| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: u-search.net / browser hijackerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
26.09.2012, 18:26
| #1 |
| |  u-search.net / browser hijacker Hi, ich hab mir einen Virus eingefangen der die Startseite von Firefox auf "hxxp://u-search.net/?a=1&e=1" stellt die mich dann zu Google weiterleitet (speichert Suchanfragen etc.?). Ändern ist nicht möglich, bei jedem Neustart wird die Seite zurückgesetzt. Ich hab auch schon mein System neu aufgesetzt, wurde aber wieder infiziert.. (vielleicht über meine ext. festplatte..) Mein Virenscanner (ms security essentials) und mbam hatten keine Funde. OTL.txt:OTL Logfile: Code:
ATTFilter OTL logfile created on: 26.09.2012 18:51:35 - Run 1 OTL by OldTimer - Version 3.2.68.0 Folder = C:\Users\Marius\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,91 Gb Total Physical Memory | 2,07 Gb Available Physical Memory | 52,94% Memory free 7,82 Gb Paging File | 6,01 Gb Available in Paging File | 76,92% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 297,99 Gb Total Space | 185,21 Gb Free Space | 62,15% Space Free | Partition Type: NTFS Drive D: | 2,81 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS Drive E: | 465,76 Gb Total Space | 15,37 Gb Free Space | 3,30% Space Free | Partition Type: NTFS Computer Name: MARIUS-NOTEBOOK | User Name: Marius | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.09.26 18:36:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Marius\Downloads\OTL.exe PRC - [2012.09.25 22:17:25 | 001,193,176 | ---- | M] () -- C:\Users\Marius\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe PRC - [2012.08.08 10:17:00 | 000,540,056 | ---- | M] (Lavasoft) -- C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2011.03.21 17:30:02 | 003,077,120 | ---- | M] () -- C:\Program Files (x86)\Hotkey\Hotkey.exe PRC - [2011.02.15 17:16:46 | 000,033,792 | ---- | M] () -- C:\Program Files (x86)\Hotkey\PowerBiosServer.exe PRC - [2011.02.01 07:24:42 | 002,656,280 | R--- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2011.02.01 07:24:40 | 000,326,168 | R--- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2010.11.17 03:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe ========== Modules (No Company Name) ========== MOD - [2012.09.25 22:17:25 | 001,193,176 | ---- | M] () -- C:\Users\Marius\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe MOD - [2011.03.21 17:30:02 | 003,077,120 | ---- | M] () -- C:\Program Files (x86)\Hotkey\Hotkey.exe MOD - [2010.11.21 05:51:24 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\System.Management.ni.dll MOD - [2010.11.21 05:49:27 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll MOD - [2010.11.21 05:48:49 | 012,432,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll MOD - [2010.11.21 05:48:42 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll MOD - [2010.11.21 05:48:40 | 000,025,600 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\Accessibility.ni.dll MOD - [2010.11.21 05:48:21 | 007,963,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll MOD - [2010.11.21 05:48:14 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll MOD - [2009.06.06 14:50:32 | 000,019,968 | ---- | M] () -- C:\Program Files (x86)\Hotkey\Audiodll.dll MOD - [2006.12.11 02:10:26 | 000,049,152 | ---- | M] () -- C:\Program Files (x86)\Hotkey\AudioControlDLL.dll ========== Services (SafeList) ========== SRV - [2012.09.26 17:07:37 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.07.14 02:13:54 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.07.09 00:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.03.26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv) SRV - [2012.03.26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV - [2011.02.15 17:16:46 | 000,033,792 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotkey\PowerBiosServer.exe -- (PowerBiosServer) SRV - [2011.02.01 07:24:42 | 002,656,280 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2011.02.01 07:24:40 | 000,326,168 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.09.25 22:45:22 | 000,231,376 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt) DRV:64bit: - [2012.06.22 15:35:00 | 000,251,560 | ---- | M] (PC Tools) [Kernel | Disabled | Running] -- C:\Windows\SysNative\drivers\PCTSD64.sys -- (PCTSD) DRV:64bit: - [2012.05.15 12:48:00 | 000,028,992 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt) DRV:64bit: - [2012.03.20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv) DRV:64bit: - [2011.01.27 02:57:12 | 012,273,408 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2011.01.14 07:24:56 | 000,132,624 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\JME.sys -- (JME) DRV:64bit: - [2011.01.04 11:29:46 | 008,507,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) DRV:64bit: - [2010.12.06 09:56:26 | 000,174,168 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR) DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.21 05:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.11.21 05:23:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2010.11.21 05:23:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.19 04:34:26 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2010.11.19 04:34:26 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2010.10.19 10:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:64bit: - [2010.10.14 18:28:16 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) DRV:64bit: - [2010.09.16 13:14:56 | 001,393,200 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-2773119867-2929089309-3414940213-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-2773119867-2929089309-3414940213-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2773119867-2929089309-3414940213-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://u-search.net/?a=1&e=1" FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_278.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\Windows\system32\npDeployJava1.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll () FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.26 18:15:45 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.25 22:11:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Marius\AppData\Roaming\mozilla\Extensions [2012.09.26 18:39:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Marius\AppData\Roaming\mozilla\Firefox\Profiles\lrbj5yeh.default\extensions [2012.09.25 22:11:04 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.07.14 02:15:45 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.07.14 02:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.07.14 02:45:08 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.07.14 02:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.07.14 02:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.07.14 02:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.14 02:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Ad-Aware Browsing Protection] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2773119867-2929089309-3414940213-1000..\Run: [Spotify] C:\Users\Marius\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd) O4 - HKU\S-1-5-21-2773119867-2929089309-3414940213-1000..\Run: [Spotify Web Helper] C:\Users\Marius\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe () O4 - HKU\S-1-5-21-2773119867-2929089309-3414940213-1000..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation) O4 - HKU\S-1-5-21-2773119867-2929089309-3414940213-1003..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-2773119867-2929089309-3414940213-1000..\RunOnce: [adawarebp] reg.exe delete "HKCU\Software\AppDataLow\Software\adawarebp" /f File not found O4 - HKU\S-1-5-21-2773119867-2929089309-3414940213-1000..