| |
| |||||||
Log-Analyse und Auswertung: Leider ein 50 Euro Virus eingefangenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
02.03.2012, 19:50
| #1 |
| |  Leider ein 50 Euro Virus eingefangen Hallo habe mir leider einen Virus eingefangen. Bildschirm wird nach einiger Zeit schwarz und fordert mich auf ein kostenpflichtiges Sicherheitsupdates herunterzuladen. Hab schon malewarebytes benutzt und alle identifizierten Dateien gelöscht. Leider besteht das Problem immer noch. Würde mich wirklich sehr freuen, wenn mir jemand helfen könnte! Wäre wirklich sehr lieb! |
|
02.03.2012, 20:29
| #2 |
| /// Malware-holic   | Leider ein 50 Euro Virus eingefangen hi,
__________________neustart, f8 drücken abgesicherter modus mit netzwerk wählen. im betroffenen konto anmelden malwarebytes öffnen, logdateien, alle bisher erstellten berichte posten
__________________ |
|
03.03.2012, 11:55
| #3 |
| | Leider ein 50 Euro Virus eingefangen Malwarebytes Anti-Malware (Test) 1.60.1.1000
__________________Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: v2012.01.13.04 Windows Vista Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 8.0.6001.19088 Kroh-Plura :: VISTA-PC [Administrator] Schutz: Deaktiviert 03.03.2012 09:58:34 mbam-log-2012-03-03 (09-58-34).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 500639 Laufzeit: 1 Stunde(n), 16 Minute(n), 35 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) Malwarebytes Anti-Malware (Test) 1.60.1.1000 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: v2012.01.13.04 Windows Vista Service Pack 1 x86 NTFS Internet Explorer 8.0.6001.19088 Kroh-Plura :: VISTA-PC [Administrator] Schutz: Aktiviert 02.03.2012 14:59:12 mbam-log-2012-03-02 (14-59-12).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 498420 Laufzeit: 2 Stunde(n), 42 Minute(n), 25 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 9 C:\Program Files\MegaDev\MD-Trainers\MegaTrainer XL\MegaTrainerXL.exe (Trojan.AVKiller.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Kroh-Plura\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\5d74f01f-4bc775b7 (Trojan.PWS) -> Erfolgreich gelöscht und in Quarantäne gestellt. K:\DATEN_DELL-PC\backup\Desktop\Bilder Marius\PICT0050.JPG (Extension.Mismatch) -> Erfolgreich gelöscht und in Quarantäne gestellt. K:\DATEN_DELL-PC\backup\Desktop\Bilder Marius\PICT0133.JPG (Extension.Mismatch) -> Erfolgreich gelöscht und in Quarantäne gestellt. K:\DATEN_DELL-PC\backup\Desktop\Bilder Marius\PICT0153.JPG (Extension.Mismatch) -> Erfolgreich gelöscht und in Quarantäne gestellt. K:\DATEN_DELL-PC\backup\Desktop\FLORIAN_Buchstaben\Klasse 3\MAthe_Test_FeB_2006\SAchaufgaben_Hamsterkiste\Hamsterkiste - _NR_6-Dateien\knobel06-Dateien\Wauwau.gif (Extension.Mismatch) -> Erfolgreich gelöscht und in Quarantäne gestellt. K:\DATEN_DELL-PC\backup\Kroh-Plura\Desktop\Bilder Marius\PICT0050.JPG (Extension.Mismatch) -> Erfolgreich gelöscht und in Quarantäne gestellt. K:\DATEN_DELL-PC\backup\Kroh-Plura\Desktop\Bilder Marius\PICT0133.JPG (Extension.Mismatch) -> Erfolgreich gelöscht und in Quarantäne gestellt. K:\DATEN_DELL-PC\backup\Kroh-Plura\Desktop\Bilder Marius\PICT0153.JPG (Extension.Mismatch) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Malwarebytes Anti-Malware (Test) 1.60.1.1000 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: v2012.01.13.04 Windows Vista Service Pack 1 x86 NTFS (Abgesichertenmodus) Internet Explorer 8.0.6001.19088 Kroh-Plura :: VISTA-PC [Administrator] Schutz: Deaktiviert 01.03.2012 21:22:44 mbam-log-2012-03-01 (21-22-44).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 198387 Laufzeit: 7 Minute(n), Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Users\Kroh-Plura\AppData\Local\Temp\Installmanager.exe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Kroh-Plura\AppData\Local\Temp\wpbt0.dll (Exploit.Drop) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) |
|
03.03.2012, 14:47
| #4 |
| /// Malware-holic | Leider ein 50 Euro Virus eingefangen ich hatte nichts von nem neuen log gesagt oder? ich wollte ausschließlich die alten sehen. geht der normale modus wieder? falls ja: Bitte beginne damit, Windows Updates zu instalieren. Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst. Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist: - Updates automatisch Instalieren, - Täglich - Uhrzeit wählen - Bitte den gesammten rest anhaken, außer: - detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist. Klicke jetzt die Schaltfläche "OK" Klicke jetzt "nach Updates suchen". Bitte instaliere zunächst wichtige Updates. Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren. Mache das selbe bitte mit den optionalen Updates. wenn fertig, melden
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
04.03.2012, 10:08
| #5 |
| | Leider ein 50 Euro Virus eingefangen Der normale Modus ging ungefähr 10 min wieder allerdings kam es dann wieder zu der Aufforderung sich das Sicherheitsupdate herunterzuladen. Ich hatte damit angefangen Windows Updates herunterzuladen was der Computer auch abgeschlossen hat. |
|
04.03.2012, 16:19
| #6 |
| /// Malware-holic | Leider ein 50 Euro Virus eingefangen surfe nirgendwo außer auf von mir benannten seiten. poste ein neues otl log bitte
__________________ --> Leider ein 50 Euro Virus eingefangen |
|
05.03.2012, 16:56
| #7 |
| | Leider ein 50 Euro Virus eingefangen Hallo hab den Virus im Task Manager ausgeschaltet war dort unter Skype versteckt, nach erneutem Hochfahren hat mir Avira gemeldet das unter Skype ein Virus versteckt ist und hab ihn entfernen lassen seitdem seh ich nichts mehr von dem virus Ich wollt's nur sagen und erstell grad das OTL log |
|
05.03.2012, 17:02
| #8 |
| /// Malware-holic | Leider ein 50 Euro Virus eingefangen wo ist das otl log
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
05.03.2012, 17:24
| #9 |
| | Leider ein 50 Euro Virus eingefangen hoffe mal das ist das richtige:OTL Logfile: Code:
ATTFilter OTL logfile created on: 05.03.2012 16:54:17 - Run 1 OTL by OldTimer - Version 3.2.34.0 Folder = C:\Users\Kroh-Plura\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 0,59 Gb Available Physical Memory | 29,58% Memory free 4,23 Gb Paging File | 2,09 Gb Available in Paging File | 49,26% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 176,36 Gb Total Space | 3,72 Gb Free Space | 2,11% Space Free | Partition Type: NTFS Drive E: | 4,28 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Drive H: | 1396,92 Gb Total Space | 783,55 Gb Free Space | 56,09% Space Free | Partition Type: FAT32 Drive K: | 60,86 Gb Total Space | 38,00 Gb Free Space | 62,43% Space Free | Partition Type: NTFS Drive L: | 60,86 Gb Total Space | 51,00 Gb Free Space | 83,79% Space Free | Partition Type: NTFS Computer Name: VISTA-PC | User Name: Kroh-Plura | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.03.02 19:21:50 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Users\Kroh-Plura\Downloads\OTL.exe PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.01.13 14:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011.12.15 15:00:00 