| |
| |||||||
Log-Analyse und Auswertung: mystart Incredibar loswerdenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
11.09.2012, 22:04
| #1 |
| |  mystart Incredibar loswerden Hallo schon mal Danke für die Hilfe! Habe mir leider durch einen Download incredibar eingefangen und erst spaäter herausgefunden das dies schädlich ist... habe leider auch schon Online Banking, E-mail und andere Programme zum einloggen verwendet. habe hier im Forum gelesen und mir schonmal OTl und Malwarebyts heruntergeladen. Hier ist das Otl ergebnis: OTL logfile created on: 11.09.2012 22:36:01 - Run 1 OTL by OldTimer - Version 3.2.61.3 Folder = C:\Users\sevinia\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,97 Gb Total Physical Memory | 2,53 Gb Available Physical Memory | 63,73% Memory free 7,93 Gb Paging File | 6,20 Gb Available in Paging File | 78,19% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 450,16 Gb Total Space | 98,29 Gb Free Space | 21,84% Space Free | Partition Type: NTFS Drive D: | 66,88 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive E: | 7,60 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: SEVINIAS-PC | User Name: sevinia | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.09.10 18:55:37 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\sevinia\Desktop\OTL.exe PRC - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.09.07 17:04:44 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.06.06 09:14:32 | 000,185,856 | ---- | M] () -- C:\Programme\Web Assistant\ExtensionUpdaterService.exe PRC - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.04.04 06:25:00 | 000,295,584 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe PRC - [2011.11.18 14:51:12 | 003,673,944 | ---- | M] () -- C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe PRC - [2011.08.22 17:34:38 | 000,224,096 | ---- | M] () -- C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe PRC - [2011.08.22 17:34:37 | 000,734,336 | ---- | M] (Bytemobile, Inc.) -- C:\Program Files (x86)\T-Mobile\InternetManager_H\bmop.exe PRC - [2011.08.22 17:34:37 | 000,520,032 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\Internet Manager.exe PRC - [2011.08.22 17:34:37 | 000,193,664 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\bmsdk.exe PRC - [2011.08.22 17:34:36 | 000,390,272 | ---- | M] (Bytemobile, Inc.) -- C:\Program Files (x86)\T-Mobile\InternetManager_H\bmctl.exe PRC - [2011.04.13 16:39:50 | 000,387,696 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe PRC - [2011.01.28 06:03:26 | 000,236,384 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DatacardService\DCSHelper.exe PRC - [2010.10.27 20:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe PRC - [2010.08.25 12:27:44 | 000,309,824 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac PRC - [2010.03.18 12:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe PRC - [2010.03.10 14:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe PRC - [2010.02.18 14:01:06 | 000,462,632 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe PRC - [2009.09.23 14:38:18 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe PRC - [2009.08.21 02:25:50 | 000,062,720 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe PRC - [2009.08.06 19:18:54 | 000,311,592 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe PRC - [2009.08.06 19:18:42 | 000,349,480 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe PRC - [2009.07.10 11:54:44 | 000,253,952 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe PRC - [2009.06.05 04:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2009.06.05 04:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe PRC - [2009.06.04 15:04:50 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe PRC - [2007.08.02 21:08:00 | 000,095,504 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe PRC - [2006.07.24 13:02:12 | 000,086,016 | ---- | M] (Olivetti) -- C:\Program Files (x86)\Olivetti\ANY_WAY\olMntrService.exe ========== Modules (No Company Name) ========== MOD - [2011.08.22 17:34:45 | 000,414,048 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\USSDUIPlugin.dll MOD - [2011.08.22 17:34:45 | 000,282,976 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\XFramePlugin.dll MOD - [2011.08.22 17:34:45 | 000,174,432 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\XCodec.dll MOD - [2011.08.22 17:34:45 | 000,147,808 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\USSDSrvPlugin.dll MOD - [2011.08.22 17:34:45 | 000,120,160 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\Win7Support.dll MOD - [2011.08.22 17:34:44 | 000,824,160 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\SMSUIPlugin.dll MOD - [2011.08.22 17:34:44 | 000,691,552 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\SmsAppPlugin.dll MOD - [2011.08.22 17:34:44 | 000,398,336 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\QtXml4.dll MOD - [2011.08.22 17:34:44 | 000,324,960 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\StatusBarMgrPlugin.dll MOD - [2011.08.22 17:34:44 | 000,277,856 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\sdk.dll MOD - [2011.08.22 17:34:44 | 000,224,608 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\SmsSrvPlugin.dll MOD - [2011.08.22 17:34:44 | 000,140,640 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\Trace.dll MOD - [2011.08.22 17:34:44 | 000,131,936 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\ServiceUIPlugin.dll MOD - [2011.08.22 17:34:44 | 000,115,840 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\rdiff.dll MOD - [2011.08.22 17:34:43 | 009,515,520 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\QtGui4.dll MOD - [2011.08.22 17:34:43 | 002,415,104 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\QtCore4.dll MOD - [2011.08.22 17:34:43 | 001,148,416 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\QtNetwork4.dll MOD - [2011.08.22 17:34:43 | 000,081,920 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\plugins\imageformats\qico4.dll MOD - [2011.08.22 17:34:42 | 000,550,752 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\PluginContainer.dll MOD - [2011.08.22 17:34:42 | 000,429,920 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\NetSettingPlugin.dll MOD - [2011.08.22 17:34:42 | 