| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: System repair Virus Windows 7 StarterWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
27.02.2013, 10:35
| #1 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  System repair Virus Windows 7 Starter JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Im Anschluss: adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Danach eine Kontrolle mit OTL bitte:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
27.02.2013, 13:56
| #2 |
 | System repair Virus Windows 7 Starter Ok hab ich gemacht.
__________________Danke. Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.6.5 (02.18.2013:1)
OS: Windows 7 Starter x86
Ran by Falk on 27.02.2013 at 12:24:47,47
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\internet explorer\urlsearchhooks\\{ef99bd32-c1fb-11d2-892f-0090271d4f88}
Successfully deleted: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\toolbar\\{ef99bd32-c1fb-11d2-892f-0090271d4f88}
~~~ Registry Keys
Successfully deleted: [Registry Key] hkey_current_user\software\softonic
Successfully deleted: [Registry Key] hkey_classes_root\clsid\{02478d38-c3f9-4efb-9b51-7695eca05670}
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478d38-c3f9-4efb-9b51-7695eca05670}
Successfully deleted: [Registry Key] hkey_classes_root\clsid\{ef99bd32-c1fb-11d2-892f-0090271d4f88}
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.02.2013 at 12:47:00,29
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter # AdwCleaner v2.113 - Datei am 27/02/2013 um 12:54:35 erstellt
# Aktualisiert am 23/02/2013 von Xplode
# Betriebssystem : Windows 7 Starter Service Pack 1 (32 bits)
# Benutzer : Falk - FALK-EEEPC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Falk\Desktop\6JRT-ADWcleaner-OLT\adwcleaner.exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gefunden : C:\ProgramData\Ask
***** [Registrierungsdatenbank] *****
Schlüssel Gefunden : HKCU\Software\Ask.com.tmp
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Schlüssel Gefunden : HKLM\SOFTWARE\Software
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16464
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v13.0.1 (de)
Datei : C:\Users\Falk\AppData\Roaming\Mozilla\Firefox\Profiles\jt2uqs14.default\prefs.js
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [1939 octets] - [27/02/2013 12:54:35]
########## EOF - C:\AdwCleaner[R1].txt - [1999 octets] ##########
Code:
ATTFilter # AdwCleaner v2.113 - Datei am 27/02/2013 um 12:54:35 erstellt
# Aktualisiert am 23/02/2013 von Xplode
# Betriebssystem : Windows 7 Starter Service Pack 1 (32 bits)
# Benutzer : Falk - FALK-EEEPC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Falk\Desktop\6JRT-ADWcleaner-OLT\adwcleaner.exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gefunden : C:\ProgramData\Ask
***** [Registrierungsdatenbank] *****
Schlüssel Gefunden : HKCU\Software\Ask.com.tmp
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Schlüssel Gefunden : HKLM\SOFTWARE\Software
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16464
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v13.0.1 (de)
Datei : C:\Users\Falk\AppData\Roaming\Mozilla\Firefox\Profiles\jt2uqs14.default\prefs.js
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [1939 octets] - [27/02/2013 12:54:35]
########## EOF - C:\AdwCleaner[R1].txt - [1999 octets] ##########
Code:
ATTFilter OTL logfile created on: 27.02.2013 13:02:35 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Falk\Desktop Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,99 Gb Total Physical Memory | 0,81 Gb Available Physical Memory | 40,51% Memory free 3,98 Gb Paging File | 2,21 Gb Available in Paging File | 55,42% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 115,00 Gb Total Space | 25,97 Gb Free Space | 22,58% Space Free | Partition Type: NTFS Drive D: | 117,87 Gb Total Space | 60,96 Gb Free Space | 51,72% Space Free | Partition Type: NTFS Computer Name: FALK-EEEPC | User Name: Falk | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Falk\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Avira\AntiVir Desktop\avscan.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe (AsusTek Computer Inc.) PRC - C:\Program Files\Citrix\ICA Client\WFCRUN32.EXE (Citrix Systems, Inc.) PRC - C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.) PRC - C:\Program Files\Citrix\ICA Client\ssonsvr.exe (Citrix Systems, Inc.) