Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Vodafone PDF Trojaner?

Vodafone PDF Trojaner?


Plagegeister aller Art und deren Bekämpfung: Vodafone PDF Trojaner?

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Seite 3 von 3 12 3
Alt 23.10.2012, 11:32   #31
harryhirschi
 
Vodafone PDF Trojaner? - Standard

Vodafone PDF Trojaner?


So, danke für den Hinweis, habe das mit dem Zusatz "S" schlicht überlesen. Das Löschlog lautet:
Code:
ATTFilter
# AdwCleaner v2.005 - Datei am 21/10/2012 um 21:26:57 erstellt
# Aktualisiert am 14/10/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (32 bits)
# Benutzer : hamis - HAMIS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\hamis\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\Program Files\FreeCompressor
Ordner Gelöscht : C:\Program Files\Iminent
Ordner Gelöscht : C:\ProgramData\Iminent
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeCompressor
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent
Ordner Gelöscht : C:\Users\hamis\AppData\Local\FreeCompressor Air
Ordner Gelöscht : C:\Users\hamis\AppData\Local\Temp\Iminent
Ordner Gelöscht : C:\Users\hamis\AppData\Roaming\FreeCompressor
Ordner Gelöscht : C:\Users\hamis\AppData\Roaming\Iminent

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\FreeCompressor
Schlüssel Gelöscht : HKCU\Software\Iminent
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{01994268-3C10-4044-A1EA-7A9C1B739A11}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Iminent.WebBooster.InternetExplorer.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{01A602A0-D0B9-445B-8081-719E4177C4A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02C9C7B0-C7C8-4AAC-A9E4-55295BF60F8F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0398B101-6DA7-473F-A290-17D2FBC88CC0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0CC36196-8589-4B80-A771-D659411D7F90}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{143D96F9-EB64-48B3-B192-91C2C41A1F43}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{14F7D91F-F669-45C9-9F42-BACBFDB86EAD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{187A6488-6E71-4A2A-B118-7BEFBFE58257}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{26C9BBE4-6D45-4AB6-A5B4-E068C9F5EF6D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2D065204-A024-4C39-8A38-EE7078EC7ACF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{30F5476C-677B-4DB0-B397-51F5BFD86840}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{351798B1-C1D2-45AB-92B4-4D6C2D6AB5AF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3AEA1BEF-6195-46F4-ACA2-0ED14F7EFA1B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3D7F9AC3-BAC3-4E51-81D7-D121D79E550A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4498C5E9-93C6-4142-B6BE-F0C6DC48B77A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{479BF2D6-E362-4A99-B1AB-BC764D7B97AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{492A108F-51D0-4BD8-899D-AD4AB2893064}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4B6D6E60-FBD2-4E79-BF4B-886BC98F1797}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5C176BA0-6FC0-4EBD-8ACF-24AC592506B6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{60893E02-2E5B-43F9-A93A-BAD60C2DF6EF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6D39931F-451E-4BDD-BAF4-37FB96DBBA5D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{76C684D2-C35D-4284-976A-D862F53ADB81}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{796D822A-C3F9-4A97-BAAB-42FE7628EA63}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{79EF3691-EC1A-4705-A01A-D2E36EC11758}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{82F41418-8E64-47EB-A7F1-4702A974D289}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{85D920CE-63A7-46DC-8992-41D1D2E07FAD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{895ED5E8-ABB4-40C3-A0CA-2571964268E2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8AAC123A-1959-4A45-BFC5-E2D50783098A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A07956CD-81F8-4A03-B524-5D87E690DC83}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B5E3B26B-6E5C-4865-A63D-58D04B10E245}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B84D2DC5-42B2-4E5E-BF61-7B48152FF8EF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B89D5309-0367-4494-A92F-3D4C94F88307}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C014EBF8-8854-448B-B5A4-557C4090EDCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C31191DB-2F64-464C-B97C-6AC81ACB7AAC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C342C7A7-F622-4EF3-8B7F-ABB9FBE73F14}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C4765B07-BC2F-477B-925C-B2BF24887823}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C875C0A1-09E3-48D5-9F8E-BD337796FD14}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD126DA6-FF5B-4181-AC13-54A62240D2FA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D8F01233-2DE6-4EE7-8988-37263F00651B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DD438708-AAB4-422D-A322-B619589F5680}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E812AE43-7799-4E67-8CF8-4104297A2D16}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F0BAAEC7-9AE0-49FF-9C4B-86E774FF397F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F92193FD-2243-4401-9ACC-49FF30885898}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD21B8A2-910B-45AC-9C10-45E6A8B84984}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.DownloadArgs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.LinkToPromoteArgs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.RawDataArgs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.TinyUrlArgs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.ViralLinkArgs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ClientCallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ContractBase
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.AddToUserContentCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.CheckLoginStatusCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.CleanCacheCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GameOverCallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetCreditCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetInstallationContextCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetLoginStatusCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetLoginStatusResult
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetVariableCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetVariableResult
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.InstallationContextResult
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoadContentCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoadContentCommandResult
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoginCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoginStatusChangedCallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LogoutCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.MergeIdentityCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.MyAccountCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.PlayContentCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.PostContentCallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.RecycleViewsCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.SetVariableCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowBrowserWindowCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowControlCenterCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowPluginWindowCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.UserContentChangedCallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.VariableChangedCallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.WarmUpCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.WelcomeCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ServerCommand
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ServerResult
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.LightContent
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.LightUri
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Mediator.MediatorServiceProxy
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandle.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandler
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ACA608DB-A210-4253-B799-3FD24E9A7BF5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A9CAF365-EA35-45DA-BD8B-2EFA09D374AC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\Software\FreeCompressor
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0AF350D9-3916-454B-AC53-0B0B65F41301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\ForceRenive
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1EF93620-4B15-4DB4-B0EA-889E2F187081}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Iminent]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [IminentMessenger]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\hamis\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [17382 octets] - [14/10/2012 22:48:00]
AdwCleaner[R2].txt - [17840 octets] - [19/10/2012 13:07:52]
AdwCleaner[R3].txt - [17788 octets] - [21/10/2012 21:26:08]
AdwCleaner[R4].txt - [17849 octets] - [21/10/2012 21:26:26]
AdwCleaner[R5].txt - [17910 octets] - [21/10/2012 21:26:47]
AdwCleaner[S2].txt - [17681 octets] - [21/10/2012 21:26:57]

########## EOF - C:\AdwCleaner[S2].txt - [17742 octets] ##########
Wie geht es jetzt weiter?

Alt 23.10.2012, 20:07   #32
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Vodafone PDF Trojaner? - Standard

Vodafone PDF Trojaner?


Mach bitte einen CustomScan mit OTL . Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
ATTFilter
 hier steht das Log

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
  • Starte bitte die OTL.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

Code:
ATTFilter
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
%systemroot%\Installer\*. /s
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Installer\*. /s
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Klick auf .
  • Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread
__________________

__________________
Alt 24.10.2012, 13:22   #33
harryhirschi
 
Vodafone PDF Trojaner? - Standard

Vodafone PDF Trojaner?


Hier der Code:
Code:
ATTFilter
OTL logfile created on: 24.10.2012 13:48:05 - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\hamis\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,43 Gb Available Physical Memory | 74,83% Memory free
6,50 Gb Paging File | 5,70 Gb Available in Paging File | 87,76% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,95 Gb Total Space | 101,61 Gb Free Space | 68,22% Space Free | Partition Type: NTFS
 
