2011.04.21 19:00:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.02.21 16:18:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.02.12 13:26:52 | 000,000,000 | ---D | M] (Yummy Games Player) -- C:\Program Files (x86)\mozilla firefox\extensions\YPlayer@yummy.net
File not found (No name found) -- 
() (No name found) -- C:\USERS\DI GIORGIO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SPSNUS7O.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
() (No name found) -- C:\USERS\DI GIORGIO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SPSNUS7O.DEFAULT\EXTENSIONS\{C45C406E-AB73-11D8-BE73-000A95BE3B12}.XPI
() (No name found) -- C:\USERS\DI GIORGIO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SPSNUS7O.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\DI GIORGIO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SPSNUS7O.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI
() (No name found) -- C:\USERS\DI GIORGIO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SPSNUS7O.DEFAULT\EXTENSIONS\YOUTUBE2MP3@MONDAYX.DE.XPI
[2011.05.01 11:02:50 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.02.02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.03.22 20:38:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (BittorrentBar_DE Toolbar) - {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Program Files (x86)\BittorrentBar_DE\tbBitt.dll (Conduit Ltd.)
O2 - BHO: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKLM\..\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (BittorrentBar_DE Toolbar) - {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Program Files (x86)\BittorrentBar_DE\tbBitt.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (BittorrentBar_DE Toolbar) - {64EAD72B-FFD4-4E01-AA3A-4C71665D73E4} - C:\Program Files (x86)\BittorrentBar_DE\tbBitt.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Conime]  File not found
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx (WRC Class)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.09.30 13:09:27 | 000,000,044 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{3cee0917-4b06-11df-a2b5-00262d203210}\Shell - "" = AutoRun
O33 - MountPoints2\{3cee0917-4b06-11df-a2b5-00262d203210}\Shell\AutoRun\command - "" = F:\CitiesXL2011.exe
O33 - MountPoints2\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\Shell\AutoRun\command - "" = E:\START.EXE -- [2010.09.30 12:50:11 | 002,775,202 | R--- | M] (Macromedia, Inc.)
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKCU\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- "%1" %*
 
 
MsConfig:64bit - StartUpReg: Conime - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: EKIJ5000StatusMonitor - hkey= - key= - C:\Windows\SysNative\spool\drivers\x64\3\EKIJ5000MUI.exe (Eastman Kodak Company)
MsConfig:64bit - StartUpReg: WinampAgent - hkey= - key= - C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: mcmscsvc - Service
SafeBootMin:64bit: MCODS - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: mcmscsvc - Service
SafeBootMin: MCODS - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: mcmscsvc - Service
SafeBootNet:64bit: MCODS - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: MpfService - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: mcmscsvc - Service
SafeBootNet: MCODS - Service
SafeBootNet: Messenger - Service
SafeBootNet: MpfService - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {68FCA9B0-CC74-A218-C7BE-0BE61C497E88} - Browser Customizations
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {9EA9D76F-CC51-5564-6C54-FEA6D102B79E} - Offline Browsing Pack
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.2
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.2
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C07FCB49-7A8A-A990-B602-21DB7644355B} - Microsoft VM
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.05.14 11:04:57 | 000,000,000 | ---D | C] -- C:\Users\Di Giorgio\AppData\Roaming\Malwarebytes
[2011.05.14 11:04:41 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011.05.14 11:04:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.05.14 11:04:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.05.14 11:04:35 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.05.14 11:04:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.05.14 10:24:37 | 000,000,000 | -HSD | C] -- C:\Users\Di Giorgio\Documents\.BackupManager
[2011.05.14 10:24:36 | 000,000,000 | -HSD | C] -- C:\Users\Di Giorgio\.BackupManager
[2011.05.14 10:24:35 | 000,000,000 | -HSD | C] -- C:\.uuid
[2011.05.14 10:24:35 | 000,000,000 | ---D | C] -- C:\Users\Di Giorgio\IOption
[2011.05.14 10:19:40 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2011.05.09 22:20:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2011.05.09 22:20:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Steam
[2011.05.08 15:47:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\kodak
[2011.05.04 02:18:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Focus Home Interactive
[2011.05.04 02:17:16 | 000,000,000 | ---D | C] -- C:\Users\Di Giorgio\AppData\Local\Focus Home Interactive
[2011.04.29 17:26:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2011.04.29 17:26:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7-Zip
[2011.04.29 17:25:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Focus Home Interactive
[2011.04.23 14:19:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SHOUTcast
[2011.04.23 14:11:58 | 000,000,000 | ---D | C] -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DRS 2006
[2011.04.23 14:11:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Borland Shared
[2011.04.23 14:11:53 | 000,000,000 | ---D | C] -- C:\DRS2006
[2011.04.18 08:37:41 | 000,000,000 | ---D | C] -- C:\Users\Di Giorgio\AppData\Roaming\elsterformular
[2011.04.18 08:37:22 | 000,000,000 | ---D | C] -- C:\ProgramData\elsterformular
[2011.04.18 08:37:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular
[2011.04.18 08:36:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ElsterFormular
[2009.10.17 04:04:41 | 000,036,136 | ---- | C] (Oberon Media) -- C:\ProgramData\FullRemove.exe
 
========== Files - Modified Within 30 Days ==========
 
[2011.05.15 15:25:00 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.05.15 13:56:24 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.05.15 13:56:24 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.05.15 13:54:18 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.05.15 13:54:18 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.05.15 13:54:18 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.05.15 13:54:18 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.05.15 13:54:18 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.05.15 13:49:15 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.05.15 13:48:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.05.15 13:48:54 | 1609,469,952 | -HS- | M] () -- C:\hiberfil.sys
[2011.05.14 11:05:15 | 000,011,820 | -HS- | M] () -- C:\ProgramData\rs4cm4n2c8jl4hl47h2oo5nj33ef2824
[2011.05.14 11:05:15 | 000,011,820 | -HS- | M] () -- C:\Users\Di Giorgio\AppData\Local\2501828141
[2011.05.14 10:56:07 | 000,011,820 | -HS- | M] () -- C:\Users\Di Giorgio\AppData\Local\rs4cm4n2c8jl4hl47h2oo5nj33ef2824
[2011.05.14 09:41:44 | 000,000,740 | ---- | M] () -- C:\Users\Di Giorgio\Documents\cc_20110514_094139.reg
[2011.05.14 08:34:10 | 000,028,282 | ---- | M] () -- C:\Users\Di Giorgio\Documents\cc_20110514_083407.reg
[2011.05.14 08:24:31 | 000,001,025 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.05.11 09:26:26 | 000,441,722 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\ITK_Sieger_cms2007.pdf
[2011.05.11 09:26:22 | 000,252,772 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\Arbeitsreferenz_GianlucaDiGiorgio_v1.pdf
[2011.05.11 09:26:13 | 000,024,535 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\faehigkeiten.pdf
[2011.05.11 09:26:10 | 000,017,495 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\anschreiben.pdf
[2011.05.08 15:35:08 | 000,350,260 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\zertifikat php.pdf
[2011.05.08 07:47:30 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\Driver Fetch.job
[2011.04.27 15:29:56 | 000,085,558 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\Curriculum_di_Giorgio_Gianluca.pdf
[2011.04.27 15:27:38 | 000,046,769 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\Bewerbung_di_Giorgio.odt
[2011.04.27 15:13:34 | 000,019,136 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\Bewerbung.odt
[2011.04.23 19:15:44 | 003,894,992 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.04.23 14:15:20 | 000,001,810 | ---- | M] () -- C:\Windows\DatabaseUtilityD.INI
[2011.04.21 19:56:39 | 000,048,586 | ---- | M] () -- C:\Users\Di Giorgio\Documents\cc_20110421_195634.reg
 
