Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


Log-Analyse und Auswertung: Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Seite 1 von 2 1 2
Alt 02.06.2013, 22:02   #1
Maraxos
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


Hi Leute, Ich habe mein Computer am 31.5.2013 neu gemacht, nun habe ich Mbam auf mein Computer installiert sowie Avira und meine Programme die ich benötige.

Ich habe aber bevor ich mein PC neu gemacht habe aus den Roaming Ordner die Dateien Von Firefox und Teamspeak, Notepad+ uvm. auf meine externe Festplatte gespeichert, dann wo ich alle Programme etc. fertig installiert habe, hab ich den Roaming Ordner bei appdata wieder rein kopiert, das ich die Gespeicherten Seiten wieder habe. Aber dann hat Mbam ein Scan gemacht und es wurde eine "pud.installBrain" gefunden. Was ist das?

Hier der Mbam Scan:
Code:
ATTFilter
 Malwarebytes Anti-Malware  (PRO) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.06.02.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16576
Maraxos :: MARAXOS-PC [Administrator]

Schutz: Aktiviert

02.06.2013 20:00:05
mbam-log-2013-06-02 (20-00-05).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 216415
Laufzeit: 2 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKLM\SYSTEM\CurrentControlSet\Services\IBUpdaterService (PUP.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Ich habe danach gegoogelt und fand nur eine datei namens "adwcleaner_2.3.0.1" und habe diese ausgeführt und er spuckte mir das Ergebnis raus:

AdwCleaner Log
Code:
ATTFilter
# AdwCleaner v2.301 - Datei am 02/06/2013 um 20:09:06 erstellt
# Aktualisiert am 16/05/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Maraxos - MARAXOS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Maraxos\Downloads\adwcleaner_2.3.0.1.exe
# Option [Suche]


**** [Dienste] ****

Gefunden : IBUpdaterService

***** [Dateien / Ordner] *****

Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\i62j7lnb.default\searchplugins\icqplugin.xml
Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\i62j7lnb.default\searchplugins\SweetIM Search.xml
Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\searchplugins\11-suche.xml
Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\searchplugins\Askcom.xml
Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\searchplugins\dvdvideosofttb-customized-web-search.xml
Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\searchplugins\funmoods.xml
Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\searchplugins\icqplugin.xml
Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\searchplugins\icqplugin-1.xml
Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\searchplugins\icqplugin-2.xml
Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\searchplugins\MyStart Search.xml
Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\searchplugins\SweetIM Search.xml
Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\searchplugins\SweetIm.xml
Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\o0ul7s80.default\searchplugins\icqplugin.xml
Datei Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\o0ul7s80.default\searchplugins\SweetIM Search.xml
Ordner Gefunden : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gefunden : C:\Program Files (x86)\SweetIM
Ordner Gefunden : C:\Program Files (x86)\sweetpacks bundle uninstaller
Ordner Gefunden : C:\Program Files (x86)\TornTV.com
Ordner Gefunden : C:\ProgramData\SweetIM
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\i62j7lnb.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\CT2269050
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\CT3242337
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\extensions\{213c8ed6-1d78-4d8f-8729-25006aa86a76}
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\extensions\ffxtlbr@funmoods.com
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\extensions\ffxtlbr@incredibar.com
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\extensions\toolbar@ask.com
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\jetpack
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\Smartbar
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\WinampToolbarData
Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\o0ul7s80.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
Ordner Gefunden : C:\Windows\Installer\{A0C9DF2B-89B5-4483-8983-18A68200F1B4}
Ordner Gefunden : C:\Windows\SysWOW64\WNLT

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\1ClickDownload
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gefunden : HKCU\Software\Conduit
Schlüssel Gefunden : HKCU\Software\IM
Schlüssel Gefunden : HKCU\Software\ImInstaller
Schlüssel Gefunden : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKCU\Software\WNLT
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CrossriderApp0033036.BHO
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CrossriderApp0033036.BHO.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CrossriderApp0033036.Sandbox
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CrossriderApp0033036.Sandbox.1
Schlüssel Gefunden : HKLM\Software\Classes\Installer\Features\B2FD9C0A5B9838449838816A28001F4B
Schlüssel Gefunden : HKLM\Software\Classes\Installer\Products\B2FD9C0A5B9838449838816A28001F4B
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\sim-packages
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440344304436}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311301136}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{11111111-1111-1111-1111-110311301136}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220322302236}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{55555555-5555-5555-5555-550355305536}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66666666-6666-6666-6666-660366306636}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311301136}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A0C9DF2B-89B5-4483-8983-18A68200F1B4}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SweetIM Bundle by SweetPacks
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WNLT
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355305536}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366306636}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SweetIM]
Wert Gefunden : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{acaa314b-eeba-48e4-ad47-84e31c44796c}]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v21.0 (de)

Datei : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\33hsjdjr.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\djopa765.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\i62j7lnb.default\prefs.js

Gefunden : user_pref("icqtoolbar.skip_default_search", "yes");
Gefunden : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Gefunden : user_pref("browser.startup.homepage", "hxxp://start.icq.com/");
Gefunden : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?barid={2B4ACA32-D3D6-4F71-B26E-[...]
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "");
Gefunden : user_pref("icqtoolbar.installsource", "1");