Computer Name: HAMIS-PC | User Name: hamis | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.10.24 13:10:35 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\hamis\Desktop\OTL.exe
PRC - [2012.10.09 17:06:13 | 000,692,152 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\Macromed\Flash\FlashUtil32_11_4_402_287_ActiveX.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.04.02 20:46:58 | 000,329,544 | ---- | M] () -- C:\Programme\Hotspot Shield\bin\hsswd.exe
PRC - [2011.11.15 20:26:48 | 000,363,336 | ---- | M] (AnchorFree Inc.) -- C:\Programme\Hotspot Shield\HssWPR\hsssrv.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009.02.26 18:36:46 | 000,030,040 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2008.02.25 01:00:00 | 001,753,088 | ---- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\WLanGUI.exe
PRC - [2008.02.25 01:00:00 | 000,364,544 | ---- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\WLanNetService.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV - [2012.10.09 17:06:29 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.04.11 02:06:10 | 000,077,520 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Hotspot Shield\bin\HSSTrayService.exe -- (HssTrayService)
SRV - [2012.04.11 01:59:14 | 000,542,552 | ---- | M] () [Auto | Stopped] -- C:\Programme\Hotspot Shield\bin\openvpnas.exe -- (hshld)
SRV - [2012.04.02 20:46:58 | 000,329,544 | ---- | M] () [Auto | Running] -- C:\Programme\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2012.03.25 14:18:22 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011.11.15 20:26:48 | 000,363,336 | ---- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Programme\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.02.26 18:36:22 | 000,064,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2008.02.25 01:00:00 | 000,364,544 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Programme\avmwlanstick\WLanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc)
DRV - [2012.04.11 17:40:28 | 000,037,376 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HssDrv.sys -- (HssDrv)
DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 12:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2009.07.14 00:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2009.06.10 23:19:48 | 009,853,248 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007.12.19 01:00:00 | 000,401,920 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fwlanusbn.sys -- (fwlanusbn)
DRV - [2007.11.07 02:00:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avmeject.sys -- (avmeject)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = 
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-3251325105-1702950111-330446913-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-3251325105-1702950111-330446913-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3251325105-1702950111-330446913-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-3251325105-1702950111-330446913-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = FC 40 76 EF 79 0A CD 01  [binary data]
IE - HKU\S-1-5-21-3251325105-1702950111-330446913-1000\..\SearchScopes,DefaultScope = {37901E78-580E-4A96-874A-EA1DCA868D1B}
IE - HKU\S-1-5-21-3251325105-1702950111-330446913-1000\..\SearchScopes\{37901E78-580E-4A96-874A-EA1DCA868D1B}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
IE - HKU\S-1-5-21-3251325105-1702950111-330446913-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\22.0.1229.94\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\22.0.1229.94\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - Extension: YouTube = C:\Users\hamis\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google-Suche = C:\Users\hamis\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: Google Mail = C:\Users\hamis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin)
O4 - HKU\S-1-5-21-3251325105-1702950111-330446913-1000..\Run: [execu] "C:\Users\hamis\AppData\Roaming\execu.exe" -autorun File not found
O4 - HKU\S-1-5-21-3251325105-1702950111-330446913-1000..\Run: [hlpho] "C:\Users\hamis\AppData\Roaming\hlpho.exe" -autorun File not found
O4 - HKU\S-1-5-21-3251325105-1702950111-330446913-1000..\Run: [packakvideo] "C:\Users\hamis\AppData\Roaming\packakvideo.exe" -autorun File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-3251325105-1702950111-330446913-1000\..Trusted Domains: gema.de ([]https in Trusted sites)
O15 - HKU\S-1-5-21-3251325105-1702950111-330446913-1000\..Trusted Domains: gema.de ([www] https in Trusted sites)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8181DA7E-254F-4696-814A-A3CA61458BDA}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A73A05B2-30A0-4A50-BFAA-5DADD54A6B4A}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{d9b2e14e-766c-11e1-88af-002522d33ed8}\Shell - "" = AutoRun
O33 - MountPoints2\{d9b2e14e-766c-11e1-88af-002522d33ed8}\Shell\AutoRun\command - "" = E:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.24 13:10:35 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\hamis\Desktop\OTL.exe
[2012.10.11 21:09:31 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.10.11 21:01:51 | 000,000,000 | ---D | C] -- C:\Users\hamis\Documents\Logfiles
[2012.10.11 20:27:55 | 000,000,000 | ---D | C] -- C:\Users\hamis\AppData\Roaming\Malwarebytes
[2012.10.11 20:27:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.10.11 20:27:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.10.11 20:27:45 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.10.11 20:27:45 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.10.11 20:18:30 | 000,000,000 | ---D | C] -- C:\Users\hamis\AppData\Local\ElevatedDiagnostics
[2012.10.10 19:31:50 | 000,000,000 | ---D | C] -- C:\Users\hamis\AppData\Roaming\May
[2012.10.10 19:31:50 | 000,000,000 | ---D | C] -- C:\Users\hamis\AppData\Roaming\Ivy
[2012.10.09 17:16:17 | 000,000,000 | ---D | C] -- C:\Users\hamis\Local Settings
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.24 13:48:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.10.24 13:44:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.10.24 13:10:35 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\hamis\Desktop\OTL.exe
[2012.10.24 13:03:14 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.10.24 13:03:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.24 11:43:15 | 000,017,360 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.24 11:43:15 | 000,017,360 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.24 11:40:13 | 000,657,438 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.10.24 11:40:13 | 000,618,714 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.10.24 11:40:13 | 000,130,810 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.10.24 11:40:13 | 000,107,034 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.10.24 11:35:56 | 2616,696,832 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.21 21:25:08 | 000,538,941 | ---- | M] () -- C:\Users\hamis\Desktop\adwcleaner.exe
[2012.10.19 12:57:33 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012.10.15 09:45:47 | 000,002,362 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.10.11 20:27:46 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.01 12:00:43 | 000,025,142 | ---- | M] () -- C:\Users\hamis\Desktop\index.htm
[2012.10.01 12:00:26 | 000,010,378 | ---- | M] () -- C:\Users\hamis\Desktop\registrieren.htm
[2012.10.01 11:45:26 | 000,018,095 | ---- | M] () -- C:\Users\hamis\Desktop\box_right_sparen.jpg
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.10.21 21:24:58 | 000,538,941 | ---- | C] () -- C:\Users\hamis\Desktop\adwcleaner.exe
[2012.10.11 20:27:46 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.01 12:00:43 | 000,025,142 | ---- | C] () -- C:\Users\hamis\Desktop\index.htm
[2012.10.01 12:00:26 | 000,010,378 | ---- | C] () -- C:\Users\hamis\Desktop\registrieren.htm
[2012.10.01 11:59:36 | 000,018,095 | ---- | C] () -- C:\Users\hamis\Desktop\box_right_sparen.jpg
[2012.04.06 17:01:25 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2012.04.06 16:59:52 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.04.06 16:08:10 | 000,431,598 | ---- | C] () -- C:\Users\hamis\C_Scheck-Spk
[2012.04.06 16:08:10 | 000,380,928 | ---- | C] () -- C:\Users\hamis\kontakte.mdb
[2012.04.06 16:08:10 | 000,169,539 | ---- | C] () -- C:\Users\hamis\kontakte.CSV
[2012.04.06 16:08:10 | 000,130,747 | ---- | C] () -- C:\Users\hamis\kalkender.CSV
[2012.04.06 16:08:10 | 000,041,513 | ---- | C] () -- C:\Users\hamis\Aktionaersbindung1.pdf
[2012.04.06 16:08:10 | 000,025,906 | ---- | C] () -- C:\Users\hamis\KORE308562003.htm
[2012.04.06 16:08:10 | 000,000,348 | ---- | C] () -- C:\Users\hamis\Fremdscan.rtf
[2012.04.06 16:08:09 | 000,060,863 | ---- | C] () -- C:\Users\hamis\~#2~#Numero riservato-19.10.2009.tif
[2012.03.25 13:23:54 | 000,015,573 | ---- | C] () -- C:\Windows\System32\drivers\fwlanusbn.bin
[2011.01.07 12:11:46 | 000,038,912 | ---- | C] () -- C:\Windows\System32\FirmwareRecovery.exe
[2011.01.04 13:17:12 | 000,237,637 | ---- | C] () -- C:\Windows\System32\nbt.exe
[2010.12.21 03:15:18 | 000,231,936 | ---- | C] () -- C:\Windows\System32\3500_256.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.10.11 21:22:54 | 000,000,000 | ---D | M] -- C:\Users\hamis\AppData\Roaming\Ivy
[2012.10.11 19:51:16 | 000,000,000 | ---D | M] -- C:\Users\hamis\AppData\Roaming\May
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.04.19 11:08:29 | 000,000,000 | ---D | M] -- C:\Users\hamis\AppData\Roaming\Adobe
[2012.03.25 12:49:56 | 000,000,000 | ---D | M] -- C:\Users\hamis\AppData\Roaming\Identities
[2012.10.11 21:22:54 | 000,000,000 | ---D | M] -- C:\Users\hamis\AppData\Roaming\Ivy
[2012.04.10 15:34:00 | 000,000,000 | ---D | M] -- C:\Users\hamis\AppData\Roaming\Macromedia
[2012.10.11 20:27:55 | 000,000,000 | ---D | M] -- C:\Users\hamis\AppData\Roaming\Malwarebytes
[2012.10.11 19:51:16 | 000,000,000 | ---D | M] -- C:\Users\hamis\AppData\Roaming\May
[2009.07.14 10:56:41 | 000,000,000 | ---D | M] -- C:\Users\hamis\AppData\Roaming\Media Center Programs
[2012.10.10 19:32:31 | 000,000,000 | --SD | M] -- C:\Users\hamis\AppData\Roaming\Microsoft
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
< %systemroot%\Installer\*. /s >
[2012.03.25 12:54:08 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$
[2012.05.02 18:43:18 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}
[2012.08.07 22:35:19 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{1EF93620-4B15-4DB4-B0EA-889E2F187081}
[2012.06.18 11:33:40 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}
[2012.10.15 10:20:50 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}
[2012.04.09 22:35:17 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{90120000-006E-0407-0000-0000000FF1CE}
