| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GVU-Trojaner auf Vista 64bitWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
31.07.2012, 23:19
| #1 |
 |  GVU-Trojaner auf Vista 64bit Hallo Team, habe auch einen GVU Trojaner eingefangen. Wie bei allen wurde mein Rechner "gesperrt" und soll nur gegen Zahlung von 100 Euro wieder freigeschaltet werden können. Es ist die Version mit dem Webcambild oben rechts. Ich habe eine Wiederherstellung von gestern durchgeführt und kann wieder am PC arbeiten. Habe natürlich Angst, dass der Virus noch im System ist und Schaden anrichtet. Ich hoffe Ihr könnt helfen den Virus unschädlich zu machen. Vielen Dank im Voraus für jegliche Hilfestellung. Extras.txt: siehe Anhang Malware-log: siehe Anhang OTL.txt: Code:
ATTFilter OTL logfile created on: 31.07.2012 22:30:14 - Run 1 OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\Boss\Desktop\DOWNLOAD 64bit-Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 5,99 Gb Total Physical Memory | 2,89 Gb Available Physical Memory | 48,21% Memory free 14,79 Gb Paging File | 11,27 Gb Available in Paging File | 76,20% Paging File free Paging file location(s): c:\pagefile.sys 9199 9199 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,76 Gb Total Space | 182,39 Gb Free Space | 39,16% Space Free | Partition Type: NTFS Drive E: | 232,88 Gb Total Space | 110,83 Gb Free Space | 47,59% Space Free | Partition Type: NTFS Drive F: | 465,76 Gb Total Space | 272,85 Gb Free Space | 58,58% Space Free | Partition Type: NTFS Drive G: | 232,88 Gb Total Space | 64,04 Gb Free Space | 27,50% Space Free | Partition Type: NTFS Drive H: | 931,51 Gb Total Space | 352,87 Gb Free Space | 37,88% Space Free | Partition Type: NTFS Computer Name: BOSS-PC | User Name: Boss | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.07.31 19:58:22 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Boss\Desktop\DOWNLOAD\OTL.exe PRC - [2012.07.24 22:32:10 | 000,404,848 | ---- | M] (AnchorFree Inc.) -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe PRC - [2012.07.24 22:28:22 | 000,387,440 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe PRC - [2012.07.24 22:26:42 | 000,474,992 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe PRC - [2012.07.10 04:57:46 | 001,240,944 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe PRC - [2012.06.19 17:32:30 | 003,048,136 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe PRC - [2012.05.29 11:39:10 | 001,028,776 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\fssm32.exe PRC - [2012.05.29 11:39:10 | 000,561,832 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\FSGK32.EXE PRC - [2012.03.01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012.02.29 14:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2012.02.25 15:11:09 | 000,307,824 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.12.10 22:49:03 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2011.11.08 11:15:45 | 000,488,104 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\fsav32.exe PRC - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE PRC - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE PRC - [2011.09.16 15:39:24 | 000,115,048 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe PRC - [2011.05.23 14:14:53 | 000,061,088 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe PRC - [2011.01.31 09:11:18 | 000,221,864 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe PRC - [2011.01.31 09:11:16 | 000,201,384 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Common\FSM32.EXE PRC - [2011.01.31 09:11:16 | 000,189,096 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE PRC - [2011.01.31 09:11:16 | 000,090,792 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Common\FSHDLL32.EXE PRC - [2010.10.18 16:01:06 | 001,882,816 | ---- | M] (Language Engineering Corporation, LLC) -- C:\Program Files (x86)\Power Translator 14\LogoMedia TranslateDotNet Server.exe PRC - [2010.09.14 19:09:52 | 001,213,848 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE PRC - [2010.09.13 15:56:02 | 000,168,960 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe PRC - [2010.09.09 15:38:16 | 000,452,016 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe PRC - [2010.04.19 12:23:10 | 000,611,968 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\Fan Xpert\QFanHelp.exe PRC - [2010.04.09 17:04:44 | 000,022,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe PRC - [2010.02.09 16:49:40 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe PRC - [2009.02.23 12:43:54 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe PRC - [2008.10.28 02:01:00 | 001,794,048 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WLanGUI.exe PRC - [2008.10.28 02:01:00 | 000,364,544 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe PRC - [2006.06.20 01:00:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\P1370Mon.exe PRC - [2006.06.09 01:11:00 | 000,024,576 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files (x86)\Creative\Creative Live! Cam\VideoFX\StartFX.exe ========== Modules (No Company Name) ========== MOD - [2012.07.24 22:35:10 | 000,010,096 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\lang\gui-ger.dll MOD - [2012.07.10 04:57:46 | 001,240,944 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011.01.31 09:11:30 | 000,086,016 | ---- | M] () -- C:\Program Files (x86)\F-Secure\FSGUI\strres.eng MOD - [2011.01.31 09:11:25 | 000,553,640 | ---- | M] () -- C:\Program Files (x86)\F-Secure\FSGUI\gres.dll MOD - [2011.01.31 09:11:24 | 000,045,056 | ---- | M] () -- C:\Program Files (x86)\F-Secure\FSGUI\fsavures.eng MOD - [2011.01.31 09:11:23 | 000,443,048 | ---- | M] () -- C:\Program Files (x86)\F-Secure\FSGUI\about.dll MOD - [2011.01.31 09:11:23 | 000,090,792 | ---- | M] () -- C:\Program Files (x86)\F-Secure\FSGUI\aboutres.dll MOD - [2009.09.30 05:33:07 | 000,024,576 | R--- | M] () -- C:\Windows\SysWOW64\AsIO.dll MOD - [2006.06.09 16:48:52 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\Creative\Creative Live! Cam\VideoFX\EyeCatcherEx.