Datei : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\prefs.js

Gefunden : user_pref("CT2269050.1000082.isDisplayHidden", "true");
Gefunden : user_pref("CT2269050.1000082.state", "{\"state\":\"stopped\",\"text\":\"Hotmix 108\",\"description\"[...]
Gefunden : user_pref("CT2269050.1000234.TWC_TMP_city", "KERPEN");
Gefunden : user_pref("CT2269050.1000234.TWC_TMP_country", "DE");
Gefunden : user_pref("CT2269050.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gefunden : user_pref("CT2269050.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]
Gefunden : user_pref("CT2269050.FirstTime", "true");
Gefunden : user_pref("CT2269050.FirstTimeFF3", "true");
Gefunden : user_pref("CT2269050.LoginRevertSettingsEnabled", true);
Gefunden : user_pref("CT2269050.RevertSettingsEnabled", true);
Gefunden : user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT226[...]
Gefunden : user_pref("CT2269050.UserID", "UN77740425072873854");
Gefunden : user_pref("CT2269050.addressBarTakeOverEnabledInHidden", "true");
Gefunden : user_pref("CT2269050.autoDisableScopes", -1);
Gefunden : user_pref("CT2269050.browser.search.defaultthis.engineName", true);
Gefunden : user_pref("CT2269050.cbfirsttime.enc", "VHVlIERlYyAxOCAyMDEyIDE4OjA1OjU1IEdNVCswMTAw");
Gefunden : user_pref("CT2269050.defaultSearch", "true");
Gefunden : user_pref("CT2269050.enableAlerts", "false");
Gefunden : user_pref("CT2269050.enableFix404ByUser", "TRUE");
Gefunden : user_pref("CT2269050.enableSearchFromAddressBar", "true");
Gefunden : user_pref("CT2269050.firstTimeDialogOpened", "true");
Gefunden : user_pref("CT2269050.fixPageNotFoundError", "true");
Gefunden : user_pref("CT2269050.fixPageNotFoundErrorByUser", "true");
Gefunden : user_pref("CT2269050.fixPageNotFoundErrorInHidden", "true");
Gefunden : user_pref("CT2269050.fixUrls", true);
Gefunden : user_pref("CT2269050.hxxp___storage_conduit_com_marketplace_83_6d_8399d181_be98_42f2_b035_1616f61731[...]
Gefunden : user_pref("CT2269050.installId", "conduitnsisintegration");
Gefunden : user_pref("CT2269050.installType", "conduitnsisintegration");
Gefunden : user_pref("CT2269050.isCheckedStartAsHidden", true);
Gefunden : user_pref("CT2269050.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gefunden : user_pref("CT2269050.isFirstTimeToolbarLoading", "false");
Gefunden : user_pref("CT2269050.isNewTabEnabled", true);
Gefunden : user_pref("CT2269050.isPerformedSmartBarTransition", "true");
Gefunden : user_pref("CT2269050.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Gefunden : user_pref("CT2269050.keyword", true);
Gefunden : user_pref("CT2269050.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...]
Gefunden : user_pref("CT2269050.lastVersion", "10.16.2.509");
Gefunden : user_pref("CT2269050.migrateAppsAndComponents", true);
Gefunden : user_pref("CT2269050.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxps[...]
Gefunden : user_pref("CT2269050.openThankYouPage", "false");
Gefunden : user_pref("CT2269050.openUninstallPage", "true");
Gefunden : user_pref("CT2269050.originalSearchAddressUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT22[...]
Gefunden : user_pref("CT2269050.price-gong.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\[...]
Gefunden : user_pref("CT2269050.revertSettingsEnabled", "false");
Gefunden : user_pref("CT2269050.search.searchAppId", "128834881989343895");
Gefunden : user_pref("CT2269050.search.searchCount", "0");
Gefunden : user_pref("CT2269050.searchInNewTabEnabledByUser", "true");
Gefunden : user_pref("CT2269050.searchInNewTabEnabledInHidden", "true");
Gefunden : user_pref("CT2269050.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gefunden : user_pref("CT2269050.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]
Gefunden : user_pref("CT2269050.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]
Gefunden : user_pref("CT2269050.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]
Gefunden : user_pref("CT2269050.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]
Gefunden : user_pref("CT2269050.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]
Gefunden : user_pref("CT2269050.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]
Gefunden : user_pref("CT2269050.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1355850346732");
Gefunden : user_pref("CT2269050.serviceLayer_services_appsMetadata_lastUpdate", "1355850346431");
Gefunden : user_pref("CT2269050.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1355850352270");
Gefunden : user_pref("CT2269050.serviceLayer_services_location_lastUpdate", "1370124189661");
Gefunden : user_pref("CT2269050.serviceLayer_services_login_10.13.40.15_lastUpdate", "1358190970637");
Gefunden : user_pref("CT2269050.serviceLayer_services_login_10.14.40.128_lastUpdate", "1359318191108");
Gefunden : user_pref("CT2269050.serviceLayer_services_login_10.14.42.7_lastUpdate", "1359494559672");
Gefunden : user_pref("CT2269050.serviceLayer_services_login_10.14.65.43_lastUpdate", "1370037789876");
Gefunden : user_pref("CT2269050.serviceLayer_services_login_10.16.2.509_lastUpdate", "1370122639071");
Gefunden : user_pref("CT2269050.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1355850352492");
Gefunden : user_pref("CT2269050.serviceLayer_services_searchAPI_lastUpdate", "1355850345810");
Gefunden : user_pref("CT2269050.serviceLayer_services_serviceMap_lastUpdate", "1370124189608");
Gefunden : user_pref("CT2269050.serviceLayer_services_toolbarContextMenu_lastUpdate", "1355850352230");
Gefunden : user_pref("CT2269050.serviceLayer_services_toolbarSettings_lastUpdate", "1370129838290");
Gefunden : user_pref("CT2269050.serviceLayer_services_translation_lastUpdate", "1370124189666");
Gefunden : user_pref("CT2269050.serviceLayer_services_userApps_lastUpdate", "1355850461425");
Gefunden : user_pref("CT2269050.settingsINI", true);
Gefunden : user_pref("CT2269050.shouldFirstTimeDialog", "false");
Gefunden : user_pref("CT2269050.showToolbarPermission", "false");
Gefunden : user_pref("CT2269050.smartbar.CTID", "CT2269050");
Gefunden : user_pref("CT2269050.smartbar.Uninstall", "0");
Gefunden : user_pref("CT2269050.smartbar.homepage", true);
Gefunden : user_pref("CT2269050.smartbar.isHidden", true);
Gefunden : user_pref("CT2269050.smartbar.toolbarName", "DVDVideoSoftTB ");
Gefunden : user_pref("CT2269050.startPage", "userChanged");
Gefunden : user_pref("CT2269050.toolbarBornServerTime", "18-12-2012");
Gefunden : user_pref("CT2269050.toolbarCurrentServerTime", "2-6-2013");
Gefunden : user_pref("CT2269050.toolbarLoginClientTime", "Sat Jun 01 2013 01:10:15 GMT+0200");
Gefunden : user_pref("CT2269050_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]
Gefunden : user_pref("CT3242337.1000082.isDisplayHidden", "true");
Gefunden : user_pref("CT3242337.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]
Gefunden : user_pref("CT3242337.1000234.TWC_TMP_city", "KERPEN");
Gefunden : user_pref("CT3242337.1000234.TWC_TMP_country", "DE");
Gefunden : user_pref("CT3242337.1000234.TWC_locId", "GMXX5292");
Gefunden : user_pref("CT3242337.1000234.TWC_location", "Kerpen, Deutschland");
Gefunden : user_pref("CT3242337.1000234.TWC_region", "DE");
Gefunden : user_pref("CT3242337.1000234.TWC_temp_dis", "c");
Gefunden : user_pref("CT3242337.1000234.TWC_wind_dis", "kmh");
Gefunden : user_pref("CT3242337.1000234.weatherData", "{\"icon\":\"26.png\",\"temperature\":\"-2°C\",\"temperat[...]
Gefunden : user_pref("CT3242337.CBOpenMAMSettings.enc", "MA==");
Gefunden : user_pref("CT3242337.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gefunden : user_pref("CT3242337.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]
Gefunden : user_pref("CT3242337.FirstTime", "true");
Gefunden : user_pref("CT3242337.FirstTimeFF3", "true");
Gefunden : user_pref("CT3242337.LoginRevertSettingsEnabled", true);
Gefunden : user_pref("CT3242337.RevertSettingsEnabled", true);
Gefunden : user_pref("CT3242337.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT324[...]
Gefunden : user_pref("CT3242337.UserID", "UN24214975076759226");
Gefunden : user_pref("CT3242337.addressBarTakeOverEnabledInHidden", "true");
Gefunden : user_pref("CT3242337.browser.search.defaultthis.engineName", true);
Gefunden : user_pref("CT3242337.cbcountry_001.enc", "REU=");
Gefunden : user_pref("CT3242337.cbfirsttime.enc", "RnJpIERlYyAwNyAyMDEyIDIzOjU1OjQ1IEdNVCswMTAw");
Gefunden : user_pref("CT3242337.enableAlerts", "always");
Gefunden : user_pref("CT3242337.enableFix404ByUser", "FALSE");
Gefunden : user_pref("CT3242337.event_data.enc", "JTVCJTVE");
Gefunden : user_pref("CT3242337.fired_events.enc", "AA==");
Gefunden : user_pref("CT3242337.firstTimeDialogOpened", "true");
Gefunden : user_pref("CT3242337.fixPageNotFoundErrorByUser", "TRUE");
Gefunden : user_pref("CT3242337.fixPageNotFoundErrorInHidden", "true");
Gefunden : user_pref("CT3242337.fixUrls", true);
Gefunden : user_pref("CT3242337.installType", "Unknown");
Gefunden : user_pref("CT3242337.isCheckedStartAsHidden", true);
Gefunden : user_pref("CT3242337.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gefunden : user_pref("CT3242337.isFirstTimeToolbarLoading", "false");
Gefunden : user_pref("CT3242337.isNewTabEnabled", true);
Gefunden : user_pref("CT3242337.isPerformedSmartBarTransition", "true");
Gefunden : user_pref("CT3242337.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Gefunden : user_pref("CT3242337.isWelcomPage", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Gefunden : user_pref("CT3242337.key_date.enc", "Nw==");
Gefunden : user_pref("CT3242337.keyword", true);
Gefunden : user_pref("CT3242337.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...]
Gefunden : user_pref("CT3242337.lastVersion", "10.15.2.523");
Gefunden : user_pref("CT3242337.migrateAppsAndComponents", true);
Gefunden : user_pref("CT3242337.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxps%3A%2F%2Fwww.facebook.co[...]
Gefunden : user_pref("CT3242337.price-gong.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\[...]
Gefunden : user_pref("CT3242337.search.searchAppId", "129888260050636624");
Gefunden : user_pref("CT3242337.search.searchCount", "0");
Gefunden : user_pref("CT3242337.searchInNewTabEnabledByUser", "true");
Gefunden : user_pref("CT3242337.searchInNewTabEnabledInHidden", "true");
Gefunden : user_pref("CT3242337.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gefunden : user_pref("CT3242337.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]
Gefunden : user_pref("CT3242337.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]
Gefunden : user_pref("CT3242337.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]
Gefunden : user_pref("CT3242337.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]
Gefunden : user_pref("CT3242337.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]
Gefunden : user_pref("CT3242337.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]
Gefunden : user_pref("CT3242337.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1354920942380");
Gefunden : user_pref("CT3242337.serviceLayer_services_appsMetadata_lastUpdate", "1354920941883");
Gefunden : user_pref("CT3242337.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1354920942194");
Gefunden : user_pref("CT3242337.serviceLayer_services_location_lastUpdate", "1370124189626");