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2011.12.15 14:59:37 | 000,306,128 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avcenter.exe PRC - [2011.12.15 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.08.30 17:18:30 | 002,358,656 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe PRC - [2010.11.07 10:22:00 | 000,286,720 | ---- | M] (Babylon Ltd.) -- C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe PRC - [2010.10.09 14:37:41 | 000,040,960 | ---- | M] () -- C:\Users\Kroh-Plura\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe PRC - [2010.09.16 21:04:06 | 001,164,584 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe PRC - [2010.06.27 10:31:29 | 000,020,480 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\realplay.exe PRC - [2010.04.01 10:16:20 | 000,357,696 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\DTLite.exe PRC - [2009.04.30 12:23:26 | 000,090,112 | ---- | M] () -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.04.11 07:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2008.09.05 02:01:00 | 001,794,048 | R--- | M] (AVM Berlin) -- C:\Program Files\avmwlanstick\WLanGUI.exe PRC - [2008.09.05 02:01:00 | 000,364,544 | R--- | M] (AVM Berlin) -- C:\Program Files\avmwlanstick\WlanNetService.exe PRC - [2008.02.29 21:05:43 | 000,020,480 | ---- | M] () -- C:\Program Files\Common Files\Hewlett-Packard\WJA Update Service\HPWJAUpdateService.exe PRC - [2008.01.19 08:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe PRC - [2007.12.06 01:15:00 | 000,028,672 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Hewlett-Packard\Web Jetadmin 10\bin\HPWJAService.exe PRC - [2007.09.10 14:20:44 | 004,702,208 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2007.06.01 10:21:30 | 001,209,904 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe PRC - [2007.06.01 10:21:08 | 000,153,136 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe PRC - [2007.04.12 07:00:00 | 000,182,272 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Windows\System32\spool\drivers\w32x86\3\E_FATICDE.EXE PRC - [2002.04.26 18:53:36 | 000,012,288 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe ========== Modules (No Company Name) ========== MOD - [2012.03.05 16:32:30 | 000,998,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\8b5f54e3b382fc1720c76557ef8c8bc3\System.Management.ni.dll MOD - [2012.03.04 14:24:43 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5c3bfd69e0c268baff0d169e11a6a784\System.Runtime.Remoting.ni.dll MOD - [2012.03.04 14:24:39 | 011,820,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\2598077ccea480c6120d3a1ad4455be0\System.Web.ni.dll MOD - [2012.03.04 14:24:26 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\7fd6c62196829d1e2dce5a253145d51a\System.Configuration.ni.dll MOD - [2012.03.04 14:24:23 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d9f0f1dc8cbdb81f1ba122d77a6ab710\System.Xml.ni.dll MOD - [2012.03.04 14:24:08 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\65450889f3742aada2a6c0cf8e6173e3\System.Windows.Forms.ni.dll MOD - [2012.03.04 14:24:00 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\137696d0416b65dbc1561152971488b4\System.Drawing.ni.dll MOD - [2012.03.04 14:22:27 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c50133cb67d7c013fa31e1ffb942060b\System.ni.dll MOD - [2012.03.04 14:20:40 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll MOD - [2012.02.15 06:03:36 | 000,429,040 | ---- | M] () -- C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\Application\17.0.963.56\ppGoogleNaClPluginChrome.dll MOD - [2012.02.15 06:03:34 | 003,772,912 | ---- | M] () -- C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll MOD - [2012.02.15 06:02:10 | 000,122,880 | ---- | M] () -- C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\Application\17.0.963.56\avutil-51.dll MOD - [2012.02.15 06:02:08 | 000,220,672 | ---- | M] () -- C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\Application\17.0.963.56\avformat-53.dll MOD - [2012.02.15 06:02:07 | 001,747,456 | ---- | M] () -- C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\Application\17.0.963.56\avcodec-53.dll MOD - [2012.02.15 03:00:24 | 008,593,568 | ---- | M] () -- C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\Application\17.0.963.56\gcswf32.dll MOD - [2012.02.15 03:00:24 | 008,593,568 | ---- | M] () -- C:\Users\KROH-P~1\AppData\Local\Google\Chrome\APPLIC~1\170963~1.56\gcswf32.dll MOD - [2011.04.01 21:39:44 | 000,034,816 | ---- | M] () -- C:\Program Files\Google\Google Desktop Search\gzlib.dll MOD - [2010.11.03 16:52:20 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2010.09.16 21:04:50 | 000,095,528 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2010.09.16 21:04:06 | 001,164,584 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe MOD - [2010.06.27 10:31:37 | 000,029,184 | ---- | M] () -- C:\Program Files\Real\RealPlayer\rplvstpn_gr.dll MOD - [2010.06.27 10:31:37 | 000,009,728 | ---- | M] () -- C:\Program Files\Real\RealPlayer\rpwfalzr_gr.dll MOD - [2010.06.27 10:31:35 | 000,036,352 | ---- | M] () -- C:\Program Files\Real\RealPlayer\psethvy_gr.dll MOD - [2009.03.30 05:42:12 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll MOD - [2009.03.30 05:42:11 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2007.11.29 11:11:54 | 000,245,760 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.2827.38377__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll MOD - [2007.11.29 11:11:54 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.2827.38410__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll MOD - [2007.11.29 11:11:53 | 001,675,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.2827.38418__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll MOD - [2007.11.29 11:11:53 | 000,688,128 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Wizard\2.0.2827.38619__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Wizard.dll MOD - [2007.11.29 11:11:53 | 000,483,328 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.2827.38677__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll MOD - [2007.11.29 11:11:53 | 000,364,544 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.2827.38647__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll MOD - [2007.11.29 11:11:53 | 000,196,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.2827.38431__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll MOD - [2007.11.29 11:11:53 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.2827.38639__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll MOD - [2007.11.29 11:11:53 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.2827.38597__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll MOD - [2007.11.29 11:11:53 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.2827.38535__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll MOD - [2007.11.29 11:11:53 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.2827.38396__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll MOD - [2007.11.29 11:11:51 | 000,425,984 