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2009.02.25 23:07:08 | 001,967,872 | ---- | M] (O&O Software GmbH) [Disabled | Stopped] -- C:\Windows\SysNative\oodag.exe -- (O&O Defrag) SRV:64bit: - [2008.01.19 10:02:01 | 000,041,984 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lpdsvc.dll -- (LPDSVC) SRV:64bit: - [2008.01.19 10:00:52 | 000,195,584 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.07.27 09:07:15 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.07.24 22:36:22 | 000,078,072 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE -- (HssTrayService) SRV - [2012.07.24 22:32:10 | 000,404,848 | ---- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv) SRV - [2012.07.24 22:28:22 | 000,387,440 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -- (HssWd) SRV - [2012.07.24 22:26:42 | 000,474,992 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe -- (hshld) SRV - [2012.07.03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.06.19 17:32:30 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service) SRV - [2012.06.19 14:51:28 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.03.01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.02.29 14:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.12.10 22:49:03 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2011.10.24 09:53:38 | 002,565,632 | ---- | M] (Deutsche Telekom AG) [Auto | Running] -- C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe -- (Netzmanager Service) SRV - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc) SRV - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate) SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2011.05.23 14:14:53 | 000,061,088 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe -- (FSORSPClient) SRV - [2011.01.31 09:11:23 | 000,849,576 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Program Files (x86)\F-Secure\FWES\Program\fsdfwd.exe -- (FSDFWD) SRV - [2011.01.31 09:11:18 | 000,221,864 | ---- | M] (F-Secure Corporation) [Auto | Running] -- C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe -- (F-Secure Gatekeeper Handler Starter) SRV - [2011.01.31 09:11:16 | 000,189,096 | ---- | M] (F-Secure Corporation) [Auto | Running] -- C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE -- (FSMA) SRV - [2010.10.19 14:29:03 | 002,011,944 | ---- | M] (TeamViewer GmbH) [Disabled | Stopped] -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5) SRV - [2010.10.18 16:01:06 | 001,882,816 | ---- | M] (Language Engineering Corporation, LLC) [Auto | Running] -- C:\Program Files (x86)\Power Translator 14\LogoMedia TranslateDotNet Server.exe -- (LEC TranslateDotNet Server) SRV - [2010.04.09 17:04:44 | 000,022,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe -- (XTUService) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.24 13:59:12 | 000,398,128 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe -- (TVGOnlineUpdateSvc) SRV - [2009.12.20 14:00:35 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2009.08.10 22:04:48 | 000,093,848 | ---- | M] (SiSoftware) [Disabled | Stopped] -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2011.SP1\RpcAgentSrv.exe -- (SandraAgentSrv) SRV - [2009.06.24 08:45:38 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service) SRV - [2009.06.24 08:29:58 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service) SRV - [2009.03.30 06:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.02.23 12:43:54 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService) SRV - [2009.01.20 01:10:54 | 003,091,200 | ---- | M] () [Auto | Running] -- C:\Programme\OO Software\DiskImage\oodiag.exe -- (O&O DiskImage) SRV - [2008.10.28 02:01:00 | 000,364,544 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service) SRV - [2008.10.15 23:06:26 | 000,481,408 | ---- | M] (market maker Software AG) [Disabled | Stopped] -- C:\Program Files (x86)\Buhl\WISO Börse 2009\bin\watchdog.exe -- (WBWatchDog) SRV - [2007.05.31 17:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm) SRV - [2007.05.31 17:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.07.10 04:48:18 | 000,041,704 | ---- | M] (AnchorFree Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\hssdrv6.sys -- (HssDRV6) DRV:64bit: - [2012.06.27 13:36:45 | 000,142,848 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\tinspusb.sys -- (USBTINSP) DRV:64bit: - [2012.05.09 10:07:15 | 000,055,960 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\fsbts.sys -- (fsbts) DRV:64bit: - [2012.04.06 20:15:10 | 000,038,632 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\taphss.sys -- (taphss) DRV:64bit: - [2012.02.29 15:52:46 | 000,016,384 | ---- | M] (Microsoft Corporation) [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.15 12:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012.01.17 14:45:56 | 000,188,224 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2012.01.10 12:02:36 | 000,410,184 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ladfGSCamd64.sys -- (LADF_CaptureOnly) DRV:64bit: - [2012.01.10 12:02:36 | 000,341,832 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ladfGSRamd64.sys -- (LADF_RenderOnly) DRV:64bit: - [2011.10.25 10:57:38 | 000,213,504 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2011.10.25 10:57:38 | 000,096,768 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2011.10.12 08:33:42 | 000,316,208 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\mvs91xx.sys -- (mvs91xx) DRV:64bit: - [2011.10.12 08:33:42 | 000,027,440 | ---- | M] (Marvell Semiconductor Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\mv91cons.sys -- (mv91cons) DRV:64bit: - [2011.09.08 17:40:24 | 000,508,520 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169) DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\LMouFilt.Sys -- (LMouFilt) DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\LHidFilt.Sys -- (LHidFilt) DRV:64bit: - [2011.05.19 16:55:34 | 000,120,920 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\jraid.sys -- (JRAID) DRV:64bit: - [2011.03.18 17:20:22 | 000,410,184 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ladfBakerCamd64.sys -- (LADF_BakerCOnly) DRV:64bit: - [2011.03.18 14:33:48 | 000,335,688 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ladfBakerRamd64.sys -- (LADF_BakerROnly) DRV:64bit: - [2011.01.31 09:11:39 | 000,046,664 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\fses.sys -- (FSES) DRV:64bit: - [2011.01.31 09:11:23 | 000,095,784 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\fsdfw.sys -- (FSFW) DRV:64bit: - [2011.01.19 18:47:18 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\cpuz135_x64.sys -- (cpuz135) DRV:64bit: - [2010.07.09 14:19:04 | 000,021,480 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\cpuz134_x64.sys -- (cpuz134) DRV:64bit: - [2010.05.30 08:39:15 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\sptd.sys -- (sptd) DRV:64bit: - [2010.05.06 12:06:03 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\atksgt.sys -- (atksgt) DRV:64bit: - [2010.05.06 12:06:00 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\lirsgt.sys -- (lirsgt) DRV:64bit: - [2010.01.20 12:27:20 | 000,036,224 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\intelsmb.sys -- (smbusp) DRV:64bit: - [2009.11.23 17:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid) DRV:64bit: - [2009.11.23 17:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum) DRV:64bit: - [2009.10.01 02:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb) DRV:64bit: - [2009.09.10 03:24:12 | 000,074,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\xusb21.sys -- (xusb21) DRV:64bit: - [2009.07.10 16:27:54 | 000,022,488 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ICTDrv.sys -- (ICTDrv) DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009.05.06 03:34:52 | 000,639,512 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\t3.sys -- (t3) DRV:64bit: - [2009.01.20 01:12:04 | 000,043,016 | ---- | M] (O&O Software GmbH) [File_System | Boot | Running] -- C:\Windows\SysNative\DRIVERS\oodivdh.sys -- (oodivdh) DRV:64bit: - [2009.01.20 01:12:02 | 000,171,016 | ---- | M] (O&O Software GmbH) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\oodivd.sys -- (oodivd) DRV:64bit: - [2009.01.20 01:12:00 | 000,039,944 | ---- | M] (O&O Software GmbH) [File_System | Boot | Running] -- C:\Windows\SysNative\DRIVERS\oodisrh.sys -- (oodisrh) DRV:64bit: - [2009.01.20 01:11:58 | 000,116,232 | ---- | M] (O&O Software GmbH) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\oodisr.sys -- (oodisr) DRV:64bit: - [2008.10.28 02:01:00 | 000,524,928 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\fwlanusbn.sys -- (fwlanusbn) DRV:64bit: - [2008.10.28 02:01:00 | 000,014,120 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject) DRV:64bit: - [2008.09.15 10:07:12 | 000,054,816 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tbhsd.sys -- (tbhsd) DRV:64bit: - [2008.04.22 08:53:36 | 000,012,744 | R--- | M] (EnTech Taiwan) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ENTECH64.sys -- (ENTECH64) DRV:64bit: - [2007.10.05 10:18:06 | 000,040,832 | ---- | M] (Saitek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SaiBus.sys -- (SaiNtBus) DRV:64bit: - [2007.10.05 10:18:06 | 000,016,000 | ---- | M] (Saitek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SaiMini.sys -- (SaiMini) DRV:64bit: - [2007.05.01 16:10:48 | 000,171,144 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\SaiH0255.sys -- (SaiH0255) DRV:64bit: - [2007.04.02 01:01:02 | 000,215,008 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\P1370Afx.sys -- (P1370Afx) DRV:64bit: - [2007.03.28 10:54:18 | 000,588,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\P1370Vid.sys -- (P1370VID) DRV:64bit: - [2007.03.05 18:55:48 | 000,012,288 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\P1370Vfx.sys -- (P1370Vfx) DRV:64bit: - [2006.12.28 01:00:00 | 000,460,800 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\fwlanusb.sys -- (FWLANUSB) DRV:64bit: - [2006.11.10 15:08:58 | 000,030,720 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ATITool64.sys -- (ATITool) DRV:64bit: - [2006.10.31 23:23:42 | 000,015,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ASACPI.sys -- (MTsensor) DRV:64bit: - [2006.10.22 18:44:56 | 000,242,688 | ---- | M] (Marvell Semiconductor, Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\MRVW13C.sys -- (MRV6X64P) DRV:64bit: - [2005.12.06 08:59:00 | 000,005,888 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\P1370Aul.sys -- (P1370Aul) DRV:64bit: - [2005.12.05 08:30:00 | 000,122,880 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\P1370Aud.sys -- (P1370Aud) DRV - [2012.05.29 11:39:23 | 000,199,848 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsgk.sys -- (F-Secure Gatekeeper) DRV - [2011.08.17 11:56:22 | 000,042,672 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysWOW64\drivers\fsbts.sys -- (fsbts) DRV - [2011.01.31 09:11:44 | 000,061,960 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\F-Secure\HIPS\drivers\fshs.sys -- (F-Secure HIPS) DRV - [2011.01.31 09:11:19 | 000,015,016 | ---- | M] () [Kernel | System | Running] -- C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsvista.sys -- (fsvista) DRV - [2010.09.16 17:02:59 | 000,045,664 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Running] -- C:\Programme\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys -- (TelekomNM6) DRV - [2010.05.10 10:44:46 | 000,028,984 | ---- | M] (Your Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\MSI\MSIWDev\DVDSYS64_100507.sys -- (MSI_DVD_010507) DRV - [2010.05.10 10:44:40 | 000,033,592 | ---- | M] (Your Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\MSI\MSIWDev\msibios64_100507.sys -- (MSI_MSIBIOS_010507) DRV - [2010.05.10 10:44:18 | 000,014,960 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\MSI\MSIWDev\VGASYS64_100507.sys -- (MSI_VGASYS_010507) DRV - [2010.02.03 12:42:02 | 000,030,384 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\ProgramData\Intel\Extreme Tuning Utility\IOCbios\64bit\IOCBios.sys -- (IOCBIOS) DRV - [2009.08.07 23:46:56 | 000,023,112 | ---- | M] (SiSoftware) [Kernel | On_Demand | Stopped] -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2011.SP1\WNt500x64\sandra.sys -- (SANDRA) DRV - [2008.01.11 14:28:02 | 000,012,464 | ---- | M] (Macrovision Europe Ltd) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\CdaC15BA.SYS -- (CdaC15BA) DRV - [2007.02.07 17:57:20 | 000,034,048 | ---- | M] (CACE Technologies) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\npf_devolo.sys -- (NPF_devolo) DRV - [2006.09.19 15:44:04 | 000,015,664 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV - [2004.06.22 16:44:50 | 000,005,632 | ---- | M] (EnTech Taiwan) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\Entech64.sys -- (ENTECH64) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKLM\..\URLSearchHook: {0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {1d8566bd-f06f-4029-a3be-ba80af5a09f3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {f16708b8-d2df-482d-9dfa-aa8d8894f0f4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\Boss\Desktop\DOWNLOAD IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.n-tv.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {1d8566bd-f06f-4029-a3be-ba80af5a09f3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {f16708b8-d2df-482d-9dfa-aa8d8894f0f4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.) IE - HKCU\..\SearchScopes,DefaultScope = {1A8E94C8-52E7-4732-81CD-BABBB2779A07} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch IE - HKCU\..\SearchScopes\{1A8E94C8-52E7-4732-81CD-BABBB2779A07}: "URL" = hxxp://www.bing.com/search?FORM=VE3D01&q={searchTerms}&src={referrer:source?} IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGIT_de IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search/web?q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "SearchTheWeb" FF - prefs.js..browser.search.defaulturl: "hxxp://www.bing.com/search?FORM=VE3D01&q=" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://search.iminent.com/?appId=fb5587bd-5f10-45c2-a008-4b8c44eabea8&lcid=1031&ref=homepage" FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.2 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: LECToolbar@lec.txt:1.1 FF - prefs.js..extensions.enabledItems: promtff9@promt9.ru:9.0 FF - prefs.js..keyword.URL: "hxxp://www.bing.com/search?FORM=VE3D01&q=" FF - prefs.js..network.proxy.autoconfig_url: "file:///C:/Users/Boss/Music/Temp/Tunebite/.downloading/profile/rrproxy_ffox_48fdf396.pac" FF - prefs.js..network.proxy.no_proxies_on: "*.local" FF - prefs.js..network.proxy.type: 1 FF - prefs.js..browser.startup.homepage: "hxxp://search.iminent.com/?appId=FB5587BD-5F10-45C2-A008-4B8C44EABEA8" FF - prefs.js..browser.search.selectedEngine: "SearchTheWeb" FF - prefs.js..browser.startup.homepage: "" FF - prefs.js..browser.search.selectedEngine: "" FF - prefs.js..browser.search.defaultenginename: "" FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_268.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ [2009.10.25 11:33:59 | 000,000,000 | ---D | M] FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: File not found FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=0.80.0: C:\Program Files (x86)\Battlelog Web Plugins\0.80.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@fileplanet.com/fpdlm: C:\Program Files (x86)\Download Manager\npfpdlm.dll (IGN Entertainment) FF - HKLM\Software\MozillaPlugins\@funwebproducts.com/Plugin: File not found FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ [2009.10.25 11:33:59 | 000,000,000 | ---D | M] FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files (x86)\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@wolfram.com/Mathematica: C:\Program Files (x86)\Common Files\Wolfram Research\Browser\8.0.4.2615434\npmathplugin.dll (Wolfram Research, Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@phonostar.de/phonostar: C:\Program Files (x86)\phonostar-Player\npphonostarDetectNP.dll ( ) FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Boss\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2010.02.03 16:55:31 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.05.22 18:59:03 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.29 09:19:35 | 000,000,000 | ---D | M] [2008.08.24 20:39:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Boss\AppData\Roaming\mozilla\Extensions [2012.06.28 15:55:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions [2012.01.10 11:19:54 | 000,000,000 | ---D | M] (Avanquest App'-Anwendungsleiste Community Toolbar) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\{1d8566bd-f06f-4029-a3be-ba80af5a09f3} [2011.04.20 08:10:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.04.30 08:46:11 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2012.05.11 18:18:38 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.01.11 12:40:41 | 000,000,000 | ---D | M] (IMinent Toolbar) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444} [2009.04.05 12:31:49 | 000,000,000 | ---D | M] ("Ask Toolbar for Firefox") -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2012.04.19 17:52:45 | 000,000,000 | ---D | M] (HotSpot Shield Elite Community Toolbar) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\{f16708b8-d2df-482d-9dfa-aa8d8894f0f4} [2012.01.11 12:53:20 | 000,000,000 | ---D | M] (Toolbar für amazon.de) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\0001.amztoolbar@minimalarts.de [2012.06.28 15:55:56 | 000,000,000 | ---D | M] (OneClickDownloader) -- C:\Users\Boss\AppData\Roaming\mozilla\Firefox\Profiles\kax47dyn.default\extensions\OneClickDownload@OneClickDownload.com [2009.12.23 07:54:08 | 000,002,172 | ---- | M] () -- C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\kax47dyn.default\searchplugins\bing.xml [2010.05.30 08:39:42 | 000,002,059 | ---- | M] () -- C:\Users\Boss\AppData\Roaming\Mozilla\Firefox\Profiles\kax47dyn.default\searchplugins\daemon-search.xml [2012.04.19 16:19:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.06.28 16:16:06 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011.01.11 09:31:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.02.26 09:25:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2012.04.19 16:19:18 | 000,000,000 | ---D | M] (Hotspot Shield Helper (Please allow this installation)) -- C:\Program Files (x86)\mozilla firefox\extensions\afurladvisor@anchorfree.com [2012.01.11 12:40:21 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:\Program Files (x86)\mozilla firefox\extensions\quickstores@quickstores.de [2010.10.28 10:19:32 | 000,000,000 | ---D | M] (LEC Translation Toolbar) -- C:\PROGRAM FILES (X86)\POWER TRANSLATOR 14\ADDINS\LECTOOLBAR [2010.10.26 15:33:48 | 000,000,000 | ---D | M] (PROMT) -- C:\PROGRAM FILES (X86)\PRMT9\FIREFOX [2011.02.02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2009.12.22 05:57:54 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2009.12.22 05:57:54 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2009.12.22 05:57:54 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2009.12.22 05:57:54 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2009.12.22 05:57:54 | 000,000,801 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.02.14 15:24:38 | 000,429,885 | R--- | M]) - C:\Windows\SysNative\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 14800 more lines... O2:64bit: - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O2:64bit: - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll (AnchorFree Inc.) O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (RadioHoops Toolbar) - {0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.) O2 - BHO: (Avanquest App'-Anwendungsleiste Toolbar) - {1d8566bd-f06f-4029-a3be-ba80af5a09f3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.) O2 - BHO: (Promt IE Helper) - {1F13CE11-4FAC-49A9-8155-D4F3F0F91A33} - C:\Program Files (x86)\PRMT9\PRMTIE\prmtie.dll (PROMT Ltd.) O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files (x86)\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Babylon IE plugin) - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O2 - BHO: (HotSpot Shield Elite Toolbar) - {f16708b8-d2df-482d-9dfa-aa8d8894f0f4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.) O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.) O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found O3 - HKLM\..