\RunOnce: [adawarebp_XP] reg.exe delete "HKCU\Software\adawarebp" /f File not found O4 - HKU\S-1-5-21-2773119867-2929089309-3414940213-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 217.0.43.97 217.0.43.113 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{805AC98C-05B8-44BB-AE68-855D5CD00724}: DhcpNameServer = 217.0.43.97 217.0.43.113 O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2011.04.12 05:17:04 | 000,000,000 | ---D | M] - D:\AutoPlay -- [ CDFS ] O32 - AutoRun File - [2011.04.09 11:31:22 | 000,016,396 | R--- | M] () - D:\autoins.ini -- [ CDFS ] O32 - AutoRun File - [2010.06.10 12:43:54 | 002,844,568 | R--- | M] () - D:\autorun.exe -- [ CDFS ] O32 - AutoRun File - [2010.03.02 10:34:26 | 000,000,031 | R--- | M] () - D:\autorun.inf -- [ CDFS ] O33 - MountPoints2\{936f5673-0747-11e2-8fb4-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{936f5673-0747-11e2-8fb4-806e6f6e6963}\Shell\AutoRun\command - "" = D:\autorun.exe -- [2010.06.10 12:43:54 | 002,844,568 | R--- | M] () O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.09.26 18:21:54 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\LavasoftStatistics [2012.09.26 18:15:44 | 000,000,000 | ---D | C] -- C:\ProgramData\blekko toolbars [2012.09.26 18:15:44 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Local\adawarebp [2012.09.26 18:15:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Ad-Aware Browsing Protection [2012.09.26 18:15:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\adawaretb [2012.09.26 18:15:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Toolbar Cleaner [2012.09.26 18:13:54 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\Ad-Aware Antivirus [2012.09.26 17:53:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy [2012.09.26 17:52:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2012.09.26 17:52:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy [2012.09.26 17:27:57 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\Malwarebytes [2012.09.26 17:27:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.09.26 17:27:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.09.26 17:27:39 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.09.26 17:27:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.09.26 16:59:13 | 000,251,560 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\PCTSD64.sys [2012.09.26 16:59:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PC Tools [2012.09.26 16:56:56 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2012.09.26 16:56:50 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools [2012.09.26 16:56:48 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\TestApp [2012.09.26 16:46:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam [2012.09.26 16:46:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Steam [2012.09.26 16:46:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Steam [2012.09.26 16:19:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin [2012.09.26 16:19:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts [2012.09.26 16:19:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin [2012.09.26 16:14:18 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++ [2012.09.26 16:14:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++ [2012.09.26 16:14:16 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\Notepad++ [2012.09.26 16:14:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Notepad++ [2012.09.26 16:13:44 | 001,034,216 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll [2012.09.26 16:13:44 | 000,916,456 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll [2012.09.26 16:13:44 | 000,289,768 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe [2012.09.26 16:13:39 | 000,189,416 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe [2012.09.26 16:13:39 | 000,188,904 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe [2012.09.26 16:13:39 | 000,108,008 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll [2012.09.26 16:12:39 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2012.09.26 16:11:27 | 000,126,312 | ---- | C] (GEAR Software Inc.) -- C:\Windows\SysNative\GEARAspi64.dll [2012.09.26 16:11:27 | 000,107,368 | ---- | C] (GEAR Software Inc.) -- C:\Windows\SysWow64\GEARAspi.dll [2012.09.26 16:11:27 | 000,034,152 | ---- | C] (GEAR Software Inc.) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys [2012.09.26 16:11:26 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE [2012.09.26 16:10:53 | 000,000,000 | ---D | C] -- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001} [2012.09.26 16:10:26 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Local\Apple [2012.09.26 16:10:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update [2012.09.26 16:08:03 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple [2012.09.26 16:07:54 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour [2012.09.26 16:07:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour [2012.09.26 16:07:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple [2012.09.26 16:07:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple [2012.09.26 15:46:14 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\Macromedia [2012.09.26 15:46:14 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Local\Macromedia [2012.09.26 15:38:02 | 000,000,000 | R--D | C] -- C:\Users\Marius\Desktop\Music [2012.09.26 15:21:07 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\NV [2012.09.26 15:21:07 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\NV [2012.09.25 22:54:33 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll [2012.09.25 22:54:31 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll [2012.09.25 22:54:22 | 001,731,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll [2012.09.25 22:51:19 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\TrueCrypt [2012.09.25 22:50:33 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\vlc [2012.09.25 22:50:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN [2012.09.25 22:49:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VideoLAN [2012.09.25 22:48:25 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\Adobe [2012.09.25 22:48:25 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Local\Adobe [2012.09.25 22:46:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt [2012.09.25 22:45:21 | 000,231,376 | ---- | C] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys [2012.09.25 22:44:19 | 000,000,000 | ---D | C] -- C:\Program Files\TrueCrypt [2012.09.25 22:42:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe [2012.09.25 22:42:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe [2012.09.25 22:36:30 | 000,696,240 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.09.25 22:36:30 | 000,073,136 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.09.25 22:36:29 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed [2012.09.25 22:36:27 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed [2012.09.25 22:32:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe [2012.09.25 22:31:07 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\packager.dll [2012.09.25 22:31:07 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\packager.dll [2012.09.25 22:30:45 | 000,000,000 | ---D | C] -- C:\Windows\Panther [2012.09.25 22:22:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET [2012.09.25 22:17:37 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Local\Spotify [2012.09.25 22:15:56 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\Spotify [2012.09.25 22:15:12 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA [2012.09.25 22:15:00 | 000,000,000 | ---D | C] -- C:\Users\Marius\Desktop\Backup 25_09_2012 [2012.09.25 22:14:45 | 006,151,488 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcpl.dll [2012.09.25 22:14:45 | 003,149,632 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvc64.dll [2012.09.25 22:14:45 | 002,561,856 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvcr.dll [2012.09.25 22:14:45 | 000,858,944 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nv3dappshext.dll [2012.09.25 22:14:45 | 000,118,080 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvmctray.dll [2012.09.25 22:14:45 | 000,063,296 