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Dashboard\2.0.2827.38719__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll MOD - [2007.11.29 11:11:51 | 000,352,256 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.2827.38605__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll MOD - [2007.11.29 11:11:51 | 000,135,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.2827.38683__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll MOD - [2007.11.29 11:11:51 | 000,090,112 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.2827.38612__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll MOD - [2007.11.29 11:11:51 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.2827.38390__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll MOD - [2007.11.29 11:11:51 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.2827.38605__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll MOD - [2007.11.29 11:11:51 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.2827.38669__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll MOD - [2007.11.29 11:11:50 | 000,901,120 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.2827.38640__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.dll MOD - [2007.11.29 11:11:50 | 000,794,624 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.2827.38544__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll MOD - [2007.11.29 11:11:50 | 000,589,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.2827.38446__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll MOD - [2007.11.29 11:11:50 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.2827.38397__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll MOD - [2007.11.29 11:11:50 | 000,401,408 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.2827.38625__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll MOD - [2007.11.29 11:11:50 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.2827.38439__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll MOD - [2007.11.29 11:11:50 | 000,118,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.2827.38564__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll MOD - [2007.11.29 11:11:50 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.2827.38718__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.dll MOD - [2007.11.29 11:11:50 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.2827.38543__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll MOD - [2007.11.29 11:11:50 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.2827.38453__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll MOD - [2007.11.29 11:11:50 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.2827.38563__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll MOD - [2007.11.29 11:11:50 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.2827.38584__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll MOD - [2007.11.29 11:11:49 | 000,659,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Dashboard\2.0.2827.38598__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Dashboard.dll MOD - [2007.11.29 11:11:49 | 000,479,232 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.2827.38537__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll MOD - [2007.11.29 11:11:49 | 000,331,776 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.2827.38529__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll MOD - [2007.11.29 11:11:49 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.2827.38535__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll MOD - [2007.11.29 11:11:49 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.2791.31988__90ba9c70f846762e\CLI.Foundation.dll MOD - [2007.11.29 11:11:49 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll MOD - [2007.11.29 11:11:49 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.2827.38542__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll MOD - [2007.11.29 11:11:49 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.2791.31986__90ba9c70f846762e\LOG.Foundation.dll MOD - [2007.11.29 11:11:49 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2791.32434__90ba9c70f846762e\CLI.Foundation.XManifest.dll MOD - [2007.11.29 11:11:49 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2791.31992__90ba9c70f846762e\NEWAEM.Foundation.dll MOD - [2007.11.29 11:11:49 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2791.32016__90ba9c70f846762e\DEM.OS.I0602.dll MOD - [2007.11.29 11:11:49 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.dll MOD - [2007.11.29 11:11:49 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2791.32007__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll MOD - [2007.11.29 11:11:49 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.2791.31999__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll MOD - [2007.11.29 11:11:49 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.2791.32000__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll MOD - [2007.11.29 11:11:49 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.2791.31999__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll MOD - [2007.11.29 11:11:49 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.2791.32006__90ba9c70f846762e\MOM.Foundation.dll MOD - [2007.11.29 11:11:49 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.2791.32016__90ba9c70f846762e\DEM.OS.dll MOD - [2007.11.29 11:11:49 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll MOD - [2007.11.29 11:11:49 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.2791.32015__90ba9c70f846762e\DEM.Graphics.dll MOD - [2007.11.29 11:11:49 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll MOD - [2007.11.29 11:11:49 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.2791.32001__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll MOD - [2007.11.29 11:11:49 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.2791.32024__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll MOD - [2007.11.29 11:11:49 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.2791.32011__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll MOD - [2007.11.29 11:11:49 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.2791.32025__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll MOD - [2007.11.29 11:11:49 | 000,006,656 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll MOD - [2007.11.29 11:11:48 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2791.32027__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2791.32002__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.2791.32025__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.2791.32027__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.2791.32014__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.2791.32015__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.2791.32041__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.2791.32014__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2791.32026__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2791.32007__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.2791.32014__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.2791.32039__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.2791.32041__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.2791.32039__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2791.32011__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2791.31995__90ba9c70f846762e\CLI.Component.Client.Shared.dll