Gefunden : user_pref("CT3242337.serviceLayer_services_login_10.13.40.15_lastUpdate", "1358190970373");
Gefunden : user_pref("CT3242337.serviceLayer_services_login_10.14.40.128_lastUpdate", "1359318190684");
Gefunden : user_pref("CT3242337.serviceLayer_services_login_10.14.42.7_lastUpdate", "1359398736594");
Gefunden : user_pref("CT3242337.serviceLayer_services_login_10.14.65.43_lastUpdate", "1370037789847");
Gefunden : user_pref("CT3242337.serviceLayer_services_login_10.15.2.523_lastUpdate", "1370122638869");
Gefunden : user_pref("CT3242337.serviceLayer_services_menu_769c590835a76d075fe33b9a87a87786_lastUpdate", "13549[...]
Gefunden : user_pref("CT3242337.serviceLayer_services_menu_d32f45618f5a02bd965c56155a643855_lastUpdate", "13549[...]
Gefunden : user_pref("CT3242337.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1354920942223");
Gefunden : user_pref("CT3242337.serviceLayer_services_searchAPI_lastUpdate", "1354920941663");
Gefunden : user_pref("CT3242337.serviceLayer_services_serviceMap_lastUpdate", "1370124189539");
Gefunden : user_pref("CT3242337.serviceLayer_services_toolbarContextMenu_lastUpdate", "1354920942061");
Gefunden : user_pref("CT3242337.serviceLayer_services_toolbarSettings_lastUpdate", "1370129838006");
Gefunden : user_pref("CT3242337.serviceLayer_services_translation_lastUpdate", "1370124189926");
Gefunden : user_pref("CT3242337.serviceLayer_services_userApps_lastUpdate", "1354920990378");
Gefunden : user_pref("CT3242337.settingsINI", true);
Gefunden : user_pref("CT3242337.showToolbarPermission", "false");
Gefunden : user_pref("CT3242337.smartbar.CTID", "CT3242337");
Gefunden : user_pref("CT3242337.smartbar.Uninstall", "0");
Gefunden : user_pref("CT3242337.smartbar.homepage", true);
Gefunden : user_pref("CT3242337.smartbar.isHidden", true);
Gefunden : user_pref("CT3242337.smartbar.toolbarName", "WiseConvert 1.3 ");
Gefunden : user_pref("CT3242337.startPage", "userChanged");
Gefunden : user_pref("CT3242337.toolbarBornServerTime", "8-12-2012");
Gefunden : user_pref("CT3242337.toolbarCurrentServerTime", "2-6-2013");
Gefunden : user_pref("CT3242337.toolbarLoginClientTime", "Sat Jun 01 2013 01:10:15 GMT+0200");
Gefunden : user_pref("CT3242337.url_history0001.enc", "aHR0cDovL2xlZXRoYXgubmV0L2V4dGVuc2lvbi86OjpjbGlja2hhbmRs[...]
Gefunden : user_pref("CT3242337_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]
Gefunden : user_pref("Smartbar.ConduitHomepagesList", "");
Gefunden : user_pref("Smartbar.ConduitSearchEngineList", "");
Gefunden : user_pref("Smartbar.ConduitSearchUrlList", "");
Gefunden : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://search.etoolkit.com/search?t=ff&&id=02644[...]
Gefunden : user_pref("Smartbar.keywordURLSelectedCTID", "CT2269050");
Gefunden : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Gefunden : user_pref("browser.search.defaultengine", "Ask.com");
Gefunden : user_pref("browser.search.defaultenginename", "SweetIM Search");
Gefunden : user_pref("browser.search.order.1", "Ask.com");
Gefunden : user_pref("browser.search.selectedEngineInDialog", "Web Search (eToolKit)");
Gefunden : user_pref("browser.startup.homepage", "hxxp://home.sweetim.com/?barid={0F79B879-CA3F-11E2-AEFE-10BF4[...]
Gefunden : user_pref("extensions.BabylonToolbar_i.newTab", true);
Gefunden : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?AF=109980&babsrc=NT_s[...]
Gefunden : user_pref("extensions.a4fdacf00e9c44ad5b4cfbf9800f184f63685711674e04973936f860cd2a102a9com33036.3303[...]
Gefunden : user_pref("extensions.a4fdacf00e9c44ad5b4cfbf9800f184f63685711674e04973936f860cd2a102a9com33036.3303[...]
Gefunden : user_pref("extensions.asktb.FeaturePageVersion", "1");
Gefunden : user_pref("extensions.asktb.InstallDir", "C:\\Program Files (x86)\\Ask.com\\");
Gefunden : user_pref("extensions.asktb.OOBEVersion", "1");
Gefunden : user_pref("extensions.asktb.apn_dbr", "ff_17.0.1");
Gefunden : user_pref("extensions.asktb.autofill-text-highlight-enabled", true);
Gefunden : user_pref("extensions.asktb.cbid", "^AGY");
Gefunden : user_pref("extensions.asktb.config-updated", true);
Gefunden : user_pref("extensions.asktb.cr-o", "APN10267");
Gefunden : user_pref("extensions.asktb.crumb", "2012.12.17+02.57.32-toolbar010iad-NL-QW1zdGVyZGFtLE5ldGhlcmxhbm[...]
Gefunden : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://avira-int.ask.com/web?q={query}&qsrc=[...]
Gefunden : user_pref("extensions.asktb.domain", "avira-int.ask.com");
Gefunden : user_pref("extensions.asktb.domainName", "avira-int.ask.com");
Gefunden : user_pref("extensions.asktb.dtid", "^YYYYYY^YY^NL");
Gefunden : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://search.conduit.com/ResultsExt.aspx?cti[...]
Gefunden : user_pref("extensions.asktb.first-restart-after-config-update", true);
Gefunden : user_pref("extensions.asktb.fresh-install", false);
Gefunden : user_pref("extensions.asktb.guid", "486f95c9-01c4-429d-b9ce-bb4b08759a05");
Gefunden : user_pref("extensions.asktb.hpr", "YES");
Gefunden : user_pref("extensions.asktb.hxxp-header-whitelist-hosts", "[\"static-dev.en.dev.ask.com\", \"ask.com[...]
Gefunden : user_pref("extensions.asktb.if", "first");
Gefunden : user_pref("extensions.asktb.keyword-toggled-in-session", true);
Gefunden : user_pref("extensions.asktb.l", "dis");
Gefunden : user_pref("extensions.asktb.last-config-req", "1360871732456");
Gefunden : user_pref("extensions.asktb.locale", "de_NL");
Gefunden : user_pref("extensions.asktb.localePref", true);
Gefunden : user_pref("extensions.asktb.location", "Amsterdam,Netherlands");
Gefunden : user_pref("extensions.asktb.new-tab-opt-out", true);
Gefunden : user_pref("extensions.asktb.o", "APN10267");
Gefunden : user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
Gefunden : user_pref("extensions.asktb.qsrc", "2871");
Gefunden : user_pref("extensions.asktb.r", "19");
Gefunden : user_pref("extensions.asktb.sa", "YES");
Gefunden : user_pref("extensions.asktb.saguid", "4B5CE601-6696-47A1-A513-A40A53400FDD");
Gefunden : user_pref("extensions.asktb.search-suggestions-enabled", true);
Gefunden : user_pref("extensions.asktb.silent-upgrade", true);
Gefunden : user_pref("extensions.asktb.silent-upgrade-from-pre-newtabs-build", false);
Gefunden : user_pref("extensions.asktb.socialmini-first", true);
Gefunden : user_pref("extensions.asktb.socialmini-interval", "1200000");
Gefunden : user_pref("extensions.asktb.socialmini-max-char-ticker", "33");
Gefunden : user_pref("extensions.asktb.socialmini-max-items", "30");
Gefunden : user_pref("extensions.asktb.socialmini-native-on", true);
Gefunden : user_pref("extensions.asktb.socialmini-speed", "5000");
Gefunden : user_pref("extensions.asktb.themeid", "");
Gefunden : user_pref("extensions.asktb.timeinstalled", "17.12.2012 17:01:25");
Gefunden : user_pref("extensions.asktb.to", "");
Gefunden : user_pref("extensions.asktb.v", "3.15.13.100015");
Gefunden : user_pref("extensions.asktb.version", "5.15.13.33021");
Gefunden : user_pref("extensions.enabledAddons", "testpilot%40labs.mozilla.com:1.2.2,yslow%40yahoo-inc.com:3.1.[...]
Gefunden : user_pref("extensions.ffxtlbr@funmoods.com.install-event-fired", true);
Gefunden : user_pref("extensions.ffxtlbr@incredibar.com.install-event-fired", true);
Gefunden : user_pref("extensions.funmoods_i.aflt", "make");
Gefunden : user_pref("extensions.funmoods_i.dfltLng", "");
Gefunden : user_pref("extensions.funmoods_i.dfltSrch", true);
Gefunden : user_pref("extensions.funmoods_i.dnsErr", true);
Gefunden : user_pref("extensions.funmoods_i.excTlbr", false);
Gefunden : user_pref("extensions.funmoods_i.hmpg", true);
Gefunden : user_pref("extensions.funmoods_i.hmpgUrl", "hxxp://start.funmoods.com/?f=1&a=make");
Gefunden : user_pref("extensions.funmoods_i.id", "be2b7cf300000000000000012929be58");
Gefunden : user_pref("extensions.funmoods_i.instlDay", "15455");
Gefunden : user_pref("extensions.funmoods_i.instlRef", "");
Gefunden : user_pref("extensions.funmoods_i.newTab", true);
Gefunden : user_pref("extensions.funmoods_i.newTabUrl", "hxxp://start.funmoods.com/?f=2&a=make");
Gefunden : user_pref("extensions.funmoods_i.prdct", "funmoods");
Gefunden : user_pref("extensions.funmoods_i.prtnrId", "funmoods");
Gefunden : user_pref("extensions.funmoods_i.smplGrp", "none");
Gefunden : user_pref("extensions.funmoods_i.srchPrvdr", "Search");
Gefunden : user_pref("extensions.funmoods_i.tlbrId", "base");
Gefunden : user_pref("extensions.funmoods_i.tlbrSrchUrl", "hxxp://start.funmoods.com/results.php?f=3&a=make&q="[...]
Gefunden : user_pref("extensions.funmoods_i.vrsn", "1.5.11.16");
Gefunden : user_pref("extensions.funmoods_i.vrsnTs", "1.5.11.160:36:38");
Gefunden : user_pref("extensions.funmoods_i.vrsni", "1.5.11.16");
Gefunden : user_pref("extensions.toolbar@ask.com.install-event-fired", true);
Gefunden : user_pref("icqtoolbar.allowSendURL", false);
Gefunden : user_pref("icqtoolbar.defSearchChange", true);
Gefunden : user_pref("icqtoolbar.engineVerified", false);
Gefunden : user_pref("icqtoolbar.geolastmodified", 1314213124);
Gefunden : user_pref("icqtoolbar.hiddenElements", "itb_options");
Gefunden : user_pref("icqtoolbar.history", "Kuh-Steaks||hxxp%3A%2F%2Fwww.google.de%2Fsearch%3Fq%3Dgebratenes%2B[...]
Gefunden : user_pref("icqtoolbar.hpChange", true);
Gefunden : user_pref("icqtoolbar.icqgeo", 49);
Gefunden : user_pref("icqtoolbar.installTime", "1313901807");
Gefunden : user_pref("icqtoolbar.installsource", "1");
Gefunden : user_pref("icqtoolbar.newtab_state", "1");
Gefunden : user_pref("icqtoolbar.numberOfSearches", 0);
Gefunden : user_pref("icqtoolbar.previousFFVersion", "6.0");
Gefunden : user_pref("icqtoolbar.skip_default_search", "yes");
Gefunden : user_pref("icqtoolbar.suggestions", false);
Gefunden : user_pref("icqtoolbar.uninstStatSent", true);
Gefunden : user_pref("icqtoolbar.uniqueID", "130969990413097001611309820745275");
Gefunden : user_pref("icqtoolbar.usageStatstTimestamp", 1314277167);
Gefunden : user_pref("icqtoolbar.voucherHideClicks", 0);
Gefunden : user_pref("icqtoolbar.voucherMoreLinkClicks", 0);
Gefunden : user_pref("icqtoolbar.voucherRedeemClicks", 0);
Gefunden : user_pref("icqtoolbar.voucherWasShown", 0);
Gefunden : user_pref("icqtoolbar.xmlEnableHomePageDsGuard", true);
Gefunden : user_pref("icqtoolbar.xmlEnableSuggestions", false);
Gefunden : user_pref("icqtoolbar.xmlLanguage", "de");
Gefunden : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&CU[...]
Gefunden : user_pref("smartBar.searchInNewTabOwner", "CT2269050");
Gefunden : user_pref("smartbar.addressBarOwnerCTID", "CT2269050");
Gefunden : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3242337&SearchSource=13[...]
Gefunden : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]
Gefunden : user_pref("smartbar.machineId", "PB4WZU5ILPBHV37+COELFEZQ6NXAY6XDP+TCMMXABHHFUHBFOUEMBTI8SQZNW3TATFQ[...]
Gefunden : user_pref("smartbar.originalHomepage", "about:home");
Gefunden : user_pref("smartbar.originalSearchAddressUrl", "hxxp://search.etoolkit.com/search?t=ff&&id=02644a4fa[...]
Gefunden : user_pref("smartbar.originalSearchEngine", "Google");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "Google");
Gefunden : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "about:home");
Gefunden : user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]
Gefunden : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?ptr=100&crg=3.1010000.10011&bar[...]