[2012.10.19 12:57:25 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{98EABC7F-B1A1-43A5-B505-5B4EC3908DCD}
[2012.08.20 12:21:44 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{AC76BA86-7AD7-1031-7B44-AA1000000001}
[2012.08.07 22:34:38 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{DB8A0A15-1796-489A-9246-29A4798D249B}
[2012.04.24 10:35:22 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}
[2012.10.02 16:11:56 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed
[2012.04.09 22:38:00 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC
[2012.03.25 14:21:13 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\000021091A0070400000000000F01FEC
[2012.03.25 14:21:08 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109440070400000000000F01FEC
[2012.03.25 14:21:37 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109510070400000000000F01FEC
[2012.04.09 22:35:24 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109610070400000000000F01FEC
[2012.04.09 22:35:43 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109810070400000000000F01FEC
[2012.03.25 12:55:10 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109910070400000000000F01FEC
[2012.04.09 22:35:39 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109A10070400000000000F01FEC
[2012.03.25 14:21:42 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109AB0070400000000000F01FEC
[2012.04.09 22:35:52 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109B10070400000000000F01FEC
[2012.03.25 14:20:51 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109E60070400000000000F01FEC
[2012.03.25 14:26:08 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F10001400000000000F01FEC
[2012.03.25 14:25:58 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F10070400000000000F01FEC
[2012.03.25 14:26:02 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F10090400000000000F01FEC
[2012.03.25 14:26:05 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F100C0400000000000F01FEC
[2012.04.26 03:01:39 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00004109500200000000000000F01FEC
[2012.04.09 22:27:27 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\5C1093C35543A0E32A41B090A305076A
[2012.04.09 22:31:05 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\689C057F0135A5A3598FE47CC1A80CC1
[2012.04.19 10:58:52 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010
[2012.04.11 18:22:33 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518
[2012.07.11 19:24:36 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612
[2012.04.09 22:35:35 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\000021091A0070400000000000F01FEC\12.0.4518
[2012.03.25 14:21:08 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109440070400000000000F01FEC\12.0.4518
[2012.03.25 14:21:37 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109510070400000000000F01FEC\12.0.4518
[2012.03.25 14:26:13 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109610070400000000000F01FEC\12.0.4518
[2012.04.09 22:35:24 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109610070400000000000F01FEC\12.0.6612
[2012.03.25 14:26:50 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109810070400000000000F01FEC\12.0.4518
[2012.04.09 22:35:43 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109810070400000000000F01FEC\12.0.6612
[2012.03.25 12:55:10 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109910070400000000000F01FEC\12.0.4518
[2012.03.25 14:26:40 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109A10070400000000000F01FEC\12.0.4518
[2012.04.09 22:35:39 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109A10070400000000000F01FEC\12.0.6612
[2012.03.25 14:21:42 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109AB0070400000000000F01FEC\12.0.4518
[2012.03.25 14:26:44 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109B10070400000000000F01FEC\12.0.4518
[2012.04.09 22:35:52 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109B10070400000000000F01FEC\12.0.6612
[2012.04.09 22:35:17 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109E60070400000000000F01FEC\12.0.4518
[2012.03.25 14:26:08 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F10001400000000000F01FEC\12.0.4518
[2012.04.09 22:39:03 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F10070400000000000F01FEC\12.0.4518
[2012.03.25 14:26:02 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F10090400000000000F01FEC\12.0.4518
[2012.04.09 22:39:13 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F100C0400000000000F01FEC\12.0.4518
[2012.04.26 03:01:38 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00004109500200000000000000F01FEC\14.0.5130
[2012.05.10 18:29:51 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\5C1093C35543A0E32A41B090A305076A\4.0.30319
[2012.04.09 22:31:05 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\689C057F0135A5A3598FE47CC1A80CC1\4.0.30319
[2012.08.20 12:21:28 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
< %systemroot%\Installer\*. /s >
[2012.03.25 12:54:08 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$
[2012.05.02 18:43:18 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}
[2012.08.07 22:35:19 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{1EF93620-4B15-4DB4-B0EA-889E2F187081}
[2012.06.18 11:33:40 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}
[2012.10.15 10:20:50 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}
[2012.04.09 22:35:17 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{90120000-006E-0407-0000-0000000FF1CE}
[2012.10.19 12:57:25 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{98EABC7F-B1A1-43A5-B505-5B4EC3908DCD}
[2012.08.20 12:21:44 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{AC76BA86-7AD7-1031-7B44-AA1000000001}
[2012.08.07 22:34:38 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{DB8A0A15-1796-489A-9246-29A4798D249B}
[2012.04.24 10:35:22 | 000,000,000 | ---D | M] -- C:\Windows\Installer\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}
[2012.10.02 16:11:56 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed
[2012.04.09 22:38:00 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC
[2012.03.25 14:21:13 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\000021091A0070400000000000F01FEC
[2012.03.25 14:21:08 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109440070400000000000F01FEC
[2012.03.25 14:21:37 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109510070400000000000F01FEC
[2012.04.09 22:35:24 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109610070400000000000F01FEC
[2012.04.09 22:35:43 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109810070400000000000F01FEC
[2012.03.25 12:55:10 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109910070400000000000F01FEC
[2012.04.09 22:35:39 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109A10070400000000000F01FEC
[2012.03.25 14:21:42 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109AB0070400000000000F01FEC
[2012.04.09 22:35:52 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109B10070400000000000F01FEC
[2012.03.25 14:20:51 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109E60070400000000000F01FEC
[2012.03.25 14:26:08 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F10001400000000000F01FEC
[2012.03.25 14:25:58 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F10070400000000000F01FEC
[2012.03.25 14:26:02 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F10090400000000000F01FEC
[2012.03.25 14:26:05 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F100C0400000000000F01FEC
[2012.04.26 03:01:39 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00004109500200000000000000F01FEC
[2012.04.09 22:27:27 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\5C1093C35543A0E32A41B090A305076A
[2012.04.09 22:31:05 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\689C057F0135A5A3598FE47CC1A80CC1
[2012.04.19 10:58:52 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010
[2012.04.11 18:22:33 | 000,000,000 | -HSD | M] -- [C:\Windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518
[2012.07.11 19:24:36 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6612
[2012.04.09 22:35:35 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\000021091A0070400000000000F01FEC\12.0.4518
[2012.03.25 14:21:08 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109440070400000000000F01FEC\12.0.4518
[2012.03.25 14:21:37 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109510070400000000000F01FEC\12.0.4518
[2012.03.25 14:26:13 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109610070400000000000F01FEC\12.0.4518
[2012.04.09 22:35:24 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109610070400000000000F01FEC\12.0.6612
[2012.03.25 14:26:50 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109810070400000000000F01FEC\12.0.4518
[2012.04.09 22:35:43 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109810070400000000000F01FEC\12.0.6612
[2012.03.25 12:55:10 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109910070400000000000F01FEC\12.0.4518
[2012.03.25 14:26:40 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109A10070400000000000F01FEC\12.0.4518
[2012.04.09 22:35:39 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109A10070400000000000F01FEC\12.0.6612
[2012.03.25 14:21:42 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109AB0070400000000000F01FEC\12.0.4518
[2012.03.25 14:26:44 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109B10070400000000000F01FEC\12.0.4518
[2012.04.09 22:35:52 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109B10070400000000000F01FEC\12.0.6612
[2012.04.09 22:35:17 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109E60070400000000000F01FEC\12.0.4518
[2012.03.25 14:26:08 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F10001400000000000F01FEC\12.0.4518
[2012.04.09 22:39:03 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F10070400000000000F01FEC\12.0.4518
[2012.03.25 14:26:02 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F10090400000000000F01FEC\12.0.4518
[2012.04.09 22:39:13 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00002109F100C0400000000000F01FEC\12.0.4518
[2012.04.26 03:01:38 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\00004109500200000000000000F01FEC\14.0.5130
[2012.05.10 18:29:51 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\5C1093C35543A0E32A41B090A305076A\4.0.30319
[2012.04.09 22:31:05 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\689C057F0135A5A3598FE47CC1A80CC1\4.0.30319
[2012.08.20 12:21:28 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744AA0100000010\10.1.0