\Toolbar: (RadioHoops Toolbar) - {0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Avanquest App'-Anwendungsleiste Toolbar) - {1d8566bd-f06f-4029-a3be-ba80af5a09f3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (LEC) - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - C:\Program Files (x86)\Power Translator 14\Applications\LEC IE Translation Extension.dll (Language Engineering Corporation, LLC) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (PROMT-Übersetzer) - {C7DDDD27-F303-42A5-B979-51559F7DC0F0} - C:\Program Files (x86)\PRMT9\PRMTIE\prmtie.dll (PROMT Ltd.) O3 - HKLM\..\Toolbar: (HotSpot Shield Elite Toolbar) - {f16708b8-d2df-482d-9dfa-aa8d8894f0f4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (no name) - {FF284F5C-7CF9-4682-8701-D467C1DBB99F} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (RadioHoops Toolbar) - {0C3110F6-A2E6-4B6F-9516-6DC345E1F7EF} - C:\Program Files (x86)\RadioHoops\prxtbRadi.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Avanquest App'-Anwendungsleiste Toolbar) - {1D8566BD-F06F-4029-A3BE-BA80AF5A09F3} - C:\Program Files (x86)\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll (Conduit Ltd.) O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com) O3:64bit: - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) O3 - HKCU\..\Toolbar\WebBrowser: (myBabylon English Toolbar) - {B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} - C:\Program Files (x86)\myBabylon_English\tbmyB1.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (PROMT-Übersetzer) - {C7DDDD27-F303-42A5-B979-51559F7DC0F0} - C:\Program Files (x86)\PRMT9\PRMTIE\prmtie.dll (PROMT Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (HotSpot Shield Elite Toolbar) - {F16708B8-D2DF-482D-9DFA-AA8D8894F0F4} - C:\Program Files (x86)\HotSpot_Shield_Elite\prxtbHotS.dll (Conduit Ltd.) O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [ProfilerU] C:\Programme\Saitek\SD6\Software\ProfilerU.exe (Saitek) O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [SaiMfd] C:\Programme\Saitek\SD6\Software\SaiMfd.exe (Saitek) O4:64bit: - HKLM..\Run: [Windows Defender] %ProgramFiles(x86)%\Windows Defender\MSASCui.exe -hide File not found O4:64bit: - HKLM..\Run: [XboxStat] C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AVFX Engine] C:\Program Files (x86)\Creative\Creative Live! Cam\VideoFX\StartFX.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin) O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.) O4 - HKLM..\Run: [F-Secure Manager] C:\Program Files (x86)\F-Secure\Common\FSM32.EXE (F-Secure Corporation) O4 - HKLM..\Run: [F-Secure TNB] C:\Program Files (x86)\F-Secure\FSGUI\TNBUtil.exe (F-Secure Corporation) O4 - HKLM..\Run: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.) O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe () O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) O4 - HKLM..\Run: [P1370Mon.exe] C:\Windows\P1370Mon.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [QFan Help] C:\Program Files (x86)\ASUS\Fan Xpert\QFanHelp.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKCU..\Run: [igndlm.exe] C:\Program Files (x86)\Download Manager\DLM.exe (IGN Entertainment) O4 - HKCU..\Run: [POEngine5] File not found O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation) O4 - Startup: C:\Users\Boss\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk = File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O8:64bit: - Extra context menu item: &Suche im Duden - res://C:\Program Files (x86)\Duden-Suche Toolbar\toolbar.dll/SEARCH.HTML File not found O8:64bit: - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Boss\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: Ganze Seite übersetzen - C:\Program Files (x86)\PRMT9\PRMTIE\page.htm () O8:64bit: - Extra context menu item: Google Sidewiki... - Reg Error: Value error. File not found O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Markierung ubersetzen - C:\Program Files (x86)\PRMT9\PRMTIE\translat.htm () O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - File not found O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - File not found O8:64bit: - Extra context menu item: Suchanfrage ubersetzen - C:\Program Files (x86)\PRMT9\PRMTIE\search.htm () O8:64bit: - Extra context menu item: Thema automatisch bestimmen - C:\Program Files (x86)\PRMT9\PRMTIE\aot.htm () O8:64bit: - Extra context menu item: Translate this web page with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O8:64bit: - Extra context menu item: Translate with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O8:64bit: - Extra context menu item: Übersetzungsoptionen anpassen - C:\Program Files (x86)\PRMT9\PRMTIE\options.htm () O8:64bit: - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: &Suche im Duden - res://C:\Program Files (x86)\Duden-Suche Toolbar\toolbar.dll/SEARCH.HTML File not found O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Boss\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Ganze Seite übersetzen - C:\Program Files (x86)\PRMT9\PRMTIE\page.htm () O8 - Extra context menu item: Google Sidewiki... - Reg Error: Value error. File not found O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Markierung ubersetzen - C:\Program Files (x86)\PRMT9\PRMTIE\translat.htm () O8 - Extra context menu item: Nach Microsoft &Excel exportieren - File not found O8 - Extra context menu item: Nach Microsoft E&xel exportieren - File not found O8 - Extra context menu item: Suchanfrage ubersetzen - C:\Program Files (x86)\PRMT9\PRMTIE\search.htm () O8 - Extra context menu item: Thema automatisch bestimmen - C:\Program Files (x86)\PRMT9\PRMTIE\aot.htm () O8 - Extra context menu item: Translate this web page with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O8 - Extra context menu item: Translate with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O8 - Extra context menu item: Übersetzungsoptionen anpassen - C:\Program Files (x86)\PRMT9\PRMTIE\options.htm () O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O9 - Extra Button: PokerStars.eu - {07BA1DA9-F501-4796-8728-74D1B91A6CD5} - C:\Program Files (x86)\PokerStars.EU\PokerStarsUpdate.exe (PokerStars) O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars) O9 - Extra Button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - File not found O9 - Extra 'Tools' menuitem : PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - File not found O9 - Extra 'Tools' menuitem : Übersetzen - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - File not found O9 - Extra 'Tools' menuitem : Übersetzungsoptionen anpassen - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - File not found O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - File not found O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - File not found O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited) O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - File not found