MOD - [2007.11.29 11:11:48 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2791.32029__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll MOD - [2007.11.29 11:11:48 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.2791.32006__90ba9c70f846762e\APM.Foundation.dll MOD - [2007.11.29 11:11:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2791.32029__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll MOD - [2007.11.29 11:11:48 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.2791.32040__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll MOD - [2007.11.29 11:11:47 | 000,102,400 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.2827.38662__90ba9c70f846762e\MOM.Implementation.dll MOD - [2007.11.29 11:11:47 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.2827.38660__90ba9c70f846762e\LOG.Foundation.Implementation.dll MOD - [2007.11.29 11:11:47 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2791.31996__90ba9c70f846762e\CLI.Foundation.Private.dll MOD - [2007.11.29 11:11:47 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.2827.38705__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll MOD - [2007.11.29 11:11:47 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2791.31993__90ba9c70f846762e\LOG.Foundation.Private.dll MOD - [2007.11.29 11:11:47 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray.resources\2.0.2827.38654_de_90ba9c70f846762e\CLI.Component.Systemtray.resources.dll MOD - [2007.11.29 11:11:47 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Foundation\2.0.2791.31987__90ba9c70f846762e\AEM.Foundation.dll MOD - [2007.11.29 11:11:47 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll MOD - [2007.11.29 11:11:47 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2791.32009__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll MOD - [2007.11.29 11:11:47 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2791.32001__90ba9c70f846762e\AEM.Server.Shared.dll MOD - [2007.11.29 11:11:47 | 000,006,656 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.2827.38367__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll MOD - [2007.11.29 11:11:46 | 001,503,232 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.2827.38384__90ba9c70f846762e\CLI.Component.Dashboard.dll MOD - [2007.11.29 11:11:46 | 000,471,040 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.2827.38404__90ba9c70f846762e\CLI.Component.Wizard.dll MOD - [2007.11.29 11:11:46 | 000,462,848 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.2827.38654__90ba9c70f846762e\CLI.Component.Systemtray.dll MOD - [2007.11.29 11:11:46 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.2827.38369__90ba9c70f846762e\CLI.Component.Runtime.dll MOD - [2007.11.29 11:11:46 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.2827.38370__90ba9c70f846762e\ATIDEMOS.dll MOD - [2007.11.29 11:11:46 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.2827.38369__90ba9c70f846762e\APM.Server.dll MOD - [2007.11.29 11:11:46 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.2827.38367__90ba9c70f846762e\AEM.Server.dll MOD - [2007.11.29 11:11:46 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2791.32008__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll MOD - [2007.11.29 11:11:46 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2791.32004__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll MOD - [2007.11.29 11:11:46 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.2827.38661__90ba9c70f846762e\CCC.Implementation.dll MOD - [2007.11.29 11:11:46 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll MOD - [2007.11.29 11:11:46 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2791.32039__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll MOD - [2007.11.29 11:11:46 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.2791.32010__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll MOD - [2007.11.29 11:11:46 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2791.32030__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll MOD - [2007.09.29 04:02:46 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll MOD - [2002.04.26 18:53:36 | 000,012,288 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe ========== Win32 Services (SafeList) ========== SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.01.08 14:47:29 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.11.16 17:23:44 | 000,377,344 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- winhttp.dll -- (WinHttpAutoProxySvc) SRV - [2011.08.30 17:18:30 | 002,358,656 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6) SRV - [2010.10.09 14:37:41 | 000,040,960 | ---- | M] () [Auto | Running] -- C:\Users\Kroh-Plura\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer) SRV - [2009.04.30 12:23:26 | 000,090,112 | ---- | M] () [Auto | Running] -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe -- (OMSI download service) SRV - [2008.09.05 02:01:00 | 000,364,544 | R--- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service) SRV - [2008.02.29 21:05:43 | 000,020,480 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Hewlett-Packard\WJA Update Service\HPWJAUpdateService.exe -- (HPWJAUpdateService) SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV - [2007.12.06 01:15:00 | 000,028,672 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Hewlett-Packard\Web Jetadmin 10\bin\HPWJAService.exe -- (HPWJAService) ========== Driver Services (SafeList) ========== DRV - [2012.02.15 14:44:11 | 000,137,416 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.12.15 15:00:00 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.12.15 15:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2011.07.15 14:56:01 | 000,500,704 | ---- | M] (AhnLab, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\EagleXNt.sys -- (EagleXNt) DRV - [2010.11.16 18:07:37 | 000,231,248 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\System32\drivers\truecrypt.sys -- (truecrypt) DRV - [2010.07.26 13:48:06 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd) DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.06.09 21:41:03 | 000,106,432 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AnyDVD.sys -- (AnyDVD) DRV - [2008.11.12 14:42:00 | 000,046,592 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\l160x86.sys -- (AtcL001) DRV - [2008.09.05 02:01:00 | 000,419,328 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fwlanusbn.sys -- (fwlanusbn) DRV - [2008.09.05 02:01:00 | 000,004,352 | R--- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avmeject.sys -- (avmeject) DRV - [2008.05.16 05:33:14 | 