000,392,544 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\Proxy.dll MOD - [2011.08.22 17:34:42 | 000,229,728 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\NetSrvPlugin.dll MOD - [2011.08.22 17:34:42 | 000,139,104 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\OSDialup.dll MOD - [2011.08.22 17:34:42 | 000,137,056 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\OSNDIS.dll MOD - [2011.08.22 17:34:42 | 000,107,360 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\OSAdapt.dll MOD - [2011.08.22 17:34:42 | 000,102,752 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\NotifyServicePlugin.dll MOD - [2011.08.22 17:34:42 | 000,082,944 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\plugins\imageformats\qgif4.dll MOD - [2011.08.22 17:34:42 | 000,071,008 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\OSPowerMgr.dll MOD - [2011.08.22 17:34:41 | 001,107,296 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\NDISAPI.dll MOD - [2011.08.22 17:34:41 | 000,810,336 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\MiniFramePlugin.dll MOD - [2011.08.22 17:34:41 | 000,524,640 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\NetInfoUIExPlugin.dll MOD - [2011.08.22 17:34:41 | 000,332,640 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\NetConnectPlugin.dll MOD - [2011.08.22 17:34:41 | 000,319,328 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\NetInfoRecordUIPlugin.dll MOD - [2011.08.22 17:34:41 | 000,301,920 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\NetInfoSrvPlugin.dll MOD - [2011.08.22 17:34:41 | 000,277,344 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\MenuMgrPlugin.dll MOD - [2011.08.22 17:34:41 | 000,250,720 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\LiveUpdateInterface.dll MOD - [2011.08.22 17:34:41 | 000,184,160 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\NDISPlugin.dll MOD - [2011.08.22 17:34:41 | 000,164,192 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\NetConnectSrvPlugin.dll MOD - [2011.08.22 17:34:41 | 000,143,712 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\HelpUIPlugin.dll MOD - [2011.08.22 17:34:41 | 000,122,720 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\LayoutPlugin.dll MOD - [2011.08.22 17:34:41 | 000,043,008 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\libgcc_s_dw2-1.dll MOD - [2011.08.22 17:34:41 | 000,011,362 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\mingwm10.dll MOD - [2011.08.22 17:34:40 | 000,506,720 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\DeviceMgrUIPlugin.dll MOD - [2011.08.22 17:34:40 | 000,434,016 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\DialupUIPlugin.dll MOD - [2011.08.22 17:34:40 | 000,342,880 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\DeviceAppPlugin.dll MOD - [2011.08.22 17:34:40 | 000,306,016 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\DeviceSrvPlugin.dll MOD - [2011.08.22 17:34:40 | 000,217,440 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\DialUpPlugin.dll MOD - [2011.08.22 17:34:40 | 000,162,656 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\DataServicePlugin.dll MOD - [2011.08.22 17:34:39 | 000,421,216 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\core.dll MOD - [2011.08.22 17:34:39 | 000,227,168 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\Common.dll MOD - [2011.08.22 17:34:39 | 000,104,800 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\CompressRatePlugin.dll MOD - [2011.08.22 17:34:38 | 001,089,888 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\AddrBookPlugin.dll MOD - [2011.08.22 17:34:38 | 000,801,632 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\AddrBookUIPlugin.dll MOD - [2011.08.22 17:34:38 | 000,268,128 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\AddrBookSrvPlugin.dll MOD - [2011.08.22 17:34:38 | 000,244,576 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\AtCodec.dll MOD - [2011.08.22 17:34:38 | 000,129,376 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\ATR2SMgr.dll MOD - [2011.08.22 17:34:37 | 000,520,032 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\Internet Manager.exe MOD - [2011.08.22 17:34:37 | 000,193,664 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_H\bmsdk.exe MOD - [2009.05.18 11:55:48 | 007,745,536 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll MOD - [2009.05.18 11:55:44 | 002,121,728 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll MOD - [2009.05.18 11:55:44 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll MOD - [2007.08.02 21:07:56 | 000,034,064 | ---- | M] () -- C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\DetMethod.dll ========== Services (SafeList) ========== SRV - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.09.06 03:25:06 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.08.15 20:02:19 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.06.06 09:14:32 | 000,185,856 | ---- | M] () [Auto | Running] -- C:\Programme\Web Assistant\ExtensionUpdaterService.exe -- (Web Assistant Updater) SRV - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.11.18 14:51:12 | 003,673,944 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe -- (Radio.fx) SRV - [2011.11.17 22:12:44 | 000,073,728 | ---- | M] (Sony Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe -- (Sony SCSI Helper Service) SRV - [2011.08.22 17:34:38 | 000,224,096 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe -- (Internet Manager. RunOuc) SRV - [2011.04.13 16:39:50 | 000,387,696 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe -- (AVP) SRV - [2011.03.07 21:58:47 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2011.01.28 06:03:34 | 000,344,928 | ---- | M] () [Auto | Running] -- C:\ProgramData\DatacardService\HWDeviceService64.exe -- (HWDeviceService64.exe) SRV - [2010.10.22 14:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.03.18 12:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon) SRV - [2010.03.10 14:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2) SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2010.02.18 14:01:06 | 000,462,632 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate) SRV - [2009.09.23 14:38:18 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2009.08.28 