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\Asus\Eee Docking\Eee Docking.exe (ASUSTek Computer Inc.) PRC - C:\Program Files\ASUS\HotkeyService\HotKeyMon.exe (ASUSTeK Computer Inc.) PRC - C:\Windows\System32\AsusService.exe () PRC - C:\Program Files\ASUS\HotkeyService\HotkeyService.exe (ASUSTeK Computer Inc.) PRC - C:\Program Files\ASUS\CapsHook\CapsHook.exe (ASUS) PRC - C:\Program Files\ASUS\SHE\SuperHybridEngine.exe (ASUSTeK Computer Inc.) PRC - C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.) PRC - C:\ProgramData\DatacardService\DCService.exe () PRC - C:\ProgramData\DatacardService\DCSHelper.exe (Huawei Technologies Co., Ltd.) PRC - C:\Program Files\Elantech\ETDCtrlHelper.exe (ELAN Microelectronic Corp.) PRC - C:\Program Files\HP\HP Color LaserJet CM1312 MFP Series\hppfaxprintersrv.exe (Hewlett-Packard Company) PRC - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.) PRC - C:\Program Files\Visafone Wireless Terminal\bin\MonServiceUDisk.exe () ========== Modules (No Company Name) ========== MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7366a39c36523a084bc11c230929ff92\Microsoft.VisualBasic.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll () MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll () MOD - \\?\C:\ProgramData\Microsoft\Windows\DRM\Cache\Indiv_SID_S-1-5-21-291956970-2086752177-2648855092-1000\Indiv01.key () MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll () MOD - C:\PROGRA~1\ASUS\ASUSWE~1\30108~1.222\ASUSWS~1.DLL () ========== Services (SafeList) ========== SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirWebService) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG) SRV - (AntiVirMailService) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (MBAMScheduler) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia) SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies) SRV - (sftvsa) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (AsusService) -- C:\Windows\System32\AsusService.exe () SRV - (DCService.exe) -- C:\ProgramData\DatacardService\DCService.exe () SRV - (HFGService) -- C:\Windows\System32\HFGService.dll (CSR, plc) SRV - (btwdins) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.) SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (UDisk Monitor) -- C:\Program Files\Visafone Wireless Terminal\bin\MonServiceUDisk.exe () ========== Driver Services (SafeList) ========== DRV - (PnSson) -- File not found DRV - (catchme) -- C:\Users\Falk\AppData\Local\Temp\catchme.sys File not found DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG) DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira Operations GmbH & Co. KG) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG) DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation) DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia) DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia) DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia) DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia) DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia) DRV - (Sftvol) -- C:\Windows\System32\drivers\Sftvollh.sys (Microsoft Corporation) DRV - (Sftredir) -- C:\Windows\System32\drivers\Sftredirlh.sys (Microsoft Corporation) DRV - (Sftplay) -- C:\Windows\System32\drivers\Sftplaylh.sys (Microsoft Corporation) DRV - (Sftfs) -- C:\Windows\System32\drivers\Sftfslh.sys (Microsoft Corporation) DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.) DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) DRV - (L1C) -- C:\Windows\System32\drivers\L1C62x86.sys (Atheros Communications, Inc.) DRV - (AsUpIO) -- C:\Windows\System32\drivers\AsUpIO.sys () DRV - (ctxusbm) -- C:\Windows\System32\drivers\ctxusbm.sys (Citrix Systems, Inc.) DRV - (AsIO) -- C:\Windows\System32\drivers\AsIO.sys () DRV - (FsUsbExDisk) -- C:\Windows\System32\FsUsbExDisk.Sys () DRV - (huawei_enumerator) -- C:\Windows\System32\drivers\ew_jubusenum.sys (Huawei Technologies Co., Ltd.) DRV - (ewusbnet) -- C:\Windows\System32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.) DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (ew_hwusbdev) -- C:\Windows\System32\drivers\ew_hwusbdev.sys (Huawei Technologies Co., Ltd.) DRV - (BthAudioHF) -- C:\Windows\System32\drivers\BthAudioHF.sys (CSR, plc) DRV - (azvusb) -- C:\Windows\System32\drivers\azvusb.sys (AzureWave Technologies, Inc.) DRV - (BthAvrcp) -- C:\Windows\System32\drivers\BthAvrcp.sys (CSR, plc) DRV - (kbfiltr) -- C:\Windows\System32\drivers\kbfiltr.sys ( ) DRV - (WSDPrintDevice) -- C:\Windows\System32\drivers\WSDPrint.sys (Microsoft Corporation) DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation) DRV - (btusbflt) -- C:\Windows\System32\drivers\btusbflt.sys (Broadcom Corporation.) DRV - (ztemtusbser) -- C:\Windows\System32\drivers\CT_ZTEMT_U_USBSER.sys (ZTEMT Incorporated) DRV - (csr_a2dp) -- C:\Windows\System32\drivers\bthav.sys (CSR, plc) DRV - (Ltn_stk7070P) -- C:\Windows\System32\drivers\Ltn_stk7070P.sys (LITEON) DRV - (Ltn_stkrc) -- C:\Windows\System32\drivers\Ltn_stkrc.sys (LITEON) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP07&src=IE-SearchBox IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-21-291956970-2086752177-2648855092-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://eeepc.asus.com [binary data] IE - HKU\S-1-5-21-291956970-2086752177-2648855092-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\S-1-5-21-291956970-2086752177-2648855092-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-291956970-2086752177-2648855092-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP07&src=IE-SearchBox IE - HKU\S-1-5-21-291956970-2086752177-2648855092-1000\..\SearchScopes\{2E51F52B-02CE-491C-ACFC-FD7BC5FC65EE}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=BFF392C4-79C7-4AB7-BCF3-21CD7D74D0D5&apn_sauid=F0392549-C34B-431D-BE61-2C1736E394D1& IE - HKU\S-1-5-21-291956970-2086752177-2648855092-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-291956970-2086752177-2648855092-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-291956970-2086752177-2648855092-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nokia.com/EnablerPlugin: C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( ) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013.02.25 20:59:45 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.25 21:00:04 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.02.25 21:00:04 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013.02.25 20:59:45 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.25 21:00:04 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.02.25 21:00:04 | 000,000,000 | ---D | M] [2011.07.18 10:01:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Falk\AppData\Roaming\mozilla\Extensions [2011.07.18 10:01:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Falk\AppData\Roaming\mozilla\Extensions\ideskbrowser@haufe.de [2012.10.25 18:47:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Falk\AppData\Roaming\mozilla\Firefox\Profiles\jt2uqs14.default\extensions [2013.02.25 20:42:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions [2013.02.25 21:00:04 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.09.02 16:14:50 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.04.25 00:58:10 | 000,124,864 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\CCMSDK.dll [2011.04.25 01:00:08 | 000,071,104 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\CgpCore.dll [2011.04.25 00:59:06 | 000,092,096 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\confmgr.dll [2011.04.25 00:58:38 | 000,022,976 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\ctxlogging.dll [2012.02.29 20:16:46 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011.04.25 01:49:00 | 000,485,288 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\npicaN.dll [2011.04.25 01:00:04 | 000,024,512 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\TcpPServ.dll [2012.06.07 19:44:26 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.06.07 19:44:26 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.06.07 19:44:26 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.06.07 19:44:26 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.07 19:44:26 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.07 19:44:26 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2013.02.27 01:10:15 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [ASUSPRP] C:\Program Files\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.) O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe (ecareme) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [CapsHook] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.) O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.) O4 - HKLM..\Run: [Eee Docking] C:\Program Files\ASUS\Eee Docking\Eee Docking.exe (ASUSTek Computer Inc.) O4 - HKLM..\Run: [EEESplendidAR] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.) O4 - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.) O4 - HKLM..\Run: [HotkeyMon] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.) O4 - HKLM..\Run: [HotkeyService] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.) O4 - HKLM..\Run: [HP Color LaserJet CM1312 MFP Series Fax] C:\Program Files\HP\HP Color LaserJet CM1312 MFP Series\hppfaxprintersrv.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [HPUsageTracking] C:\Program Files\HP\HP UT\bin\hppusg.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [LiveUpdate] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.) O4 - HKLM..