Datei : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\nygg9wvg.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\o0ul7s80.default\prefs.js

Gefunden : user_pref("icqtoolbar.installsource", "1");
Gefunden : user_pref("icqtoolbar.installsource", "1");
Gefunden : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://start.icq.com/");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "ICQ Search");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "");
Gefunden : user_pref("browser.startup.homepage", "hxxp://start.icq.com/");
Gefunden : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?barid={2B4ACA32-D3D6-4F71-B26E-[...]
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "");
Gefunden : user_pref("icqtoolbar.installsource", "1");

-\\ Opera v [Version kann nicht ermittelt werden]

Datei : C:\Users\Maraxos\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [36180 octets] - [02/06/2013 20:09:06]

########## EOF - C:\AdwCleaner[R1].txt - [36241 octets] ##########
Ich bin dann auf den Button löschen und er hat alles gelöscht und den PC neugestartet.
dann habe ich ein neuen Scan gemacht dann hat er das ausgespuckt:

"AdwCleaner Log2"

Code:
ATTFilter
# AdwCleaner v2.301 - Datei am 02/06/2013 um 20:23:34 erstellt
# Aktualisiert am 16/05/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Maraxos - MARAXOS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Maraxos\Downloads\adwcleaner_2.3.0.1.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gefunden : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\jetpack

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\WNLT

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v21.0 (de)

Datei : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\33hsjdjr.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\djopa765.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\i62j7lnb.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\jjy2tojg.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\nygg9wvg.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Maraxos\AppData\Roaming\Mozilla\Firefox\Profiles\o0ul7s80.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Opera v [Version kann nicht ermittelt werden]

Datei : C:\Users\Maraxos\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [36303 octets] - [02/06/2013 20:09:06]
AdwCleaner[R2].txt - [1723 octets] - [02/06/2013 20:23:34]
AdwCleaner[S1].txt - [36478 octets] - [02/06/2013 20:11:45]

########## EOF - C:\AdwCleaner[R2].txt - [1844 octets] ##########
Was ist diese Pud.Braininstall Datei? und wie werde ich den Mist los wenn noch mehr drauf ist?

Wenn die Frage kommen Sollte, Ja ich habe Mbam und Avira Gekauft

Alt 02.06.2013, 22:04   #2
schrauber
/// the machine
/// TB-Ausbilder
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


Hi,

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden ).
  • Doppelklick auf die OTL.exe
  • Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Minimal Ausgabe
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.
__________________

__________________
Alt 02.06.2013, 22:20   #3
Maraxos
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


Ich habe den Scan ausgeführt, die Extra Logs sind im anhang.

Ich kann die OTL.txt nicht posten oder anhängen da sie zu groß ist, ich kann sie auf mein Server hochladen und hier posten wenn das ok ist?

Ich hoffe ich habe nichts falsch gemacht, das ich das erste mal das ich ein Virus habe. Ich arbeite mit Computern seit dem ich 6 Jahre alt bin, und hatte bis gestern noch nie ein virus gehabt.

Den ich baue mir selber meine Rechner zusammen und Richte diese dann auf meine bedürfnisse ein und hatte noch nie Probleme mit Viren bis auf gestern.
Ich mache einiges mit den Computer, sei es Grafik Design oder Spiele spielen
__________________
Alt 02.06.2013, 22:21   #4
schrauber
/// the machine
/// TB-Ausbilder
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


teile sie in 2 Hälften und poste sie bitte hier in Codetags
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 02.06.2013, 22:25   #5
Maraxos
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


Erste Hälfte:
Code:
ATTFilter
OTL logfile created on: 02.06.2013 23:07:46 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Maraxos\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
15,95 Gb Total Physical Memory | 13,26 Gb Available Physical Memory | 83,16% Memory free
31,89 Gb Paging File | 28,94 Gb Available in Paging File | 90,74% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 389,15 Gb Free Space | 83,57% Space Free | Partition Type: NTFS
Drive D: | 333,86 Gb Total Space | 333,76 Gb Free Space | 99,97% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 461,87 Gb Free Space | 99,16% Space Free | Partition Type: NTFS
Drive F: | 597,65 Gb Total Space | 597,55 Gb Free Space | 99,98% Space Free | Partition Type: NTFS
Drive G: | 265,59 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive I: | 931,51 Gb Total Space | 636,02 Gb Free Space | 68,28% Space Free | Partition Type: NTFS
Drive J: | 1,96 Gb Total Space | 0,73 Gb Free Space | 37,09% Space Free | Partition Type: FAT
 
Computer Name: MARAXOS-PC | User Name: Maraxos | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Maraxos\Desktop\OTL(1).exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe ()
PRC - C:\Users\Maraxos\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)
PRC - E:\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe (Adobe Systems, Inc.)
PRC - E:\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe (TeamViewer GmbH)
PRC - E:\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - E:\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - E:\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Users\Maraxos\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - E:\Moborobo\MoboroboDeviceService.exe ()
PRC - C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
PRC - C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (ABBYY)
PRC - C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe (SEIKO EPSON CORPORATION)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
MOD - E:\Mozilla Firefox\mozjs.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (EpsonScanSvc) -- C:\Windows\SysNative\escsvc64.exe (Seiko Epson Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (HOSTS Anti-PUPs) -- C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe ()
SRV - (AntiVirFirewallService) -- E:\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- E:\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirMailService) -- E:\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- E:\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirSchedulerService) -- E:\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (TeamViewer8) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (MBAMService) -- E:\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- E:\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (MoboroboDeviceService) -- E:\Moborobo\MoboroboDeviceService.exe ()
SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose64) -- C:\Programme\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ABBYY.Licensing.FineReader.Sprint.9.0) -- C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (ABBYY)
SRV - (EpsonBidirectionalService) -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe (SEIKO EPSON CORPORATION)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (avfwot) -- C:\Windows\SysNative\drivers\avfwot.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avfwim) -- C:\Windows\SysNative\drivers\avfwim.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (asmtxhci) -- C:\Windows\SysNative\drivers\asmtxhci.sys (ASMedia Technology Inc)
DRV:64bit: - (asmthub3) -- C:\Windows\SysNative\drivers\asmthub3.sys (ASMedia Technology Inc)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (JRAID) -- C:\Windows\SysNative\drivers\jraid.sys (JMicron Technology Corp.)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (AODDriver4.2) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 9F FE FD C6 36 5E CE 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: E:\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: E:\Mozilla Firefox\plugins
 
[2013.05.31 21:42:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Extensions
[2013.05.31 23:56:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\extensions
[2013.05.31 23:56:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\extensions\extensions
[2013.05.31 23:56:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\01k9v22g.default\extensions
[2013.05.31 23:56:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\djopa765.default\extensions
[2013.05.31 23:56:25 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\djopa765.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2013.05.31 23:56:25 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\extensions\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2013.06.02 20:11:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\i62j7lnb.default\extensions
[2013.05.31 23:56:26 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\i62j7lnb.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2013.05.31 23:56:25 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\i62j7lnb.default\extensions\mail@gutscheinrausch.de
[2013.06.02 20:45:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\jjy2tojg.default\extensions
[2013.06.01 00:49:43 | 000,000,000 | ---D | M] ("Plus-HD-2.2") -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\jjy2tojg.default\extensions\4fdacf00-e9c4-4ad5-b4cf-bf9800f184f6@36857116-74e0-4973-936f-860cd2a102a9.com
[2013.06.01 00:14:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\jjy2tojg.default\extensions\4fdacf00-e9c4-4ad5-b4cf-bf9800f184f6@36857116-74e0-4973-936f-860cd2a102a9.com\chrome\content\extensionCode
[2013.05.31 23:56:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\nygg9wvg.default\extensions
[2013.05.31 23:56:40 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\nygg9wvg.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2013.06.02 20:11:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\o0ul7s80.default\extensions
[2013.05.31 23:56:41 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\o0ul7s80.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2013.05.31 23:56:41 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\o0ul7s80.default\extensions\mail@gutscheinrausch.de
[2013.05.31 23:56:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\SeaMonkey\Profiles\bi46rvla.default\extensions
[2012.12.05 03:17:21 | 000,573,138 | ---- | M] () (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\firefox\profiles\01k9v22g.default\extensions\testpilot@labs.mozilla.com.xpi
[2013.06.02 17:03:25 | 000,004,503 | ---- | M] () (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\firefox\profiles\jjy2tojg.default\extensions\youtubeunblocker@unblocker.yt.xpi
[2013.01.18 19:25:10 | 000,200,692 | ---- | M] () (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\firefox\profiles\jjy2tojg.default\extensions\yslow@yahoo-inc.com.xpi
[2013.06.01 00:14:52 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\firefox\profiles\jjy2tojg.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.07.18 02:09:15 | 001,184,804 | ---- | M] () (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\firefox\profiles\nygg9wvg.default\extensions\testpilot@labs.mozilla.com.xpi
 