17:22:38 | 000,221,184 | ---- | M] (Droppix) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Droppix\DxService.exe -- (Droppix Service) SRV - [2009.08.21 02:25:50 | 000,062,720 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc) SRV - [2009.08.18 22:40:12 | 000,796,192 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc) SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2009.08.06 19:18:54 | 000,311,592 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService) SRV - [2009.07.10 11:54:44 | 000,253,952 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe -- (RS_Service) SRV - [2009.07.04 03:47:12 | 000,240,160 | ---- | M] (Acer) [Disabled | Stopped] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.06.05 04:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) SRV - [2009.06.04 15:04:50 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service) SRV - [2009.03.27 12:10:16 | 000,016,896 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Programme\LSI SoftModem\agr64svc.exe -- (AgereModemAudio) SRV - [2006.07.24 13:02:12 | 000,086,016 | ---- | M] (Olivetti) [Auto | Running] -- C:\Program Files (x86)\Olivetti\ANY_WAY\olMntrService.exe -- (olMntrService) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.09.07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.04.05 15:27:37 | 000,088,480 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt) DRV:64bit: - [2012.04.05 15:27:37 | 000,046,400 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.12.12 18:07:19 | 000,556,120 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\SysNative\drivers\klif.sys -- (KLIF) DRV:64bit: - [2011.11.03 03:01:00 | 000,056,208 | ---- | M] (Rovi Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2011.08.22 17:34:46 | 000,212,992 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_juwwanecm.sys -- (huawei_wwanecm) DRV:64bit: - [2011.08.22 17:34:46 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev) DRV:64bit: - [2011.08.22 17:34:46 | 000,098,816 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jucdcacm.sys -- (huawei_cdcacm) DRV:64bit: - [2011.08.22 17:34:46 | 000,086,016 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV:64bit: - [2011.08.22 17:34:46 | 000,039,552 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tcpipBM.sys -- (tcpipBM) DRV:64bit: - [2011.08.22 17:34:46 | 000,028,672 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_juextctrl.sys -- (huawei_ext_ctrl) DRV:64bit: - [2011.08.22 17:34:46 | 000,013,952 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_usbenumfilter.sys -- (ew_usbenumfilter) DRV:64bit: - [2011.08.22 17:34:45 | 000,016,512 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\BMLoad.sys -- (BMLoad) DRV:64bit: - [2011.05.10 08:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.06.09 18:44:00 | 000,011,864 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kl2.sys -- (kl2) DRV:64bit: - [2010.06.09 18:43:56 | 000,460,888 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\kl1.sys -- (KL1) DRV:64bit: - [2010.04.22 20:07:36 | 000,027,736 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\klim6.sys -- (KLIM6) DRV:64bit: - [2009.11.02 21:27:10 | 000,022,544 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klmouflt.sys -- (klmouflt) DRV:64bit: - [2009.09.15 19:40:42 | 006,952,960 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) DRV:64bit: - [2009.09.02 11:29:06 | 000,626,688 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emOEM64.sys -- (USB28xxOEM) DRV:64bit: - [2009.09.01 16:31:42 | 000,649,984 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emBDA64.sys -- (USB28xxBGA) DRV:64bit: - [2009.08.14 16:54:54 | 000,286,768 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2009.07.27 09:04:36 | 000,058,880 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:64bit: - [2009.07.21 08:03:34 | 001,208,320 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.26 22:25:10 | 000,083,488 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2009.06.24 23:03:24 | 000,048,128 | ---- | M] (Nuvoton Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nuvotoncir.sys -- (nuvotoncir) DRV:64bit: - [2009.06.24 05:00:18 | 000,216,576 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR) DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.06.05 03:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009.06.02 13:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk) DRV:64bit: - [2009.06.02 13:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter) DRV:64bit: - [2009.06.02 13:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ) DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009.05.14 02:51:40 | 005,435,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETw5v64.sys -- (netw5v64) DRV:64bit: - [2009.05.05 10:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr) DRV:64bit: - [2009.05.05 10:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper) DRV:64bit: - [2009.04.15 11:51:52 | 000,060,736 | ---- | M] (Service & Quality Technology.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Capt900a.sys -- (SQTECH900A) DRV:64bit: - [2009.01.19 20:32:22 | 000,334,344 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11) DRV:64bit: - [2008.10.21 10:22:44 | 000,145,960 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017unic.sys -- (s0017unic) DRV:64bit: - [2008.10.21 10:22:44 | 000,128,552 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017obex.sys -- (s0017obex) DRV:64bit: - [2008.10.21 10:22:44 | 000,034,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017nd5.sys -- (s0017nd5) DRV:64bit: - [2008.10.21 10:22:42 | 000,152,616 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017mdm.sys -- (s0017mdm) DRV:64bit: - [2008.10.21 10:22:42 | 000,133,160 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017mgmt.sys -- (s0017mgmt) DRV:64bit: - [2008.10.21 10:22:42 | 000,019,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017mdfl.sys -- (s0017mdfl) DRV:64bit: - [2008.10.21 10:22:40 | 000,113,704 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017bus.sys -- (s0017bus) DRV:64bit: - [2008.03.28 17:25:30 | 000,017,952 | ---- | M] (Acer, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\OEM\factory\int15.sys -- (int15.sys) DRV:64bit: - [2007.08.07 21:48:37 | 000,032,712 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV:64bit: - [2007.02.16 02:56:51 | 000,014,032 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ElbyDelay.sys -- (ElbyDelay) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2007.02.16 02:56:51 | 000,014,032 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\ElbyDelay.sys -- (ElbyDelay) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5739g&r=273610092716l0323z186t4784y894 IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5739g&r=273610092716l0323z186t4784y894 IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://www.searchqu.com/web?src=ieb&appid=175&systemid=406&sr=0&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5739g&r=273610092716l0323z186t4784y894 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5739g&r=273610092716l0323z186t4784y894 IE - HKLM\..