< End of report >
Wie geht es weiter?
__________________
Alt 24.10.2012, 18:48   #34
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Vodafone PDF Trojaner? - Standard

Vodafone PDF Trojaner?


Beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
ATTFilter
:OTL
O4 - HKU\S-1-5-21-3251325105-1702950111-330446913-1000..\Run: [execu] "C:\Users\hamis\AppData\Roaming\execu.exe" -autorun File not found
O4 - HKU\S-1-5-21-3251325105-1702950111-330446913-1000..\Run: [hlpho] "C:\Users\hamis\AppData\Roaming\hlpho.exe" -autorun File not found
O4 - HKU\S-1-5-21-3251325105-1702950111-330446913-1000..\Run: [packakvideo] "C:\Users\hamis\AppData\Roaming\packakvideo.exe" -autorun File not found
O15 - HKU\S-1-5-21-3251325105-1702950111-330446913-1000\..Trusted Domains: gema.de ([]https in Trusted sites)
O15 - HKU\S-1-5-21-3251325105-1702950111-330446913-1000\..Trusted Domains: gema.de ([www] https in Trusted sites)
:Files
C:\Users\hamis\AppData\Roaming\*.exe
C:\Users\hamis\AppData\Roaming\May
C:\Users\hamis\AppData\Roaming\Ivy
C:\Windows\System32\FirmwareRecovery.exe
C:\Windows\System32\nbt.exe
C:\Windows\System32\3500_256.dll
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 25.10.2012, 11:22   #35
harryhirschi
 
Vodafone PDF Trojaner? - Standard

Vodafone PDF Trojaner?