========== Files Created - No Company Name ==========
 
[2011.05.14 10:21:49 | 000,011,820 | -HS- | C] () -- C:\Users\Di Giorgio\AppData\Local\2501828141
[2011.05.14 09:41:42 | 000,000,740 | ---- | C] () -- C:\Users\Di Giorgio\Documents\cc_20110514_094139.reg
[2011.05.14 09:10:47 | 000,011,820 | -HS- | C] () -- C:\Users\Di Giorgio\AppData\Local\rs4cm4n2c8jl4hl47h2oo5nj33ef2824
[2011.05.14 09:10:47 | 000,011,820 | -HS- | C] () -- C:\ProgramData\rs4cm4n2c8jl4hl47h2oo5nj33ef2824
[2011.05.14 08:34:08 | 000,028,282 | ---- | C] () -- C:\Users\Di Giorgio\Documents\cc_20110514_083407.reg
[2011.05.14 08:24:31 | 000,001,025 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.05.11 09:26:26 | 000,441,722 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\ITK_Sieger_cms2007.pdf
[2011.05.11 09:26:12 | 000,024,535 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\faehigkeiten.pdf
[2011.05.11 09:26:06 | 000,017,495 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\anschreiben.pdf
[2011.05.08 15:35:08 | 000,350,260 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\zertifikat php.pdf
[2011.04.27 15:29:55 | 000,085,558 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\Curriculum_di_Giorgio_Gianluca.pdf
[2011.04.27 15:27:36 | 000,046,769 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\Bewerbung_di_Giorgio.odt
[2011.04.27 15:19:07 | 000,252,772 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\Arbeitsreferenz_GianlucaDiGiorgio_v1.pdf
[2011.04.27 15:07:10 | 000,019,136 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\Bewerbung.odt
[2011.04.23 14:15:20 | 000,001,810 | ---- | C] () -- C:\Windows\DatabaseUtilityD.INI
[2011.04.21 19:56:36 | 000,048,586 | ---- | C] () -- C:\Users\Di Giorgio\Documents\cc_20110421_195634.reg
[2011.04.21 19:00:26 | 000,001,154 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.04.07 19:00:17 | 000,000,352 | ---- | C] () -- C:\Users\Di Giorgio\AppData\Roaming\burnaware.ini
[2011.04.03 16:12:32 | 000,372,736 | ---- | C] () -- C:\Windows\SysWow64\RSLSP.dll
[2011.03.28 18:15:42 | 000,000,138 | ---- | C] () -- C:\Windows\cdplayer.ini
[2011.03.28 18:02:26 | 000,001,378 | ---- | C] () -- C:\ProgramData\ss.ini
[2011.03.27 00:51:18 | 000,000,023 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2011.03.26 18:50:20 | 000,000,052 | ---- | C] () -- C:\Windows\videodeLuxe.INI
[2011.03.26 18:48:08 | 000,019,968 | ---- | C] () -- C:\Windows\SysWow64\cpuinf32.dll
[2011.03.26 18:41:52 | 000,001,208 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2011.03.26 14:58:35 | 000,000,080 | RHS- | C] () -- C:\Windows\CT4CET.bin
[2011.03.09 20:54:42 | 000,000,028 | ---- | C] () -- C:\Windows\Robota.INI
[2011.03.05 21:45:35 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2011.02.12 09:59:03 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.12.13 20:56:40 | 000,005,120 | ---- | C] () -- C:\Users\Di Giorgio\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.11.24 08:12:57 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.09.18 13:40:21 | 000,000,015 | ---- | C] () -- C:\Users\Di Giorgio\AppData\Roaming\sys386ll.dat
[2010.09.18 13:39:39 | 000,000,010 | ---- | C] () -- C:\Users\Di Giorgio\AppData\Roaming\hhxprot5
[2010.06.12 12:47:00 | 000,000,025 | ---- | C] () -- C:\Users\Di Giorgio\AppData\Roaming\bdfvconp.ini
[2010.05.16 21:28:22 | 000,373,248 | ---- | C] () -- C:\Windows\EyeCand3.INI
[2010.05.16 17:09:57 | 000,000,025 | ---- | C] () -- C:\Windows\SIERRA.INI
[2010.05.02 20:55:38 | 000,049,152 | ---- | C] () -- C:\Windows\amcap.exe
[2010.04.14 19:46:13 | 000,000,127 | ---- | C] () -- C:\Windows\wininit.ini
[2010.04.13 15:16:13 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.04.10 19:21:34 | 000,001,040 | ---- | C] () -- C:\Users\Di Giorgio\AppData\Roaming\wklnhst.dat
[2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2007.03.26 10:45:18 | 000,071,208 | ---- | C] () -- C:\Windows\SysWow64\PhysXLoader.dll
[2007.02.20 14:59:08 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll
[2007.02.20 14:59:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2007.02.20 14:59:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll
[2007.02.20 14:59:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2007.02.20 14:59:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll
[2007.02.20 14:59:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll
[2007.02.20 14:59:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll
[2007.02.20 14:59:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll
[2007.02.20 14:59:04 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll
 
========== LOP Check ==========
 
[2010.10.24 16:24:00 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\10-Sekunden-Haushaltsbuch
[2010.06.12 12:37:45 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\BitDefender
[2011.05.14 08:29:41 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\BitTorrent
[2011.03.16 17:58:21 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\biu software
[2011.02.16 14:26:11 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Civitas2
[2010.04.18 18:22:05 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\DAEMON Tools Lite
[2011.04.15 15:13:53 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Dyyno
[2011.04.18 08:37:44 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\elsterformular
[2011.05.14 08:29:41 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FileZilla
[2010.04.29 13:50:26 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FireShot
[2010.07.14 21:43:24 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Foxit Software
[2010.04.14 15:43:39 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FreeCommander
[2011.04.08 07:49:02 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FreeScreenToVideo
[2011.03.11 06:48:25 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\GetRightToGo
[2010.12.15 12:23:05 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\HandBrake
[2010.08.06 03:51:11 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Imperium Romanum
[2010.11.23 23:20:32 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\inkscape
[2010.11.30 02:25:21 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\IrfanView
[2010.12.05 20:28:54 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\iScreensaver
[2011.03.05 21:48:28 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\MAGIX
[2011.03.29 06:04:58 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\MP3 Quality Modifier
[2011.04.08 21:16:46 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Mp3tag
[2010.04.20 04:47:58 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\My Games
[2010.08.03 21:46:36 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\OpenOffice.org
[2011.04.15 14:00:46 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Opera
[2011.03.21 12:39:51 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Pegasys Inc
[2010.12.19 17:49:43 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Process Hacker
[2010.04.26 21:35:21 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Sierra Entertainment
[2011.04.08 17:48:15 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\SMRecorder
[2010.04.29 03:36:26 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Sports Interactive
[2010.07.10 15:54:51 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Stellarium
[2010.05.16 13:06:39 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\streamripper
[2011.05.08 15:36:08 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Temp
[2010.04.10 19:21:37 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Template
[2010.04.13 13:02:57 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Thunderbird
[2011.03.02 02:37:31 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Ubisoft
[2010.12.03 15:17:19 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Webocton - Scriptly
[2010.12.03 21:09:57 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\XnView
[2011.05.08 07:47:30 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\Driver Fetch.job
[2011.04.09 16:09:05 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< Code: >
 