\URLSearchHook: - No CLSID value found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\prxtbsof0.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://www.searchqu.com/web?src=ieb&appid=175&systemid=406&sr=0&q={searchTerms} IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5739g&r=273610092716l0323z186t4784y894 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchplusnetwork.com/?sp=vit4 IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - No CLSID value found IE - HKCU\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - No CLSID value found IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\prxtbsof0.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {cd8812d4-e5b8-41c6-94d4-59872a484bf1} - C:\Program Files (x86)\dvdvideosofttoolbar\dvdvideosofttoolbarX.dll () IE - HKCU\..\SearchScopes,DefaultScope = {4327FABE-3C22-4689-8DBF-D226CF777FE9} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&AF=100482&babsrc=SP_ss&mntrId=34cfab7f000000000000001e658e3c68 IE - HKCU\..\SearchScopes\{120F54AD-E6CE-4F1F-AC95-FAA5B38BF1EF}: "URL" = hxxp://go.web.de/suchbox/smartshopping/?searchText={searchTerms}&mc=searchplugin@suche@msie.suche@preisvergleich IE - HKCU\..\SearchScopes\{4327FABE-3C22-4689-8DBF-D226CF777FE9}: "URL" = hxxp://www.searchplusnetwork.com/?sp=vit4&q={searchTerms} IE - HKCU\..\SearchScopes\{5508AFC9-ECBC-4ECE-9FC2-1DE803077479}: "URL" = hxxp://go.web.de/suchbox/amazon/?keywords={searchTerms} IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de IE - HKCU\..\SearchScopes\{7D52917E-FC78-4E8D-9005-78B4BDDA9AE6}: "URL" = hxxp://search.1und1.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://www.searchqu.com/web?src=ieb&appid=175&systemid=406&sr=0&q={searchTerms} IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029 IE - HKCU\..\SearchScopes\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}: "URL" = hxxp://eu.ask.com/web?l=dis&o=APN10020&gct=sb&qsrc=2869&apn_dtid=^YYYYYY^YY^DE&apn_ptnrs=^A4G &apn_uid=4264159698444538&p2=^A4G ^YYYYYY^YY^DE&q={searchTerms} IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb128/?search={searchTerms}&loc=IB_DS&a=6PQEWquolQ&i=26 IE - HKCU\..\SearchScopes\{EA87AF98-E92C-4EAB-AABC-210797272EA3}: "URL" = hxxp://suche.gmx.net/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin IE - HKCU\..\SearchScopes\{F2076791-CF2A-46C2-B0F3-FA57902A20B8}: "URL" = hxxp://suche.web.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "MyStart Search" FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q=" FF - prefs.js..browser.search.order.1: "Search the web (Babylon)" FF - prefs.js..browser.search.order.2: "1und1 Suche" FF - prefs.js..browser.search.order.3: "amazon.de" FF - prefs.js..browser.search.order.4: "WEB.DE Suche" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.update: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledAddons: browserlab@adobe.com:1.0.0.1227P.314153 FF - prefs.js..extensions.enabledAddons: low_quality_flash@pie2k.com:0.2 FF - prefs.js..extensions.enabledAddons: plugin@starstable.com:1.0.0.2 FF - prefs.js..extensions.enabledAddons: plugin@yontoo.com:1.20.00 FF - prefs.js..extensions.enabledAddons: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.9 FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1 FF - prefs.js..extensions.enabledItems: 6 FF - prefs.js..extensions.enabledItems: 2 FF - prefs.js..extensions.enabledItems: 48 FF - prefs.js..extensions.enabledItems: allglassv2@ambroos.neowin.net:2.1.4 FF - prefs.js..extensions.enabledItems: {95f24680-9e31-11da-a746-0800200c9a66}:0.1.5.5 FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.6.13.184 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {ce18769b-c7fa-42d2-860d-17c4662c70ad}:2.7.2.0 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.7 FF - prefs.js..extensions.enabledItems: {464F169E-ACE1-4C5F-A778-A433A3DABBAE}:1.0 FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..keyword.URL: "hxxp://www.searchplusnetwork.com/?sp=vit4&q=" FF - prefs.js..network.proxy.type: 4 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@sony.com/ReaderDesktop: C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX [2012.07.29 16:17:08 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2009.12.27 11:28:09 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012.07.29 16:17:08 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.10 22:35:35 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.07.28 20:03:10 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2009.12.27 11:28:09 | 000,000,000 | ---D | M] [2011.08.25 12:46:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\sevinia\AppData\Roaming\mozilla\Extensions [2009.11.28 23:38:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\sevinia\AppData\Roaming\mozilla\Extensions\IMVUClientXUL@imvu.com [2012.07.29 16:17:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\extensions [2012.07.29 16:15:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\extensions\extensions [2012.09.10 19:34:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\c86cq9ri.default\extensions [2012.08.28 12:45:06 | 000,000,000 | ---D | M] (BittorrentBar_DE Community Toolbar) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\c86cq9ri.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4} [2012.02.27 12:37:33 | 000,000,000 | ---D | M] (PriceGong) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\c86cq9ri.