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvshext.dll [2012.09.25 22:14:45 | 000,055,616 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nv3dappshextr.dll [2012.09.25 22:14:28 | 000,068,928 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2012.09.25 22:14:28 | 000,061,248 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll [2012.09.25 22:14:22 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation [2012.09.25 22:14:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation [2012.09.25 22:13:52 | 025,743,168 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll [2012.09.25 22:13:52 | 025,248,064 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll [2012.09.25 22:13:52 | 019,607,872 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll [2012.09.25 22:13:52 | 018,044,224 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll [2012.09.25 22:13:52 | 017,551,680 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll [2012.09.25 22:13:52 | 015,322,432 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvd3dum.dll [2012.09.25 22:13:52 | 010,194,752 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvwgf2umx.dll [2012.09.25 22:13:52 | 008,139,072 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll [2012.09.25 22:13:52 | 008,105,280 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvwgf2um.dll [2012.09.25 22:13:52 | 005,982,528 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll [2012.09.25 22:13:52 | 002,881,856 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll [2012.09.25 22:13:52 | 002,741,568 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvapi64.dll [2012.09.25 22:13:52 | 002,681,664 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll [2012.09.25 22:13:52 | 002,524,992 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll [2012.09.25 22:13:52 | 002,445,120 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvenc.dll [2012.09.25 22:13:52 | 002,368,832 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvapi.dll [2012.09.25 22:13:52 | 001,738,048 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco64.dll [2012.09.25 22:13:52 | 001,468,224 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvgenco64.dll [2012.09.25 22:13:52 | 000,949,056 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvumdshimx.dll [2012.09.25 22:13:52 | 000,818,496 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvumdshim.dll [2012.09.25 22:13:52 | 000,364,352 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdecodemft.dll [2012.09.25 22:13:52 | 000,301,376 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvdecodemft.dll [2012.09.25 22:13:52 | 000,246,592 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvinitx.dll [2012.09.25 22:13:52 | 000,202,048 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvinit.dll [2012.09.25 22:13:52 | 000,028,992 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\drivers\nvpciflt.sys [2012.09.25 22:13:35 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation [2012.09.25 22:13:09 | 000,000,000 | ---D | C] -- C:\NVIDIA [2012.09.25 22:12:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip [2012.09.25 22:12:44 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip [2012.09.25 22:11:13 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\Mozilla [2012.09.25 22:11:13 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Local\Mozilla [2012.09.25 22:11:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2012.09.25 22:11:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla [2012.09.25 22:11:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012.09.25 22:08:35 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll [2012.09.25 22:08:35 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe [2012.09.25 22:08:35 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll [2012.09.25 22:08:15 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll [2012.09.25 22:08:15 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe [2012.09.25 22:07:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client [2012.09.25 22:07:19 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client [2012.09.25 22:01:14 | 000,000,000 | ---D | C] -- C:\Program Files\Intel [2012.09.25 21:59:19 | 000,000,000 | ---D | C] -- C:\Windows\Snapshot [2012.09.25 21:59:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BisonCam [2012.09.25 21:58:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Simplo Video Camera [2012.09.25 21:58:47 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\InstallShield [2012.09.25 21:58:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WebCam [2012.09.25 21:57:12 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM [2012.09.25 21:57:12 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek [2012.09.25 21:57:02 | 002,578,576 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib.dll [2012.09.25 21:57:02 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll [2012.09.25 21:57:02 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll [2012.09.25 21:57:02 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll [2012.09.25 21:57:01 | 000,332,392 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtlCPAPI64.dll [2012.09.25 21:57:01 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll [2012.09.25 21:57:00 | 000,638,056 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkApi64.dll [2012.09.25 21:57:00 | 000,149,608 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkCfg64.dll [2012.09.25 21:56:59 | 002,839,656 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkAPO64.dll [2012.09.25 21:56:59 | 002,358,888 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtPgEx64.dll [2012.09.25 21:56:58 | 001,247,848 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTCOM64.dll [2012.09.25 21:56:58 | 001,146,984 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTSnMg64.cpl [2012.09.25 21:56:58 | 000,375,128 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll [2012.09.25 21:56:58 | 000,204,120 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll [2012.09.25 21:56:58 | 000,101,208 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll [2012.09.25 21:56:58 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll [2012.09.25 21:56:57 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll [2012.09.25 21:56:57 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll [2012.09.25 21:56:57 | 000,083,560 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RCoInst64.dll [2012.09.25 21:56:54 | 002,197,264 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ.dll [2012.09.25 21:56:54 | 000,397,912 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysNative\MBTHX64.dll [2012.09.25 21:56:54 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll [2012.09.25 21:56:54 | 000,309,336 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysWow64\MBTHX32.dll [2012.09.25 21:56:54 | 000,080,984 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysNative\MBWrp64.dll [2012.09.25 21:56:48 | 001,943,616 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll [2012.09.25 21:56:44 | 000,108,960 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\SysNative\AERTAR64.dll [2012.09.25 21:56:43 | 000,200,800 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\SysNative\AERTAC64.dll [2012.09.25 21:56:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek [2012.09.25 21:56:24 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp [2012.09.25 21:56:23 | 001,284,712 | R--- | C] (Realtek Semiconductor Corp.) -- C:\Windows\RtlExUpd.dll [2012.09.25 21:56:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield [2012.09.25 21:55:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\postureAgent [2012.09.25 21:54:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Renesas Electronics [2012.09.25 21:54:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Renesas Electronics [2012.09.25 21:53:49 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information [2012.09.25 