< --------- >
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.10.24 16:24:00 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\10-Sekunden-Haushaltsbuch
[2011.04.08 06:45:07 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Adobe
[2011.04.15 14:05:18 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Apple Computer
[2010.04.07 11:38:32 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\ATI
[2010.06.16 21:43:11 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Avira
[2010.06.12 12:37:45 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\BitDefender
[2011.05.14 08:29:41 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\BitTorrent
[2011.03.16 17:58:21 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\biu software
[2011.02.16 14:26:11 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Civitas2
[2010.04.18 18:22:05 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\DAEMON Tools Lite
[2010.12.13 20:56:40 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\DivX
[2011.04.15 15:13:53 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Dyyno
[2011.04.18 08:37:44 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\elsterformular
[2011.05.14 08:29:41 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FileZilla
[2010.04.29 13:50:26 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FireShot
[2010.07.14 21:43:24 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Foxit Software
[2010.04.14 15:43:39 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FreeCommander
[2011.04.08 07:49:02 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FreeScreenToVideo
[2011.03.11 06:48:25 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\GetRightToGo
[2010.04.07 11:45:00 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Google
[2010.12.15 12:23:05 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\HandBrake
[2010.04.07 11:37:31 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Identities
[2010.08.06 03:51:11 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Imperium Romanum
[2010.11.23 23:20:32 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\inkscape
[2010.08.18 11:44:43 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\InstallShield
[2010.11.30 02:25:21 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\IrfanView
[2010.12.05 20:28:54 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\iScreensaver
[2010.04.07 11:37:49 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Macromedia
[2011.03.05 21:48:28 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\MAGIX
[2011.05.14 11:04:57 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Malwarebytes
[2009.07.14 09:44:38 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Media Center Programs
[2011.04.08 19:20:31 | 000,000,000 | --SD | M] -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft
[2010.04.18 19:01:47 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft Games
[2010.04.13 12:50:45 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Mozilla
[2011.03.29 06:04:58 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\MP3 Quality Modifier
[2011.04.08 21:16:46 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Mp3tag
[2010.04.20 04:47:58 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\My Games
[2010.04.18 18:18:00 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Nero
[2010.08.03 21:46:36 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\OpenOffice.org
[2011.04.15 14:00:46 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Opera
[2011.03.21 12:39:51 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Pegasys Inc
[2010.12.19 17:49:43 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Process Hacker
[2011.03.26 15:02:18 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Reallusion
[2010.04.26 21:35:21 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Sierra Entertainment
[2011.05.09 22:17:30 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Skype
[2011.05.09 22:16:39 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\skypePM
[2011.04.08 17:48:15 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\SMRecorder
[2010.04.29 03:36:26 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Sports Interactive
[2010.07.10 15:54:51 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Stellarium
[2010.05.16 13:06:39 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\streamripper
[2011.05.08 15:36:08 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Temp
[2010.04.10 19:21:37 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Template
[2010.04.13 13:02:57 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Thunderbird
[2011.03.02 02:37:31 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Ubisoft
[2011.04.08 07:19:52 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\vlc
[2010.12.03 15:17:19 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Webocton - Scriptly
[2011.05.14 08:29:43 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Winamp
[2010.10.02 12:44:26 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\WinRAR
[2010.12.03 21:09:57 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\XnView
 
< %APPDATA%\*.exe /s >
[2011.04.08 07:50:41 | 000,038,784 | ---- | M] () -- C:\Users\Di Giorgio\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2011.03.16 17:58:21 | 000,003,638 | R--- | M] () -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{38AFE2B1-19DB-432A-BA4A-410BFBA78DCE}\_04AE388B2FA7C658E82E73.exe
[2011.03.16 17:58:21 | 000,003,638 | R--- | M] () -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{38AFE2B1-19DB-432A-BA4A-410BFBA78DCE}\_6FEFF9B68218417F98F549.exe
[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\ARPPRODUCTICON.exe
[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut10.exe
[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut1_4.exe
[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut2_4.exe
[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut3_1.exe
[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut4_1.exe
[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut5_1.exe
[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut6_1.exe
[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut7_1.exe
[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut8_1.exe
[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut9_1.exe
[2011.03.21 12:30:17 | 000,151,552 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{B1A455B8-1EC9-44E5-A158-DFBC978383F0}\NewShortcut6_3DE414CF8B684A84B59234BD57B6AF5C.exe
[2011.03.21 12:30:17 | 000,151,552 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{B1A455B8-1EC9-44E5-A158-DFBC978383F0}\NewShortcut7_3DE414CF8B684A84B59234BD57B6AF5C.exe
[2011.04.28 23:26:30 | 000,045,056 | ---- | M] () -- C:\Users\Di Giorgio\AppData\Roaming\Mozilla\Firefox\Profiles\spsnus7o.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fireshot-install.exe
[2011.03.29 05:37:05 | 000,581,120 | ---- | M] () -- C:\Users\Di Giorgio\AppData\Roaming\MP3 Quality Modifier\Encoder.exe
[2011.03.29 05:37:05 | 000,296,960 | ---- | M] () -- C:\Users\Di Giorgio\AppData\Roaming\MP3 Quality Modifier\Validator.exe
 
< %SYSTEMDRIVE%\*.exe >
[2007.11.07 08:44:20 | 000,855,040 | ---- | M] (Microsoft Corporation) -- C:\install.exe
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0033117673c16921\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\SysNative\netlogon.dll
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_38e464dbe521cc7f\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\SysNative\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\SysNative\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< --------- >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:4CF61E54

< End of report >
         
--- --- ---

Alt 15.05.2011, 16:39   #9
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
win 7 home security 2011, trojaner, spyware - Standard

win 7 home security 2011, trojaner, spyware



Hm, was willst du mit diesen komischen Toolbars auf dem Rechner? Am besten alle entfernen und bei zukünftigen Programminstallation immer die benutzerdefinierte Methode anklicken, damit man bei der Installation mögliche Toolbars abwählen kann.


Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
ATTFilter
:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.09.30 13:09:27 | 000,000,044 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{3cee0917-4b06-11df-a2b5-00262d203210}\Shell - "" = AutoRun
O33 - MountPoints2\{3cee0917-4b06-11df-a2b5-00262d203210}\Shell\AutoRun\command - "" = F:\CitiesXL2011.exe
O33 - MountPoints2\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\Shell\AutoRun\command - "" = E:\START.EXE -- [2010.09.30 12:50:11 | 002,775,202 | R--- | M] (Macromedia, Inc.)
[2011.05.14 11:05:15 | 000,011,820 | -HS- | M] () -- C:\ProgramData\rs4cm4n2c8jl4hl47h2oo5nj33ef2824
[2011.05.14 11:05:15 | 000,011,820 | -HS- | M] () -- C:\Users\Di Giorgio\AppData\Local\2501828141
[2011.05.14 10:56:07 | 000,011,820 | -HS- | M] () -- C:\Users\Di Giorgio\AppData\Local\rs4cm4n2c8jl4hl47h2oo5nj33ef2824
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:4CF61E54
:Commands
[purity]
[resethosts]
         