\Run: [SuperHybridEngine] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-291956970-2086752177-2648855092-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-291956970-2086752177-2648855092-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-291956970-2086752177-2648855092-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O15 - HKU\S-1-5-21-291956970-2086752177-2648855092-1000\..Trusted Domains: lht-portal.de ([seccustomer] https in Vertrauenswürdige Sites) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 80.248.7.1 80.248.7.2 165.21.83.88 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08B0C0E4-3354-40B7-81F5-70F9BC22D92A}: DhcpNameServer = 80.248.7.1 80.248.7.2 165.21.83.88 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6AB71594-7E93-4B1C-9BCC-51B99B42CE23}: DhcpNameServer = 80.248.7.1 80.248.7.2 165.21.83.88 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9CEB75ED-5532-45CB-80E9-C3A2E37437B3}: NameServer = 172.24.8.50 141.1.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BA6342C5-025A-462B-A9F5-39D721745D35}: NameServer = 172.24.8.50 141.1.1.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.02.27 13:01:48 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Falk\Desktop\OTL.exe [2013.02.27 12:24:34 | 000,000,000 | ---D | C] -- C:\windows\ERUNT [2013.02.27 12:24:17 | 000,000,000 | ---D | C] -- C:\JRT [2013.02.27 12:23:05 | 000,000,000 | ---D | C] -- C:\Users\Falk\Desktop\6JRT-ADWcleaner-OLT [2013.02.27 12:17:54 | 000,000,000 | ---D | C] -- C:\Users\Falk\Desktop\5combofix [2013.02.27 08:25:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2013.02.27 01:18:00 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2013.02.27 01:17:48 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\temp [2013.02.27 00:42:45 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe [2013.02.27 00:42:45 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe [2013.02.27 00:42:45 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe [2013.02.27 00:41:51 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.02.27 00:41:05 | 000,000,000 | ---D | C] -- C:\windows\erdnt [2013.02.27 00:38:52 | 005,036,023 | R--- | C] (Swearware) -- C:\Users\Falk\Desktop\ComboFix.exe [2013.02.27 00:35:43 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{A04FF9A8-5454-4329-8983-1855A854E391} [2013.02.26 20:55:12 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\TsUsbRedirectionGroupPolicyControl.exe [2013.02.26 20:55:10 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\rdpvideominiport.sys [2013.02.26 20:55:09 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\TsUsbRedirectionGroupPolicyExtension.dll [2013.02.26 20:55:08 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\RdpGroupPolicyExtension.dll [2013.02.26 20:55:07 | 000,027,136 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\TsUsbGD.sys [2013.02.26 20:55:06 | 000,049,664 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\TsUsbFlt.sys [2013.02.26 20:55:03 | 000,269,312 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\aaclient.dll [2013.02.26 20:55:03 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\TSWbPrxy.exe [2013.02.26 20:55:03 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\MsRdpWebAccess.dll [2013.02.26 20:55:03 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\tsgqec.dll [2013.02.26 20:55:03 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\TsUsbGDCoInstaller.dll [2013.02.26 20:55:03 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wksprtPS.dll [2013.02.26 20:55:02 | 000,317,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wksprt.exe [2013.02.26 20:55:02 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdpudd.dll [2013.02.26 20:55:02 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdpendp_winip.dll [2013.02.26 20:55:00 | 002,739,712 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdpcorets.dll [2013.02.26 20:51:58 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\qdvd.dll [2013.02.26 17:42:32 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mshtml.tlb [2013.02.26 17:42:29 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jsproxy.dll [2013.02.26 17:42:28 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieui.dll [2013.02.26 17:42:28 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieUnatt.exe [2013.02.26 17:42:27 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeeds.dll [2013.02.26 17:42:23 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jscript9.dll [2013.02.26 17:42:23 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\url.dll [2013.02.26 17:42:19 