Hier das Log:

Code:
ATTFilter
All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-3251325105-1702950111-330446913-1000\Software\Microsoft\Windows\CurrentVersion\Run\\execu deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3251325105-1702950111-330446913-1000\Software\Microsoft\Windows\CurrentVersion\Run\\hlpho deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3251325105-1702950111-330446913-1000\Software\Microsoft\Windows\CurrentVersion\Run\\packakvideo deleted successfully.
Registry key HKEY_USERS\S-1-5-21-3251325105-1702950111-330446913-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\gema.de\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-3251325105-1702950111-330446913-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\gema.de\www\ not found.
========== FILES ==========
File\Folder C:\Users\hamis\AppData\Roaming\*.exe not found.
C:\Users\hamis\AppData\Roaming\May folder moved successfully.
C:\Users\hamis\AppData\Roaming\Ivy folder moved successfully.
C:\Windows\System32\FirmwareRecovery.exe moved successfully.
C:\Windows\System32\nbt.exe moved successfully.
C:\Windows\System32\3500_256.dll moved successfully.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\hamis\Desktop\cmd.bat deleted successfully.
C:\Users\hamis\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: hamis
->Temp folder emptied: 145205295 bytes
->Temporary Internet Files folder emptied: 357555997 bytes
->Google Chrome cache emptied: 6450792 bytes
->Flash cache emptied: 3401 bytes
 
User: hamis_note
->Temp folder emptied: 486556 bytes
->Temporary Internet Files folder emptied: 10958127 bytes
->Flash cache emptied: 456 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 619520 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 220518253 bytes
RecycleBin emptied: 19947951 bytes
 
Total Files Cleaned = 726,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.69.0 log created on 10252012_121404

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
Wie sieht es aus, ist das System jetzt i.O.? Recht herzlichen Dank!


Alt 25.10.2012, 11:54   #36
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Vodafone PDF Trojaner? - Standard

Vodafone PDF Trojaner?


Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

__________________
--> Vodafone PDF Trojaner?

Alt 25.10.2012, 12:55   #37
harryhirschi
 
Vodafone PDF Trojaner? - Standard

Vodafone PDF Trojaner?


Ich bekomme die Report Datei mit dem Log zwar geöffnet, aber kann sie nicht kopieren und damit exportieren. Das Progi hat 4 Funde:
AVM WLAN connection Service (UnsignedFile.Multi.Generic)
avmeject (UnsignedFile.Multi.Generic)
NetDriverHPZ12 (UnsignedFile.Multi.Generic)
PmlDriver HPZ12 (UnsigenedFile.Multi.Generic)
Denke mal, das dürften keine Bedrohungen sein?!

Alt 25.10.2012, 13:12   #38
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Vodafone PDF Trojaner? - Standard

Vodafone PDF Trojaner?


Bitte nun Logs mit GMER (<<< klick für Anleitung) und aswMBR (Anleitung etwas weiter unten) erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim zweiten Mal nicht will, lass es einfach weg und führ nur aswMBR aus.

aswMBR-Download => aswMBR.exe - speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 25.10.2012, 17:11   #39
harryhirschi
 
Vodafone PDF Trojaner? - Standard

Vodafone PDF Trojaner?


Hier ist erstmals das Log von GMER:
Code:
ATTFilter
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-10-25 18:09:28
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\0000005e Hitachi_ rev.ES1O
Running: gi3zoktf.exe; Driver: C:\Users\hamis\AppData\Local\Temp\kgloipod.sys


---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 140D                                                                                               82847A49 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                                 828814D2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\Internet Explorer\iexplore.exe[2112] USER32.dll!EnableWindow                                                          772C8D02 5 Bytes  JMP 72289EBC C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2112] USER32.dll!GetAsyncKeyState                                                      772CA256 5 Bytes  JMP 7222DECD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2112] USER32.dll!CallNextHookEx                                                        772CABE1 5 Bytes  JMP 722A7FDF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2112] USER32.dll!UnhookWindowsHookEx + 4                                               772CADFD 1 Byte  [FB]
.text           C:\Program Files\Internet Explorer\iexplore.exe[2112] USER32.dll!SetWindowsHookExW                                                     772CE30C 5 Bytes  JMP 722825B4 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2112] USER32.dll!GetKeyState                                                           772D2B4D 5 Bytes  JMP 7222DDA7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2112] USER32.dll!DefWindowProcW                                                        772D507D 7 Bytes  JMP 722A8042 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2112] SHELL32.dll!RealDriveType + 173D                                                 7664FE30 4 Bytes  [CF, 01, FC, 72]
.text           C:\Program Files\Internet Explorer\iexplore.exe[2112] SHELL32.dll!RealDriveType + 1745                                                 7664FE38 8 Bytes  [E0, 61, FB, 72, 79, F7, FB, ...]
.text           C:\Program Files\Internet Explorer\iexplore.exe[2704] USER32.dll!EnableWindow                                                          772C8D02 5 Bytes  JMP 72289EBC C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2760] USER32.dll!EnableWindow                                                          772C8D02 5 Bytes  JMP 72289EBC C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2760] USER32.dll!GetAsyncKeyState                                                      772CA256 5 Bytes  JMP 7222DECD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2760] USER32.dll!CallNextHookEx                                                        772CABE1 5 Bytes  JMP 722A7FDF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2760] USER32.dll!UnhookWindowsHookEx + 4                                               772CADFD 1 Byte  [FB]
.text           C:\Program Files\Internet Explorer\iexplore.exe[2760] USER32.dll!SetWindowsHookExW                                                     772CE30C 5 Bytes  JMP 722825B4 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2760] USER32.dll!GetKeyState                                                           772D2B4D 5 Bytes  JMP 7222DDA7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2760] USER32.dll!DefWindowProcW                                                        772D507D 7 Bytes  JMP 722A8042 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2760] SHELL32.dll!RealDriveType + 173D                                                 7664FE30 4 Bytes  [CF, 01, FC, 72]
.text           C:\Program Files\Internet Explorer\iexplore.exe[2760] SHELL32.dll!RealDriveType + 1745                                                 7664FE38 8 Bytes  [E0, 61, FB, 72, 79, F7, FB, ...]
.text           C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!EnableWindow                                                          772C8D02 5 Bytes  JMP 72289EBC C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!GetAsyncKeyState                                                      772CA256 5 Bytes  JMP 7222DECD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!CallNextHookEx                                                        772CABE1 5 Bytes  JMP 722A7FDF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!UnhookWindowsHookEx + 4                                               772CADFD 1 Byte  [FB]
.text           C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!SetWindowsHookExW                                                     772CE30C 5 Bytes  JMP 722825B4 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!GetKeyState                                                           772D2B4D 5 Bytes  JMP 7222DDA7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!DefWindowProcW                                                        772D507D 7 Bytes  JMP 722A8042 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[4008] SHELL32.dll!RealDriveType + 173D                                                 7664FE30 4 Bytes  [CF, 01, FC, 72]
.text           C:\Program Files\Internet Explorer\iexplore.exe[4008] SHELL32.dll!RealDriveType + 1745                                                 7664FE38 8 Bytes  [E0, 61, FB, 72, 79, F7, FB, ...]