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 15.05.2011, 16:56   #10
schneekappe
 
win 7 home security 2011, trojaner, spyware - Icon24

win 7 home security 2011, trojaner, spyware



ok, das ist der bericht, ... die toolbars sollte ich wirklich deinstallieren

========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File move failed. E:\AUTORUN.INF scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3cee0917-4b06-11df-a2b5-00262d203210}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3cee0917-4b06-11df-a2b5-00262d203210}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3cee0917-4b06-11df-a2b5-00262d203210}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3cee0917-4b06-11df-a2b5-00262d203210}\ not found.
File F:\CitiesXL2011.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\ not found.
File move failed. E:\START.EXE scheduled to be moved on reboot.
C:\ProgramData\rs4cm4n2c8jl4hl47h2oo5nj33ef2824 moved successfully.
C:\Users\Di Giorgio\AppData\Local\2501828141 moved successfully.
C:\Users\Di Giorgio\AppData\Local\rs4cm4n2c8jl4hl47h2oo5nj33ef2824 moved successfully.
ADS C:\ProgramData\TEMP:4CF61E54 deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.22.3 log created on 05152011_175000

Files\Folders moved on Reboot...
File move failed. E:\AUTORUN.INF scheduled to be moved on reboot.
File move failed. E:\START.EXE scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Alt 15.05.2011, 17:09   #11
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
win 7 home security 2011, trojaner, spyware - Standard

win 7 home security 2011, trojaner, spyware



Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.




Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen!
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 15.05.2011, 17:38   #12
schneekappe
 
win 7 home security 2011, trojaner, spyware - Standard

win 7 home security 2011, trojaner, spyware



........ .....

Geändert von schneekappe (15.05.2011 um 17:48 Uhr)