O1 HOSTS File: ([2013.06.02 22:27:16 | 000,104,224 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 00aaf101a7.gougava.asia # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 08sr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 1a2e115593.efacen.pro # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 1f1.fr # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 1facebookhackeronline.blogspot.no # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2010-fr.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2012-new.biz # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 24h00business.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 33black.porn-quest.net # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 4672ee0bc8.laibritec.waw.pl # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 4990usd.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 4xp.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 74.80.131.123 # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 78031d2298.tradorad.waw.pl # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 80323fcc6e.starsogor.waw.pl # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 888.rahon.org # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 8e47c22037.temavi.pro # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 94eb028571.eimeefiewe.pisz.pl # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 96910cbcd4.nicero.pro # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 96fb625592.tysofque.waw.pl:82 # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 98eu.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ack.cdnperformance.info # hosts anti-adware / pups
O1 - Hosts: 1800 more lines...
O2:64bit: - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] E:\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [EEventManager] C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [HOSTS Anti-Adware_PUPs] C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe ()
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [EPLTarget\P0000000000000000] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIME.EXE /EPT "EPLTarget\P0000000000000000" /M "XP-202 203 206 Series" File not found
O4 - HKCU..\Run: [uTorrent] C:\Users\Maraxos\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)
O4 - Startup: C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Maraxos\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: An OneNote s&enden - res://E:\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://E:\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://E:\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://E:\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - Reg Error: Key error. File not found
O9:64bit: - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - Reg Error: Key error. File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - E:\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - E:\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - E:\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - E:\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - E:\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - E:\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - E:\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - E:\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - E:\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - E:\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.3.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1917A94B-9634-4FB6-97F4-73238D08E4CA}: DhcpNameServer = 192.168.3.1
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.12.21 02:00:00 | 000,000,033 | R--- | M] () - G:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.06.02 23:05:11 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Maraxos\Desktop\OTL(1).exe
[2013.06.02 22:33:51 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Maraxos\Desktop\OTL.exe
[2013.06.02 22:27:16 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.06.02 22:20:08 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.06.02 22:20:08 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.06.02 22:20:08 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.06.02 22:20:05 | 000,000,000 | --SD | C] -- C:\ComboFix
[2013.06.02 22:20:02 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.06.02 22:19:51 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.06.02 20:24:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs
[2013.06.02 17:01:39 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Epson
[2013.06.02 03:49:13 | 000,054,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdfLdr.sys
[2013.06.02 03:49:13 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wdfres.dll
[2013.06.02 03:40:20 | 001,054,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013.06.02 03:40:20 | 000,719,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2013.06.02 03:40:20 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.06.02 03:40:20 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.06.02 03:40:20 | 000,226,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll
[2013.06.02 03:40:20 | 000,185,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll
[2013.06.02 03:40:20 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2013.06.02 03:40:20 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe
[2013.06.02 03:40:20 | 000,138,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe
[2013.06.02 03:40:20 | 000,137,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.06.02 03:40:20 | 000,125,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2013.06.02 03:40:20 | 000,117,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2013.06.02 03:40:20 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll
[2013.06.02 03:40:20 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.06.02 03:40:20 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2013.06.02 03:40:20 | 000,079,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.06.02 03:40:20 | 000,073,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013.06.02 03:40:20 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.06.02 03:40:20 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll
[2013.06.02 03:40:20 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll
[2013.06.02 03:40:20 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2013.06.02 03:40:19 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.06.02 03:40:19 | 001,509,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.06.02 03:40:19 | 001,441,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.06.02 03:40:19 | 001,400,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat
[2013.06.02 03:40:19 | 001,400,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat
[2013.06.02 03:40:19 | 000,905,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2013.06.02 03:40:19 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.06.02 03:40:19 | 000,762,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2013.06.02 03:40:19 | 000,629,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2013.06.02 03:40:19 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.06.02 03:40:19 | 000,599,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.06.02 03:40:19 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.06.02 03:40:19 | 000,452,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2013.06.02 03:40:19 | 000,441,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2013.06.02 03:40:19 | 000,361,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2013.06.02 03:40:19 | 000,281,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2013.06.02 03:40:19 | 000,235,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.06.02 03:40:19 | 000,232,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.06.02 03:40:19 | 000,216,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll
[2013.06.02 03:40:19 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2013.06.02 03:40:19 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.06.02 03:40:19 | 000,167,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe
[2013.06.02 03:40:19 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2013.06.02 03:40:19 | 000,144,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe
[2013.06.02 03:40:19 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.06.02 03:40:19 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2013.06.02 03:40:19 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll
[2013.06.02 03:40:19 | 000,102,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2013.06.02 03:40:19 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.06.02 03:40:19 | 000,092,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2013.06.02 03:40:19 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.06.02 03:40:19 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll
[2013.06.02 03:40:19 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2013.06.02 03:40:19 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll
[2013.06.02 03:40:19 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013.06.02 03:40:19 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll
[2013.06.02 03:40:19 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2013.06.02 03:40:19 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.06.02 03:40:19 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013.06.02 03:40:19 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll
[2013.06.02 03:40:19 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll
[2013.06.02 03:40:19 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013.06.02 03:40:19 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.06.02 03:40:19 | 000,027,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2013.06.02 03:40:19 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2013.06.02 03:40:19 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe
[2013.06.02 03:40:19 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2013.06.02 03:35:53 | 003,928,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll
[2013.06.02 03:35:53 | 002,776,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll
[2013.06.02 03:35:53 | 002,565,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll
[2013.06.02 03:35:53 | 002,284,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2013.06.02 03:35:53 | 001,682,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll
[2013.06.02 03:35:53 | 001,158,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll
[2013.06.02 03:35:53 | 000,522,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll
[2013.06.02 03:35:53 | 000,465,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll
[2013.06.02 03:35:53 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll
[2013.06.02 03:35:53 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll
[2013.06.02 03:35:53 | 000,363,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll
[2013.06.02 03:35:53 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.06.02 03:35:53 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.06.02 03:35:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.06.02 03:35:53 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.06.02 03:35:52 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013.06.02 03:35:52 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2013.06.02 03:35:52 | 001,504,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013.06.02 03:35:52 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013.06.02 03:35:52 | 001,238,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll
[2013.06.02 03:35:52 | 000,648,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2013.06.02 03:35:52 | 000,333,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll
[2013.06.02 03:35:52 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll
[2013.06.02 03:35:52 | 000,245,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll
[2013.06.02 03:35:52 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll
[2013.06.02 03:35:52 | 000,194,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2013.06.02 03:35:52 | 000,187,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll
[2013.06.02 03:27:40 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe
[2013.06.02 03:15:24 | 000,367,616 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll
[2013.06.02 03:15:24 | 000,295,424 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll
[2013.06.02 03:15:24 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\fontsub.dll
[2013.06.02 03:15:24 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\fontsub.dll
[2013.06.02 03:15:24 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll
[2013.06.02 03:15:24 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll
[2013.06.02 03:14:45 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFx.dll
[2013.06.02 03:14:45 | 000,229,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFHost.exe
[2013.06.02 03:14:45 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFPlatform.dll
[2013.06.02 03:14:45 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFCoinstaller.dll
[2013.06.02 03:13:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2013.06.02 03:13:01 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2013.06.02 03:13:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2013.06.02 03:10:56 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll
[2013.06.02 03:10:56 | 000,023,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\fs_rec.sys
[2013.06.02 03:07:26 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.06.02 02:20:42 | 000,135,168 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EEBAPI.dll
[2013.06.02 02:20:42 | 000,110,592 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EEBDSCVR.dll
[2013.06.02 02:20:42 | 000,077,824 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EBAPI.dll
[2013.06.02 02:20:42 | 000,065,536 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EEBUtil.dll
[2013.06.02 02:20:42 | 000,055,808 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EEBSDKIF.dll
[2013.06.02 02:20:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\EPSON
[2013.06.02 02:18:00 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\ABBYY
[2013.06.02 02:17:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ABBYY FineReader 9.0 Sprint
[2013.06.02 02:16:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ABBYY FineReader 9.0 Sprint
[2013.06.02 02:16:51 | 000,000,000 | ---D | C] -- C:\ProgramData\ABBYY
[2013.06.02 02:16:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ABBYY
[2013.06.02 02:15:18 | 000,000,000 | ---D | C] -- C:\ProgramData\UDL
[2013.06.02 02:13:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epson Software
[2013.06.02 02:12:48 | 000,558,592 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\ensppmon.dll
[2013.06.02 02:12:48 | 000,558,592 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\enppmon.dll
[2013.06.02 02:12:48 | 000,535,552 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\ensppui.dll
[2013.06.02 02:12:48 | 000,535,552 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\enppui.dll
[2013.06.02 02:12:48 | 000,219,648 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\enspres.dll
[2013.06.02 02:12:48 | 000,219,648 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\enpres.dll
[2013.06.02 02:12:48 | 000,000,000 | ---D | C] -- C:\Program Files\EpsonNet