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]                 [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SearchPathW]                      [72FC029E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                   [72FB5EC7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateProcessW]                   [72FC7F4F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SetCurrentDirectoryW]             [72FCF500] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindClose]                        [72FCF94D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindNextFileW]                    [72FD07CA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindFirstFileW]                   [72FCFCF6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExA]                   [72FB5E4F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetPrivateProfileStringW]         [72FCABDB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]                   [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryW]                     [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateFileW]                      [72FB63E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!WritePrivateProfileStringW]       [72FCB56B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA]                      [72FB6D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CopyFileW]                         [72FCBC51] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!DeleteFileW]                       [72FCC811] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!SearchPathW]                       [72FC029E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW]                      [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]                    [72FB5EC7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]                    [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CreateFileW]                       [72FB63E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW]                    [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!DeleteFileW]                     [72FCC811] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!ReplaceFileW]                    [72FCE457] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetPrivateProfileStringA]        [72FCAA37] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetPrivateProfileStringW]        [72FCABDB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!WritePrivateProfileStringW]      [72FCB56B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA]                    [72FB6D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]                  [72FB5EC7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindFirstFileW]                  [72FCFCF6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindNextFileW]                   [72FD07CA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesW]              [72FC939B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileW]                     [72FB63E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SearchPathW]                     [72FC029E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetFileAttributesW]              [72FB5F62] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesA]              [72FC9229] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileA]                     [72FBF1F1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]                  [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA]                  [72FB5E4F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetFileAttributesA]              [72FC0ADF] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SearchPathA]                     [72FCF2BD] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindClose]                       [72FCF94D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindNextFileA]                   [72FD072B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindFirstFileA]                  [72FCF9A0] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRootA]                      [72FD1542] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathStripToRootW]                 [72FD1C5E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsURLW]                       [72FBFA79] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathFindOnPathW]                  [72FD1191] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHCreateStreamOnFileW]            [72FBF725] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHOpenRegStream2W]                [72FBFB25] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathCombineW]                     [72FD1095] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteKeyA]                     [72FD1F32] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryW]                 [72FD12D2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryStringByKeyW]           [72FD0DFB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathCreateFromUrlW]               [72FC0178] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathSkipRootW]                    [72FD1B2E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathRelativePathToW]              [72FD194A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsContentTypeW]               [72FD1233] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegQueryUSValueW]               [72FBF86E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegEnumUSKeyW]                  [72FBF472] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegOpenUSKeyA]                  [72FD27C3] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryEmptyW]            [72FD136E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryA]                 [72FD1284] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathBuildRootA]                   [72FD0F4E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetPathW]                    [72FD2769] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathCanonicalizeW]                [72FBF9DA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegSetPathW]                    [72FD2937] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetUSValueW]                 [72FB7430] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryKeyW]                   [72FBF817] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetBoolUSValueW]             [72FBE265] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRelativeW]                  [72FB5D08] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsNetworkPathW]               [72FD140A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRootW]                      [72FD1590] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteKeyW]                     [72FD1F83] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathFileExistsW]                  [72FC0123] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHEnumValueW]                     [72FD218A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathStripPathW]                   [72FD1BC6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegOpenUSKeyW]                  [72FBFACB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathRemoveArgsW]                  [72FD19EE] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHQueryValueExW]                  [72FBFC0B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHEnumKeyExW]                     [72FD20D3] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHSetValueW]                      [72FD2B62] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteValueW]                   [72FD2028] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathBuildRootW]                   [72FD0F9F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHGetValueW]                      [72FB4927] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryStringW]                [72FD0D47] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCW]                       [72FBFA2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathMakeSystemFolderW]            [72FD18A2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathUnExpandEnvStringsW]          [72FD1CAC] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCServerW]                 [72FD171C] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCServerShareW]            [72FD17B8] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetValueW]                   [72FB4984] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [ntdll.dll!NtQueryDirectoryFile]               [72FC8C1A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [USER32.dll!LoadImageW]                        [72FCCB0F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [USER32.dll!WinHelpW]                          [72FCD6BF] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [USER32.dll!PrivateExtractIconsW]              [72FCD11F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA]                    [72FB6D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CreateHardLinkW]                 [72FCC49D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!WritePrivateProfileStringW]      [72FCB56B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!WritePrivateProfileSectionW]     [72FCB245] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileSectionNamesW]  [72FCA89F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileExW]                     [72FCE0C1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW]                    [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileStringW]        [72FCABDB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileIntW]           [72FCA249] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetShortPathNameA]               [72FC9AF3] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!ReplaceFileW]                    [72FCE457] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileW]                       [72FCE089] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetBinaryTypeW]                  [72FC9F4B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CopyFileW]                       [72FCBC51] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileSectionW]       [72FCA56D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryW]                      [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryA]                      [72FB6D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!PathUnExpandEnvStringsA]          [72FBF6D1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHDeleteKeyA]                     [72FD1F32] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHDeleteValueW]                   [72FD2028] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHSetValueA]                      [72FD2B05] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHSetValueW]                      [72FD2B62] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!PathCreateFromUrlW]               [72FC0178] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetUSValueA]                 [72FB64C5] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHGetValueA]                      [72FB4CAA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHGetValueW]                      [72FB4927] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetValueW]                   [72FB4984] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetValueA]                   [72FB6528] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress]                  [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]                  [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2112] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]                  [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]                 [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SearchPathW]                      [72FC029E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                   [72FB5EC7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateProcessW]                   [72FC7F4F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SetCurrentDirectoryW]             [72FCF500] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindClose]                        [72FCF94D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindNextFileW]                    [72FD07CA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindFirstFileW]                   [72FCFCF6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExA]                   [72FB5E4F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetPrivateProfileStringW]         [72FCABDB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]                   [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryW]                     [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateFileW]                      [72FB63E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!WritePrivateProfileStringW]       [72FCB56B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA]                      [72FB6D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CopyFileW]                         [72FCBC51] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!DeleteFileW]                       [72FCC811] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!SearchPathW]                       [72FC029E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW]                      [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]                    [72FB5EC7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]                    [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CreateFileW]                       [72FB63E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW]                    [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!DeleteFileW]                     [72FCC811] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!ReplaceFileW]                    [72FCE457] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetPrivateProfileStringA]        [72FCAA37] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetPrivateProfileStringW]        [72FCABDB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!WritePrivateProfileStringW]      [72FCB56B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA]                    [72FB6D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]                  [72FB5EC7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindFirstFileW]                  [72FCFCF6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindNextFileW]                   [72FD07CA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesW]              [72FC939B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileW]                     [72FB63E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SearchPathW]                     [72FC029E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetFileAttributesW]              [72FB5F62] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesA]              [72FC9229] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileA]                     [72FBF1F1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]                  [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA]                  [72FB5E4F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetFileAttributesA]              [72FC0ADF] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SearchPathA]                     [72FCF2BD] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindClose]                       [72FCF94D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindNextFileA]                   [72FD072B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindFirstFileA]                  [72FCF9A0] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRootA]                      [72FD1542] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathStripToRootW]                 [72FD1C5E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsURLW]                       [72FBFA79] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathFindOnPathW]                  [72FD1191] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHCreateStreamOnFileW]            [72FBF725] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHOpenRegStream2W]                [72FBFB25] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathCombineW]                     [72FD1095] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteKeyA]                     [72FD1F32] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryW]                 [72FD12D2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryStringByKeyW]           [72FD0DFB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathCreateFromUrlW]               [72FC0178] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathSkipRootW]                    [72FD1B2E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathRelativePathToW]              [72FD194A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsContentTypeW]               [72FD1233] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegQueryUSValueW]               [72FBF86E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegEnumUSKeyW]                  [72FBF472] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegOpenUSKeyA]                  [72FD27C3] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryEmptyW]            [72FD136E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryA]                 [72FD1284] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathBuildRootA]                   [72FD0F4E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetPathW]                    [72FD2769] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathCanonicalizeW]                [72FBF9DA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegSetPathW]                    [72FD2937] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetUSValueW]                 [72FB7430] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryKeyW]                   [72FBF817] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetBoolUSValueW]             [72FBE265] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRelativeW]                  [72FB5D08] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsNetworkPathW]               [72FD140A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRootW]                      [72FD1590] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteKeyW]                     [72FD1F83] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathFileExistsW]                  [72FC0123] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHEnumValueW]                     [72FD218A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathStripPathW]                   [72FD1BC6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegOpenUSKeyW]                  [72FBFACB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathRemoveArgsW]                  [72FD19EE] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHQueryValueExW]                  [72FBFC0B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHEnumKeyExW]                     [72FD20D3] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHSetValueW]                      [72FD2B62] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteValueW]                   [72FD2028] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathBuildRootW]                   [72FD0F9F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHGetValueW]                      [72FB4927] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryStringW]                [72FD0D47] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCW]                       [72FBFA2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathMakeSystemFolderW]            [72FD18A2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathUnExpandEnvStringsW]          [72FD1CAC] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCServerW]                 [72FD171C] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCServerShareW]            [72FD17B8] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetValueW]                   [72FB4984] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [ntdll.dll!NtQueryDirectoryFile]               [72FC8C1A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [USER32.dll!LoadImageW]                        [72FCCB0F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [USER32.dll!WinHelpW]                          [72FCD6BF] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [USER32.dll!PrivateExtractIconsW]              [72FCD11F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA]                    [72FB6D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CreateHardLinkW]                 [72FCC49D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!WritePrivateProfileStringW]      [72FCB56B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!WritePrivateProfileSectionW]     [72FCB245] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileSectionNamesW]  [72FCA89F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileExW]                     [72FCE0C1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW]                    [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileStringW]        [72FCABDB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileIntW]           [72FCA249] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetShortPathNameA]               [72FC9AF3] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!ReplaceFileW]                    [72FCE457] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileW]                       [72FCE089] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetBinaryTypeW]                  [72FC9F4B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CopyFileW]                       [72FCBC51] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileSectionW]       [72FCA56D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryW]                      [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryA]                      [72FB6D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!PathUnExpandEnvStringsA]          [72FBF6D1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHDeleteKeyA]                     [72FD1F32] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHDeleteValueW]                   [72FD2028] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHSetValueA]                      [72FD2B05] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHSetValueW]                      [72FD2B62] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!PathCreateFromUrlW]               [72FC0178] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetUSValueA]                 [72FB64C5] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHGetValueA]                      [72FB4CAA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHGetValueW]                      [72FB4927] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetValueW]                   [72FB4984] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetValueA]                   [72FB6528] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress]                  [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]                  [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[2760] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]                  [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]                 [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SearchPathW]                      [72FC029E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                   [72FB5EC7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateProcessW]                   [72FC7F4F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SetCurrentDirectoryW]             [72FCF500] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindClose]                        [72FCF94D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindNextFileW]                    [72FD07CA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindFirstFileW]                   [72FCFCF6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExA]                   [72FB5E4F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetPrivateProfileStringW]         [72FCABDB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]                   [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryW]                     [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateFileW]                      [72FB63E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!WritePrivateProfileStringW]       [72FCB56B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA]                      [72FB6D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CopyFileW]                         [72FCBC51] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!DeleteFileW]                       [72FCC811] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!SearchPathW]                       [72FC029E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW]                      [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]                    [72FB5EC7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]                    [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CreateFileW]                       [72FB63E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW]                    [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!DeleteFileW]                     [72FCC811] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!ReplaceFileW]                    [72FCE457] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetPrivateProfileStringA]        [72FCAA37] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetPrivateProfileStringW]        [72FCABDB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!WritePrivateProfileStringW]      [72FCB56B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA]                    [72FB6D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]                  [72FB5EC7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindFirstFileW]                  [72FCFCF6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindNextFileW]                   [72FD07CA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesW]              [72FC939B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileW]                     [72FB63E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SearchPathW]                     [72FC029E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetFileAttributesW]              [72FB5F62] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesA]              [72FC9229] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileA]                     [72FBF1F1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]                  [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA]                  [72FB5E4F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetFileAttributesA]              [72FC0ADF] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SearchPathA]                     [72FCF2BD] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindClose]                       [72FCF94D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindNextFileA]                   [72FD072B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindFirstFileA]                  [72FCF9A0] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRootA]                      [72FD1542] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathStripToRootW]                 [72FD1C5E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsURLW]                       [72FBFA79] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathFindOnPathW]                  [72FD1191] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHCreateStreamOnFileW]            [72FBF725] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHOpenRegStream2W]                [72FBFB25] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathCombineW]                     [72FD1095] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteKeyA]                     [72FD1F32] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryW]                 [72FD12D2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryStringByKeyW]           [72FD0DFB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathCreateFromUrlW]               [72FC0178] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathSkipRootW]                    [72FD1B2E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathRelativePathToW]              [72FD194A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsContentTypeW]               [72FD1233] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegQueryUSValueW]               [72FBF86E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegEnumUSKeyW]                  [72FBF472] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegOpenUSKeyA]                  [72FD27C3] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryEmptyW]            [72FD136E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryA]                 [72FD1284] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathBuildRootA]                   [72FD0F4E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetPathW]                    [72FD2769] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathCanonicalizeW]                [72FBF9DA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegSetPathW]                    [72FD2937] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetUSValueW]                 [72FB7430] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryKeyW]                   [72FBF817] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetBoolUSValueW]             [72FBE265] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRelativeW]                  [72FB5D08] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsNetworkPathW]               [72FD140A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRootW]                      [72FD1590] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteKeyW]                     [72FD1F83] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathFileExistsW]                  [72FC0123] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHEnumValueW]                     [72FD218A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathStripPathW]                   [72FD1BC6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegOpenUSKeyW]                  [72FBFACB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathRemoveArgsW]                  [72FD19EE] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHQueryValueExW]                  [72FBFC0B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHEnumKeyExW]                     [72FD20D3] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHSetValueW]                      [72FD2B62] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteValueW]                   [72FD2028] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathBuildRootW]                   [72FD0F9F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHGetValueW]                      [72FB4927] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryStringW]                [72FD0D47] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCW]                       [72FBFA2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathMakeSystemFolderW]            [72FD18A2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathUnExpandEnvStringsW]          [72FD1CAC] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCServerW]                 [72FD171C] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCServerShareW]            [72FD17B8] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetValueW]                   [72FB4984] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [ntdll.dll!NtQueryDirectoryFile]               [72FC8C1A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [USER32.dll!LoadImageW]                        [72FCCB0F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [USER32.dll!WinHelpW]                          [72FCD6BF] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [USER32.dll!PrivateExtractIconsW]              [72FCD11F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA]                    [72FB6D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CreateHardLinkW]                 [72FCC49D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!WritePrivateProfileStringW]      [72FCB56B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!WritePrivateProfileSectionW]     [72FCB245] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileSectionNamesW]  [72FCA89F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileExW]                     [72FCE0C1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW]                    [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileStringW]        [72FCABDB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileIntW]           [72FCA249] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetShortPathNameA]               [72FC9AF3] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!ReplaceFileW]                    [72FCE457] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileW]                       [72FCE089] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetBinaryTypeW]                  [72FC9F4B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CopyFileW]                       [72FCBC51] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileSectionW]       [72FCA56D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryW]                      [72FB4E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryA]                      [72FB6D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!PathUnExpandEnvStringsA]          [72FBF6D1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHDeleteKeyA]                     [72FD1F32] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHDeleteValueW]                   [72FD2028] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHSetValueA]                      [72FD2B05] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHSetValueW]                      [72FD2B62] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!PathCreateFromUrlW]               [72FC0178] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetUSValueA]                 [72FB64C5] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHGetValueA]                      [72FB4CAA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHGetValueW]                      [72FB4927] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetValueW]                   [72FB4984] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetValueA]                   [72FB6528] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress]                  [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]                  [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]                  [72FB47BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device          \Driver\ACPI_HAL \Device\00000049                                                                                                      halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                                 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                                 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                                 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                                 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----
Code:
ATTFilter
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-10-25 18:16:51
-----------------------------
18:16:51.492    OS Version: Windows 6.1.7601 Service Pack 1
18:16:51.492    Number of processors: 2 586 0x603
18:16:51.492    ComputerName: HAMIS-PC  UserName: hamis
18:16:52.210    Initialize success
18:19:05.814    AVAST engine defs: 12102501
18:20:11.767    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005e
18:20:11.783    Disk 0 Vendor: Hitachi_ ES1O Size: 152627MB BusType: 3
18:20:11.861    Disk 0 MBR read successfully
18:20:11.876    Disk 0 MBR scan
18:20:11.876    Disk 0 Windows 7 default MBR code
18:20:11.892    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
18:20:11.939    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       152525 MB offset 206848
18:20:11.939    Disk 0 scanning sectors +312578048
18:20:12.205    Disk 0 scanning C:\Windows\system32\drivers
18:20:49.470    Service scanning
18:21:21.283    Modules scanning
18:22:00.533    Disk 0 trace - called modules:
18:22:00.548    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll storport.sys nvstor.sys 
18:22:00.548    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86159378]
18:22:00.564    3 CLASSPNP.SYS[8b9ae59e] -> nt!IofCallDriver -> [0x85a2d6d0]
18:22:00.564    5 ACPI.sys[82fa73d4] -> nt!IofCallDriver -> \Device\0000005e[0x85a2d900]
18:22:01.564    AVAST engine scan C:\
19:19:33.267    Scan finished successfully
19:33:52.361    Disk 0 MBR has been saved successfully to "C:\Users\hamis\Desktop\MBR.dat"
19:33:52.361    The log file has been saved successfully to "C:\Users\hamis\Desktop\aswMBR.txt"
Und was geht jetzt? Beste Grüsse.