Alt 15.05.2011, 17:49   #13
schneekappe
 
win 7 home security 2011, trojaner, spyware - Standard

win 7 home security 2011, trojaner, spyware



2011/05/15 18:35:55.0021 3368 TDSS rootkit removing tool 2.5.1.0 May 13 2011 13:20:29
2011/05/15 18:35:55.0209 3368 ================================================================================
2011/05/15 18:35:55.0209 3368 SystemInfo:
2011/05/15 18:35:55.0209 3368
2011/05/15 18:35:55.0209 3368 OS Version: 6.1.7600 ServicePack: 0.0
2011/05/15 18:35:55.0209 3368 Product type: Workstation
2011/05/15 18:35:55.0209 3368 ComputerName: DIGIORGIO-2010
2011/05/15 18:35:55.0209 3368 UserName: Di Giorgio
2011/05/15 18:35:55.0209 3368 Windows directory: C:\Windows
2011/05/15 18:35:55.0209 3368 System windows directory: C:\Windows
2011/05/15 18:35:55.0209 3368 Running under WOW64
2011/05/15 18:35:55.0209 3368 Processor architecture: Intel x64
2011/05/15 18:35:55.0209 3368 Number of processors: 2
2011/05/15 18:35:55.0209 3368 Page size: 0x1000
2011/05/15 18:35:55.0209 3368 Boot type: Normal boot
2011/05/15 18:35:55.0209 3368 ================================================================================
2011/05/15 18:35:58.0173 3368 Initialize success
2011/05/15 18:36:02.0603 1352 ================================================================================
2011/05/15 18:36:02.0603 1352 Scan started
2011/05/15 18:36:02.0603 1352 Mode: Manual;
2011/05/15 18:36:02.0603 1352 ================================================================================
2011/05/15 18:36:04.0787 1352 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys
2011/05/15 18:36:04.0834 1352 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys
2011/05/15 18:36:04.0881 1352 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys
2011/05/15 18:36:04.0927 1352 adfs (2f0683fd2df1d92e891caca14b45a8c1) C:\Windows\system32\drivers\adfs.sys
2011/05/15 18:36:05.0005 1352 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/05/15 18:36:05.0052 1352 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
2011/05/15 18:36:05.0099 1352 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
2011/05/15 18:36:05.0146 1352 AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys
2011/05/15 18:36:05.0193 1352 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys
2011/05/15 18:36:05.0239 1352 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys
2011/05/15 18:36:05.0271 1352 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys
2011/05/15 18:36:05.0302 1352 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
2011/05/15 18:36:05.0349 1352 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
2011/05/15 18:36:05.0395 1352 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys
2011/05/15 18:36:05.0427 1352 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/05/15 18:36:05.0458 1352 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys
2011/05/15 18:36:05.0520 1352 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
2011/05/15 18:36:05.0551 1352 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
2011/05/15 18:36:05.0583 1352 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
2011/05/15 18:36:05.0614 1352 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/05/15 18:36:05.0645 1352 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys
2011/05/15 18:36:05.0692 1352 AtiHdmiService (fb7602c5c508be281368aae0b61b51c6) C:\Windows\system32\drivers\AtiHdmi.sys
2011/05/15 18:36:05.0848 1352 atikmdag (b5fb227a09a9ec28163fa4b45487c3c7) C:\Windows\system32\DRIVERS\atikmdag.sys
2011/05/15 18:36:06.0019 1352 atksgt (1fd0fa6618b31fad14385740d0f6c333) C:\Windows\system32\DRIVERS\atksgt.sys
2011/05/15 18:36:06.0097 1352 avgntflt (39c2e2870fc0c2ae0595b883cbe716b4) C:\Windows\system32\DRIVERS\avgntflt.sys
2011/05/15 18:36:06.0129 1352 avipbb (c98fa6e5ad0e857d22716bd2b8b1f399) C:\Windows\system32\DRIVERS\avipbb.sys
2011/05/15 18:36:06.0175 1352 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
2011/05/15 18:36:06.0222 1352 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
2011/05/15 18:36:06.0269 1352 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
2011/05/15 18:36:06.0316 1352 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/05/15 18:36:06.0347 1352 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys
2011/05/15 18:36:06.0378 1352 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/05/15 18:36:06.0409 1352 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/05/15 18:36:06.0441 1352 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
2011/05/15 18:36:06.0503 1352 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/05/15 18:36:06.0534 1352 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
2011/05/15 18:36:06.0565 1352 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/05/15 18:36:06.0597 1352 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/05/15 18:36:06.0628 1352 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/05/15 18:36:06.0690 1352 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys
2011/05/15 18:36:06.0737 1352 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
2011/05/15 18:36:06.0768 1352 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
2011/05/15 18:36:06.0815 1352 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/05/15 18:36:06.0846 1352 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys
2011/05/15 18:36:06.0877 1352 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys
2011/05/15 18:36:06.0909 1352 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
2011/05/15 18:36:06.0940 1352 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys
2011/05/15 18:36:06.0971 1352 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/05/15 18:36:07.0033 1352 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys
2011/05/15 18:36:07.0065 1352 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
2011/05/15 18:36:07.0096 1352 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
2011/05/15 18:36:07.0143 1352 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
2011/05/15 18:36:07.0205 1352 DXGKrnl (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys
2011/05/15 18:36:07.0361 1352 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
2011/05/15 18:36:07.0486 1352 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
2011/05/15 18:36:07.0533 1352 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys
2011/05/15 18:36:07.0579 1352 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
2011/05/15 18:36:07.0642 1352 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
2011/05/15 18:36:07.0673 1352 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
2011/05/15 18:36:07.0720 1352 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
2011/05/15 18:36:07.0751 1352 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
2011/05/15 18:36:07.0782 1352 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/05/15 18:36:07.0829 1352 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
2011/05/15 18:36:07.0891 1352 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
2011/05/15 18:36:07.0923 1352 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
2011/05/15 18:36:07.0969 1352 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys
2011/05/15 18:36:08.0001 1352 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/05/15 18:36:08.0047 1352 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
2011/05/15 18:36:08.0079 1352 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
2011/05/15 18:36:08.0110 1352 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/05/15 18:36:08.0141 1352 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/05/15 18:36:08.0172 1352 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
2011/05/15 18:36:08.0188 1352 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
2011/05/15 18:36:08.0219 1352 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
2011/05/15 18:36:08.0266 1352 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys
2011/05/15 18:36:08.0313 1352 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
2011/05/15 18:36:08.0359 1352 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
2011/05/15 18:36:08.0391 1352 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/05/15 18:36:08.0437 1352 iaStorV (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys
2011/05/15 18:36:08.0484 1352 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
2011/05/15 18:36:08.0531 1352 InputFilter_Hid_FlexDef2b (caa8bc6737dfa3bf1a50175cfb226788) C:\Windows\system32\DRIVERS\InputFilter_FlexDef2b.sys
2011/05/15 18:36:08.0640 1352 IntcAzAudAddService (bc64b75e8e0a0b8982ab773483164e72) C:\Windows\system32\drivers\RTKVHD64.sys
2011/05/15 18:36:08.0734 1352 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys
2011/05/15 18:36:08.0749 1352 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
2011/05/15 18:36:08.0781 1352 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/05/15 18:36:08.0812 1352 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys
2011/05/15 18:36:08.0827 1352 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
2011/05/15 18:36:08.0859 1352 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
2011/05/15 18:36:08.0874 1352 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys
2011/05/15 18:36:08.0921 1352 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/05/15 18:36:08.0968 1352 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/05/15 18:36:08.0983 1352 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/05/15 18:36:09.0030 1352 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys
2011/05/15 18:36:09.0077 1352 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys
2011/05/15 18:36:09.0124 1352 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
2011/05/15 18:36:09.0186 1352 lirsgt (5ea407821bb3104c31a705175ab4f309) C:\Windows\system32\DRIVERS\lirsgt.sys
2011/05/15 18:36:09.0233 1352 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
2011/05/15 18:36:09.0280 1352 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/05/15 18:36:09.0311 1352 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/05/15 18:36:09.0342 1352 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/05/15 18:36:09.0373 1352 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/05/15 18:36:09.0405 1352 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
2011/05/15 18:36:09.0436 1352 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
2011/05/15 18:36:09.0467 1352 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/05/15 18:36:09.0514 1352 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
2011/05/15 18:36:09.0545 1352 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
2011/05/15 18:36:09.0576 1352 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
2011/05/15 18:36:09.0607 1352 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
2011/05/15 18:36:09.0639 1352 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
2011/05/15 18:36:09.0670 1352 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys
2011/05/15 18:36:09.0717 1352 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
2011/05/15 18:36:09.0748 1352 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
2011/05/15 18:36:09.0795 1352 mrxsmb (b7f3d2c40bdf8ffb73ebfb19c77734e2) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/05/15 18:36:09.0841 1352 mrxsmb10 (86c6f88b5168ce21cf8d69d0b3ff5d19) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/05/15 18:36:09.0873 1352 mrxsmb20 (b081069251c8e9f42cb8769d07148f9c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/05/15 18:36:09.0904 1352 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys
2011/05/15 18:36:09.0919 1352 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys
2011/05/15 18:36:09.0966 1352 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
2011/05/15 18:36:09.0997 1352 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
2011/05/15 18:36:10.0029 1352 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys
2011/05/15 18:36:10.0091 1352 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
2011/05/15 18:36:10.0138 1352 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/05/15 18:36:10.0153 1352 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