000,115,752 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016unic.sys -- (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) DRV - [2008.05.16 05:33:14 | 000,025,512 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016nd5.sys -- (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) DRV - [2008.05.16 05:33:14 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mdfl.sys -- (s0016mdfl) DRV - [2008.05.16 05:33:12 | 000,120,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mdm.sys -- (s0016mdm) DRV - [2008.05.16 05:33:12 | 000,114,216 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mgmt.sys -- (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) DRV - [2008.05.16 05:33:12 | 000,110,632 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016obex.sys -- (s0016obex) DRV - [2008.05.16 05:33:12 | 000,089,256 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016bus.sys -- (s0016bus) Sony Ericsson Device 0016 driver (WDM) DRV - [2008.02.16 16:30:10 | 000,278,728 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt) DRV - [2008.02.16 16:30:09 | 000,025,416 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt) DRV - [2008.01.09 12:28:34 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\seehcri.sys -- (seehcri) DRV - [2007.11.24 09:25:20 | 000,003,026 | ---- | M] (Logix4u) [Kernel | System | Running] -- C:\Windows\System32\drivers\hwinterface.sys -- (hwinterface) DRV - [2007.09.29 04:13:56 | 003,154,944 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2007.09.04 22:40:56 | 000,039,408 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files\CyberLink\PowerDVD\000.fcl -- ({95808DC4-FA4A-4C74-92FE-5B863F82066B}) DRV - [2007.02.03 09:32:36 | 000,041,504 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta) DRV - [2007.02.03 09:25:56 | 001,075,360 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Camdrl.sys -- (CamDrL) Logitech QuickCam Pro 3000(CamDrl) DRV - [2007.01.30 21:03:36 | 000,205,312 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8187.sys -- (RTL8187) DRV - [2007.01.26 01:00:00 | 000,265,088 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB) DRV - [2006.10.18 13:44:48 | 000,007,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor) DRV - [2006.07.05 13:46:06 | 000,063,352 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sfdrv01a.sys -- (sfdrv01a) StarForce Protection Environment Driver (version 1.x.a) DRV - [2006.06.14 15:56:56 | 000,013,680 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x) DRV - [2001.05.07 11:56:02 | 000,019,805 | ---- | M] (Thesycon GmbH, Germany) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbio.sys -- (USBIO) USBIO Driver (usbio.sys) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=543225a8000000000000001f3f04a1e2&tlver=1.4.19.19&ss=1&affID=17395 IE - HKLM\..\URLSearchHook: - No CLSID value found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Upgrade to Google Chrome IE - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Upgrade to Google Chrome IE - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Google IE - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google IE - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = Upgrade to Google Chrome IE - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Upgrade to Google Chrome IE - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) IE - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) IE - HKU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E6C6976652E636F6D2F726573756C74732E617370783F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826466F726D3D494538535243&st={searchTerms}&clid=6dd857af-ab65-4631-8562-5092159302db&pid=nc&k=0 IE - HKU\..\SearchScopes\{0899636B-7D26-43F2-AAAA-6F720E5C8032}: "URL" = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=6dd857af-ab65-4631-8562-5092159302db&pid=nc&mode=bounce&k=0 IE - HKU\..\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}: "URL" = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=543225a8000000000000001f3f04a1e2&tlver=1.4.19.19&ss=1&affID=17395 IE - HKU\..\SearchScopes\{2D4D97A0-2B76-45AC-8C50-B98CF286A132}: "URL" = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=6dd857af-ab65-4631-8562-5092159302db&pid=nc&mode=bounce&k=0 IE - HKU\..\SearchScopes\{39A92476-CCB1-4965-AAC9-2D4E7D5706F2}: "URL" = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=6dd857af-ab65-4631-8562-5092159302db&pid=nc&mode=bounce&k=0 IE - HKU\..\SearchScopes\{44C74F91-112E-4F71-B9AE-29B4F2F4C8B9}: "URL" = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=6dd857af-ab65-4631-8562-5092159302db&pid=nc&mode=bounce&k=0 IE - HKU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rlz=1I7SUNC_deDE359&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = hxxp://127.0.0.1:4664/search&s=o0P6PoUPkuTYTgYBSTsi0qoEg0Y?q={searchTerms} IE - HKU\..\SearchScopes\{92FDB239-F945-496E-935F-3FAADED9C4B5}: "URL" = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=6dd857af-ab65-4631-8562-5092159302db&pid=nc&mode=bounce&k=0 IE - HKU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E6461656D6F6E2D7365617263682E636F6D2F7365617263682F7765623F713D7B7365617263685465726D737D&st={searchTerms}&clid=6dd857af-ab65-4631-8562-5092159302db&pid=nc&k=0 IE - HKU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 IE - HKU\..\SearchScopes\{D084CDAD-9102-46FE-B101-BBC9DE9EEA04}: "URL" = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=6dd857af-ab65-4631-8562-5092159302db&pid=nc&mode=bounce&k=0 IE - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=;ftp=;https=; ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.4.3 FF - prefs.js..extensions.enabledItems: {AA994882-F391-4d2e-806F-8908DA4814ED}:2.11.19 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.3&q=" FF - prefs.js..network.proxy.no_proxies_on: "localhost" FF - prefs.js..network.proxy.type: 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll () FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Kroh-Plura\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Kroh-Plura\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Kroh-Plura\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.27\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.24 20:34:36 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.27\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.24 20:34:36 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.9\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.04.03 14:57:06 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.9\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2011.05.28 09:46:39 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape 7.1\Extensions\\Components: C:\Program Files\Netscape\Netscape\Components [2011.05.28 09:47:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape 7.1\Extensions\\Plugins: C:\Program Files\Netscape\Netscape\Plugins [2011.05.28 09:47:44 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Netscape 7.1\Extensions\\Components: C:\Program Files\Netscape\Netscape\Components [2011.05.28 09:47:50 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Netscape 7.1\Extensions\\Plugins: C:\Program Files\Netscape\Netscape\Plugins [2011.05.28 09:47:44 | 000,000,000 | ---D | M] [2011.04.01 16:23:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kroh-Plura\AppData\Roaming\mozilla\Extensions [2011.04.01 16:23:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kroh-Plura\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2012.03.01 17:52:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kroh-Plura\AppData\Roaming\mozilla\Firefox\Profiles\ae06mkew.default\extensions [2010.12.13 19:21:40 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Kroh-Plura\AppData\Roaming\mozilla\Firefox\Profiles\ae06mkew.