21:53:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hotkey [2012.09.25 21:48:09 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2012.09.25 21:47:38 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics [2012.09.25 21:47:32 | 001,721,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WdfCoInstaller01009.dll [2012.09.25 21:47:32 | 001,393,200 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\drivers\SynTP.sys [2012.09.25 21:47:32 | 000,272,168 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynCtrl.dll [2012.09.25 21:47:32 | 000,221,480 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynTPAPI.dll [2012.09.25 21:47:32 | 000,218,408 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynCtrl.dll [2012.09.25 21:47:32 | 000,173,352 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynCOM.dll [2012.09.25 21:47:32 | 000,147,752 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynTPCo4.dll [2012.09.25 21:47:32 | 000,107,816 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynTPCOM.dll [2012.09.25 21:47:16 | 000,400,168 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynCOM.dll [2012.09.25 21:46:22 | 000,203,352 | ---- | C] (JMicron Technology Corporation) -- C:\Windows\SysWow64\jmcricon.dll [2012.09.25 21:46:22 | 000,203,352 | ---- | C] (JMicron Technology Corporation) -- C:\Windows\SysNative\jmcricon.dll [2012.09.25 21:46:22 | 000,174,168 | ---- | C] (JMicron Technology Corporation) -- C:\Windows\SysNative\drivers\jmcr.sys [2012.09.25 21:46:20 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\SDA [2012.09.25 21:45:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\JMicron [2012.09.25 21:45:04 | 000,132,624 | ---- | C] (JMicron Technology Corp.) -- C:\Windows\SysNative\drivers\JME.sys [2012.09.25 21:44:08 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel [2012.09.25 21:44:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Intel [2012.09.25 21:43:56 | 000,317,440 | ---- | C] (Intel(R) Corporation) -- C:\Windows\SysNative\drivers\IntcDAud.sys [2012.09.25 21:43:56 | 000,014,848 | ---- | C] (Intel(R) Corporation) -- C:\Windows\SysNative\IntcDAuC.dll [2012.09.25 21:43:42 | 004,368,920 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\GfxUI.exe [2012.09.25 21:43:42 | 000,391,704 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\hkcmd.exe [2012.09.25 21:43:42 | 000,142,336 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxdo.dll [2012.09.25 21:43:41 | 019,591,680 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\ig4icd64.dll [2012.09.25 21:43:41 | 014,292,992 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\ig4icd32.dll [2012.09.25 21:43:41 | 012,273,408 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\drivers\igdkmd64.sys [2012.09.25 21:43:41 | 009,014,784 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxress.dll [2012.09.25 21:43:41 | 007,470,080 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igdumd64.dll [2012.09.25 21:43:41 | 007,386,112 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igd10umd64.dll [2012.09.25 21:43:41 | 006,068,224 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\igd10umd32.dll [2012.09.25 21:43:41 | 005,689,344 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\igdumd32.dll [2012.09.25 21:43:41 | 000,575,488 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\igdumdx32.dll [2012.09.25 21:43:41 | 000,509,976 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxsrvc.exe [2012.09.25 21:43:41 | 000,418,328 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxpers.exe [2012.09.25 21:43:41 | 000,385,024 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxdev.dll [2012.09.25 21:43:41 | 000,380,928 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxTMM.dll [2012.09.25 21:43:41 | 000,368,640 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\iglhsip32.dll [2012.09.25 21:43:41 | 000,364,032 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\iglhsip64.dll [2012.09.25 21:43:41 | 000,335,872 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxpph.dll [2012.09.25 21:43:41 | 000,288,768 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\igfxdv32.dll [2012.09.25 21:43:41 | 000,287,232 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrfra.lrc [2012.09.25 21:43:41 | 000,287,232 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxresn.lrc [2012.09.25 21:43:41 | 000,287,232 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrell.lrc [2012.09.25 21:43:41 | 000,286,720 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrsky.lrc [2012.09.25 21:43:41 | 000,286,720 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrrus.lrc [2012.09.25 21:43:41 | 000,286,720 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrrom.lrc [2012.09.25 21:43:41 | 000,286,720 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrptg.lrc [2012.09.25 21:43:41 | 000,286,720 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrplk.lrc [2012.09.25 21:43:41 | 000,286,720 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrnld.lrc [2012.09.25 21:43:41 | 000,286,720 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrita.lrc [2012.09.25 21:43:41 | 000,286,720 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrhrv.lrc [2012.09.25 21:43:41 | 000,286,720 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrdeu.lrc [2012.09.25 21:43:41 | 000,286,720 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrcsy.lrc [2012.09.25 21:43:41 | 000,286,208 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrtrk.lrc [2012.09.25 21:43:41 | 000,286,208 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrsve.lrc [2012.09.25 21:43:41 | 000,286,208 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrslv.lrc [2012.09.25 21:43:41 | 000,286,208 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrptb.lrc [2012.09.25 21:43:41 | 000,286,208 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrnor.lrc [2012.09.25 21:43:41 | 000,286,208 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrhun.lrc [2012.09.25 21:43:41 | 000,286,208 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrfin.lrc [2012.09.25 21:43:41 | 000,285,696 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrtha.lrc [2012.09.25 21:43:41 | 000,285,696 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrenu.lrc [2012.09.25 21:43:41 | 000,285,696 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrdan.lrc [2012.09.25 21:43:41 | 000,285,184 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrheb.lrc [2012.09.25 21:43:41 | 000,285,184 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrara.lrc [2012.09.25 21:43:41 | 000,283,648 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrjpn.lrc [2012.09.25 21:43:41 | 000,283,136 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrkor.lrc [2012.09.25 21:43:41 | 000,282,624 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrcht.lrc [2012.09.25 21:43:41 | 000,282,624 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxrchs.lrc [2012.09.25 21:43:41 | 000,239,128 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxext.exe [2012.09.25 21:43:41 | 000,167,960 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxtray.exe [2012.09.25 21:43:41 | 000,144,896 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\gfxSrvc.dll [2012.09.25 21:43:41 | 000,142,848 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\igfxcmrt32.dll [2012.09.25 21:43:41 | 000,126,976 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxcpl.cpl [2012.09.25 21:43:41 | 000,122,368 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxcmrt64.dll [2012.09.25 21:43:41 | 000,109,056 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\hccutils.dll [2012.09.25 21:43:41 | 000,095,744 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\iglhcp64.dll [2012.09.25 21:43:41 | 000,092,672 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxCoIn_v2291.dll [2012.09.25 21:43:41 | 000,086,528 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\iglhcp32.dll [2012.09.25 21:43:41 | 000,062,464 