O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000021 - C:\Program Files (x86)\F-Secure\FSPS\program\fslsp_x64.dll (F-Secure Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: com ([www.msi] http in Trusted sites) O15 - HKCU\..Trusted Domains: com.tw ([asia.msi] http in Trusted sites) O15 - HKCU\..Trusted Domains: com.tw ([global.msi] http in Trusted sites) O15 - HKCU\..Trusted Domains: imageshack.us ([toolbar] http in Trusted sites) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab (Office Genuine Advantage Validation Tool) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab (System Requirements Lab Class) O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab (CDownloadCtrl Object) O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab (EPUImageControl Class) O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab (Reg Error: Key error.) O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan) O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab (WebSDev Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab (EPUImageControl Class) O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab (Java Plug-in 1.5.0_04) O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (RealPlayer G2 Control) O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://recordedfuture.webex.com/client/T27LB/webex/ieatgpc1.cab (GpcContainer Class) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15109/CTPID.cab (Creative Software AutoUpdate Support Package) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1DDCD9FF-A25E-4458-B97E-4BA005ADDDE9}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6719F06D-D845-4079-9EEF-82B9D9473F1D}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D381F183-DF0C-48DD-9951-CBEF842508E4}: NameServer = 10.92.64.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E11ED395-C5DC-4B77-8BB1-B837AD0E9A37}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\belarc - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml - No CLSID value found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation) O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - Deskscapes - C:\PROGRA~2\Stardock\OBJECT~1\DESKSC~1\deskscapes.dll (Stardock Corporation) O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - Stardock Vista ControlPanel Extension - C:\PROGRA~2\Stardock\OBJECT~1\DESKSC~1\DesktopControlPanel.dll (Stardock) O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - StardockDreamController - C:\PROGRA~2\Stardock\OBJECT~1\DESKSC~1\DreamControl.dll (Stardock) O24 - Desktop WallPaper: C:\Wallpaper\f-15.jpg O24 - Desktop BackupWallPaper: C:\Wallpaper\f-15.jpg O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{3dfc4963-8894-11dd-8525-001a9261b457}\Shell - "" = AutoRun O33 - MountPoints2\{3dfc4963-8894-11dd-8525-001a9261b457}\Shell\AutoRun\command - "" = I:\pushinst.exe O33 - MountPoints2\{4c6ff34d-2854-11dc-86cd-001a9261b457}\Shell - "" = AutoRun O33 - MountPoints2\{4c6ff34d-2854-11dc-86cd-001a9261b457}\Shell\AutoRun\command - "" = I:\pushinst.exe O33 - MountPoints2\I\Shell - "" = AutoRun O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\pushinst.exe O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (OODBS) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.07.31 22:08:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.07.30 19:59:34 | 000,000,000 | ---D | C] -- C:\Users\Boss\Documents\ArmA 2 Other Profiles [2012.07.22 23:28:10 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Local\ArmA 2 OA [2012.07.22 23:23:31 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Local\ArmA 2 Free [2012.07.22 23:23:31 | 000,000,000 | ---D | C] -- C:\Users\Boss\Documents\ArmA 2 [2012.07.22 23:23:13 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive [2012.07.22 23:23:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive [2012.07.22 22:21:32 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Local\SIX_Projects [2012.07.22 22:17:11 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Roaming\six-updater [2012.07.22 22:17:09 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Roaming\six-zsync [2012.07.22 22:15:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Six Projects [2012.07.22 22:14:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SIX Projects [2012.07.19 23:09:00 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Hotspot Shield [2012.07.17 16:00:05 | 000,000,000 | ---D | C] -- C:\Users\Boss\Documents\Echt Einfach TV [2012.07.17 09:23:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DreamCalc DC4P [2012.07.17 09:23:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DreamCalc DC4P [2012.07.11 12:12:25 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView [2012.07.11 12:12:01 | 000,000,000 | ---D | C] -- C:\Users\Boss\AppData\Roaming\IrfanView [2012.07.11 12:12:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IrfanView [2012.07.11 11:43:22 | 000,000,000 | ---D | C] -- C:\Users\Boss\Documents\My Pictures [2012.07.10 04:48:18 | 000,041,704 | ---- | C] (AnchorFree Inc.) -- C:\Windows\SysNative\drivers\hssdrv6.sys [2012.07.05 23:49:14 | 000,000,000 | ---D | C] -- C:\Users\Boss\Documents\Maple 16 [2012.07.04 07:58:32 | 000,000,000 | ---D | C] -- C:\Users\Boss\.maplesoft [2012.07.04 07:56:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maple 16 [2012.07.04 07:51:18 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Zero G Registry [2012.07.04 07:51:18 | 000,000,000 | ---D | C] -- C:\Program Files\Maple 16 [2012.07.04 07:49:42 | 000,000,000 | -H-D | C] -- C:\Users\Boss\InstallAnywhere [4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Users\Boss\AppData\Local\*.tmp files -> C:\Users\Boss\AppData\Local\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.07.31 22:21:08 | 000,004,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.31 22:21:07 | 000,004,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.31 22:20:33 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl [2012.07.31 22:20:30 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.07.31 22:20:26 | 000,000,408 | ---- | M] () -- C:\Windows\tasks\Final Media Player Update Checker.job [2012.07.31 22:20:22 | 000,000,530 | ---- | M] () -- C:\Windows\tasks\Scheduled scanning task.job [2012.07.31 22:20:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.31 22:20:11 | 2138,169,343 | -HS- | M] () -- C:\hiberfil.sys [2012.07.31 22:20:09 | 003,840,856 | ---- | M] () -- C:\Windows\SysNative\OODBS.lor [2012.07.31 22:18:45 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2012.07.31 22:17:44 | 000,000,228 | ---- | M] () -- C:\Users\Boss\Desktop\Anleitung Malwarebytes Anti-Malware - Trojaner-Board.url [2012.07.31 22:08:56 | 000,000,952 