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829} [2012.01.01 16:13:08 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\c86cq9ri.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7} [2012.03.03 23:32:46 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\c86cq9ri.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.03.30 20:22:28 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\c86cq9ri.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2012.03.02 22:30:32 | 000,000,000 | ---D | M] (DVD Video Soft Toolbar) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\c86cq9ri.default\extensions\{cd8812d4-e5b8-41c6-94d4-59872a484bf1} [2012.08.21 11:26:32 | 000,000,000 | ---D | M] (Babylon-EnglishBB Community Toolbar) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\c86cq9ri.default\extensions\{ce18769b-c7fa-42d2-860d-17c4662c70ad} [2012.05.12 22:58:46 | 000,000,000 | ---D | M] (Adobe BrowserLab for Firebug) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\c86cq9ri.default\extensions\browserlab@adobe.com [2012.01.31 22:55:16 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\c86cq9ri.default\extensions\ffxtlbr@babylon.com [2012.07.28 20:32:25 | 000,000,000 | ---D | M] (Low Quality Flash) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\c86cq9ri.default\extensions\low_quality_flash@pie2k.com [2012.08.11 21:58:38 | 000,000,000 | ---D | M] (OneClickDownloader) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\c86cq9ri.default\extensions\OneClickDownload@OneClickDownload.com [2012.09.09 21:01:03 | 000,000,000 | ---D | M] ("Star Stable Online") -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\c86cq9ri.default\extensions\plugin@starstable.com [2012.07.29 16:15:35 | 000,000,000 | ---D | M] (Yontoo) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\c86cq9ri.default\extensions\plugin@yontoo.com [2012.07.29 16:15:37 | 000,000,000 | ---D | M] (Yontoo) -- C:\Users\sevinia\AppData\Roaming\mozilla\Firefox\Profiles\extensions\extensions\plugin@yontoo.com [2012.08.09 21:06:18 | 000,526,409 | ---- | M] () (No name found) -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\extensions\toolbar@web.de.xpi [2012.05.12 22:58:46 | 000,097,169 | ---- | M] () (No name found) -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}.xpi [2012.07.29 19:18:23 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012.02.27 12:37:23 | 000,162,686 | ---- | M] () (No name found) -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi [2012.01.03 10:42:34 | 000,000,933 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\11-suche.xml [2010.02.17 21:32:17 | 000,005,591 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\1und1-suche.xml [2010.02.17 21:32:17 | 000,001,371 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\amazonde.xml [2010.09.13 18:55:41 | 000,000,873 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\conduit.xml [2012.01.03 10:42:34 | 000,002,419 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\englische-ergebnisse.xml [2010.02.17 21:32:17 | 000,010,605 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\gmx-suche.xml [2011.04.11 19:16:35 | 000,000,950 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\icqplugin-1.xml [2011.06.24 20:20:25 | 000,000,950 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\icqplugin-2.xml [2011.08.21 20:01:48 | 000,000,950 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\icqplugin-3.xml [2011.10.03 12:06:15 | 000,000,950 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\icqplugin-4.xml [2010.06.21 17:35:24 | 000,001,042 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\icqplugin.xml [2012.01.03 10:42:34 | 000,002,457 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\lastminute.xml [2012.07.29 16:16:10 | 000,002,203 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\MyStart Search.xml [2012.08.20 18:45:21 | 000,002,792 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\Plusnetwork.xml [2012.01.01 16:12:59 | 000,002,520 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\SearchResults.xml [2012.02.27 12:37:19 | 000,003,915 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\sweetim.xml [2010.02.17 21:32:17 | 000,005,588 | ---- | M] () -- C:\Users\sevinia\AppData\Roaming\mozilla\firefox\profiles\c86cq9ri.default\searchplugins\webde-suche.xml [2012.09.10 22:35:34 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2010.07.23 16:22:44 | 000,000,000 | ---D | M] (VMLoad) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{464F169E-ACE1-4C5F-A778-A433A3DABBAE} [2011.12.12 18:08:57 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru [2011.12.12 18:08:54 | 000,000,000 | ---D | M] (Modul zur Link-Untersuchung) -- C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2012.09.06 03:26:03 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.09.06 04:07:37 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.03.02 22:30:49 | 000,002,276 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\ask.xml [2012.01.31 22:54:58 | 000,002,310 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml [2012.09.06 04:07:37 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.09.06 04:07:37 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.09.06 04:07:37 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.01.01 16:12:59 | 000,002,520 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SearchResults.xml [2012.09.06 04:07:37 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.09.06 04:07:37 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Programme\Web Assistant\Extension64.dll () O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\x64\ievkbd.dll (Kaspersky Lab ZAO) O2:64bit: - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2:64bit: - BHO: (Loader Class) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media, inc) O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\x64\klwtbbho.dll (Kaspersky Lab ZAO) O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Programme\Web Assistant\Extension32.dll () O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\ievkbd.dll (Kaspersky Lab ZAO) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll () O2 - BHO: (Loader Class) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (VMLoadHBO Class) - {C17C7688-31D1-46D7-8C9B-5D253E4F5D5E} - C:\Users\sevinia\AppData\Roaming\VMLoad\addin\VMLoad.dll (TODO: <Company name>) O2 - BHO: (ST-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\prxtbsof0.dll (Conduit Ltd.) O2 - BHO: (DVD Video Soft Toolbar) - {cd8812d4-e5b8-41c6-94d4-59872a484bf1} - C:\Program Files (x86)\dvdvideosofttoolbar\dvdvideosofttoolbarX.dll () O2 - BHO: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\klwtbbho.dll (Kaspersky Lab ZAO) O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll (Yontoo LLC) O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll () O3 - HKLM\..