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxsrvc.dll [2012.09.25 21:43:41 | 000,028,672 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\igfxexps.dll [2012.09.25 21:43:41 | 000,024,576 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\igfxexps32.dll [2012.09.25 21:40:19 | 000,053,248 | R--- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\SysWow64\CSVer.dll [2012.09.25 21:40:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel [2012.09.25 21:39:47 | 000,000,000 | ---D | C] -- C:\Intel [2012.09.25 21:38:31 | 000,000,000 | R--D | C] -- C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2012.09.25 21:38:31 | 000,000,000 | R--D | C] -- C:\Users\Marius\Searches [2012.09.25 21:38:31 | 000,000,000 | R--D | C] -- C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2012.09.25 21:38:22 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\Identities [2012.09.25 21:38:20 | 000,000,000 | R--D | C] -- C:\Users\Marius\Contacts [2012.09.25 21:38:18 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Local\VirtualStore [2012.09.25 21:38:09 | 000,000,000 | --SD | C] -- C:\Users\Marius\AppData\Roaming\Microsoft [2012.09.25 21:38:09 | 000,000,000 | R--D | C] -- C:\Users\Marius\Videos [2012.09.25 21:38:09 | 000,000,000 | R--D | C] -- C:\Users\Marius\Saved Games [2012.09.25 21:38:09 | 000,000,000 | R--D | C] -- C:\Users\Marius\Pictures [2012.09.25 21:38:09 | 000,000,000 | R--D | C] -- C:\Users\Marius\Music [2012.09.25 21:38:09 | 000,000,000 | R--D | C] -- C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2012.09.25 21:38:09 | 000,000,000 | R--D | C] -- C:\Users\Marius\Links [2012.09.25 21:38:09 | 000,000,000 | R--D | C] -- C:\Users\Marius\Favorites [2012.09.25 21:38:09 | 000,000,000 | R--D | C] -- C:\Users\Marius\Downloads [2012.09.25 21:38:09 | 000,000,000 | R--D | C] -- C:\Users\Marius\Documents [2012.09.25 21:38:09 | 000,000,000 | R--D | C] -- C:\Users\Marius\Desktop [2012.09.25 21:38:09 | 000,000,000 | R--D | C] -- C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\Vorlagen [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\AppData\Local\Verlauf [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\AppData\Local\Temporary Internet Files [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\Startmenü [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\SendTo [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\Recent [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\Netzwerkumgebung [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\Lokale Einstellungen [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\Documents\Eigene Videos [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\Documents\Eigene Musik [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\Eigene Dateien [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\Documents\Eigene Bilder [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\Druckumgebung [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\Cookies [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\AppData\Local\Anwendungsdaten [2012.09.25 21:38:09 | 000,000,000 | -HSD | C] -- C:\Users\Marius\Anwendungsdaten [2012.09.25 21:38:09 | 000,000,000 | -H-D | C] -- C:\Users\Marius\AppData [2012.09.25 21:38:09 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Local\Temp [2012.09.25 21:38:09 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Local\Microsoft [2012.09.25 21:38:09 | 000,000,000 | ---D | C] -- C:\Users\Marius\AppData\Roaming\Media Center Programs [2012.09.25 21:38:03 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2012.09.25 21:38:03 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2012.09.25 21:38:03 | 000,000,000 | -HSD | C] -- C:\Recovery [2012.09.25 21:38:03 | 000,000,000 | -HSD | C] -- C:\Programme [2012.09.25 21:38:03 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2012.09.25 21:38:03 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2012.09.25 21:38:03 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2012.09.25 21:38:03 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2012.09.25 21:38:03 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2012.09.25 21:38:03 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2012.09.25 21:38:03 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2012.09.25 21:38:03 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2012.09.25 21:34:18 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2012.09.25 21:32:06 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch [2012.09.25 21:31:23 | 000,000,000 | -HSD | C] -- C:\System Volume Information ========== Files - Modified Within 30 Days ========== [2012.09.26 18:50:45 | 000,020,656 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.09.26 18:50:45 | 000,020,656 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.09.26 17:53:01 | 000,001,262 | ---- | M] () -- C:\Users\Marius\Desktop\Spybot - Search & Destroy.lnk [2012.09.26 17:27:48 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.09.26 16:59:31 | 001,489,799 | ---- | M] () -- C:\Windows\SysNative\drivers\Cat.DB [2012.09.26 16:46:39 | 000,000,917 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk [2012.09.26 16:14:18 | 000,001,059 | ---- | M] () -- C:\Users\Marius\Desktop\Notepad++.lnk [2012.09.26 16:13:36 | 000,108,008 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll [2012.09.26 16:13:34 | 001,034,216 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll [2012.09.26 16:13:34 | 000,916,456 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll [2012.09.26 16:13:34 | 000,289,768 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe [2012.09.26 16:13:34 | 000,189,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe [2012.09.26 16:13:34 | 000,188,904 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe [2012.09.26 15:27:22 | 001,624,848 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.09.26 15:27:22 | 000,701,026 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.09.26 15:27:22 | 000,655,824 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.09.26 15:27:22 | 000,150,034 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.09.26 15:27:22 | 000,122,596 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.09.26 15:20:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.09.26 15:20:00 | 3148,136,448 | -HS- | M] () -- C:\hiberfil.sys [2012.09.25 22:46:11 | 000,000,875 | ---- | M] () -- C:\Users\Public\Desktop\TrueCrypt.lnk [2012.09.25 22:45:22 | 000,231,376 | ---- | M] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys [2012.09.25 22:44:19 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk [2012.09.25 22:36:31 | 000,696,240 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.09.25 22:36:30 | 000,073,136 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.09.25 22:25:38 | 001,565,640 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.09.25 22:24:50 | 000,000,355 | ---- | M] () -- C:\Users\Marius\Desktop\Computer.lnk [2012.09.25 22:07:45 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif [2012.09.25 22:03:59 | 000,018,236 | ---- | M] () -- C:\Windows\SysNative\results.xml [2012.09.25 21:58:45 | 000,000,710 | ---- | M] () -- C:\Users\Public\Desktop\WebCam Installer 3.33.lnk [2012.09.25 21:53:49 | 000,000,865 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hotkey.lnk [2012.09.25 21:47:43 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf [2012.09.25 21:35:55 | 000,274,464 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.09.25 21:34:46 | 000,159,772 | ---- | M] () -- C:\Windows\SysWow64\license.rtf [2012.09.25 21:34:46 | 000,159,772 | ---- | M] () -- C:\Windows\SysNative\license.rtf [2012.09.07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys ========== Files Created - No Company Name ========== [2012.09.26 17:53:01 | 000,001,262 | ---- | C] () -- C:\Users\Marius\Desktop\Spybot - Search & Destroy.lnk [2012.09.26 17:27:48 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.09.26 16:59:17 | 001,489,799 | ---- | C] () -- C:\Windows\SysNative\drivers\Cat.DB [2012.09.26 16:46:39 | 000,000,917 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk [2012.09.26 16:14:18 | 000,001,059 | ---- | C] () -- C:\Users\Marius\Desktop\Notepad++.lnk [2012.09.26 16:10:25 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk [2012.09.25 22:48:12 | 2097,152,000 | ---- | C] () -- C:\Users\Marius\Desktop\TC_BACKUP [2012.09.25 22:46:11 | 000,000,875 | ---- | C] () -- C:\Users\Public\Desktop\TrueCrypt.lnk [2012.09.25 22:44:19 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk [2012.09.25 22:44:19 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk [2012.09.25 22:24:50 | 000,000,355 | ---- | C] () -- C:\Users\Marius\Desktop\Computer.lnk [2012.09.25 22:17:35 | 000,001,803 | ---- | C] () -- C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk [2012.09.25 22:14:45 | 002,621,723 | ---- | C] () -- C:\Windows\SysNative\nvcoproc.bin [2012.09.25 22:13:52 | 000,014,324 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb [2012.09.25 22:11:06 | 000,001,146 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.09.25 22:07:45 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif [2012.09.25 22:07:31 | 000,001,915 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk [2012.09.25 22:07:26 | 001,565,640 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.09.25 22:03:59 | 000,018,236 | ---- | C] () -- C:\Windows\SysNative\results.xml [2012.09.25 21:59:18 | 000,000,101 | R--- | C] () -- C:\Windows\OEM.ini [2012.09.25 21:59:18 | 000,000,020 | R--- | C] () -- C:\Windows\Bison.ini [2012.09.25 21:58:45 | 000,000,710 | ---- | C] () -- C:\Users\Public\Desktop\WebCam Installer 3.33.lnk [2012.09.25 21:55:52 | 000,008,192 | R--- | C] () -- C:\Windows\SysNative\drivers\IntelMEFWVer.dll [2012.09.25 21:53:49 | 000,000,865 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hotkey.lnk [2012.09.25 21:47:43 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf [2012.09.25 21:43:42 | 000,179,736 | ---- | C] () -- C:\Windows\SysNative\difx64.exe [2012.09.25 21:43:42 | 000,004,096 | ---- | C] ( ) -- C:\Windows\SysNative\IGFXDEVLib.dll [2012.09.25 21:43:41 | 001,991,936 | ---- | C] () -- C:\Windows\SysNative\iglhxa64.cpa [2012.09.25 21:43:41 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin [2012.09.25 21:43:41 | 000,960,940 | ---- | C] () -- C:\Windows\SysNative\igkrng600.bin [2012.09.25 21:43:41 | 000,213,332 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin [2012.09.25 21:43:41 | 000,213,332 | ---- | C] () -- C:\Windows\SysNative\igfcg600m.bin [2012.09.25 21:43:41 | 000,208,335 | ---- | C] () -- C:\Windows\SysNative\Gfxres.th-TH.resources [2012.09.25 21:43:41 | 000,195,681 | ---- | C] () -- C:\Windows\SysNative\Gfxres.el-GR.resources [2012.09.25 21:43:41 | 000,180,246 | ---- | C] () -- C:\Windows\SysNative\Gfxres.ru-RU.resources [2012.09.25 21:43:41 | 000,154,366 | ---- | C] () -- C:\Windows\SysNative\Gfxres.ar-SA.resources [2012.09.25 21:43:41 | 000,151,350 | ---- | C] () -- C:\Windows\SysNative\Gfxres.ja-JP.resources [2012.09.25 21:43:41 | 000,147,392 | ---- | C] () -- C:\Windows\SysNative\Gfxres.he-IL.resources [2012.09.25 21:43:41 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin [2012.09.25 21:43:41 | 000,145,804 | ---- | C] () -- C:\Windows\SysNative\igcompkrng600.bin [2012.09.25 21:43:41 | 000,138,635 | ---- | C] () -- C:\Windows\SysNative\Gfxres.it-IT.resources [2012.09.25 21:43:41 | 000,137,000 | ---- | C] () -- C:\Windows\SysNative\Gfxres.ko-KR.resources [2012.09.25 21:43:41 | 000,136,226 | ---- | C] () -- C:\Windows\SysNative\Gfxres.de-DE.resources [2012.09.25 21:43:41 | 000,136,172 | ---- | C] () -- C:\Windows\SysNative\Gfxres.es-ES.resources [2012.09.25 21:43:41 | 000,135,119 | ---- | C] () -- C:\Windows\SysNative\Gfxres.ro-RO.resources [2012.09.25 21:43:41 | 000,134,081 | ---- | C] () -- C:\Windows\SysNative\Gfxres.fr-FR.resources [2012.09.25 21:43:41 | 000,133,868 | ---- | C] () -- C:\Windows\SysNative\Gfxres.tr-TR.resources [2012.09.25 21:43:41 | 000,133,321 | ---- | C] () -- C:\Windows\SysNative\Gfxres.pt-BR.resources [2012.09.25 21:43:41 | 000,132,876 | ---- | C] () -- C:\Windows\SysNative\Gfxres.nl-NL.resources [2012.09.25 21:43:41 | 000,132,861 | ---- | C] () -- C:\Windows\SysNative\Gfxres.hu-HU.resources [2012.09.25 21:43:41 | 000,132,422 | ---- | C] () -- C:\Windows\SysNative\Gfxres.sv-SE.resources [2012.09.25 21:43:41 | 000,132,299 | ---- | C] () -- C:\Windows\SysNative\Gfxres.pt-PT.resources [2012.09.25 21:43:41 | 000,131,897 | ---- | C] () -- C:\Windows\SysNative\Gfxres.cs-CZ.resources [2012.09.25 21:43:41 | 000,131,711 | ---- | C] () -- C:\Windows\SysNative\Gfxres.pl-PL.resources [2012.09.25 21:43:41 | 000,131,456 | ---- | C] () -- C:\Windows\SysNative\Gfxres.fi-FI.resources [2012.09.25 21:43:41 | 000,131,290 | ---- | C] () -- C:\Windows\SysNative\Gfxres.sk-SK.resources [2012.09.25 21:43:41 | 000,130,414 | ---- | C] () -- C:\Windows\SysNative\Gfxres.hr-HR.resources [2012.09.25 21:43:41 | 000,127,599 | ---- | C] () -- C:\Windows\SysNative\Gfxres.sl-SI.resources [2012.09.25 21:43:41 | 000,127,367 | ---- | C] () -- C:\Windows\SysNative\Gfxres.nb-NO.resources [2012.09.25 21:43:41 | 000,127,109 | ---- | C] () -- C:\Windows\SysNative\Gfxres.da-DK.resources [2012.09.25 21:43:41 | 000,122,646 | ---- | C] () -- C:\Windows\SysNative\Gfxres.en-US.resources [2012.09.25 21:43:41 | 000,116,413 | ---- | C] () -- C:\Windows\SysNative\Gfxres.zh-TW.resources [2012.09.25 21:43:41 | 000,115,195 | ---- | C] () -- C:\Windows\SysNative\Gfxres.zh-CN.resources [2012.09.25 21:43:41 | 000,094,208 | ---- | C] () -- C:\Windows\SysNative\IccLibDll_x64.dll [2012.09.25 21:43:41 | 000,060,254 | ---- | C] () -- C:\Windows\SysNative\iglhxg64.vp [2012.09.25 21:43:41 | 000,060,226 | ---- | C] () -- C:\Windows\SysNative\iglhxc64.vp [2012.09.25 21:43:41 | 000,060,015 | ---- | C] () -- C:\Windows\SysNative\iglhxo64.vp [2012.09.25 21:43:41 | 000,013,476 | ---- | C] () -- C:\Windows\SysNative\iglhxs64.vp [2012.09.25 21:43:41 | 000,000,151 | ---- | C] () -- C:\Windows\SysNative\GfxUI.exe.config [2012.09.25 21:34:39 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk [2012.09.25 21:31:23 | 3148,136,448 | -HS- | C] () -- C:\hiberfil.sys ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2010.11.21 05:23:55 | 014,174,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2010.11.21 05:24:02 | 012,872,192 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] < End of report > Extras.txt:OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 26.09.2012 18:51:35 - Run 1
OTL by OldTimer - Version 3.2.68.0 Folder = C:\Users\Marius\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,91 Gb Total Physical Memory | 2,07 Gb Available Physical Memory | 52,94% Memory free
7,82 Gb Paging File | 6,01 Gb Available in Paging File | 76,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 297,99 Gb Total Space | 185,21 Gb Free Space | 62,15% Space Free | Partition Type: NTFS
Drive D: | 2,81 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 465,76 Gb Total Space | 15,37 Gb Free Space | 3,30% Space Free | Partition Type: NTFS
Computer Name: MARIUS-NOTEBOOK | User Name: Marius | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- Reg Error: Key error. File not found
[HKEY_USERS\S-1-5-21-2773119867-2929089309-3414940213-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06D96946-AB00-4E8E-8DC5-8336DF0F1B70}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{09625F5E-1179-4FEB-96CE-851ED956D095}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{2284C0CE-1B1E-4A8D-ADD8-72D5B2C78B57}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2852331E-1F5C-4D6C-94F1-A64D0A427D67}" = lport=10243 | protocol=6 | dir=in | app=system |
"{2D621975-ACA0-4994-9C8C-0B5A08DD0336}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4F0D5A4A-A193-4F4E-8CBE-B8B762B2C4B3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{537B8B2E-4208-4AAE-B8AF-363CB174450D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{56762CAC-6761-410D-96D9-2634FE997778}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{79F14B02-303F-453D-8AE8-6EF42993006D}" = lport=137 | protocol=17 | dir=in | app=system |