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2012.02.24 19:06:29 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Kroh-Plura\AppData\Roaming\mozilla\Firefox\Profiles\ae06mkew.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012.01.19 14:53:44 | 000,000,000 | ---D | M] (kikin plugin) -- C:\Users\Kroh-Plura\AppData\Roaming\mozilla\Firefox\Profiles\ae06mkew.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED} [2012.02.24 19:06:21 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Kroh-Plura\AppData\Roaming\mozilla\Firefox\Profiles\ae06mkew.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2012.02.24 19:06:34 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Users\Kroh-Plura\AppData\Roaming\mozilla\Firefox\Profiles\ae06mkew.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} [2011.01.22 11:40:16 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Kroh-Plura\AppData\Roaming\mozilla\Firefox\Profiles\ae06mkew.default\extensions\engine@conduit.com [2011.04.03 13:36:50 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Kroh-Plura\AppData\Roaming\mozilla\Firefox\Profiles\ae06mkew.default\extensions\ffxtlbr@babylon.com [2012.02.24 20:34:53 | 000,000,950 | ---- | M] () -- C:\Users\Kroh-Plura\AppData\Roaming\Mozilla\Firefox\Profiles\ae06mkew.default\searchplugins\icqplugin-1.xml [2012.01.04 14:54:58 | 000,000,168 | ---- | M] () -- C:\Users\Kroh-Plura\AppData\Roaming\Mozilla\Firefox\Profiles\ae06mkew.default\searchplugins\icqplugin.gif [2012.01.04 14:54:58 | 000,000,618 | ---- | M] () -- C:\Users\Kroh-Plura\AppData\Roaming\Mozilla\Firefox\Profiles\ae06mkew.default\searchplugins\icqplugin.src [2012.02.23 17:34:36 | 000,001,056 | ---- | M] () -- C:\Users\Kroh-Plura\AppData\Roaming\Mozilla\Firefox\Profiles\ae06mkew.default\searchplugins\icqplugin.xml [2011.03.19 11:41:50 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions [2011.03.19 11:33:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.03.19 11:33:13 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2012.02.24 14:07:44 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.04.03 13:36:50 | 000,002,428 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml [2012.02.24 14:07:44 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.02.24 14:07:44 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.02.24 14:07:44 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.02.24 14:07:44 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\Application\17.0.963.56\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\Application\17.0.963.56\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Unity Player (Enabled) = C:\Users\Kroh-Plura\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: YouTube = C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\ CHR - Extension: Babylon Translator = C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.3_0\ CHR - Extension: Default = C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkacjpbfdknhflllbcmjibkdeoafencn\1.1_0\ CHR - Extension: Google Mail = C:\Users\Kroh-Plura\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll (Babylon BHO) O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.) O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) O2 - BHO: (kikin Plugin) - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Program Files\kikin\ie_kikin.dll (kikin) O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll (Babylon Ltd.) O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\wlangui.exe (AVM Berlin) O4 - HKLM..\Run: [BabylonToolbar] C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe (Babylon Ltd.) O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe () O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [Ocs_SM] C:\Users\Kroh-Plura\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS) O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe () O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\Winampa.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" File not found O4 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001..\Run: [Devmappnp] rundll32.exe "C:\Users\Kroh-Plura\AppData\Local\nsAuthenticationppm\Devmappnp.dll",nsWebplugin AgereMobiledsc File not found O4 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent File not found O4 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001..\Run: [EPSON Stylus DX7400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE (SEIKO EPSON CORPORATION) O4 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001..\Run: [EPSON Stylus DX7400 Series (Kopie 1)] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE (SEIKO EPSON CORPORATION) O4 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001..\Run: [SkypeM] C:\Users\Kroh-Plura\AppData\Local\Skype\Skype.exe File not found O4 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation) O4 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001..\Run: [ymga.exe] C:\Users\Kroh-Plura\AppData\Roaming\Ogyrdu\ymga.exe File not found O4 - Startup: C:\Users\Kroh-Plura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration DIE SIEDLER - Das Erbe der Könige.LNK = File not found O4 - Startup: C:\Users\Kroh-Plura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Heroes of Might & Magic 5.LNK = File not found O7 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data] O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Program Files\kikin\ie_kikin.dll (kikin) O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\..Trusted Domains: localhost ([]http in Lokales Intranet) O15 - HKU\S-1-5-21-588106855-2643219736-4218611786-1001\..Trusted Ranges: GD ([http] in Lokales Intranet) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/products/plugin/1.4/jinstall-14_02-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/1.4/jinstall-14_02-windows-i586.cab (Java Plug-in 1.4.1_02) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.40.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3D5A7BB1-14B4-4C97-BF1A-C62882421A1E}: DhcpNameServer = 192.168.40.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{978F1D8E-4A15-488C-AC27-D38A16AD2DA6}: DhcpNameServer = 192.168.40.