\Toolbar: (ST-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\prxtbsof0.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (DVD Video Soft Toolbar) - {cd8812d4-e5b8-41c6-94d4-59872a484bf1} - C:\Program Files (x86)\dvdvideosofttoolbar\dvdvideosofttoolbarX.dll () O3 - HKLM\..\Toolbar: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\WebBrowser: (ST-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files (x86)\softonic-de3\prxtbsof0.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.) O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe (Kaspersky Lab ZAO) O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Ulead AutoDetector v2] C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.) O4 - HKCU..\Run: [] File not found O4 - HKCU..\Run: [AdobeBridge] File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0 O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\sevinia\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\sevinia\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html File not found O8:64bit: - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\ie_banner_deny.htm () O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Web-Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Free YouTube Download - C:\Users\sevinia\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\sevinia\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html File not found O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\ie_banner_deny.htm () O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Web-Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\x64\klwtbbho.dll (Kaspersky Lab ZAO) O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\x64\klwtbbho.dll (Kaspersky Lab ZAO) O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\klwtbbho.dll (Kaspersky Lab ZAO) O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\klwtbbho.dll (Kaspersky Lab ZAO) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 10.5.1) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 10.5.1) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{47E77BBB-11B7-4E1C-8989-A9B359FA32AA}: NameServer = 10.74.210.210 10.74.210.211 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B2A27924-41E4-4416-BA91-0A0D3A7D1E5A}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DB9A1F7A-80B1-439B-BC4C-2B246CDE52BC}: NameServer = 10.74.210.210 10.74.210.211 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E8393C20-1514-44C3-A075-9931456A5DB5}: NameServer = 10.74.210.210 10.74.210.211 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F9E49A12-9959-489B-B3D2-2A6E3A19E6AF}: DhcpNameServer = 192.168.99.10 192.168.99.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WI3C8A~1\Datamngr\x64\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\x64\IEBHO.dll) - C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\x64\datamngr.dll (Bandoo Media, inc) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\x64\kloehk.dll (Kaspersky Lab ZAO) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\x64\sbhook64.dll (Kaspersky Lab ZAO) O20 - AppInit_DLLs: (C:\PROGRA~2\WI3C8A~1\Datamngr\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\IEBHO.dll) - C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc) O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\mzvkbd3.dll (Kaspersky Lab ZAO) O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Suite CBE 11\sbhook.dll (Kaspersky Lab ZAO) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\klogon: DllName - (%SystemRoot%\System32\klogon.dll) - C:\Windows\SysNative\klogon.dll (Kaspersky Lab ZAO) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010.12.30 21:56:05 | 000,147,808 | R--- | M] () - D:\AutoRun.exe -- [ CDFS ] O32 - AutoRun File - [2009.09.25 12:46:52 | 000,000,045 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{568f2129-d1d7-11de-93ff-00269e2c6a01}\Shell - "" = AutoRun O33 - MountPoints2\{568f2129-d1d7-11de-93ff-00269e2c6a01}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -a O33 - MountPoints2\{8113ca1b-cb3d-11e0-876e-00269e4e4d26}\Shell - "" = AutoRun O33 - MountPoints2\{8113ca1b-cb3d-11e0-876e-00269e4e4d26}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2010.12.30 21:56:05 | 000,147,808 | R--- | M] () O33 - MountPoints2\{8113ca3c-cb3d-11e0-876e-00269e4e4d26}\Shell - "" = AutoRun O33 - MountPoints2\{8113ca3c-cb3d-11e0-876e-00269e4e4d26}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2010.12.30 21:56:05 | 000,147,808 | R--- | M] () O33 - MountPoints2\{8113ca40-cb3d-11e0-876e-00269e4e4d26}\Shell - "" = AutoRun O33 - MountPoints2\{8113ca40-cb3d-11e0-876e-00269e4e4d26}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2010.12.30 21:56:05 | 000,147,808 | R--- | M] () O33 - MountPoints2\{b8f9628d-e2dd-11e0-882f-00269e4e4d26}\Shell - "" = AutoRun O33 - MountPoints2\{b8f9628d-e2dd-11e0-882f-00269e4e4d26}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2010.12.30 21:56:05 | 000,147,808 | R--- | M] () O33 - MountPoints2\{d0c06db4-a8ce-11e0-8787-00269e4e4d26}\Shell - "" = AutoRun O33 - MountPoints2\{d0c06db4-a8ce-11e0-8787-00269e4e4d26}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.09.10 22:41:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.09.10 22:41:18 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.09.10 22:41:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.09.10 22:35:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2012.09.10 22:12:15 | 000,000,000 | ---D | C] -- C:\Users\sevinia\AppData\Roaming\Malwarebytes [2012.09.10 22:07:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.09.10 19:01:35 | 000,000,000 | ---D | C] -- C:\_OTL [2012.09.10 18:55:33 | 000,600,064 | ---- | C] (OldTimer