"{7FAABD2B-F363-4C84-A36B-AC9699A18B92}" = lport=445 | protocol=6 | dir=in | app=system |
"{89D1D6F1-C531-4D04-BB76-1558CCDFE647}" = rport=445 | protocol=6 | dir=out | app=system |
"{96432F92-557B-433D-B6F5-CF4E0FB79E5B}" = rport=138 | protocol=17 | dir=out | app=system |
"{9FE93D9E-6956-448C-8E53-39BAEA1BB24B}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B173CFC4-0A61-4181-903B-E951957BB771}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BF6D3FA9-3CE4-41C0-9642-C3DC104C828F}" = rport=139 | protocol=6 | dir=out | app=system |
"{C86D1EDE-6800-4606-9C74-FC4974C9C06C}" = lport=138 | protocol=17 | dir=in | app=system |
"{CDFA1016-E1CA-4C17-BDCC-AAA32001539F}" = rport=10243 | protocol=6 | dir=out | app=system |
"{CF7A3EC5-4A64-4E95-B7FF-27D1B49974DF}" = rport=137 | protocol=17 | dir=out | app=system |
"{E9F47BA8-98CC-4ADF-8614-CD2C40A0379C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{ED426427-A552-4ED7-8EA5-37424FFA9564}" = lport=139 | protocol=6 | dir=in | app=system |
"{F2163C04-8217-4A54-B6E0-F76A35A79059}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C43AB86-484E-4C0C-95A6-C14DB980FF70}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{305E97A5-26CD-4447-92B2-83A3F00D9B22}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{4328DA71-66B1-46E8-88E9-246E8F1B91F3}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4FE90928-1378-486B-9C67-C01E63149A7B}" = protocol=6 | dir=out | app=system |
"{5004FE1E-A4AF-4974-913A-86C590C531E5}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{59FFB0B4-CACA-4638-B1A6-0FD1E6FE7A0C}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{62F9C81B-54B9-4610-89A1-645335DD0B09}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7FBDBF62-8CE4-4893-BA2C-86733B0DF74B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{855302A9-B40E-43BC-883C-DFBF6B2C7FEC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{87372C8C-1D8E-4DDF-976C-4395F4278BA3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8AFB20C5-41C7-4EDD-AFD0-618CF29531D3}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{8CA2ABB4-89CB-472F-898A-8D8FC2CB4F9F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{92790BFB-7FF1-4C07-BEB0-A18DE9D83EF8}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{99E21EAC-39FF-4BDA-92AE-82FB540A93B9}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{9C01F6DC-5409-42DA-A6B1-A0D85471610A}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{9FF0627C-7B87-4156-8717-0CE16A152C9A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B045FD04-436F-4FE0-8882-2E5D86E85093}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{BC781D43-43A8-4486-BE08-71FDF0F692F1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C21CEEBC-0BB9-43CB-83D9-6053E26640E0}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{C86270DF-2FED-453C-81A7-71EDA04BCB20}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{CAF7CB25-5887-4B91-82B9-19E4D4AC7BE9}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{D6452DD9-1500-4960-87C8-C6EEB73E15A2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D8F8C803-E10A-4DCA-966F-17EEF8A1395D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{DCD76808-DAD6-4D55-B605-BFA98E96C03C}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{ED37C848-0B3A-4C02-9B5D-E642667EEDF1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FFF75754-AFB0-488C-B540-9AB3A6153682}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"TCP Query User{A63DE348-F31B-4E01-B41F-0CF3A985CADE}C:\users\marius\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\marius\appdata\roaming\spotify\spotify.exe |
"UDP Query User{474F3981-7E27-4A9C-8E21-1AFB7376C9CC}C:\users\marius\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\marius\appdata\roaming\spotify\spotify.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1927E640-A2C6-4BA7-8F43-FFD2AE3DFCF3}" = Intel(R) PROSet/Wireless WiFi-Software
"{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}" = Microsoft .NET Framework 4.5
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417006FF}" = Java 7 Update 6 (64-bit)
"{64A3A4F4-B792-11D6-A78A-00B0D0170060}" = Java SE Development Kit 7 Update 6 (64-bit)
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5
"{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}" = Microsoft Security Client
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.8.15
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.8.15
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"Microsoft Security Client" = Microsoft Security Essentials
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = Synaptics Pointing Device Driver
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{164714B6-46BC-4649-9A30-A6ED32F03B5A}" = Hotkey 3.3029
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron Flash Media Controller Driver
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{5BBC4803-C96E-4D3E-9D1D-2E43774C4062}" = BisonCam
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{82D571B5-ED0C-49BC-AABC-DB8E05BCFA8D}" = Simplo Video Camera
"{96DCEE2F-98EE-4F80-8C0F-7C04D1FB9D7F}" = JMicron Ethernet Adapter NDIS Driver
"{AAE521B6-2F19-447F-8CB6-6D1E3A19F3ED}" = WebCam Installer
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Ad-Aware Browsing Protection" = Ad-Aware Browsing Protection
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"InstallShield_{164714B6-46BC-4649-9A30-A6ED32F03B5A}" = Hotkey 3.3029
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Notepad++" = Notepad++
"Origin" = Origin
"TrueCrypt" = TrueCrypt
"VLC media player" = VLC media player 2.0.3
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-2773119867-2929089309-3414940213-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Spotify" = Spotify
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 26.09.2012 11:01:46 | Computer Name = Marius-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 26.09.2012 11:11:29 | Computer Name = Marius-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 26.09.2012 11:11:30 | Computer Name = Marius-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 26.09.2012 11:12:30 | Computer Name = Marius-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 26.09.2012 11:33:28 | Computer Name = Marius-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 26.09.2012 11:55:39 | Computer Name = Marius-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 26.09.2012 11:55:39 | Computer Name = Marius-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 26.09.2012 12:16:46 | Computer Name = Marius-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 26.09.2012 12:16:46 | Computer Name = Marius-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 26.09.2012 12:17:05 | Computer Name = Marius-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
[ System Events ]
Error - 26.09.2012 10:11:37 | Computer Name = Marius-Notebook | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers
nicht gestartet: %%14001
Error - 26.09.2012 10:11:42 | Computer Name = Marius-Notebook | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers
nicht gestartet: %%14001
Error - 26.09.2012 10:11:47 | Computer Name = Marius-Notebook | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers
nicht gestartet: %%14001
Error - 26.09.2012 10:11:52 | Computer Name = Marius-Notebook | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers
nicht gestartet: %%14001
Error - 26.09.2012 10:11:57 | Computer Name = Marius-Notebook | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers
nicht gestartet: %%14001
Error - 26.09.2012 10:12:02 | Computer Name = Marius-Notebook | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers
nicht gestartet: %%14001
Error - 26.09.2012 11:07:48 | Computer Name = Marius-Notebook | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
Steam Client Service erreicht.