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\inetcpl.cpl [2013.02.26 14:01:09 | 000,000,000 | ---D | C] -- C:\Users\Falk\Desktop\Unhide [2013.02.26 14:00:42 | 000,000,000 | ---D | C] -- C:\Users\Falk\Desktop\4aswMbr [2013.02.26 13:59:55 | 000,000,000 | ---D | C] -- C:\Users\Falk\Desktop\3mbar [2013.02.26 13:59:14 | 000,000,000 | ---D | C] -- C:\Users\Falk\Desktop\2mbam [2013.02.26 13:58:51 | 000,000,000 | ---D | C] -- C:\Users\Falk\Desktop\1gmer [2013.02.26 13:58:21 | 000,000,000 | ---D | C] -- C:\Users\Falk\Desktop\5tdsskiller [2013.02.26 09:18:36 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{312A1566-81CB-424C-976B-E524CFB76CAE} [2013.02.26 01:43:31 | 002,347,008 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\win32k.sys [2013.02.26 00:18:39 | 000,187,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\FWPKCLNT.SYS [2013.02.26 00:10:14 | 003,967,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ntkrnlpa.exe [2013.02.26 00:10:12 | 003,913,064 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ntoskrnl.exe [2013.02.26 00:09:11 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\winsrv.dll [2013.02.25 22:39:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2013.02.25 21:53:25 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2013.02.25 21:51:34 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2013.02.25 21:51:34 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 [2013.02.25 13:51:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.02.25 13:51:18 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys [2013.02.25 09:26:45 | 000,000,000 | ---D | C] -- C:\Program Files\falkspecial [2013.02.25 00:50:31 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Roaming\Malwarebytes [2013.02.25 00:50:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.02.25 00:50:12 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2013.02.25 00:49:52 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\Programs [2013.02.24 22:36:31 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter [2013.02.24 22:36:29 | 000,000,000 | ---D | C] -- C:\sh4ldr [2013.02.24 22:36:29 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group [2013.02.24 20:31:08 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{EDB6BBC3-269B-42BF-BAB1-EC6581948DC0} [2013.02.24 20:26:52 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{E9736B9A-BD75-4ED9-B087-0CA13693735E} [2013.02.23 10:26:44 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{17B62879-D327-40EC-BAFB-8E9067E1D113} [2013.02.22 09:23:49 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{804C3AD9-1EDA-4F69-8BF0-8EE2664A5AE4} [2013.02.21 09:17:07 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{D0FDE89D-3DD2-462C-991A-76881A71ADE4} [2013.02.20 14:05:59 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{15FC1275-EE45-443D-A090-CE0B9C64EC6A} [2013.02.19 08:56:19 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{212D61F2-9956-46A8-BC04-FF98CEFDBCB5} [2013.02.18 11:24:19 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{9557AD7B-EE54-498D-8552-463711FA3F86} [2013.02.17 21:13:37 | 000,000,000 | ---D | C] -- C:\Users\Falk\Desktop\nulli [2013.02.17 18:07:01 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{538D5817-7DFD-49FA-8DC7-C2ABEB79257E} [2013.02.16 12:54:08 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{6C9C2340-71B4-4600-B3EF-B02D730804FC} [2013.02.16 11:18:13 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{3DD0C790-7519-4348-BC55-0BB9D3FF2F36} [2013.02.15 18:29:51 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{2121B358-431F-465D-A11C-C311C88CAF70} [2013.02.14 17:38:40 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant [2013.02.14 17:24:18 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\HP [2013.02.14 17:23:53 | 000,013,929 | ---- | C] (Hewlett-Packard Company) -- C:\windows\System32\hppfaxprintermon5.dll [2013.02.14 17:23:53 | 000,009,451 | ---- | C] (Hewlett-Packard Company) -- C:\windows\System32\hppfaxprintermonui5.dll [2013.02.14 17:21:27 | 000,161,280 | ---- | C] (Hewlett-Packard Corporation) -- C:\windows\System32\hpcpn093.dll [2013.02.14 17:21:26 | 000,059,928 | ---- | C] (Hewlett-Packard) -- C:\windows\System32\fxcompchannel.dll [2013.02.14 16:45:36 | 000,000,000 | ---D | C] -- C:\Users\Falk\Documents\My Scans [2013.02.14 05:26:56 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{4AEE2D94-9496-4DC4-8CA6-0C712C9B6951} [2013.02.13 20:30:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo! Companion [2013.02.13 20:23:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\HP [2013.02.13 16:28:18 | 000,761,856 | ---- | C] (Hewlett-Packard) -- C:\windows\System32\hpxp1312.dll [2013.02.13 16:28:17 | 000,770,048 | ---- | C] (Hewlett-Packard) -- C:\windows\System32\hpptsp04.dll [2013.02.13 16:28:17 | 000,450,560 | ---- | C] (Hewlett-Packard) -- C:\windows\System32\hppasc11.dll [2013.02.13 16:28:17 | 000,331,776 | ---- | C] (Hewlett-Packard) -- C:\windows\System32\hppcpr11.dll [2013.02.13 14:39:09 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{3B8F6A27-F7C4-46B8-9849-043AA6054CAA} [2013.02.13 06:34:05 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{790A5603-4A24-4097-9D7B-170FA455418F} [2013.02.12 17:53:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\SWF Studio [2013.02.12 17:49:47 | 000,000,000 | ---D | C] -- C:\CM1312_Full_Solution_Win7_5_1_AM-EMEA1 [2013.02.12 16:57:04 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{9F53B4F2-8C5B-4E1E-AD0F-CF6D787EB9B0} [2013.02.12 11:33:07 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{050420B6-E64D-4A83-B53F-5BE931FF54B7} [2013.02.11 23:32:40 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{300BC72C-D5FA-461D-8DD9-5D4D556A0C02} [2013.02.11 11:32:01 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{296180BC-B700-4838-8C53-5BF8B1429A9D} [2013.02.10 23:31:35 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{F1CB0D8C-E158-40B4-BB1B-8B2DD0E82600} [2013.02.10 11:48:57 | 000,000,000 | ---D | C] -- C:\Users\Falk\Desktop\BCN [2013.02.10 11:31:23 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{79944562-E1B0-4736-B726-828D4832C3FF} [2013.02.09 20:57:46 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{1B318D4E-9688-409D-8B83-DC78790AC8A5} [2013.02.08 22:52:45 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{01FCC537-3841-4F83-A70E-B71C2FC7EF8B} [2013.02.08 10:11:50 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{32276B32-5369-4B37-805A-67D90AC8A9EA} [2013.02.07 09:56:16 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{701884B0-7821-4956-9D45-32BAA2380440} [2013.02.06 21:55:50 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{0AEB2119-0A3D-4785-8EAF-AE44547ACB5A} [2013.02.06 09:19:58 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{2F8197F5-A56D-410A-A9B9-603D94F01518} [2013.02.06 09:16:55 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{7B667C4F-1F46-4411-952D-9E91ECE18723} [2013.02.05 16:10:13 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{8014590E-1C41-48E4-A2E4-FFF0943B131A} [2013.02.04 23:37:17 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{569C7A2F-6D58-4014-BC4A-6D65F4C4F4D6} [2013.02.04 08:59:39 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{223D97E1-5C79-4FC7-B9F5-7B9CE354D612} [2013.01.31 22:42:55 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{93F542E1-1F29-42BF-B4A4-540D7C6AE0CE} [2013.01.31 08:33:04 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{ADFFD25F-8979-4E5B-9560-3A53AEA8FBEF} [2013.01.29 22:50:46 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{4076BD1A-DD15-4AA6-A481-A7FF3E6F28DA} [2013.01.29 08:13:13 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{33AF2D69-09C8-403D-966A-92AF716118E3} [2013.01.28 15:26:57 | 000,000,000 | ---D | C] -- C:\$WINDOWS.~BT [2013.01.28 15:21:34 | 000,000,000 | ---D | C] -- C:\windows\System32\directx [2013.01.28 14:14:38 | 000,000,000 | ---D | C] -- C:\ESD [2013.01.28 13:25:27 | 000,000,000 | ---D | C] -- C:\Users\Falk\AppData\Local\{780397B7-E6AA-4CBF-96CD-BE6C4FF962F4} [5 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.02.27 13:08:04 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job [2013.02.27 13:01:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Falk\Desktop\OTL.exe [2013.02.27 12:39:05 | 000,001,094 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job [2013.02.27 09:38:07 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2013.02.27 08:19:34 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avkmgr.sys [2013.02.27 08:19:31 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avipbb.sys [2013.02.27 08:19:28 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avgntflt.sys [2013.02.27 08:12:27 | 002,086,216 | ---- | M] () -- C:\Users\Falk\Desktop\avira_antivirus_premium.exe [2013.02.27 08:07:20 | 000,009,696 | ---- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.02.27 08:07:20 | 000,009,696 | ---- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.02.27 08:00:14 | 000,001,090 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job [2013.02.27 07:58:23 | 1602,887,680 | -HS- | M] () -- C:\hiberfil.sys [2013.02.27 01:10:15 | 000,000,027 | ---- | M] () -- C:\windows\System32\drivers\etc\hosts [2013.02.27 00:40:38 | 005,036,023 | R--- | M] (Swearware) -- C:\Users\Falk\Desktop\ComboFix.exe [2013.02.27 00:10:27 | 000,691,568 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerApp.exe [2013.02.27 00:10:27 | 000,071,024 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerCPLApp.cpl [2013.02.26 08:27:05 | 000,356,448 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT [2013.02.26 00:15:44 | 000,666,216 | ---- | M] () -- C:\windows\System32\perfh007.dat [2013.02.26 00:15:44 | 000,638,388 | ---- | M] () -- C:\windows\System32\perfh009.dat [2013.02.26 00:15:44 | 000,134,174 | ---- | M] () -- C:\windows\System32\perfc007.dat [2013.02.26 00:15:44 | 000,111,022 | ---- | M] () -- C:\windows\System32\perfc009.dat [2013.02.25 09:57:45 | 000,000,152 | ---- | M] () -- C:\ProgramData\-KqqAuLXXXiuQHkW [2013.02.25 09:13:04 | 000,000,168 | ---- | M] () -- C:\ProgramData\-KqqAuLXXXiuQHkWr [2013.02.15 18:50:26 | 000,042,334 | ---- | M] () -- C:\Users\Falk\Desktop\Verlustmeldung.pdf [2013.02.14 18:02:43 | 000,202,453 | ---- | M] () -- C:\windows\hpoins18.dat [2013.02.14 18:02:43 | 000,002,281 | ---- | M] () -- C:\Users\Public\Desktop\Add a Device - All-In-One Series.lnk [2013.02.14 17:42:20 | 000,062,214 | ---- | M] () -- C:\windows\hpqins01.dat [2013.02.14 17:41:31 | 000,002,069 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2013.02.14 17:39:28 | 000,077,620 | ---- | M] () -- C:\windows\hpqins05.dat [2013.02.14 17:38:28 | 000,001,273 | ---- | M] () -- C:\Users\Public\Desktop\HP Solution Center.lnk [2013.02.14 17:26:27 | 000,176,744 | ---- | M] () -- C:\windows\hppins11.dat [2013.02.14 17:23:53 | 000,000,608 | -HS- | M] () -- C:\windows\System32\winzvprt5.sys [2013.02.14 17:23:53 | 000,000,222 | ---- | M] () -- C:\windows\System32\hppfaxprinter5.ini [2013.02.14 17:20:10 | 000,000,224 | ---- | M] () -- C:\windows\System32\AddPort.ini [2013.02.14 17:20:07 | 000,000,749 | ---- | M] () -- C:\windows\hpntwksetup.ini [2013.02.13 20:39:48 | 000,202,702 | ---- | M] () -- C:\windows\hpoins18.dat.temp [5 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.02.27 08:12:03 | 002,086,216 | ---- | C] () -- C:\Users\Falk\Desktop\avira_antivirus_premium.exe [2013.02.27 00:42:45 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe [2013.02.27 00:42:45 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe [2013.02.27 00:42:45 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe [2013.02.27 00:42:45 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe [2013.02.27 00:42:45 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe [2013.02.24 21:17:22 | 000,000,168 | ---- | C] () -- C:\ProgramData\-KqqAuLXXXiuQHkWr [2013.02.24 21:17:21 | 000,000,152 | ---- | C] () -- C:\ProgramData\-KqqAuLXXXiuQHkW [2013.02.15 18:50:18 | 000,042,334 | ---- | C] () -- C:\Users\Falk\Desktop\Verlustmeldung.pdf [2013.02.14 18:02:43 | 000,002,281 | ---- | C] () -- C:\Users\Public\Desktop\Add a Device - All-In-One Series.lnk [2013.02.14 17:55:41 | 000,202,453 | ---- | C] () -- C:\windows\hpoins18.dat [2013.02.14 17:55:41 | 000,005,355 | ---- | C] () -- C:\windows\hpomdl18.dat [2013.02.14 17:42:40 | 000,202,702 | ---- | C] () -- C:\windows\hpoins18.dat.temp [2013.02.14 17:39:43 | 000,062,214 | ---- | C] () -- C:\windows\hpqins01.dat [2013.02.14 17:38:28 | 000,001,273 | ---- | C] () -- C:\Users\Public\Desktop\HP Solution Center.lnk [2013.02.14 17:36:42 | 000,077,620 | ---- | C] () -- C:\windows\hpqins05.dat [2013.02.14 17:24:46 | 000,002,069 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2013.02.14 17:23:53 | 000,000,222 | ---- | C] () -- C:\windows\System32\hppfaxprinter5.ini [2013.02.14 17:09:31 | 000,176,744 | ---- | C] () -- C:\windows\hppins11.dat [2013.02.14 17:09:31 | 000,005,707 | ---- | C] () -- C:\windows\hppmdl11.dat [2013.02.13 20:29:10 | 000,001,030 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk [2013.02.13 16:45:00 | 000,000,608 | -HS- | C] () -- C:\windows\System32\winzvprt5.sys [2013.02.13 16:40:04 | 000,000,224 | ---- | C] () -- C:\windows\System32\AddPort.ini [2013.02.13 16:39:28 | 000,000,749 | ---- | C] () -- C:\windows\hpntwksetup.ini [2013.02.12 17:52:32 | 000,003,212 | ---- | C] () -- C:\windows\System32\hppls1312.spf [2013.02.12 17:52:30 | 000,000,665 | ---- | C] () -- C:\windows\System32\hppapr11.dat [2013.01.25 16:42:04 | 000,037,774 | ---- | C] () -- C:\Users\Falk\Windows 8-Upgrade-Assistent.html [2012.05.21 14:31:09 | 000,007,597 | ---- | C] () -- C:\Users\Falk\AppData\Local\Resmon.ResmonCfg [2012.02.04 19:47:03 | 000,000,000 | ---- | C] () -- C:\windows\HPMProp.INI [2012.01.08 14:52:55 | 000,000,017 | ---- | C] () -- C:\windows\System32\shortcut_ex.dat [2011.12.27 13:07:42 | 000,014,428 | ---- | C] () -- C:\Users\Falk\NETGEARNEU.cfg [2011.11.13 22:18:26 | 000,110,592 | ---- | C] () -- C:\windows\System32\FsUsbExDevice.Dll [2011.11.13 22:18:26 | 000,036,608 | ---- | C] () -- C:\windows\System32\FsUsbExDisk.Sys [2011.10.23 06:56:16 | 004,738,560 | ---- | C] () -- C:\windows\System32\x264vfw.dll [2011.10.21 15:43:18 | 000,000,094 | ---- | C] () -- C:\windows\ParrotFlashWiz.INI [2011.09.25 16:56:26 | 000,216,064 | ---- | C] ( ) -- C:\windows\System32\lagarith.dll [2011.07.18 11:04:20 | 000,000,147 | ---- | C] () -- C:\windows\ODBC.INI [2011.07.12 15:56:50 | 000,074,752 | ---- | C] () -- C:\windows\System32\ff_vfw.dll [2011.07.07 20:46:53 | 000,009,216 | ---- | C] () -- C:\Users\Falk\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.07.06 16:00:20 | 000,005,355 | ---- | C] () -- C:\windows\hpomdl18.dat.temp [2011.07.04 08:58:09 | 000,005,576 | ---- | C] () -- C:\windows\Language.ini [2011.07.04 08:51:37 | 000,004,692 | ---- | C] () -- C:\windows\System32\drivers\SamSfPa.dat [2011.07.04 08:51:37 | 000,000,008 | ---- | C] () -- C:\windows\System32\drivers\rtkhdaud.dat [2011.05.13 09:03:16 | 000,303,104 | ---- | C] () -- C:\windows\System32\dnt27VC8.dll [2011.05.13 09:01:22 | 000,143,360 | ---- | C] () -- C:\windows\System32\dntvmc27VC8.dll [2011.05.13 09:01:00 | 000,086,016 | ---- | C] () -- C:\windows\System32\dntvm27VC8.dll [2011.04.02 03:53:06 | 000,224,680 | ---- | C] () -- C:\windows\System32\AsusService.exe [2011.04.02 03:53:06 | 000,025,616 | ---- | C] () -- C:\windows\AsAcpiSvrLang.ini [2011.04.02 03:48:13 | 000,011,832 | ---- | C] () -- C:\windows\System32\drivers\AsUpIO.sys [2011.04.02 03:48:12 | 000,011,456 | ---- | C] () -- C:\windows\System32\drivers\AsIO.sys [2011.04.02 03:47:53 | 000,000,702 | ---- | C] () -- C:\windows\Reboot.ini [2011.04.02 03:43:20 | 000,451,072 | ---- | C] () -- C:\windows\System32\ISSRemoveSP.exe [2011.04.02 03:42:53 | 000,014,051 | ---- | C] () -- C:\windows\System32\RaCoInst.dat ========== ZeroAccess Check ========== [2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2011.04.02 04:05:40 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\ASUS WebStorage [2013.02.25 21:00:46 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\E-Cam [2011.04.02 04:05:40 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\ASUS WebStorage [2013.02.25 21:00:46 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\E-Cam [2011.04.02 04:05:40 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\ASUS WebStorage [2013.01.05 15:54:09 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2011.07.04 09:17:21 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\com.nyt.timesreader.78C54164786ADE80CB31E1C5D95607D0938C987A.1 [2013.02.25 21:01:00 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\E-Cam [2013.01.05 14:06:54 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\GehirnJogging [2013.02.25 20:47:54 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\Haufe Mediengruppe [2013.02.25 21:01:00 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\ICAClient [2011.07.18 11:45:36 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\Lexware [2013.02.25 20:47:57 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\Nokia [2013.02.25 20:47:57 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\Nokia Ovi Suite [2012.09.04 13:18:35 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\Nokia Suite [2013.02.25 20:47:58 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\OpenOffice.org [2012.12.09 12:29:01 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\PC Suite [2013.02.25 21:01:02 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\PhotoScape [2012.01.07 01:16:12 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\pokerth [2012.03.11 00:21:21 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\Samsung [2013.02.25 20:47:58 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\SoftGrid Client [2011.07.05 09:10:15 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\TP [2013.02.25 21:01:02 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\Win7codecs [2011.07.05 22:18:59 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\Windows Live Writer [2011.12.20 18:42:08 | 000,000,000 | ---D | M] -- C:\Users\Falk\AppData\Roaming\ZTEEVDO ========== Purity Check ========== < End of report > |
|
| Themen zu System repair Virus Windows 7 Starter |
| abgesicherten, administrator, aktion, anti-malware, autostart, dateien, explorer, gestartet, logdatei, malwarebytes, microsoft, minute, modus, registrierung, scan, service, software, speicher, system, temp, test, version, virus, windows, windows 7 |
Hybrid-Darstellung