[2013.06.02 02:12:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\EPSON
[2013.06.02 02:12:38 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EPSON Software
[2013.06.02 02:12:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EPSON Software
[2013.06.02 02:09:33 | 000,010,752 | ---- | C] (SEIKO EPSON CORP.) -- C:\Windows\SysNative\E_GCINST.DLL
[2013.06.02 02:09:32 | 000,120,320 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\E_ILMIME.DLL
[2013.06.02 02:09:32 | 000,083,968 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\E_ID4BIME.DLL
[2013.06.02 02:09:29 | 000,000,000 | ---D | C] -- C:\ProgramData\EPSON
[2013.06.02 02:09:18 | 000,466,432 | ---- | C] (Seiko Epson Corporation) -- C:\Windows\SysNative\esxw2ud.dll
[2013.06.02 02:09:18 | 000,135,824 | ---- | C] (Seiko Epson Corporation) -- C:\Windows\SysNative\escsvc64.exe
[2013.06.02 02:09:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
[2013.06.02 02:09:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\epson
[2013.06.01 03:14:58 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xmllite.dll
[2013.06.01 03:14:54 | 000,750,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2013.06.01 03:14:54 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2013.06.01 03:14:54 | 000,265,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys
[2013.06.01 03:14:54 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
[2013.06.01 03:14:53 | 000,319,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbcjt32.dll
[2013.06.01 03:14:53 | 000,212,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbctrac.dll
[2013.06.01 03:14:53 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbctrac.dll
[2013.06.01 03:14:53 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccp32.dll
[2013.06.01 03:14:53 | 000,122,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccp32.dll
[2013.06.01 03:14:53 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccu32.dll
[2013.06.01 03:14:53 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccr32.dll
[2013.06.01 03:14:53 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccu32.dll
[2013.06.01 03:14:53 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccr32.dll
[2013.06.01 03:14:42 | 000,142,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\poqexec.exe
[2013.06.01 03:14:42 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\poqexec.exe
[2013.06.01 03:14:39 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcore6.dll
[2013.06.01 03:14:39 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dhcpcore6.dll
[2013.06.01 03:14:39 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcsvc6.dll
[2013.06.01 03:14:36 | 003,717,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll
[2013.06.01 03:14:35 | 003,217,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll
[2013.06.01 03:14:35 | 000,158,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aaclient.dll
[2013.06.01 03:14:35 | 000,131,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\aaclient.dll
[2013.06.01 03:14:35 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll
[2013.06.01 03:14:35 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll
[2013.06.01 03:14:32 | 002,871,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2013.06.01 03:14:32 | 002,616,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\explorer.exe
[2013.06.01 03:14:24 | 000,961,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CPFilters.dll
[2013.06.01 03:14:23 | 001,118,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sbe.dll
[2013.06.01 03:14:23 | 000,850,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\sbe.dll
[2013.06.01 03:14:23 | 000,642,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\CPFilters.dll
[2013.06.01 03:14:23 | 000,259,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mpg2splt.ax
[2013.06.01 03:14:23 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mpg2splt.ax
[2013.06.01 03:14:20 | 001,572,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll
[2013.06.01 03:14:19 | 001,328,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll
[2013.06.01 03:14:19 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll
[2013.06.01 03:14:19 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll
[2013.06.01 03:14:18 | 002,315,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tquery.dll
[2013.06.01 03:14:17 | 002,223,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssrch.dll
[2013.06.01 03:14:17 | 001,549,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tquery.dll
[2013.06.01 03:14:17 | 001,401,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssrch.dll
[2013.06.01 03:14:17 | 000,778,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssvp.dll
[2013.06.01 03:14:17 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssvp.dll
[2013.06.01 03:14:17 | 000,491,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssph.dll
[2013.06.01 03:14:17 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssph.dll
[2013.06.01 03:14:17 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssphtb.dll
[2013.06.01 03:14:17 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SearchProtocolHost.exe
[2013.06.01 03:14:17 | 000,113,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SearchFilterHost.exe
[2013.06.01 03:14:17 | 000,075,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msscntrs.dll
[2013.06.01 03:14:17 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msscntrs.dll
[2013.06.01 03:14:15 | 000,509,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll
[2013.06.01 03:14:11 | 001,930,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll
[2013.06.01 03:14:11 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll
[2013.06.01 03:14:11 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shdocvw.dll
[2013.06.01 03:14:11 | 000,111,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe
[2013.06.01 03:14:07 | 000,395,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll
[2013.06.01 03:14:07 | 000,314,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\webio.dll
[2013.06.01 03:14:05 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wwanprotdim.dll
[2013.06.01 03:14:01 | 000,515,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\timedate.cpl
[2013.06.01 03:14:00 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl
[2013.06.01 03:13:55 | 001,359,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfc42u.dll
[2013.06.01 03:13:54 | 001,395,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfc42.dll
[2013.06.01 03:13:54 | 001,164,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc42u.dll
[2013.06.01 03:13:54 | 001,137,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc42.dll
[2013.06.01 03:13:50 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\RNDISMP.sys
[2013.06.01 03:13:48 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usb8023.sys
[2013.06.01 03:13:47 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll
[2013.06.01 03:13:47 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll
[2013.06.01 03:13:47 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe
[2013.06.01 03:13:45 | 001,447,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2013.06.01 03:13:45 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
[2013.06.01 03:13:45 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
[2013.06.01 03:13:45 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
[2013.06.01 03:13:41 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2013.06.01 03:13:41 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2013.06.01 03:13:39 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netcorehc.dll
[2013.06.01 03:13:39 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncsi.dll
[2013.06.01 03:13:39 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netcorehc.dll
[2013.06.01 03:13:39 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ncsi.dll
[2013.06.01 03:13:39 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll
[2013.06.01 03:13:39 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll
[2013.06.01 03:13:35 | 000,027,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\Diskdump.sys
[2013.06.01 03:13:34 | 000,357,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dnsapi.dll
[2013.06.01 03:13:33 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dnscacheugc.exe
[2013.06.01 03:13:33 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dnscacheugc.exe
[2013.06.01 03:13:21 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dpnet.dll
[2013.06.01 03:13:21 | 000,376,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dpnet.dll
[2013.06.01 03:13:15 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2013.06.01 03:13:15 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2013.06.01 03:13:14 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2013.06.01 03:13:14 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2013.06.01 03:13:14 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2013.06.01 03:13:14 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2013.06.01 03:13:14 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2013.06.01 03:13:13 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2013.06.01 03:13:12 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe
[2013.06.01 03:12:46 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\usp10.dll
[2013.06.01 03:12:45 | 000,376,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys
[2013.06.01 03:12:45 | 000,288,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
[2013.06.01 03:12:43 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\fpb.rs
[2013.06.01 03:12:43 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysNative\fpb.rs
[2013.06.01 03:12:43 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc-nz.rs
[2013.06.01 03:12:43 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc-nz.rs
[2013.06.01 03:12:43 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegibbfc.rs
[2013.06.01 03:12:43 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegibbfc.rs
[2013.06.01 03:12:43 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\csrr.rs
[2013.06.01 03:12:43 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysNative\csrr.rs
[2013.06.01 03:12:43 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cob-au.rs
[2013.06.01 03:12:43 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cob-au.rs
[2013.06.01 03:12:43 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\usk.rs
[2013.06.01 03:12:43 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysNative\usk.rs
[2013.06.01 03:12:42 | 002,746,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gameux.dll
[2013.06.01 03:12:42 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\gameux.dll
[2013.06.01 03:12:42 | 000,441,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wpc.dll
[2013.06.01 03:12:42 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Wpc.dll
[2013.06.01 03:12:42 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cero.rs
[2013.06.01 03:12:42 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cero.rs
[2013.06.01 03:12:42 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\esrb.rs
[2013.06.01 03:12:42 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysNative\esrb.rs
[2013.06.01 03:12:42 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc.rs
[2013.06.01 03:12:42 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc.rs
[2013.06.01 03:12:42 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\grb.rs
[2013.06.01 03:12:42 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysNative\grb.rs
[2013.06.01 03:12:42 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-pt.rs
[2013.06.01 03:12:42 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-pt.rs
[2013.06.01 03:12:42 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-fi.rs
[2013.06.01 03:12:42 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-fi.rs
[2013.06.01 03:12:42 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi.rs
[2013.06.01 03:12:42 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi.rs
[2013.06.01 03:12:42 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\djctq.rs
[2013.06.01 03:12:42 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysNative\djctq.rs
[2013.06.01 03:12:37 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisdecd.dll
[2013.06.01 03:12:37 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll
[2013.06.01 03:12:37 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisrndr.ax
[2013.06.01 03:12:36 | 000,108,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisrndr.ax
[2013.06.01 03:12:13 | 003,216,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll
[2013.06.01 03:12:06 | 001,161,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2013.06.01 03:12:06 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2013.06.01 03:12:06 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2013.06.01 03:12:06 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2013.06.01 03:12:06 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2013.06.01 03:12:06 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2013.06.01 03:12:06 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2013.06.01 03:12:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013.06.01 03:12:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2013.06.01 03:12:06 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013.06.01 03:12:06 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2013.06.01 03:11:55 | 000,605,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.exe
[2013.06.01 03:11:55 | 000,566,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.efi
[2013.06.01 03:11:55 | 000,518,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.exe
[2013.06.01 03:11:55 | 000,095,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\synceng.dll
[2013.06.01 03:11:55 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\synceng.dll
[2013.06.01 03:11:55 | 000,020,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kdusb.dll
[2013.06.01 03:11:55 | 000,019,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kd1394.dll
[2013.06.01 03:11:55 | 000,017,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kdcom.dll
[2013.06.01 03:11:54 | 000,642,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.efi
[2013.06.01 03:11:50 | 000,068,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\taskhost.exe
[2013.06.01 03:11:43 | 000,252,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drvinst.exe
[2013.06.01 03:11:43 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\devrtl.dll
[2013.06.01 03:11:41 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
[2013.06.01 03:11:41 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll
[2013.06.01 03:11:41 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll
[2013.06.01 03:11:40 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\prevhost.exe
[2013.06.01 03:11:40 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\prevhost.exe
[2013.06.01 03:11:39 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[2013.06.01 03:11:31 | 000,267,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\FXSCOVER.exe
[2013.06.01 03:11:30 | 000,634,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msvcrt.dll
[2013.06.01 03:11:27 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
[2013.06.01 03:11:21 | 000,861,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll


Alt 02.06.2013, 22:26   #6
Maraxos
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


Zweite Hälfte:
Code:
ATTFilter
[2013.06.01 03:11:21 | 000,331,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleacc.dll
[2013.06.01 03:11:19 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2013.06.01 03:11:19 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2013.06.01 03:11:18 | 005,550,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2013.06.01 03:11:18 | 003,968,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2013.06.01 03:11:18 | 003,913,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2013.06.01 03:11:18 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe
[2013.06.01 03:11:18 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2013.06.01 03:11:17 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll
[2013.06.01 03:11:14 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2013.06.01 03:11:13 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2013.06.01 03:11:11 | 001,731,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2013.06.01 03:11:10 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe
[2013.06.01 03:11:06 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2013.06.01 03:11:06 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2013.06.01 03:11:01 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\packager.dll
[2013.06.01 03:11:01 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\packager.dll
[2013.06.01 01:06:30 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Nero
[2013.06.01 00:56:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nero
[2013.06.01 00:55:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Nero
[2013.06.01 00:55:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
[2013.06.01 00:55:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero
[2013.06.01 00:50:41 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\AMD
[2013.06.01 00:50:15 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\ATI
[2013.06.01 00:50:15 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\ATI
[2013.06.01 00:50:15 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2013.06.01 00:25:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT
[2013.06.01 00:25:05 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2013.06.01 00:25:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2013.06.01 00:25:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2013.06.01 00:24:32 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD
[2013.06.01 00:23:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2013.06.01 00:23:35 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2013.06.01 00:23:34 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2013.06.01 00:23:07 | 000,000,000 | ---D | C] -- C:\AMD
[2013.06.01 00:11:40 | 000,035,328 | ---- | C] (IncrediMail, Ltd.) -- C:\Windows\SysNative\ImHttpComm.dll
[2013.06.01 00:11:40 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\jmdp
[2013.06.01 00:11:40 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\ARFC
[2013.06.01 00:11:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Plus-HD-2.2
[2013.06.01 00:08:45 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\uTorrent
[2013.05.31 23:56:14 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\ts3overlay
[2013.05.31 23:55:58 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\TS3Client
[2013.05.31 23:55:58 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\skypePM
[2013.05.31 23:54:26 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Samsung
[2013.05.31 23:54:26 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Origin
[2013.05.31 23:54:25 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Opera
[2013.05.31 23:53:42 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2013.05.31 23:52:48 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Old_minecraft
[2013.05.31 23:52:42 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\LibreOffice
[2013.05.31 23:52:41 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\ICQ
[2013.05.31 23:49:03 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\.minecraft
[2013.05.31 23:42:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe AIR
[2013.05.31 23:39:38 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_42.dll
[2013.05.31 23:39:27 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_42.dll
[2013.05.31 23:39:14 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_40.dll
[2013.05.31 23:39:01 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_35.dll
[2013.05.31 23:38:43 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_34.dll
[2013.05.31 23:38:27 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_30.dll
[2013.05.31 23:35:27 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
[2013.05.31 23:34:44 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps
[2013.05.31 23:33:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2013.05.31 23:32:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2013.05.31 23:30:40 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2013.05.31 23:21:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2013.05.31 23:20:31 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
[2013.05.31 23:16:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2013.05.31 23:16:07 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2013.05.31 23:15:46 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2013.05.31 23:13:07 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Analysis Services
[2013.05.31 23:13:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services
[2013.05.31 23:12:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2013.05.31 23:12:51 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2013.05.31 23:12:42 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2013.05.31 23:04:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2013.05.31 22:45:04 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Macromedia
[2013.05.31 22:45:04 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\Macromedia
[2013.05.31 22:45:04 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Adobe
[2013.05.31 22:30:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2013.05.31 22:29:49 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\DVDVideoSoft
[2013.05.31 22:29:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
[2013.05.31 22:28:27 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll
[2013.05.31 22:28:27 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll
[2013.05.31 22:27:33 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Dropbox
[2013.05.31 22:26:07 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2013.05.31 22:25:36 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\TeamViewer
[2013.05.31 22:25:34 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Dropbox
[2013.05.31 22:25:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamViewer
[2013.05.31 22:22:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.05.31 22:22:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2013.05.31 22:22:37 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2013.05.31 22:11:19 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2013.05.31 22:11:19 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2013.05.31 22:11:19 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2013.05.31 22:11:12 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2013.05.31 22:11:12 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2013.05.31 22:11:12 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2013.05.31 22:11:05 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2013.05.31 22:11:05 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2013.05.31 22:10:12 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2013.05.31 22:08:24 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\MicrosoftStore
[2013.05.31 22:01:05 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\Microsoft Help
[2013.05.31 22:01:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2013.05.31 21:58:55 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\Documents\moborobo
[2013.05.31 21:58:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Moborobo
[2013.05.31 21:58:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Moborobo
[2013.05.31 21:56:20 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Skype
[2013.05.31 21:56:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2013.05.31 21:54:22 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++
[2013.05.31 21:54:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
[2013.05.31 21:54:21 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Notepad++
[2013.05.31 21:50:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeCommander
[2013.05.31 21:49:37 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\FileZilla
[2013.05.31 21:49:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
[2013.05.31 21:48:26 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Foxit Software
[2013.05.31 21:45:19 | 000,692,104 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.05.31 21:45:19 | 000,071,048 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.05.31 21:45:18 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2013.05.31 21:45:17 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2013.05.31 21:45:05 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\Adobe
[2013.05.31 21:44:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2013.05.31 21:43:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2013.05.31 21:43:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.05.31 21:43:44 | 000,866,720 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2013.05.31 21:43:44 | 000,788,896 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2013.05.31 21:43:44 | 000,263,584 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013.05.31 21:43:42 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.05.31 21:43:42 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.05.31 21:43:42 | 000,095,648 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.05.31 21:43:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013.05.31 21:42:13 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Mozilla
[2013.05.31 21:42:13 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\Mozilla
[2013.05.31 21:42:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2013.05.31 21:42:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2013.05.31 21:36:46 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2013.05.31 21:36:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2013.05.31 21:33:54 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\WinRAR
[2013.05.31 21:33:47 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2013.05.31 21:33:08 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\Programs
[2013.05.31 21:32:58 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Malwarebytes
[2013.05.31 21:32:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.05.31 21:32:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.05.31 21:32:55 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.05.31 21:30:43 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Avira
[2013.05.31 21:30:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.05.31 21:30:28 | 000,140,936 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwot.sys
[2013.05.31 21:30:28 | 000,132,832 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.05.31 21:30:28 | 000,114,168 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwim.sys
[2013.05.31 21:30:28 | 000,098,848 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.05.31 21:30:28 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.05.31 21:30:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2013.05.31 20:52:11 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\Desktop\Neuer Ordner
[2013.05.31 19:45:52 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2013.05.31 19:29:20 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\Desktop\Billy Talent 1
[2013.05.31 19:26:29 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\Desktop\Olli Schulz & der Hund Marie
[2013.05.31 19:25:57 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\Desktop\Kings of Convenience
[2013.05.31 19:13:47 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\Desktop\blumentopf
[2013.05.31 19:10:48 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\Desktop\Musik
[2013.05.31 19:06:01 | 000,016,896 | ---- | C] (ASUS) -- C:\Windows\AsTaskSched.dll
[2013.05.31 19:05:07 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM
[2013.05.31 19:05:07 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2013.05.31 19:04:58 | 002,580,824 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib.dll
[2013.05.31 19:04:58 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll
[2013.05.31 19:04:58 | 000,220,496 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysNative\SFNHK64.dll
[2013.05.31 19:04:58 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll
[2013.05.31 19:04:58 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll
[2013.05.31 19:04:58 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll
[2013.05.31 19:04:58 | 000,121,744 | ---- | C] (Sony Corporation) -- C:\Windows\SysNative\SFSS_APO.dll
[2013.05.31 19:04:56 | 000,332,392 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtlCPAPI64.dll
[2013.05.31 19:04:56 | 000,081,232 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysNative\SFCOM64.dll
[2013.05.31 19:04:56 | 000,078,160 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysNative\SFAPO64.dll
[2013.05.31 19:04:56 | 000,074,064 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysWow64\SFCOM.dll
[2013.05.31 19:04:55 | 000,626,792 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkApi64.dll
[2013.05.31 19:04:55 | 000,149,608 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkCfg64.dll
[2013.05.31 19:04:54 | 002,813,544 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkAPO64.dll
[2013.05.31 19:04:54 | 002,186,344 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtPgEx64.dll
[2013.05.31 19:04:54 | 001,247,848 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTCOM64.dll
[2013.05.31 19:04:54 | 001,146,984 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTSnMg64.cpl
[2013.05.31 19:04:53 | 000,544,768 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RCoRes64.dat
[2013.05.31 19:04:53 | 000,375,128 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll
[2013.05.31 19:04:53 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll
[2013.05.31 19:04:53 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll
[2013.05.31 19:04:53 | 000,204,120 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll
[2013.05.31 19:04:53 | 000,101,208 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll
[2013.05.31 19:04:53 | 000,083,048 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RCoInst64.dll
[2013.05.31 19:04:53 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll
[2013.05.31 19:04:51 | 002,197,264 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ.dll
[2013.05.31 19:04:51 | 001,870,680 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek.dll
[2013.05.31 19:04:51 | 001,718,616 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEP64A.dll
[2013.05.31 19:04:51 | 000,421,720 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EED64A.dll
[2013.05.31 19:04:51 | 000,341,336 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO30.dll
[2013.05.31 19:04:51 | 000,334,680 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxVolumeSDAPO.dll
[2013.05.31 19:04:51 | 000,127,832 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEL64A.dll
[2013.05.31 19:04:51 | 000,108,888 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEA64A.dll
[2013.05.31 19:04:51 | 000,074,584 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEG64A.dll
[2013.05.31 19:04:50 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll
[2013.05.31 19:04:47 | 001,937,312 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll
[2013.05.31 19:04:47 | 001,327,208 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2SpeakerDLL64.dll
[2013.05.31 19:04:47 | 001,179,752 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2HeadphoneDLL64.dll
[2013.05.31 19:04:47 | 000,491,112 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSSymmetryDLL64.dll
[2013.05.31 19:04:47 | 000,475,752 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSVoiceClarityDLL64.dll
[2013.05.31 19:04:46 | 001,111,656 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBoostDLL64.dll
[2013.05.31 19:04:46 | 000,504,936 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBassEnhancementDLL64.dll
[2013.05.31 19:04:46 | 000,317,032 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSNeoPCDLL64.dll
[2013.05.31 19:04:46 | 000,269,928 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLimiterDLL64.dll
[2013.05.31 19:04:46 | 000,266,856 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGainCompensatorDLL64.dll
[2013.05.31 19:04:46 | 000,200,800 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\SysNative\AERTAC64.dll
[2013.05.31 19:04:46 | 000,126,056 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLFXAPO64.dll
[2013.05.31 19:04:46 | 000,125,544 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPO64.dll
[2013.05.31 19:04:46 | 000,125,032 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPONS64.dll
[2013.05.31 19:04:46 | 000,108,960 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\SysNative\AERTAR64.dll
[2013.05.31 19:04:21 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp
[2013.05.31 19:04:20 | 001,251,944 | R--- | C] (Realtek Semiconductor Corp.) -- C:\Windows\RtlExUpd.dll
[2013.05.31 19:04:07 | 000,315,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Difxb412.rra
[2013.05.31 19:03:50 | 000,120,408 | ---- | C] (JMicron Technology Corp.) -- C:\Windows\SysNative\drivers\jraid.sys
[2013.05.31 19:03:48 | 000,000,000 | ---D | C] -- C:\Windows\RaidTool
[2013.05.31 19:03:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2013.05.31 19:03:27 | 000,565,352 | ---- | C] (Realtek                                            ) -- C:\Windows\SysNative\drivers\Rt64win7.sys
[2013.05.31 19:03:27 | 000,107,552 | ---- | C] (Realtek Semiconductor Corporation) -- C:\Windows\SysNative\RTNUninst64.dll
[2013.05.31 19:03:21 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2013.05.31 19:03:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek
[2013.05.31 19:02:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ASM104xUSB3
[2013.05.31 19:02:17 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2013.05.31 18:53:56 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013.05.31 18:53:56 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Searches
[2013.05.31 18:53:56 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013.05.31 18:53:49 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Identities
[2013.05.31 18:53:47 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Contacts
[2013.05.31 18:53:46 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\VirtualStore
[2013.05.31 18:53:40 | 000,000,000 | --SD | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Videos
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Saved Games
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Pictures
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Music
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Links
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Favorites
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Downloads
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Documents
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Desktop
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Vorlagen
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\AppData\Local\Verlauf
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\AppData\Local\Temporary Internet Files
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Startmenü
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\SendTo
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Recent
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Netzwerkumgebung
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Lokale Einstellungen
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Documents\Eigene Videos
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Documents\Eigene Musik
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Eigene Dateien
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Documents\Eigene Bilder
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Druckumgebung
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Cookies
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\AppData\Local\Anwendungsdaten
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Anwendungsdaten
[2013.05.31 18:53:40 | 000,000,000 | -H-D | C] -- C:\Users\Maraxos\AppData
[2013.05.31 18:53:40 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\Temp
[2013.05.31 18:53:40 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\Microsoft
[2013.05.31 18:53:40 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Media Center Programs
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\Recovery
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\Programme
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2013.05.31 18:49:59 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2013.05.31 18:47:53 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2013.05.31 18:47:25 | 000,000,000 | -HSD | C] -- C:\System Volume Information
 