2011/05/15 18:36:10.0185 1352 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
2011/05/15 18:36:10.0216 1352 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/05/15 18:36:10.0231 1352 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
2011/05/15 18:36:10.0263 1352 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/05/15 18:36:10.0294 1352 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
2011/05/15 18:36:10.0341 1352 mwlPSDFilter (6ffecc25b39dc7652a0cec0ada9db589) C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
2011/05/15 18:36:10.0372 1352 mwlPSDNServ (0befe32ca56d6ee89d58175725596a85) C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
2011/05/15 18:36:10.0419 1352 mwlPSDVDisk (d43bc633b8660463e446e28e14a51262) C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
2011/05/15 18:36:10.0465 1352 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
2011/05/15 18:36:10.0528 1352 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys
2011/05/15 18:36:10.0590 1352 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
2011/05/15 18:36:10.0606 1352 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/05/15 18:36:10.0653 1352 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/05/15 18:36:10.0684 1352 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/05/15 18:36:10.0715 1352 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
2011/05/15 18:36:10.0746 1352 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
2011/05/15 18:36:10.0777 1352 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
2011/05/15 18:36:10.0840 1352 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
2011/05/15 18:36:10.0855 1352 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
2011/05/15 18:36:10.0887 1352 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
2011/05/15 18:36:10.0996 1352 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys
2011/05/15 18:36:11.0105 1352 NTIDrvr (64ddd0dee976302f4bd93e5efcc2f013) C:\Windows\system32\drivers\NTIDrvr.sys
2011/05/15 18:36:11.0136 1352 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
2011/05/15 18:36:11.0183 1352 NVENETFD (a85b4f2ef3a7304a5399ef0526423040) C:\Windows\system32\DRIVERS\nvm62x64.sys
2011/05/15 18:36:11.0401 1352 nvlddmkm (dd81fbc57ab9134cddc5ce90880bfd80) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/05/15 18:36:11.0651 1352 NVNET (0ad267a4674805b61a5d7b911d2a978a) C:\Windows\system32\DRIVERS\nvmf6264.sys
2011/05/15 18:36:11.0698 1352 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys
2011/05/15 18:36:11.0745 1352 nvsmu (afde3015bb8d76e26bec3b287c5443a0) C:\Windows\system32\DRIVERS\nvsmu.sys
2011/05/15 18:36:11.0791 1352 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys
2011/05/15 18:36:11.0823 1352 nvstor64 (7c7eef51979658ce15bbc04f96a77d56) C:\Windows\system32\DRIVERS\nvstor64.sys
2011/05/15 18:36:11.0854 1352 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys
2011/05/15 18:36:11.0901 1352 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/05/15 18:36:11.0932 1352 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
2011/05/15 18:36:11.0963 1352 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys
2011/05/15 18:36:12.0010 1352 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys
2011/05/15 18:36:12.0025 1352 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys
2011/05/15 18:36:12.0072 1352 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/05/15 18:36:12.0103 1352 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
2011/05/15 18:36:12.0150 1352 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
2011/05/15 18:36:12.0275 1352 Point64 (b8d8ec78b0f9ed8e220506181274f3d3) C:\Windows\system32\DRIVERS\point64.sys
2011/05/15 18:36:12.0322 1352 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
2011/05/15 18:36:12.0353 1352 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
2011/05/15 18:36:12.0415 1352 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
2011/05/15 18:36:12.0493 1352 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
2011/05/15 18:36:12.0587 1352 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/05/15 18:36:12.0618 1352 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
2011/05/15 18:36:12.0649 1352 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
2011/05/15 18:36:12.0681 1352 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/05/15 18:36:12.0727 1352 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/05/15 18:36:12.0759 1352 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/05/15 18:36:12.0774 1352 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
2011/05/15 18:36:12.0805 1352 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
2011/05/15 18:36:12.0837 1352 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
2011/05/15 18:36:12.0868 1352 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/05/15 18:36:12.0899 1352 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
2011/05/15 18:36:12.0915 1352 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
2011/05/15 18:36:12.0946 1352 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys
2011/05/15 18:36:12.0977 1352 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys
2011/05/15 18:36:13.0039 1352 ReallusionVirtualAudio (138ece3e53db1a808156c9f1e9af5fc5) C:\Windows\system32\DRIVERS\RLVrtAuCbl.sys
2011/05/15 18:36:13.0086 1352 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
2011/05/15 18:36:13.0133 1352 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys
2011/05/15 18:36:13.0149 1352 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
2011/05/15 18:36:13.0195 1352 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
2011/05/15 18:36:13.0242 1352 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
2011/05/15 18:36:13.0258 1352 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
2011/05/15 18:36:13.0289 1352 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
2011/05/15 18:36:13.0336 1352 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
2011/05/15 18:36:13.0367 1352 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
2011/05/15 18:36:13.0398 1352 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\drivers\sffp_sd.sys
2011/05/15 18:36:13.0414 1352 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/05/15 18:36:13.0445 1352 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/05/15 18:36:13.0476 1352 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/05/15 18:36:13.0507 1352 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
2011/05/15 18:36:13.0554 1352 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
2011/05/15 18:36:13.0648 1352 sptd (602884696850c86434530790b110e8eb) C:\Windows\system32\Drivers\sptd.sys
2011/05/15 18:36:13.0648 1352 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 602884696850c86434530790b110e8eb
2011/05/15 18:36:13.0663 1352 sptd - detected LockedFile.Multi.Generic (1)
2011/05/15 18:36:13.0726 1352 srv (148d50904d2a0df29a19778715eb35bb) C:\Windows\system32\DRIVERS\srv.sys
2011/05/15 18:36:13.0788 1352 srv2 (ce2189fe31d36678ac9eb7ddee08ec96) C:\Windows\system32\DRIVERS\srv2.sys
2011/05/15 18:36:13.0851 1352 srvnet (cb69edeb069a49577592835659cd0e46) C:\Windows\system32\DRIVERS\srvnet.sys
2011/05/15 18:36:13.0897 1352 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
2011/05/15 18:36:13.0929 1352 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
2011/05/15 18:36:14.0038 1352 Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys
2011/05/15 18:36:14.0163 1352 TCPIP6 (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys
2011/05/15 18:36:14.0209 1352 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
2011/05/15 18:36:14.0241 1352 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
2011/05/15 18:36:14.0272 1352 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
2011/05/15 18:36:14.0287 1352 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
2011/05/15 18:36:14.0303 1352 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys
2011/05/15 18:36:14.0350 1352 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/05/15 18:36:14.0381 1352 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
2011/05/15 18:36:14.0412 1352 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
2011/05/15 18:36:14.0443 1352 UBHelper (2e22c1fd397a5a9ffef55e9d1fc96c00) C:\Windows\system32\drivers\UBHelper.sys
2011/05/15 18:36:14.0490 1352 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys
2011/05/15 18:36:14.0537 1352 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys
2011/05/15 18:36:14.0584 1352 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys
2011/05/15 18:36:14.0599 1352 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
2011/05/15 18:36:14.0662 1352 usbaudio (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys
2011/05/15 18:36:14.0693 1352 usbccgp (7b6a127c93ee590e4d79a5f2a76fe46f) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/05/15 18:36:14.0740 1352 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys
2011/05/15 18:36:14.0771 1352 usbehci (92969ba5ac44e229c55a332864f79677) C:\Windows\system32\DRIVERS\usbehci.sys
2011/05/15 18:36:14.0818 1352 usbhub (e7df1cfd28ca86b35ef5add0735ceef3) C:\Windows\system32\DRIVERS\usbhub.sys
2011/05/15 18:36:14.0849 1352 usbohci (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\Windows\system32\DRIVERS\usbohci.sys
2011/05/15 18:36:14.0880 1352 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
2011/05/15 18:36:14.0927 1352 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
2011/05/15 18:36:14.0958 1352 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\drivers\USBSTOR.SYS
2011/05/15 18:36:15.0005 1352 usbuhci (bc3070350a491d84b518d7cca9abd36f) C:\Windows\system32\drivers\usbuhci.sys
2011/05/15 18:36:15.0052 1352 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\system32\Drivers\usbvideo.sys
2011/05/15 18:36:15.0099 1352 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys
2011/05/15 18:36:15.0130 1352 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/05/15 18:36:15.0161 1352 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
2011/05/15 18:36:15.0192 1352 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys
2011/05/15 18:36:15.0223 1352 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys
2011/05/15 18:36:15.0239 1352 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys
2011/05/15 18:36:15.0286 1352 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
2011/05/15 18:36:15.0317 1352 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys
2011/05/15 18:36:15.0348 1352 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/05/15 18:36:15.0379 1352 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
2011/05/15 18:36:15.0411 1352 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
2011/05/15 18:36:15.0442 1352 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
2011/05/15 18:36:15.0457 1352 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
2011/05/15 18:36:15.0489 1352 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
2011/05/15 18:36:15.0520 1352 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
2011/05/15 18:36:15.0582 1352 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/05/15 18:36:15.0598 1352 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
2011/05/15 18:36:15.0676 1352 WinUsb (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys
2011/05/15 18:36:15.0707 1352 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/05/15 18:36:15.0769 1352 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
2011/05/15 18:36:15.0801 1352 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys
2011/05/15 18:36:15.0832 1352 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/05/15 18:36:15.0972 1352 ================================================================================
2011/05/15 18:36:15.0972 1352 Scan finished
2011/05/15 18:36:15.0972 1352 ================================================================================
2011/05/15 18:36:15.0972 3512 Detected object count: 1
2011/05/15 18:36:27.0922 3512 LockedFile.Multi.Generic(sptd) - User select action: Skip