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.31 22:07:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.07.31 21:20:11 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.07.31 20:34:25 | 001,606,382 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.07.31 20:34:25 | 000,687,592 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.07.31 20:34:25 | 000,646,644 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.07.31 20:34:25 | 000,151,726 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.07.31 20:34:25 | 000,125,390 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.07.31 14:45:40 | 004,503,728 | ---- | M] () -- C:\ProgramData\ras_0oed.pad [2012.07.31 14:41:10 | 000,002,032 | ---- | M] () -- C:\Users\Boss\AppData\Local\d3d9caps.dat [2012.07.30 14:42:00 | 000,000,986 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job [2012.07.27 17:15:00 | 000,000,414 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job [2012.07.25 08:05:49 | 000,001,852 | ---- | M] () -- C:\Users\Public\Desktop\Six Updater.lnk [2012.07.25 08:05:48 | 000,001,852 | ---- | M] () -- C:\Users\Public\Desktop\Six Launcher.lnk [2012.07.22 13:27:26 | 000,005,237 | ---- | M] () -- C:\Users\Boss\AppData\Roaming\DreamCalc DC4P.dat [2012.07.19 12:02:12 | 000,002,101 | ---- | M] () -- C:\Users\Boss\Desktop\TI-Nspire CAS Student Software.lnk [2012.07.13 16:35:41 | 000,000,823 | ---- | M] () -- C:\Users\Boss\Desktop\Maple 16.lnk [2012.07.11 16:47:49 | 000,588,592 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.07.10 04:48:18 | 000,041,704 | ---- | M] (AnchorFree Inc.) -- C:\Windows\SysNative\drivers\hssdrv6.sys [2012.07.04 07:56:14 | 000,281,088 | ---- | M] () -- C:\Windows\SysNative\WMIMPLEX.dll [2012.07.04 07:56:14 | 000,033,280 | ---- | M] () -- C:\Windows\SysNative\maplec.dll [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Users\Boss\AppData\Local\*.tmp files -> C:\Users\Boss\AppData\Local\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.07.31 22:17:44 | 000,000,228 | ---- | C] () -- C:\Users\Boss\Desktop\Anleitung Malwarebytes Anti-Malware - Trojaner-Board.url [2012.07.31 22:08:56 | 000,000,952 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.31 15:34:24 | 2138,169,343 | -HS- | C] () -- C:\hiberfil.sys [2012.07.31 14:28:11 | 004,503,728 | ---- | C] () -- C:\ProgramData\ras_0oed.pad [2012.07.22 22:15:09 | 000,001,852 | ---- | C] () -- C:\Users\Public\Desktop\Six Updater.lnk [2012.07.22 22:15:09 | 000,001,852 | ---- | C] () -- C:\Users\Public\Desktop\Six Launcher.lnk [2012.07.19 12:02:12 | 000,002,101 | ---- | C] () -- C:\Users\Boss\Desktop\TI-Nspire CAS Student Software.lnk [2012.07.17 09:24:29 | 000,005,237 | ---- | C] () -- C:\Users\Boss\AppData\Roaming\DreamCalc DC4P.dat [2012.07.13 16:35:41 | 000,000,823 | ---- | C] () -- C:\Users\Boss\Desktop\Maple 16.lnk [2012.07.04 07:56:14 | 000,281,088 | ---- | C] () -- C:\Windows\SysNative\WMIMPLEX.dll [2012.07.04 07:56:14 | 000,033,280 | ---- | C] () -- C:\Windows\SysNative\maplec.dll [2012.06.27 13:36:56 | 000,002,189 | ---- | C] () -- C:\Users\Boss\AppData\Local\TempfixPerms.vbs [2012.04.19 16:20:41 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\cd.dat [2012.02.29 14:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.12.10 22:49:02 | 003,123,272 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2011.11.03 10:28:01 | 000,000,203 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_Hawaiian Airports Volume 2.reg [2011.10.27 08:13:37 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe [2011.10.07 08:42:16 | 000,280,976 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.10.07 08:42:14 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.04.26 20:57:41 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2011.03.06 06:43:18 | 000,000,185 | ---- | C] () -- C:\Users\Boss\FlightBeam_San Francisco X.reg [2011.02.14 14:13:42 | 000,000,323 | ---- | C] () -- C:\Windows\wininit.ini [2011.02.12 12:25:38 | 010,977,280 | ---- | C] () -- C:\ProgramData\sandra.mda [2011.01.31 09:14:52 | 000,042,672 | ---- | C] () -- C:\Windows\SysWow64\drivers\fsbts.sys [2011.01.09 17:58:15 | 000,000,186 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_Honolulu.reg [2011.01.06 09:36:38 | 000,270,848 | ---- | C] () -- C:\Program Files (x86)\UNWISE.EXE [2011.01.05 15:00:41 | 000,000,171 | ---- | C] () -- C:\Users\Boss\Aerosoft_FlorenceX.reg [2011.01.05 15:00:21 | 000,000,181 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_JFK.reg [2011.01.05 15:00:01 | 000,000,180 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_ZurichX.reg [2010.12.10 17:40:34 | 000,000,183 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_Geneva.reg [2010.12.10 17:40:18 | 000,000,181 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_XPOI.reg [2010.12.10 17:39:58 | 000,000,191 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_Chicago Ohare.reg [2010.12.03 20:30:52 | 000,000,204 | ---- | C] () -- C:\Users\Boss\FSDreamTeam_Hawaiian Airports Volume 1.reg [2010.12.03 19:57:07 | 000,000,179 | ---- | C] () -- C:\Users\Boss\Cloud9_Xcity Rome.reg [2010.12.03 19:56:47 | 000,000,175 | ---- | C] () -- C:\Users\Boss\Cloud9_Bergen.reg [2010.12.03 19:56:26 | 000,000,190 | ---- | C] () -- C:\Users\Boss\Cloud9_Orlando International.reg [2010.10.30 13:53:59 | 000,081,312 | ---- | C] () -- C:\ProgramData\dudenbib.wav [2010.10.28 10:20:15 | 000,075,040 | ---- | C] () -- C:\Program Files (x86)\Common Files\SpeechUninstall.exe [2008.10.01 10:59:35 | 000,004,553 | ---- | C] () -- C:\Users\Boss\.recently-used.xbel [2008.06.25 14:58:31 | 003,211,264 | ---- | C] () -- C:\Program Files (x86)\Common FilesDDBACSetup.msi [2008.01.11 14:14:08 | 000,000,092 | ---- | C] () -- C:\Users\Boss\AppData\Local\fusioncache.dat [2007.12.06 15:12:56 | 000,002,032 | ---- | C] () -- C:\Users\Boss\AppData\Local\d3d9caps.dat [2007.11.05 18:01:43 | 000,002,188 | ---- | C] () -- C:\Users\Boss\AppData\Local\d3d9caps64.dat [2007.10.26 05:16:52 | 000,055,808 | ---- | C] () -- C:\Users\Boss\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.08.10 06:45:43 | 000,000,466 | RHS- | C] () -- C:\ProgramData\ntuser.pol ========== LOP Check ========== [2007.10.23 12:20:03 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\ACD Systems [2009.05.20 23:32:25 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Acreon [2007.10.23 12:20:03 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Aerosimulations [2011.07.02 12:51:58 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Amazon [2012.02.04 17:50:56 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Babylon [2010.11.20 13:48:50 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\BitTorrent [2009.05.11 15:48:27 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Buhl