Tools) -- C:\Users\sevinia\Desktop\OTL.exe [2012.09.09 15:24:36 | 000,000,000 | ---D | C] -- C:\Users\sevinia\Desktop\Wohnung [2012.09.05 10:26:32 | 000,000,000 | ---D | C] -- C:\Users\sevinia\Desktop\Lady Gaga [2012.09.01 21:53:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Atari [2012.08.31 12:30:58 | 000,000,000 | ---D | C] -- C:\Users\sevinia\Desktop\ATZ_Jupp [2012.08.31 11:49:33 | 000,000,000 | ---D | C] -- C:\Users\sevinia\Desktop\Unsere kleine Farm [2012.08.30 12:38:43 | 000,000,000 | ---D | C] -- C:\Users\sevinia\Desktop\Full metal Panic F [2012.08.20 18:45:20 | 000,000,000 | ---D | C] -- C:\Users\sevinia\AppData\Local\Messenger_Plus_Live [2012.08.20 18:45:17 | 000,000,000 | ---D | C] -- C:\Users\sevinia\AppData\Roaming\BrowserCompanion [2012.08.20 18:45:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BrowserCompanion [2012.08.15 19:46:10 | 000,000,000 | ---D | C] -- C:\Users\sevinia\Documents\Meine Paletten [2012.08.15 19:22:16 | 000,000,000 | ---D | C] -- C:\Users\sevinia\Documents\Corel [2012.08.15 19:21:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Protexis [2012.08.15 19:21:30 | 000,000,000 | ---D | C] -- C:\Users\sevinia\AppData\Roaming\Corel [2012.08.15 19:10:26 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Corel [2012.08.15 19:08:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Corel [2012.08.15 19:08:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Protexis [2012.08.15 19:08:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Corel [2012.08.15 19:05:31 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Home & Student Suite X5 [2012.08.14 11:11:04 | 000,000,000 | ---D | C] -- C:\Users\sevinia\Documents\Harry Potter und der Gefangene von Askaban [2012.08.13 17:25:04 | 000,000,000 | ---D | C] -- C:\Users\sevinia\Documents\Harry Potter [2009.08.22 08:22:38 | 000,036,136 | ---- | C] (Oberon Media) -- C:\ProgramData\FullRemove.exe [3 C:\Users\sevinia\Documents\*.tmp files -> C:\Users\sevinia\Documents\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\sevinia\Desktop\*.tmp files -> C:\Users\sevinia\Desktop\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.09.11 22:35:04 | 000,000,000 | ---- | M] () -- C:\Users\sevinia\defogger_reenable [2012.09.11 22:33:26 | 000,050,477 | ---- | M] () -- C:\Users\sevinia\Desktop\Defogger.exe [2012.09.11 22:08:00 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.09.11 22:04:57 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.09.11 22:04:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.09.11 20:41:25 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.09.11 20:41:25 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.09.11 20:32:52 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.09.11 20:32:29 | 3193,643,008 | -HS- | M] () -- C:\hiberfil.sys [2012.09.11 09:05:09 | 001,492,188 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.09.11 09:05:09 | 000,652,012 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.09.11 09:05:09 | 000,614,160 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.09.11 09:05:09 | 000,129,020 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.09.11 09:05:09 | 000,105,402 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.09.10 22:46:11 | 000,001,077 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.09.10 22:36:13 | 000,001,098 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.09.10 18:55:37 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\sevinia\Desktop\OTL.exe [2012.09.07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.08.26 14:38:35 | 000,000,055 | ---- | M] () -- C:\Windows\Tkkg_2.ini [2012.08.25 20:57:35 | 000,017,819 | ---- | M] () -- C:\Users\sevinia\Desktop\wohnung.ods [2012.08.16 19:06:34 | 005,310,744 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.08.13 17:04:39 | 000,000,524 | ---- | M] () -- C:\Windows\eReg.dat [3 C:\Users\sevinia\Documents\*.tmp files -> C:\Users\sevinia\Documents\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\sevinia\Desktop\*.tmp files -> C:\Users\sevinia\Desktop\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.09.11 22:35:04 | 000,000,000 | ---- | C] () -- C:\Users\sevinia\defogger_reenable [2012.09.11 22:33:24 | 000,050,477 | ---- | C] () -- C:\Users\sevinia\Desktop\Defogger.exe [2012.09.10 22:41:20 | 000,001,077 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.09.10 22:36:13 | 000,001,098 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.09.10 22:36:04 | 000,001,110 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.08.26 14:38:08 | 000,000,055 | ---- | C] () -- C:\Windows\Tkkg_2.ini [2012.08.13 17:04:39 | 000,000,524 | ---- | C] () -- C:\Windows\eReg.dat [2012.06.18 19:17:03 | 000,554,496 | ---- | C] () -- C:\Windows\SysWow64\dvmsg.dll [2012.04.12 21:42:56 | 001,591,306 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.02.26 16:27:51 | 000,005,120 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2012.02.05 15:35:58 | 000,019,677 | ---- | C] () -- C:\Users\sevinia\AppData\Local\internal.grp [2012.01.31 22:54:56 | 000,098,304 | ---- | C] () -- C:\Windows\SysWow64\redmonnt.dll [2012.01.23 12:32:38 | 000,000,000 | ---- | C] () -- C:\Users\sevinia\AppData\Local\{15F96DE6-A2CB-40F2-8834-C28AD6FCE0F7} [2012.01.11 20:52:48 | 000,001,006 | ---- | C] () -- C:\Windows\ULEAD32.INI [2011.12.29 21:54:26 | 000,000,000 | ---- | C] () -- C:\Windows\ViewNX2.INI [2011.12.29 21:49:53 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Workflows [2011.12.29 21:49:53 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Work - Home [2011.12.29 21:49:53 | 000,000,268 | RH-- | C] () -- C:\Users\sevinia\AppData\Roaming\Woodwind [2011.12.29 21:49:53 | 000,000,268 | RH-- | C] () -- C:\Users\sevinia\AppData\Roaming\Widgets [2011.12.29 21:49:53 | 000,000,268 | RH-- | C] () -- C:\ProgramData\business-inkjet [2011.12.29 21:49:53 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT [2011.12.29 21:49:53 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT [2011.12.29 21:49:53 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Action [2011.12.29 21:49:53 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Abstract [2011.12.29 21:49:52 | 000,000,268 | RH-- | C] () -- C:\Users\sevinia\AppData\Roaming\WebServer [2011.12.29 21:49:52 