Alt 15.05.2011, 18:25   #14
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
win 7 home security 2011, trojaner, spyware - Standard

win 7 home security 2011, trojaner, spyware



Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 16.05.2011, 11:00   #15
schneekappe
 
win 7 home security 2011, trojaner, spyware - Standard

win 7 home security 2011, trojaner, spyware



Combofix Logfile:
Code:
ATTFilter
ComboFix 11-05-15.03 - Di Giorgio 16.05.2011   1:45.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.2047.934 [GMT 2:00]
ausgeführt von:: c:\users\Di Giorgio\Desktop\cofi.exe
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-04-15 bis 2011-05-15  ))))))))))))))))))))))))))))))
.
.
2011-05-15 23:53 . 2011-05-15 23:53	--------	d-----w-	c:\users\Gast\AppData\Local\temp
2011-05-15 23:53 . 2011-05-15 23:53	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-05-15 15:50 . 2011-05-15 15:50	--------	d-----w-	C:\_OTL
2011-05-15 11:49 . 2011-05-15 11:49	404640	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-05-14 09:04 . 2011-05-14 09:04	--------	d-----w-	c:\users\Di Giorgio\AppData\Roaming\Malwarebytes
2011-05-14 09:04 . 2010-12-20 16:09	38224	----a-w-	c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-05-14 09:04 . 2011-05-14 09:04	--------	d-----w-	c:\programdata\Malwarebytes
2011-05-14 09:04 . 2010-12-20 16:08	24152	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-05-14 09:04 . 2011-05-14 09:04	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2011-05-14 08:24 . 2011-05-14 08:35	--------	d-sh--w-	c:\users\Di Giorgio\.BackupManager
2011-05-14 08:24 . 2011-05-14 08:24	--------	d-----w-	c:\users\Di Giorgio\IOption
2011-05-14 08:24 . 2011-05-14 08:24	--------	d-----w-	C:\.uuid
2011-05-14 08:19 . 2011-05-14 08:19	--------	d-----w-	c:\programdata\PC Tools
2011-05-13 06:45 . 2011-04-11 08:21	8802128	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{5539FA6D-3189-440B-A402-479CC44A5462}\mpengine.dll
2011-05-11 06:23 . 2011-04-09 06:45	5509504	----a-w-	c:\windows\system32\ntoskrnl.exe
2011-05-11 06:23 . 2011-04-09 06:13	3957632	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2011-05-11 06:23 . 2011-04-09 06:13	3901824	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2011-05-11 06:23 . 2011-03-25 03:23	324608	----a-w-	c:\windows\system32\drivers\usbport.sys
2011-05-11 06:23 . 2011-03-25 03:22	52224	----a-w-	c:\windows\system32\drivers\usbehci.sys
2011-05-11 06:23 . 2011-03-25 03:23	343040	----a-w-	c:\windows\system32\drivers\usbhub.sys
2011-05-11 06:23 . 2011-03-25 03:23	98816	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2011-05-11 06:23 . 2011-03-25 03:22	25600	----a-w-	c:\windows\system32\drivers\usbohci.sys
2011-05-11 06:23 . 2011-03-25 03:22	30720	----a-w-	c:\windows\system32\drivers\usbuhci.sys
2011-05-11 06:23 . 2011-03-25 03:22	7936	----a-w-	c:\windows\system32\drivers\usbd.sys
2011-05-09 20:20 . 2011-05-15 22:08	--------	d-----w-	c:\program files (x86)\Steam
2011-05-08 14:28 . 2011-03-03 05:58	232960	----a-w-	c:\windows\system32\Spool\prtprocs\x64\EKIJ5000PPR.dll
2011-05-08 13:47 . 2011-05-08 13:47	--------	d-----w-	c:\windows\SysWow64\kodak
2011-05-04 00:17 . 2011-05-04 00:17	--------	d-----w-	c:\users\Di Giorgio\AppData\Local\Focus Home Interactive
2011-04-29 15:26 . 2011-04-29 15:26	--------	d-----w-	c:\program files (x86)\7-Zip
2011-04-29 15:25 . 2011-04-29 15:25	--------	d-----w-	c:\program files (x86)\Focus Home Interactive
2011-04-23 12:19 . 2011-04-23 12:19	--------	d-----w-	c:\program files (x86)\SHOUTcast
2011-04-21 17:00 . 2011-05-01 09:02	713632	----a-w-	c:\program files (x86)\Mozilla Firefox\uninstall\helper.exe
2011-04-18 06:37 . 2011-04-18 06:37	--------	d-----w-	c:\users\Di Giorgio\AppData\Roaming\elsterformular
2011-04-18 06:37 . 2011-04-18 06:37	--------	d-----w-	c:\programdata\elsterformular
2011-04-18 06:36 . 2011-04-18 06:37	--------	d-----w-	c:\program files (x86)\ElsterFormular
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-21 10:30 . 2011-03-21 10:30	151552	----a-r-	c:\users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{B1A455B8-1EC9-44E5-A158-DFBC978383F0}\NewShortcut7_3DE414CF8B684A84B59234BD57B6AF5C.exe
2011-03-21 10:30 . 2011-03-21 10:30	151552	----a-r-	c:\users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{B1A455B8-1EC9-44E5-A158-DFBC978383F0}\NewShortcut6_3DE414CF8B684A84B59234BD57B6AF5C.exe
2011-03-21 10:29 . 2011-03-21 10:30	59488	----a-w-	c:\windows\SysWow64\GenSvcInst.exe
2011-03-21 10:29 . 2011-03-21 10:30	33408	----a-w-	c:\windows\SysWow64\drivers\CDRBSDRV.SYS
2011-03-21 10:29 . 2011-03-21 10:30	145504	----a-w-	c:\windows\SysWow64\bgsvcgen.exe
2011-03-11 06:19 . 2011-04-15 02:47	1395712	----a-w-	c:\windows\system32\mfc42.dll
2011-03-11 06:19 . 2011-04-15 02:47	1359872	----a-w-	c:\windows\system32\mfc42u.dll
2011-03-11 05:40 . 2011-04-15 02:47	1164288	----a-w-	c:\windows\SysWow64\mfc42u.dll
2011-03-11 05:40 . 2011-04-15 02:47	1137664	----a-w-	c:\windows\SysWow64\mfc42.dll
2011-03-08 06:14 . 2011-04-15 02:47	976896	----a-w-	c:\windows\system32\inetcomm.dll
2011-03-08 05:38 . 2011-04-15 02:47	740864	----a-w-	c:\windows\SysWow64\inetcomm.dll
2011-03-04 06:17 . 2011-04-27 05:26	135168	----a-w-	c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2011-03-04 06:17 . 2011-04-27 05:26	347648	----a-w-	c:\windows\apppatch\AppPatch64\AcLayers.dll
2011-03-03 06:17 . 2011-04-15 02:47	182272	----a-w-	c:\windows\system32\dnsrslvr.dll
2011-03-03 06:14 . 2011-04-15 02:47	30208	----a-w-	c:\windows\system32\dnscacheugc.exe
2011-03-03 06:03 . 2011-03-03 06:03	143360	----a-w-	c:\windows\system32\EKIJCOINST12.dll
2011-03-03 05:57 . 2011-03-03 05:57	613376	----a-w-	c:\windows\system32\EKIJ5000MON.dll
2011-03-03 05:27 . 2011-04-15 02:47	28672	----a-w-	c:\windows\SysWow64\dnscacheugc.exe
2011-03-03 03:58 . 2011-04-15 02:47	3133440	----a-w-	c:\windows\system32\win32k.sys
2011-02-24 06:30 . 2011-04-15 02:48	476160	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2011-02-24 06:29 . 2011-04-15 02:47	1197056	----a-w-	c:\windows\system32\wininet.dll
2011-02-24 06:24 . 2011-04-15 02:47	57856	----a-w-	c:\windows\system32\licmgr10.dll
2011-02-24 05:32 . 2011-04-15 02:48	288256	----a-w-	c:\windows\SysWow64\XpsGdiConverter.dll
2011-02-24 05:32 . 2011-04-15 02:47	981504	----a-w-	c:\windows\SysWow64\wininet.dll
2011-02-24 05:30 . 2011-04-15 02:47	44544	----a-w-	c:\windows\SysWow64\licmgr10.dll
2011-02-24 05:05 . 2011-04-15 02:47	482816	----a-w-	c:\windows\system32\html.iec
2011-02-24 04:24 . 2011-04-15 02:47	1638912	----a-w-	c:\windows\system32\mshtml.tlb
2011-02-24 04:23 . 2011-04-15 02:47	386048	----a-w-	c:\windows\SysWow64\html.iec
2011-02-24 03:50 . 2011-04-15 02:47	1638912	----a-w-	c:\windows\SysWow64\mshtml.tlb
2011-02-23 05:16 . 2011-04-15 02:47	461312	----a-w-	c:\windows\system32\drivers\srv.sys
2011-02-23 05:16 . 2011-04-15 02:47	401920	----a-w-	c:\windows\system32\drivers\srv2.sys
2011-02-23 05:15 . 2011-04-15 02:47	161792	----a-w-	c:\windows\system32\drivers\srvnet.sys
2011-02-23 05:15 . 2011-04-15 02:47	157696	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-02-23 05:15 . 2011-04-15 02:47	286720	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2011-02-23 05:15 . 2011-04-15 02:47	126464	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2011-02-23 05:15 . 2011-04-15 02:47	90624	----a-w-	c:\windows\system32\drivers\bowser.sys
2011-02-19 06:37 . 2011-03-09 09:56	1135104	----a-w-	c:\windows\system32\FntCache.dll
2011-02-19 06:37 . 2011-03-09 09:56	1540608	----a-w-	c:\windows\system32\DWrite.dll
2011-02-19 06:36 . 2011-03-09 09:56	902656	----a-w-	c:\windows\system32\d2d1.dll
2011-02-19 06:36 . 2011-04-15 02:47	46080	----a-w-	c:\windows\system32\atmlib.dll
2011-02-19 05:32 . 2011-03-09 09:56	1074176	----a-w-	c:\windows\SysWow64\DWrite.dll
2011-02-19 05:32 . 2011-03-09 09:56	739840	----a-w-	c:\windows\SysWow64\d2d1.dll
2011-02-19 05:32 . 2011-04-15 02:47	34304	----a-w-	c:\windows\SysWow64\atmlib.dll
2011-02-19 04:13 . 2011-04-15 02:47	367104	----a-w-	c:\windows\system32\atmfd.dll
2011-02-19 03:37 . 2011-04-15 02:47	294912	----a-w-	c:\windows\SysWow64\atmfd.dll
2011-02-18 06:37 . 2011-04-15 02:47	612352	----a-w-	c:\windows\system32\vbscript.dll
2011-02-18 05:36 . 2011-04-15 02:47	428032	----a-w-	c:\windows\SysWow64\vbscript.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-28 20:44	1400712	----a-w-	c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:41	120104	----a-w-	c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-18 98304]
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2011-03-22 74752]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-11-06 281768]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe" [2011-03-03 2922496]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux9"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 136176]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 136176]
R3 InputFilter_Hid_FlexDef2b;Siliten HID Devices(FlexDef2b) Driver Service;c:\windows\system32\DRIVERS\InputFilter_FlexDef2b.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-30 136360]
S2 Dyyno Launcher;Dyyno Service;c:\program files (x86)\Dyyno\Dyyno Broadcaster\launcherd.exe [2011-03-16 415072]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-05-06 1220608]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files (x86)\Kodak\AiO\Center\EKAiOHostService.exe [2011-03-09 366000]
S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-12 62208]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
S2 WLCleanRAM;WinLube memory clean up scheduler;c:\program files (x86)\LOADSTREET\WinSpeedUp 3\CleanRAMService.exe [2007-12-04 20480]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
S3 ReallusionVirtualAudio;Reallusion Virtual Audio;c:\windows\system32\DRIVERS\RLVrtAuCbl.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2011-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 16:15]
.
2011-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 16:15]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:44	137512	----a-w-	c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-20 7981088]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360410kn07974580t65bh4j12w6p
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
FF - ProfilePath - c:\users\Di Giorgio\AppData\Roaming\Mozilla\Firefox\Profiles\spsnus7o.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.de
.
.
------- Dateityp-Verknüpfung -------
.
.txt=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - (no file)
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-Conime - c:\windows\system32\conime.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
Toolbar-Locked - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{64EAD72B-FFD4-4E01-AA3A-4C71665D73E4} - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-05-16  01:55:35
ComboFix-quarantined-files.txt  2011-05-15 23:55
.
Vor Suchlauf: 12 Verzeichnis(se), 295.425.671.168 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 295.290.408.960 Bytes frei
.
- - End Of File - - F797F5F0B5698788C17556BA36FE8671
         