Alt 25.10.2012, 20:23   #40
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Vodafone PDF Trojaner? - Standard

Vodafone PDF Trojaner?


Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Scans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 26.10.2012, 18:32   #41
harryhirschi
 
Vodafone PDF Trojaner? - Standard

Vodafone PDF Trojaner?


Hier erst mals das Logfile von Malwarebytes:
Code:
ATTFilter
Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.10.26.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
hamis :: HAMIS-PC [Administrator]

26.10.2012 16:23:32
mbam-log-2012-10-26 (16-23-32).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 307666
Laufzeit: 1 Stunde(n), 4 Minute(n), 13 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Rest - Superantispyware - folgt ...

Code:
ATTFilter
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 10/26/2012 at 07:43 PM

Application Version : 5.6.1012

Core Rules Database Version : 9477
Trace Rules Database Version: 7289

Scan type       : Complete Scan
Total Scan Time : 00:23:41

Operating System Information
Windows 7 Ultimate 32-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 587
Memory threats detected   : 0
Registry items scanned    : 37056
Registry threats detected : 0
File items scanned        : 27826
File threats detected     : 148

Adware.Tracking Cookie
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\KT6D99VV.txt [ /adfarm1.adition.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\P9D12WZ7.txt [ /www.googleadservices.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\I2OKQ8MY.txt [ /revsci.net ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\51J5XV4D.txt [ /at.atwola.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\QSFJHP7V.txt [ /www.googleadservices.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\LW9H36QP.txt [ /ad3.adfarm1.adition.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\AUFNO6ID.txt [ /tracking.quisma.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\MA2B7YLW.txt [ /casalemedia.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\V3YZNQL7.txt [ /tribalfusion.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\65HWH3LP.txt [ /adx2.chip.de ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\X0YQE0XR.txt [ /ads.creative-serving.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\FVS24TG9.txt [ /advertising.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\8V8IWAKE.txt [ /webmasterplan.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\YDVYZPVI.txt [ /insightexpressai.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\6QNAU5YM.txt [ /ad.yieldmanager.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\84MK7F5M.txt [ /ad.zanox.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\JS1AR6NS.txt [ /tracking.mlsat02.de ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\JROID0V6.txt [ /accounts.google.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\4G5BYLBI.txt [ /bs.serving-sys.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\F0LWJP9T.txt [ /atdmt.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\XJ668XRM.txt [ /news.springertransportmedia.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\HUG2L5TZ.txt [ /adserv.idf-bxl.org ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\LWPEMUFM.txt [ /ad.ad-srv.net ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\FJ83TAJ0.txt [ /www.googleadservices.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\CAGBEJ4I.txt [ /apmebf.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\E1GDW5K8.txt [ /tradedoubler.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\FXMNH8M1.txt [ /www.googleadservices.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\02V3TEGY.txt [ /doubleclick.net ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\CF8DGSE5.txt [ /2o7.net ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\EQPZR291.txt [ /www.googleadservices.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\OU7Y75QZ.txt [ /kontera.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\P1C0W85D.txt [ /yadro.ru ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\P90WM8M8.txt [ /www.googleadservices.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\YXPNIF2D.txt [ /ru4.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\2UWKM89F.txt [ /yieldmanager.net ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\4XPFV7TJ.txt [ /zanox.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\5KVLUXPW.txt [ /questionmarket.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\13YIGUKI.txt [ /tracker.vinsight.de ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\RGRSKDFZ.txt [ /adx.chip.de ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\M0NRXFJC.txt [ /lucidmedia.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\1PUFA1EM.txt [ /adbrite.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\R2BMA3EH.txt [ /c1.atdmt.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\POKFCRDA.txt [ /serving-sys.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\JKFFHZIU.txt [ /www.googleadservices.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\5D82HRG9.txt [ /imrworldwide.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\4Q9OD183.txt [ /mediaplex.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\108PLD2O.txt [ /ad.360yield.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\WOOK78WS.txt [ /invitemedia.com ]
	C:\Users\hamis\AppData\Roaming\Microsoft\Windows\Cookies\L426GCLV.txt [ /ad2.adfarm1.adition.com ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\39CWQAUL.txt [ Cookie:hamis@adfarm1.adition.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\TPKQC9PI.txt [ Cookie:hamis@track.webstatistik-bw.de/track/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\1O3W266E.txt [ Cookie:hamis@de.sitestat.com/sueddeutscher/stuttgarter-nachrichten/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\D4YB57H3.txt [ Cookie:hamis@at.atwola.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\SCW55S94.txt [ Cookie:hamis@tracking.quisma.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\QU7QQEP8.txt [ Cookie:hamis@virilion.122.2o7.net/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\JDKPEZL5.txt [ Cookie:hamis@eas.apm.emediate.eu/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\08B1JVNK.txt [ Cookie:hamis@advertising.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\KCSJRZWG.txt [ Cookie:hamis@banners.victor.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\8VZOKQ1R.txt [ Cookie:hamis@webmasterplan.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\63Z5ZKUR.txt [ Cookie:hamis@fastclick.net/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\IX3NM5AV.txt [ Cookie:hamis@c.atdmt.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\EHMQ1CK3.txt [ Cookie:hamis@tomtailor.dyntracker.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\6MPXAPQT.txt [ Cookie:hamis@accounts.google.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\U45RJ1HZ.txt [ Cookie:hamis@bs.serving-sys.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\19MMRSK6.txt [ Cookie:hamis@atdmt.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\WOQUCUCI.txt [ Cookie:hamis@4stats.de/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\HKZOZ2JH.txt [ Cookie:hamis@t2.trackalyzer.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\1C8KGZHW.txt [ Cookie:hamis@apmebf.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\H7321BOG.txt [ Cookie:hamis@ad4.adfarm1.adition.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\GNV7DGPW.txt [ Cookie:hamis@overture.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\FXNGUVVC.txt [ Cookie:hamis@www.etracker.de/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\XO1QQQ9E.txt [ Cookie:hamis@zanox-affiliate.de/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\E0QT93Y5.txt [ Cookie:hamis@doubleclick.net/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\07KAMXAG.txt [ Cookie:hamis@adformdsp.net/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\7KRYUGD8.txt [ Cookie:hamis@xiti.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\3NA2J3OT.txt [ Cookie:hamis@adtech.de/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\JPB3V6C2.txt [ Cookie:hamis@warnerbros.112.2o7.net/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\8FSH0DP7.txt [ Cookie:hamis@traffictrack.de/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\J4LH5JP0.txt [ Cookie:hamis@ru4.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\ESOJE67W.txt [ Cookie:hamis@track.adform.net/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\0XI5O15F.txt [ Cookie:hamis@zanox.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\Y8IR5339.txt [ Cookie:hamis@de.sitestat.com/is24/is24/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\BV2WP594.txt [ Cookie:hamis@trackalyzer.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\NS9PZ7FN.txt [ Cookie:hamis@c1.atdmt.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\OGROPD2B.txt [ Cookie:hamis@vogelservices.122.2o7.net/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\1ARKL19C.txt [ Cookie:hamis@de.sitestat.com/is24-community/is24-community/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\OTB4P307.txt [ Cookie:hamis@imrworldwide.com/cgi-bin ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\AZ2PZYIQ.txt [ Cookie:hamis@smartadserver.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\GRU8MKNX.txt [ Cookie:hamis@adform.net/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\3FAR3SND.txt [ Cookie:hamis@statse.webtrendslive.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\A9N0QJWM.txt [ Cookie:hamis@invitemedia.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\M7ZUCZJL.txt [ Cookie:hamis@ad2.adfarm1.adition.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\E6TRJQEW.txt [ Cookie:hamis@ad.adnet.de/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\GENKO4DQ.txt [ Cookie:hamis@www.adserv.webmach.de/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\2SZ91RNB.txt [ Cookie:hamis@stats.paypal.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\TULD2WIU.txt [ Cookie:hamis@www.active-tracking.de/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\2FDAHKHQ.txt [ Cookie:hamis@a.revenuemax.de/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\37L8TPNZ.txt [ Cookie:hamis@unister-adservices.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\2IIAVOKV.txt [ Cookie:hamis@casalemedia.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\XJ7IF34U.txt [ Cookie:hamis@www.googleadservices.com/pagead/conversion/1071245235/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\Q0EKSOYI.txt [ Cookie:hamis@ad.dyntracker.de/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\NE6O1P38.txt [ Cookie:hamis@statcounter.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\KP9DLAOV.txt [ Cookie:hamis@stats.immobilienpool.de/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\EIUOKRE6.txt [ Cookie:hamis@eas4.emediate.eu/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\WMLBIM18.txt [ Cookie:hamis@dkvag.112.2o7.net/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\DNNE4MMN.txt [ Cookie:hamis@www.burstnet.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\5C5B75LC.txt [ Cookie:hamis@de.sitestat.com/tuev-sued/tuev-sued/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\45HEQK3M.txt [ Cookie:hamis@questionmarket.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\URP2FHUR.txt [ Cookie:hamis@www.googleadservices.com/pagead/conversion/1002550190/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\EXLE2RRS.txt [ Cookie:hamis@zbox.zanox.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\E0W3M7XU.txt [ Cookie:hamis@ad1.adfarm1.adition.com/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\HMUOO0Z0.txt [ Cookie:hamis@urbia.wwe-media.de/ ]
	C:\USERS\HAMIS\AppData\Roaming\Microsoft\Windows\Cookies\Low\Y6HV6B4N.txt [ Cookie:hamis@www.googleadservices.com/pagead/conversion/1066494675/ ]
	C:\USERS\HAMIS\Cookies\KT6D99VV.txt [ Cookie:hamis@adfarm1.adition.com/ ]
	C:\USERS\HAMIS\Cookies\P9D12WZ7.txt [ Cookie:hamis@www.googleadservices.com/pagead/conversion/1036980325/ ]
	C:\USERS\HAMIS\Cookies\51J5XV4D.txt [ Cookie:hamis@at.atwola.com/ ]
	C:\USERS\HAMIS\Cookies\QSFJHP7V.txt [ Cookie:hamis@www.googleadservices.com/pagead/conversion/1040859109/ ]
	C:\USERS\HAMIS\Cookies\AUFNO6ID.txt [ Cookie:hamis@tracking.quisma.com/ ]
	C:\USERS\HAMIS\Cookies\MA2B7YLW.txt [ Cookie:hamis@casalemedia.com/ ]
	C:\USERS\HAMIS\Cookies\65HWH3LP.txt [ Cookie:hamis@adx2.chip.de/ ]
	C:\USERS\HAMIS\Cookies\FVS24TG9.txt [ Cookie:hamis@advertising.com/ ]
	C:\USERS\HAMIS\Cookies\8V8IWAKE.txt [ Cookie:hamis@webmasterplan.com/ ]
	C:\USERS\HAMIS\Cookies\YDVYZPVI.txt [ Cookie:hamis@insightexpressai.com/ ]
	C:\USERS\HAMIS\Cookies\JS1AR6NS.txt [ Cookie:hamis@tracking.mlsat02.de/tmobile/ ]
	C:\USERS\HAMIS\Cookies\JROID0V6.txt [ Cookie:hamis@accounts.google.com/ ]
	C:\USERS\HAMIS\Cookies\4G5BYLBI.txt [ Cookie:hamis@bs.serving-sys.com/ ]
	C:\USERS\HAMIS\Cookies\F0LWJP9T.txt [ Cookie:hamis@atdmt.com/ ]
	C:\USERS\HAMIS\Cookies\XJ668XRM.txt [ Cookie:hamis@news.springertransportmedia.com/ev ]
	C:\USERS\HAMIS\Cookies\HUG2L5TZ.txt [ Cookie:hamis@adserv.idf-bxl.org/ ]
	C:\USERS\HAMIS\Cookies\CAGBEJ4I.txt [ Cookie:hamis@apmebf.com/ ]
	C:\USERS\HAMIS\Cookies\02V3TEGY.txt [ Cookie:hamis@doubleclick.net/ ]
	C:\USERS\HAMIS\Cookies\EQPZR291.txt [ Cookie:hamis@www.googleadservices.com/pagead/conversion/1010320659/ ]
	C:\USERS\HAMIS\Cookies\P90WM8M8.txt [ Cookie:hamis@www.googleadservices.com/pagead/conversion/1045353772/ ]
	C:\USERS\HAMIS\Cookies\YXPNIF2D.txt [ Cookie:hamis@ru4.com/ ]
	C:\USERS\HAMIS\Cookies\4XPFV7TJ.txt [ Cookie:hamis@zanox.com/ ]
	C:\USERS\HAMIS\Cookies\5KVLUXPW.txt [ Cookie:hamis@questionmarket.com/ ]
	C:\USERS\HAMIS\Cookies\13YIGUKI.txt [ Cookie:hamis@tracker.vinsight.de/ ]
	C:\USERS\HAMIS\Cookies\RGRSKDFZ.txt [ Cookie:hamis@adx.chip.de/ ]
	C:\USERS\HAMIS\Cookies\R2BMA3EH.txt [ Cookie:hamis@c1.atdmt.com/ ]
	C:\USERS\HAMIS\Cookies\5D82HRG9.txt [ Cookie:hamis@imrworldwide.com/cgi-bin ]
	C:\USERS\HAMIS\Cookies\WOOK78WS.txt [ Cookie:hamis@invitemedia.com/ ]
	C:\USERS\HAMIS\Cookies\L426GCLV.txt [ Cookie:hamis@ad2.adfarm1.adition.com/ ]
	C:\USERS\HAMIS_NOTE\AppData\Roaming\Microsoft\Windows\Cookies\Low\NUPF6HIZ.txt [ Cookie:hamis_note@adfarm1.adition.com/ ]
	C:\USERS\HAMIS_NOTE\AppData\Roaming\Microsoft\Windows\Cookies\Low\0NRBMU80.txt [ Cookie:hamis_note@atdmt.com/ ]
	C:\USERS\HAMIS_NOTE\AppData\Roaming\Microsoft\Windows\Cookies\Low\W2AIXYSY.txt [ Cookie:hamis_note@fl01.ct2.comclick.com/ ]
	C:\USERS\HAMIS_NOTE\AppData\Roaming\Microsoft\Windows\Cookies\Low\IL7JS33A.txt [ Cookie:hamis_note@c.atdmt.com/ ]
	C:\USERS\HAMIS_NOTE\AppData\Roaming\Microsoft\Windows\Cookies\Low\L67EWN4A.txt [ Cookie:hamis_note@msnportal.112.2o7.net/ ]
	C:\USERS\HAMIS_NOTE\AppData\Roaming\Microsoft\Windows\Cookies\Low\K10C80PO.txt [ Cookie:hamis_note@mediaplex.com/ ]
Alles o.K.? Soll ich die gefundenen Dateien löschen (unter Quarantäne stellen) lassen?