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT [2011.12.27 23:32:42 | 000,007,605 | ---- | C] () -- C:\Users\sevinia\AppData\Local\Resmon.ResmonCfg [2011.07.31 19:18:56 | 000,000,880 | ---- | C] () -- C:\Users\sevinia\.recently-used.xbel [2011.02.02 22:34:42 | 000,533,570 | ---- | C] () -- C:\Users\sevinia\AppData\Roaming\mdbu.bin [2011.01.13 22:49:07 | 000,000,122 | ---- | C] () -- C:\Windows\scummvm.ini [2011.01.10 20:06:38 | 000,000,183 | ---- | C] () -- C:\Windows\wiso.ini [2011.01.07 21:54:54 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.09.28 12:57:24 | 000,000,051 | ---- | C] () -- C:\Windows\movexe.ini [2009.11.02 00:36:53 | 000,001,181 | ---- | C] () -- C:\Users\sevinia\Microsoft Works.lnk [2009.10.29 21:29:27 | 000,001,144 | ---- | C] () -- C:\Users\sevinia\OpenOffice.org 3.1.lnk [2009.10.29 20:56:15 | 000,001,243 | ---- | C] () -- C:\Users\sevinia\CloneDVD2OEM.lnk [2009.10.29 20:51:48 | 000,002,126 | ---- | C] () -- C:\Users\sevinia\Europa Routenplaner 2008.lnk [2009.10.29 18:49:18 | 000,002,609 | ---- | C] () -- C:\Users\sevinia\eBay.lnk [2009.10.29 18:49:13 | 000,001,970 | ---- | C] () -- C:\Users\sevinia\Acer Zubehör Shop.lnk [2009.08.22 09:22:16 | 000,002,413 | ---- | C] () -- C:\Users\sevinia\Norton Online Backup.lnk [2009.08.22 09:09:58 | 000,001,008 | ---- | C] () -- C:\Users\sevinia\McAfee Security Center.lnk [2009.08.22 08:29:35 | 000,002,155 | ---- | C] () -- C:\Users\sevinia\Acer GameZone Console.lnk ========== LOP Check ========== [2009.11.02 22:34:03 | 000,000,000 | -HSD | M] -- C:\Users\sevinia\AppData\Roaming\.# [2010.11.11 23:15:20 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\Amazon [2012.04.13 21:06:40 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\ASCOMP Software [2012.03.02 22:30:46 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\Ask.com [2012.01.31 22:54:53 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\Babylon [2012.03.19 16:01:57 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\BitTorrent [2012.01.31 22:58:14 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\biu software [2010.10.03 22:14:56 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\Boomzap [2012.09.10 19:34:42 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\BrowserCompanion [2012.01.01 18:31:44 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\Byngo [2011.07.31 15:51:35 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2012.07.01 12:41:47 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant [2010.04.24 16:03:12 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\DAZ 3D [2010.10.29 20:29:34 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\de.schlecker.fotobuch.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1 [2012.03.03 22:18:37 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\Digiarty [2012.01.31 23:13:38 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\Droppix [2012.03.04 00:17:20 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\DVDVideoSoft [2012.03.03 23:32:45 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\DVDVideoSoftIEHelpers [2012.03.20 23:11:00 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\EurekaLog [2012.01.01 16:12:57 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\FreeFLVConverter [2009.10.29 19:19:41 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\GameConsole [2011.03.07 00:16:08 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\gtk-2.0 [2012.04.21 18:36:23 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\ICQ [2011.10.17 19:25:08 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\Jens Lorek [2010.05.07 20:31:29 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\MAGIX [2010.12.25 11:51:24 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\MAGIX USB-Videowandler 2 [2012.05.20 13:07:31 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\MakeMusic [2011.12.31 15:35:58 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\Nikon [2009.10.29 21:30:06 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\OpenOffice.org [2011.11.05 00:18:10 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\Opera [2012.07.01 14:13:10 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\PACE Anti-Piracy [2012.07.01 14:11:38 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\PDAppFlex [2011.03.13 23:47:48 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\Pixpedia Publisher [2011.03.06 20:27:03 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\PlayFirst [2009.12.26 22:34:32 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\PowerCinema [2010.12.29 17:40:16 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\ProtectDisc [2010.09.28 11:12:04 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\PTV AG [2010.10.21 22:39:52 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\SoftDMA [2011.08.22 17:35:41 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\T-Mobile [2012.06.18 19:17:32 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\Tobit [2010.07.27 20:03:24 | 000,000,000 | ---D | M] -- C:\Users\sevinia\AppData\Roaming\VMLoad [2012.09.03 12:16:54 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 931 bytes -> C:\Users\sevinia\AppData\Local\Temp:HgHo8bLSG5j6Fnt6rA99SKX @Alternate Data Stream - 153 bytes -> C:\ProgramData\Temp:4D066AD2 @Alternate Data Stream - 151 bytes -> C:\ProgramData\Temp:206470A5 @Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:5D7E5A8F @Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:93DE1838 @Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:1D32EC29 @Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:ABE89FFE @Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:E3C56885 @Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:E1F04E8D @Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:4CF61E54 @Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:0B9176C0 < End of report > |
| Themen zu mystart Incredibar loswerden |
| adobe, bandoo, bho, bonjour, conduit, converter, e-mail, firefox, flash player, format, google earth, home, hängen, kaspersky, locker, logfile, loswerden, mozilla, mp3, mywinlocker, oneclickdownloader, origin, plug-in, realtek, registry, scan, search the web, security, server, software, t-mobile, tastatur, updates, windows |
Baum-Darstellung