--- --- ---

Antwort

Themen zu win 7 home security 2011, trojaner, spyware
andere, anderen, bösartige, erstell, erstellt, explorer, gefunde, home, home security, immernoch, installier, installiert, langsamer, minute, nicht sicher, objekte, rechner, security, spyware, troja, trojaner, version, verzeichnisse, win, win 7, win 7 home security, win 7 home security 2011



Ähnliche Themen: win 7 home security 2011, trojaner, spyware


  1. Blockade von exe dateien nach windows 7 home security 2012 trojaner
    Log-Analyse und Auswertung - 24.12.2011 (1)
  2. win 7 Anti-Spyware 2011
    Alles rund um Windows - 19.08.2011 (1)
  3. Vista Spyware 2011/Anleitung von Swisstreasure vom 7.5.11
    Plagegeister aller Art und deren Bekämpfung - 05.06.2011 (39)
  4. Win 7 security 2011
    Log-Analyse und Auswertung - 28.05.2011 (32)
  5. Avg Free Edition 2011 vs. AVG Internet Security 2011
    Antiviren-, Firewall- und andere Schutzprogramme - 24.05.2011 (8)
  6. xp security 2011 eingefangen
    Plagegeister aller Art und deren Bekämpfung - 21.05.2011 (13)
  7. Vista Anti-Spyware 2011. Komplett entfernt?
    Plagegeister aller Art und deren Bekämpfung - 07.05.2011 (5)
  8. Win 7 Security 2011 Trojaner
    Plagegeister aller Art und deren Bekämpfung - 03.05.2011 (12)
  9. Vista Security 2011
    Log-Analyse und Auswertung - 28.04.2011 (4)
  10. XP Internet Security 2011
    Plagegeister aller Art und deren Bekämpfung - 21.04.2011 (13)
  11. Trojaner "XP Anti-Spyware 2011"
    Plagegeister aller Art und deren Bekämpfung - 08.04.2011 (4)
  12. Windows 7 Home Security Trojaner (xyg.exe)
    Plagegeister aller Art und deren Bekämpfung - 04.04.2011 (17)
  13. Wie kann ich Win 7 Home Security 2011 entfernen?
    Plagegeister aller Art und deren Bekämpfung - 30.03.2011 (9)
  14. XP Anti-Spyware 2011, Vista Security 2011, Win 7 Internet Security 2011 entfernen
    Anleitungen, FAQs & Links - 18.02.2011 (2)
  15. XP Spyware 2011 Extrem hartnäckig
    Log-Analyse und Auswertung - 28.11.2010 (7)
  16. Wie werde ich den Virus/Trojaner "Windows 7 Security 2011" wieder los?
    Plagegeister aller Art und deren Bekämpfung - 19.11.2010 (10)
  17. Win 7 Security 2011
    Log-Analyse und Auswertung - 19.11.2010 (33)

Zum Thema win 7 home security 2011, trojaner, spyware - Hallo, ich habe wie viele anderen auch das Win 7 Home Security 2011 Problem. Ich hab das Malwarebytesprogramm wie vorgeschlagen installiert, und die Fehldateien gefunden und gelöscht. Nun läuft der - win 7 home security 2011, trojaner, spyware...
Archiv
Du betrachtest: win 7 home security 2011, trojaner, spyware auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.