Alt 27.10.2012, 14:18   #42
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Vodafone PDF Trojaner? - Standard

Vodafone PDF Trojaner?


Sieht ok aus, da wurden nur Cookies gefunden, die können alle weg.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 27.10.2012, 17:30   #43
harryhirschi
 
Vodafone PDF Trojaner? - Standard

Vodafone PDF Trojaner?


Ich danke Dir von Herzen!!! Noch eine Frage: Wie soll ich mein System für die Zukunft Deines Erachtens nach am Besten absichern. Bisher hatte ich lediglich MS Security Essentials drauf, zuvor ursprünglich die Vollversion von AVK (hab ich runtergeworfen, weil jemand meinte MS Security Essentials wäre ausreichend und würde weniger Ressourcen verbrauchen).Die Vollversion von AVK müsste ich noch haben. Oder hast Du eine andere Empfehlung?

Alt 27.10.2012, 20:00   #44
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Vodafone PDF Trojaner? - Standard

Vodafone PDF Trojaner?


Dann wären wir durch!

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Scan machen, aber immer vorher ans Update denken.

Es empfiehlt sich auf jeden Fall nach der beseitigten Infektion auch möglichst alle Passwörter zu ändern.

Abschließend ein ganz wichtiger Punkt: Absicherung des Rechners, aktualisieren der Programme siehe http://www.trojaner-board.de/96344-a...tml#post627442
__________________
Logfiles bitte immer in CODE-Tags posten

Antwort
Seite 3 von 3 12 3

Themen zu Vodafone PDF Trojaner?
erstelle, erstellen, essen, essentials, fehler, gen, kunde, logdatei, ms security essentials, neu, nichts, pdf, pdf trojaner, pdf-file, rechnung, security, security essentials, sicherung, sofort, troja, trojaner, trojaner?, versehentlich, virus, vodafone, wichtig, windows, windows 7, wirklich


« Systemreperatur von alleine geöffnet? | Tojan.ransom was nun »


Ähnliche Themen: Vodafone PDF Trojaner?


  1. Emotet-Trojaner nach Anhangöffnung vodafone spam
    Plagegeister aller Art und deren Bekämpfung - 03.04.2015 (15)
  2. Windows 7: vodafone-Rechung Anhang geöffnet Trojaner/Viren
    Log-Analyse und Auswertung - 14.12.2014 (13)
  3. Trojaner-Warnung: Vodafone: Ihre Festnetz-Rechnung für November 2014
    Diskussionsforum - 22.11.2014 (0)
  4. Vodafone Trojaner?
    Plagegeister aller Art und deren Bekämpfung - 20.11.2014 (21)
  5. Trojaner-Warnung: falsche VODAFONE Mobilfunk-Rechnungen
    Diskussionsforum - 17.11.2014 (3)
  6. Vodafone/Telekom E-Mail-Trojaner "Ihre Rechnung Juni 2014" | dgdbios.exe
    Log-Analyse und Auswertung - 24.06.2014 (9)
  7. Trojaner-Warnung: Vodafone E-Mail mit "Ihre neue Rechnung als PDF"
    Diskussionsforum - 03.06.2014 (0)
  8. Leider auch Vodafone Rechnung Trojaner erwischt TR/Cridex.A.199, TR/Spy.ZBot.xgxi, Worm/Cridex.E.560
    Log-Analyse und Auswertung - 03.02.2014 (13)
  9. Windows 7: versehentlich Fake Vodafone Rechnung geöffnet, jetzt hab ich Angst das ein Trojaner da ist
    Log-Analyse und Auswertung - 25.01.2014 (9)
  10. Vodafone Spam: Ihr Vodafone-Anschalttermin: 001537882370
    Diskussionsforum - 05.11.2013 (2)
  11. Gefälsche Vodafone Rechung mit Trojaner
    Plagegeister aller Art und deren Bekämpfung - 12.12.2012 (7)
  12. Vodafone PDF Trojaner
    Plagegeister aller Art und deren Bekämpfung - 26.11.2012 (14)
  13. Trojaner eingefangen über Vodafone MMS Email
    Log-Analyse und Auswertung - 23.11.2012 (19)
  14. Fake Vodafone Rechnung PDF geöffnet. Trojaner?
    Plagegeister aller Art und deren Bekämpfung - 20.11.2012 (3)
  15. Vodafone MMS Trojaner
    Plagegeister aller Art und deren Bekämpfung - 07.11.2012 (8)
  16. Was macht der vodafone Trojaner?
    Diskussionsforum - 11.06.2012 (9)
  17. Vodafone Rechnungs- Trojaner
    Plagegeister aller Art und deren Bekämpfung - 31.05.2012 (1)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Vodafone PDF Trojaner? - So, danke für den Hinweis, habe das mit dem Zusatz "S" schlicht überlesen. Das Löschlog lautet: Code: Alles auswählen Aufklappen ATTFilter # AdwCleaner v2.005 - Datei am 21/10/2012 um 21:26:57 - Vodafone PDF Trojaner?...
Archiv
Du betrachtest: Vodafone PDF Trojaner? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54