Error - 26.09.2012 11:07:48 | Computer Name = Marius-Notebook | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
Error - 26.09.2012 11:35:58 | Computer Name = Marius-Notebook | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Microsoft Antimalware Service" wurde unerwartet beendet.
Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 15000
Millisekunden durchgeführt: Neustart des Diensts.
Error - 26.09.2012 11:36:13 | Computer Name = Marius-Notebook | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
des Dienstes "Microsoft Antimalware Service" Korrekturmaßnahmen (Neustart des Diensts)
durchzuführen, ist fehlgeschlagen. Fehler: %%1056
< End of report >
|
|
26.09.2012, 18:33
| #2 |
| /// Malware-holic   | u-search.net / browser hijacker hi
__________________Downloade Dir bitte AdwCleaner auf deinen Desktop.
__________________ |
|
26.09.2012, 18:36
| #3 |
| | u-search.net / browser hijacker adwcleaner:
__________________Code:
ATTFilter # AdwCleaner v2.003 - Datei am 09/26/2012 um 19:35:08 erstellt
# Aktualisiert am 23/09/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Marius - MARIUS-NOTEBOOK
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Marius\Downloads\adwcleaner(1).exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gefunden : C:\ProgramData\blekko toolbars
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.7601.17514
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v14.0.1 (de)
Profilname : default
Datei : C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\lrbj5yeh.default\prefs.js
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [885 octets] - [26/09/2012 17:26:56]
AdwCleaner[R2].txt - [870 octets] - [26/09/2012 19:35:08]
########## EOF - C:\AdwCleaner[R2].txt - [929 octets] ##########
|
|
26.09.2012, 18:40
| #4 |
| /// Malware-holic | u-search.net / browser hijacker firefox öffnen, tippe in die adress leiste: about:config wähle, ich werde vorsichtig sein, versprochen. nun gelangst du in ein suchfeld, dort gib ein bzw kopiere rein: u-search dann rechtsklick, kopieren, hier auf antworten, rechtsklick, einfügen. die suche kann pro vorgang nur einen wert finden, suche so oft, bis du alle werte hast, kopiere sie jeweils und füge sie hier ein.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
26.09.2012, 18:46
| #5 |
| | u-search.net / browser hijacker fand nur 1 eintrag: browser.startup.homepage;hxxp://u-search.net/?a=1&e=1 |
|
26.09.2012, 18:47
| #6 |
| /// Malware-holic | u-search.net / browser hijacker hi suche auch mal nach blekko
__________________ --> u-search.net / browser hijacker |
|
26.09.2012, 18:49
| #7 |
| | u-search.net / browser hijacker kein eintrag vorhanden |
|
26.09.2012, 18:52
| #8 |
| /// Malware-holic | u-search.net / browser hijacker ok. 1.
wieder imm ff nach: u-search suchen, rechtsklick, standard wiederherstellen, browser schließen, pcneustarten. dann firefox und internet explorer testen, ob noch toolbars angezeigt werden bzw u-search
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
26.09.2012, 19:08
| #9 |
| | u-search.net / browser hijacker ok, ich habe jetzt wieder die normale Startseite (browser.startup.homepage;about:home), Danke für die Hilfe Logs: Code:
ATTFilter # AdwCleaner v2.003 - Datei am 09/26/2012 um 19:54:29 erstellt
# Aktualisiert am 23/09/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Marius - MARIUS-NOTEBOOK
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Marius\Downloads\adwcleaner(1).exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gelöscht : C:\ProgramData\blekko toolbars
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.7601.17514
Wiederhergestellt : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-21-2773119867-2929089309-3414940213-1003\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
-\\ Mozilla Firefox v14.0.1 (de)
Profilname : default
Datei : C:\Users\Marius\AppData\Roaming\Mozilla\Firefox\Profiles\lrbj5yeh.default\prefs.js
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [885 octets] - [26/09/2012 17:26:56]
AdwCleaner[R2].txt - [997 octets] - [26/09/2012 19:35:08]
AdwCleaner[S2].txt - [1432 octets] - [26/09/2012 19:54:29]
########## EOF - C:\AdwCleaner[S2].txt - [1492 octets] ##########
Geändert von mrdr (26.09.2012 um 19:23 Uhr) |
|
27.09.2012, 19:06
| #10 |
| /// Malware-holic | u-search.net / browser hijacker hi von wo stammen deine setups, immer direkt vom hersteller? instalierst du immer benutzerdefiniert, da sieht man häufig toolbars schon
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu u-search.net / browser hijacker |
| ad-aware, appdatalow, bho, bonjour, browser, error, fehler, firefox, flash player, frage, google, home, iexplore.exe, install.exe, installation, logfile, mozilla, ms security essentials, neu aufgesetzt, nicht möglich, nvidia update, nvpciflt.sys, plug-in, realtek, registry, scan, security, software, spotify web helper, svchost.exe, system, system neu, u-search.net, usb 3.0, virus, windows, windows xp |
Linear-Darstellung