Data Service [2012.01.07 13:40:15 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Canon [2009.05.05 20:55:51 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\ChessBase [2009.12.18 09:31:11 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\com.adobe.example.avatarAirApplication.199ED43C2CFEB351CD0244628B93195D7C58F98C.1 [2012.02.14 21:19:52 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\com.nicolasprof.OTMEditor [2009.10.09 14:40:01 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\CoSoSys [2010.05.30 08:49:19 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\DAEMON Tools Lite [2010.11.18 12:49:13 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\DasTelefonbuch Gelbe Seiten Map&Route [2008.12.31 15:58:26 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\DasTelefonbuch GelbeSeiten Map&Route [2007.10.23 12:20:04 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\DataDesign [2007.10.26 23:41:01 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\DelinvFile [2007.10.25 13:01:29 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Disposition [2010.10.30 13:37:31 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Duden [2012.05.11 18:22:15 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\DVDVideoSoft [2012.05.11 18:18:38 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\DVDVideoSoftIEHelpers [2011.10.04 08:00:29 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\elsterformular [2009.09.09 23:53:23 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\EVEMon [2011.01.31 18:13:28 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\f-secure [2007.12.16 14:53:58 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\FileZilla [2012.07.31 15:32:56 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\FinalMediaPlayer [2010.11.21 13:57:23 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Flight One Software [2011.11.30 19:13:41 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Flight1 [2008.11.28 13:19:21 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\fs_earth_x [2009.01.09 11:57:03 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\GetRightToGo [2008.10.01 10:59:35 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\gtk-2.0 [2011.11.30 22:41:22 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\HiFi [2011.05.21 10:48:05 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Imersatz GmbH [2012.07.11 12:12:01 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\IrfanView [2007.10.28 11:03:03 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Jürgen Treml [2012.05.05 16:52:44 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Kalypso Media [2010.11.08 15:32:20 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Leadertech [2010.10.28 10:18:34 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\LEC [2007.10.23 12:20:04 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Lexware [2011.08.31 12:02:20 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\LogoMaker [2010.11.20 13:24:36 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Mathsoft [2007.10.23 12:20:13 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\muvee Technologies [2009.03.20 18:34:33 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\MyOddWeb [2011.02.04 14:54:36 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\nHancer [2007.03.24 11:12:58 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Ordner HP Share-to-Web [2011.10.07 07:48:08 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Origin [2012.06.28 16:08:32 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Pdfsvg [2012.01.11 12:40:11 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\phonostar GmbH [2010.10.29 16:45:35 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\PRMT [2007.10.23 12:20:13 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Project MT [2010.10.26 15:54:46 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\PROMT [2012.01.11 12:40:22 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\QuickStoresToolbar [2011.11.30 21:31:26 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\RayV [2011.11.30 21:44:47 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\RIFT [2007.10.23 12:20:13 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\ScanSoft [2009.08.24 04:59:39 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\SecondLife [2012.07.25 15:17:40 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\six-updater [2012.07.22 22:17:09 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\six-zsync [2009.08.28 07:32:32 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\SpeedSim [2010.10.12 16:47:15 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\TeamViewer [2012.06.27 13:40:50 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Texas Instruments [2009.03.05 06:51:13 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\The Creative Assembly [2012.06.27 13:44:32 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\TI-Nspire [2007.03.30 09:19:05 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\TVG [2008.12.10 16:47:00 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\TweakNow PowerPack [2011.12.11 11:31:18 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Ubisoft [2010.12.03 19:57:48 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Virtuali [2011.06.08 19:39:34 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\wargaming.net [2010.08.12 16:59:42 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\webex [2010.06.01 16:58:23 | 000,000,000 | ---D | M] -- C:\Users\Boss\AppData\Roaming\Winsome Technologies [2012.07.27 17:15:00 | 000,000,414 | ---- | M] () -- C:\Windows\Tasks\1-Klick-Wartung.job [2012.07.31 22:20:26 | 000,000,408 | ---- | M] () -- C:\Windows\Tasks\Final Media Player Update Checker.job [2012.07.31 22:18:46 | 000,032,538 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2012.07.31 22:20:22 | 000,000,530 | ---- | M] () -- C:\Windows\Tasks\Scheduled scanning task.job ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 173 bytes -> C:\ProgramData\TEMP:CBD3E4DE @Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:74603393 @Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:D37053A2 < End of report > |
| Themen zu GVU-Trojaner auf Vista 64bit |
| askbar, bho, bingbar, bonjour, canon, cloud, conduit, converter, desktop, error, euro, excel, firefox, flash player, frage, google, google earth, helper, hotspot, hotspot shield, iminent toolbar, installation, launch, logfile, markierung, mp3, nvidia update, object, oneclickdownloader, plug-in, realtek, registry, safer networking, scan, software, system, trojaner, usb 3.0, virus, vista, wiso, zahlung |
Baum-Darstellung