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9C952753-C49D-4C72-AD7D-7C710F70D660}: NameServer = 217.237.149.142,217.237.150.205,194.25.2.129 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~1\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~1\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~1\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL) - C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL (Google) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O22 - SharedTaskScheduler: {1984D045-52CF-49cd-DB77-08F378FEA4DB} - ObjectDockShellExt - C:\Program Files\Stardock\ObjectDockFree\ODMenu.dll (Stardock) O24 - Desktop WallPaper: C:\Users\Kroh-Plura\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Kroh-Plura\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2007.11.08 22:32:36 | 000,000,056 | R--- | M] () - E:\autorun.inf -- [ UDF ] O32 - AutoRun File - [2007.12.19 05:32:01 | 001,283,448 | R--- | M] (Petroglyph Games, Inc.) - E:\AutorunUAW.exe -- [ UDF ] O33 - MountPoints2\{1922d5bd-1d62-11df-baa4-001f3f04a1e2}\Shell - "" = AutoRun O33 - MountPoints2\{1922d5bd-1d62-11df-baa4-001f3f04a1e2}\Shell\AutoRun\command - "" = M:\LaunchU3.exe -a O33 - MountPoints2\{1ef0ebda-8b5a-11de-a30b-001c4af41154}\Shell - "" = AutoRun O33 - MountPoints2\{1ef0ebda-8b5a-11de-a30b-001c4af41154}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\{21ad7b49-8c0a-11de-ad2c-001c4af41154}\Shell - "" = AutoRun O33 - MountPoints2\{21ad7b49-8c0a-11de-ad2c-001c4af41154}\Shell\AutoRun\command - "" = P:\pushinst.exe O33 - MountPoints2\{31041313-afd1-11dc-af20-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{31041313-afd1-11dc-af20-806e6f6e6963}\Shell\AutoRun\command - "" = E:\AutorunUAW.exe -- [2007.12.19 05:32:01 | 001,283,448 | R--- | M] (Petroglyph Games, Inc.) O33 - MountPoints2\{3d128a7b-e49b-11dc-9c1d-001d6067e786}\Shell - "" = AutoRun O33 - MountPoints2\{3d128a7b-e49b-11dc-9c1d-001d6067e786}\Shell\AutoRun\command - "" = M:\pushinst.exe O33 - MountPoints2\{4d5d5433-e4cc-11de-afcd-001f3f04a1e2}\Shell\AutoRun\command - "" = F:\Menu.exe O33 - MountPoints2\{7cdbaa2b-98b4-11df-854f-001f3f04a1e2}\Shell - "" = AutoRun O33 - MountPoints2\{7cdbaa2b-98b4-11df-854f-001f3f04a1e2}\Shell\AutoRun\command - "" = M:\autorun\autorun.exe O33 - MountPoints2\{bfe23714-800b-11de-8437-001c4af41154}\Shell - "" = AutoRun O33 - MountPoints2\{bfe23714-800b-11de-8437-001c4af41154}\Shell\AutoRun\command - "" = N:\LaunchU3.exe -a O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a O33 - MountPoints2\Q\Shell - "" = AutoRun O33 - MountPoints2\Q\Shell\AutoRun\command - "" = Q:\pushinst.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012.03.04 11:39:11 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices [2012.03.03 15:32:13 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES [2012.03.03 15:32:13 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES [2012.03.03 15:32:12 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN [2012.03.02 14:42:25 | 000,000,000 | -HSD | C] -- C:\found.000 [2012.03.01 21:22:09 | 000,000,000 | ---D | C] -- C:\Users\Kroh-Plura\AppData\Roaming\Malwarebytes [2012.03.01 21:22:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.03.01 21:22:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.03.01 21:22:03 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.03.01 21:22:03 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.02.19 13:17:28 | 000,000,000 | ---D | C] -- C:\Users\Kroh-Plura\Ziemlich.beste.Freunde.DVDRiP.MD.German.XViD-AOE- [2012.02.09 16:35:58 | 000,000,000 | ---D | C] -- C:\Users\Kroh-Plura\AppData\Roaming\Avira [2012.02.09 16:22:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2012.02.09 16:21:34 | 000,137,416 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2012.02.09 16:21:34 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys [2012.02.09 16:20:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2012.02.09 16:20:39 | 000,000,000 | ---D | C] -- C:\Program Files\Avira [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.03.05 17:05:00 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{94D3376D-A642-47D8-98B7-B1C428307539}.job [2012.03.05 16:53:12 | 000,675,212 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.03.05 16:53:12 | 000,642,506 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.03.05 16:53:12 | 000,143,396 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.03.05 16:53:12 | 000,121,214 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.03.05 16:45:30 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.03.05 16:43:59 | 000,001,140 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-588106855-2643219736-4218611786-1001UA.job [2012.03.05 16:26:45 | 000,005,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.03.05 16:26:45 | 000,005,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.03.05 16:26:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.03.05 16:26:00 | 2146,689,024 | -HS- | M] () -- C:\hiberfil.sys [2012.03.04 21:24:01 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.03.04 21:01:36 | 000,164,352 | ---- | M] () -- C:\Users\Kroh-Plura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.03.04 14:36:33 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat [2012.03.04 14:36:33 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat [2012.03.04 14:36:17 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf [2012.03.04 14:17:04 | 000,420,912 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.03.04 11:38:45 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf [2012.03.04 11:37:59 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf [2012.03.03 11:31:21 | 000,001,356 | ---- | M] () -- C:\Users\Kroh-Plura\AppData\Local\d3d9caps.dat [2012.03.01 21:22:04 | 000,000,916 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.03.01 15:38:27 | 000,394,987 | ---- | M] () -- C:\Users\Kroh-Plura\Desktop\Kündigung_Voßmerbäumer.pdf [2012.03.01 15:34:15 | 000,000,173 | ---- | M] () -- C:\Windows\hpbafd.ini [2012.02.26 13:44:05 | 000,001,088 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-588106855-2643219736-4218611786-1001Core.job [2012.02.21 16:19:40 | 000,411,400 | ---- | M] () -- C:\Users\Kroh-Plura\Desktop\CCI21022012_00002.pdf [2012.02.21 16:18:57 | 000,578,853 | ---- | M] () -- C:\Users\Kroh-Plura\Desktop\CCI21022012_00001.pdf [2012.02.21 16:18:23 | 003,519,515 | ---- | M] () -- C:\Users\Kroh-Plura\Desktop\CCI21022012_00000.pdf [2012.02.17 21:54:15 | 000,002,077 | ---- | M] () -- C:\Users\Kroh-Plura\Desktop\Google Chrome.lnk [2012.02.17 06:26:05 | 001,751,635 | ---- | M] () -- C:\Users\Kroh-Plura\Zuruek in die 60er.jpg [2012.02.17 06:22:46 | 001,707,888 | ---- | M] () -- C:\Users\Kroh-Plura\Der Frueling ist da.jpg [2012.02.17 06:19:27 | 001,741,536 | ---- | M] () -- C:\Users\Kroh-Plura\Die neue Kollektion ist da.jpg [2012.02.15 19:36:02 | 000,009,822 | ---- | M] () -- C:\Users\Kroh-Plura\baerensiegel.gif [2012.02.15 19:34:07 | 000,006,380 | ---- | M] () -- C:\Users\Kroh-Plura\Bärentreff.jpg [2012.02.15 14:44:11 | 000,137,416 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2012.02.14 14:28:30 | 001,917,553 | ---- | M] () -- C:\Users\Kroh-Plura\CCI14022012_00000.pdf [2012.02.06 16:31:57 | 000,306,865 | ---- | M] () -- C:\Users\Kroh-Plura\CCI06022012_00000.pdf [2012.02.05 00:29:26 | 000,212,430 | ---- | M] () -- C:\Users\Kroh-Plura\Documents\ts3_clientui-win32-12815-2012-02-05 00_29_19.518382.dmp [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.03.04 14:36:17 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf [2012.03.04 11:38:45 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf [2012.03.04 11:37:59 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf [2012.03.03 11:50:14 | 2146,689,024 | -HS- | C] () -- C:\hiberfil.sys [2012.03.01 21:22:04 | 000,000,916 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.03.01 15:38:27 | 000,394,987 | ---- | C] () -- C:\Users\Kroh-Plura\Desktop\Kündigung_Voßmerbäumer.pdf [2012.02.21 16:19:39 | 000,411,400 | ---- | C] () -- C:\Users\Kroh-Plura\Desktop\CCI21022012_00002.pdf [2012.02.21 16:18:57 | 000,578,853 | ---- | C] () -- C:\Users\Kroh-Plura\Desktop\CCI21022012_00001.pdf [2012.02.21 16:18:23 | 003,519,515 | ---- | C] () -- C:\Users\Kroh-Plura\Desktop\CCI21022012_00000.pdf [2012.02.17 06:26:05 | 001,751,635 | ---- | C] () -- C:\Users\Kroh-Plura\Zuruek in die 60er.jpg [2012.02.17 06:19:26 | 001,741,536 | ---- | C] () -- C:\Users\Kroh-Plura\Die neue Kollektion ist da.jpg [2012.02.17 06:08:49 | 001,707,888 | ---- | C] () -- C:\Users\Kroh-Plura\Der Frueling ist da.jpg [2012.02.15 19:36:06 | 000,009,822 | ---- | C] () -- C:\Users\Kroh-Plura\baerensiegel.gif [2012.02.15 19:34:06 | 000,006,380 | ---- | C] () -- C:\Users\Kroh-Plura\Bärentreff.jpg [2012.02.14 14:28:30 | 001,917,553 | ---- | C] () -- C:\Users\Kroh-Plura\CCI14022012_00000.pdf [2012.02.06 16:31:57 | 000,306,865 | ---- | C] () -- C:\Users\Kroh-Plura\CCI06022012_00000.pdf [2012.02.05 00:29:19 | 000,212,430 | ---- | C] () -- C:\Users\Kroh-Plura\Documents\ts3_clientui-win32-12815-2012-02-05 00_29_19.518382.dmp [2012.01.13 21:05:54 | 000,001,477 | ---- | C] () -- C:\Users\Kroh-Plura\AppData\Local\RecConfig.xml [2011.05.28 09:46:39 | 000,001,777 | ---- | C] () -- C:\Windows\nsreg.dat [2011.05.28 09:45:09 | 000,087,184 | ---- | C] () -- C:\Windows\NSUninst.exe [2011.05.28 09:44:52 | 000,087,184 | ---- | C] () -- C:\Windows\GREUninstall.exe [2011.05.28 09:44:50 | 000,009,606 | ---- | C] () -- C:\Windows\mozver.dat [2011.04.03 13:48:52 | 000,001,356 | ---- | C] () -- C:\Users\Kroh-Plura\AppData\Local\d3d9caps.dat [2011.01.16 18:54:00 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI [2011.01.16 18:52:39 | 000,000,050 | ---- | C] () -- C:\Windows\System32\bridf08b.dat [2011.01.16 18:45:10 | 000,031,864 | ---- | C] () -- C:\Windows\maxlink.ini [2010.12.20 19:22:57 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2010.12.19 11:52:19 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2010.12.19 11:52:19 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2010.12.17 22:03:22 | 000,036,864 | ---- | C] () -- C:\Windows\System32\LckFldService.exe [2010.11.09 15:17:03 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.07.16 14:11:40 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib [2010.06.27 10:33:27 | 000,000,241 | ---- | C] () -- C:\Windows\QSync.INI [2010.06.27 10:32:12 | 000,000,560 | ---- | C] () -- C:\Windows\_delis32.ini [2010.06.27 10:27:27 | 000,081,920 | ---- | C] () -- C:\Windows\bwUnin-6.1.4.36-8876480L.exe ========== LOP Check ========== [2010.02.12 20:32:47 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Ankh - Heart of Osiris [2011.06.21 15:14:14 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Audacity [2009.09.27 11:46:17 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Babylon [2008.11.07 18:18:41 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Black Sea Studios [2010.11.26 22:31:08 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Blender Foundation [2010.09.19 10:36:25 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Cornelsen [2010.07.26 20:53:07 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\DAEMON Tools Lite [2010.11.16 18:06:40 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\DVDVideoSoftIEHelpers [2008.12.15 10:10:26 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\EPSON [2010.06.27 10:31:46 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\FotoWire [2010.12.17 22:02:18 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\FreeHideIP [2008.02.16 11:14:39 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Glory of the Roman Empire [2012.02.20 00:22:08 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\ICQ [2008.06.20 18:42:14 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\InterTrust [2012.01.15 01:03:22 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\kikin [2011.09.21 15:00:37 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Klett [2010.07.26 14:05:28 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Leadertech [2008.09.13 17:25:07 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\LEGO Company [2011.08.07 23:13:56 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\LolClient [2011.11.25 21:23:54 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\MyVirtualHome [2010.10.09 14:37:41 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\OCS [2012.02.02 13:35:17 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Ogyrdu [2010.10.25 17:00:12 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\OpenOffice.org [2010.10.09 14:37:44 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Opera [2011.11.14 17:49:54 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Petroglyph [2009.05.03 08:25:31 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Red Alert 3 Demo [2011.04.03 13:18:58 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Stardock [2011.09.25 13:09:25 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\TeamViewer [2011.04.01 16:23:51 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Thunderbird [2010.11.16 20:20:25 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\TrueCrypt [2012.02.24 14:39:02 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\TS3Client [2012.02.01 20:23:15 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Tuygs [2011.09.24 23:21:33 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Unity [2009.05.02 11:12:06 | 000,000,000 | ---D | M] -- C:\Users\Kroh-Plura\AppData\Roaming\Wildlife Park 2 [2012.03.04 22:20:17 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2012.03.05 17:05:00 | 000,000,422 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{94D3376D-A642-47D8-98B7-B1C428307539}.job ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 481 bytes -> C:\ProgramData\TEMP:05EE1EEF < End of report > |
|
05.03.2012, 17:32
| #10 |
| /// Malware-holic | Leider ein 50 Euro Virus eingefangen nutzt du den pc für onlinebanking einkäufe sonstige zahlungsabwicklungen oder ähnlich wichtigem, wie beruflichem?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Leider ein 50 Euro Virus eingefangen |
| 50 euro, 50 euro virus, bildschirm, dateien, eingefangen, einiger, euro, fordert, freue, gefangen, gen, malewarebytes, problem, schwarz, sicherheitsupdates, virus, virus eingefangen, wirklich |
Linear-Darstellung