========== Files - Modified Within 30 Days ==========
 
[2013.06.02 23:05:13 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Maraxos\Desktop\OTL(1).exe
[2013.06.02 22:34:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.02 22:33:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Maraxos\Desktop\OTL.exe
[2013.06.02 22:27:35 | 000,001,198 | ---- | M] () -- C:\Windows\tasks\Plus-HD-2.2-updater.job
[2013.06.02 22:27:16 | 000,104,224 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.06.02 22:27:10 | 000,001,834 | ---- | M] () -- C:\Windows\tasks\Plus-HD-2.2-firefoxinstaller.job
[2013.06.02 22:27:06 | 000,001,202 | ---- | M] () -- C:\Windows\tasks\Plus-HD-2.2-codedownloader.job
[2013.06.02 22:27:06 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\Plus-HD-2.2-enabler.job
[2013.06.02 22:26:57 | 000,000,204 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job
[2013.06.02 22:26:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.02 22:26:34 | 4251,971,582 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.02 22:25:24 | 000,000,000 | ---- | M] () -- C:\Windows\EEventManager.INI
[2013.06.02 22:23:42 | 000,020,832 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.02 22:23:42 | 000,020,832 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.02 20:31:18 | 000,001,191 | ---- | M] () -- C:\Users\Maraxos\Desktop\Desinstaller_HOSTS_Anti-PUPs.lnk
[2013.06.02 20:08:41 | 000,632,031 | ---- | M] () -- C:\Users\Maraxos\Desktop\adwcleaner_2.3.0.1.exe
[2013.06.02 17:05:12 | 001,626,920 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.02 17:05:12 | 000,702,198 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.02 17:05:12 | 000,656,430 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.02 17:05:12 | 000,149,838 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.02 17:05:12 | 000,122,242 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.06.02 16:58:52 | 005,034,992 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.06.02 03:40:20 | 001,054,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013.06.02 03:40:20 | 000,719,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2013.06.02 03:40:20 | 000,690,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.06.02 03:40:20 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.06.02 03:40:20 | 000,226,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll
[2013.06.02 03:40:20 | 000,185,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll
[2013.06.02 03:40:20 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2013.06.02 03:40:20 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe
[2013.06.02 03:40:20 | 000,138,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe
[2013.06.02 03:40:20 | 000,137,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.06.02 03:40:20 | 000,125,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2013.06.02 03:40:20 | 000,117,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2013.06.02 03:40:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll
[2013.06.02 03:40:20 | 000,109,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.06.02 03:40:20 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2013.06.02 03:40:20 | 000,079,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.06.02 03:40:20 | 000,073,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013.06.02 03:40:20 | 000,071,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.06.02 03:40:20 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll
[2013.06.02 03:40:20 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll
[2013.06.02 03:40:20 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2013.06.02 03:40:19 | 003,958,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.06.02 03:40:19 | 001,509,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.06.02 03:40:19 | 001,441,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.06.02 03:40:19 | 001,400,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat
[2013.06.02 03:40:19 | 001,400,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat
[2013.06.02 03:40:19 | 000,905,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2013.06.02 03:40:19 | 000,855,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.06.02 03:40:19 | 000,762,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2013.06.02 03:40:19 | 000,629,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2013.06.02 03:40:19 | 000,603,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.06.02 03:40:19 | 000,599,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.06.02 03:40:19 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.06.02 03:40:19 | 000,452,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2013.06.02 03:40:19 | 000,441,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2013.06.02 03:40:19 | 000,361,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2013.06.02 03:40:19 | 000,281,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2013.06.02 03:40:19 | 000,235,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.06.02 03:40:19 | 000,232,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.06.02 03:40:19 | 000,216,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll
[2013.06.02 03:40:19 | 000,197,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2013.06.02 03:40:19 | 000,173,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.06.02 03:40:19 | 000,167,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe
[2013.06.02 03:40:19 | 000,149,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2013.06.02 03:40:19 | 000,144,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe
[2013.06.02 03:40:19 | 000,136,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.06.02 03:40:19 | 000,136,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2013.06.02 03:40:19 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll
[2013.06.02 03:40:19 | 000,102,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2013.06.02 03:40:19 | 000,097,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.06.02 03:40:19 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2013.06.02 03:40:19 | 000,089,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.06.02 03:40:19 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll
[2013.06.02 03:40:19 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2013.06.02 03:40:19 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll
[2013.06.02 03:40:19 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013.06.02 03:40:19 | 000,062,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll
[2013.06.02 03:40:19 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2013.06.02 03:40:19 | 000,061,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.06.02 03:40:19 | 000,051,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013.06.02 03:40:19 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll
[2013.06.02 03:40:19 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll
[2013.06.02 03:40:19 | 000,039,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013.06.02 03:40:19 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.06.02 03:40:19 | 000,027,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2013.06.02 03:40:19 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.06.02 03:40:19 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2013.06.02 03:40:19 | 000,023,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2013.06.02 03:40:19 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe
[2013.06.02 03:40:19 | 000,012,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2013.06.02 03:35:53 | 003,928,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll
[2013.06.02 03:35:53 | 002,776,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll
[2013.06.02 03:35:53 | 002,565,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll
[2013.06.02 03:35:53 | 002,284,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2013.06.02 03:35:53 | 001,682,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll
[2013.06.02 03:35:53 | 001,504,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013.06.02 03:35:53 | 001,158,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll
[2013.06.02 03:35:53 | 000,522,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll
[2013.06.02 03:35:53 | 000,465,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll
[2013.06.02 03:35:53 | 000,417,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll
[2013.06.02 03:35:53 | 000,364,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll
[2013.06.02 03:35:53 | 000,363,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll
[2013.06.02 03:35:53 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.06.02 03:35:53 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.06.02 03:35:53 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.06.02 03:35:53 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.06.02 03:35:52 | 001,887,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013.06.02 03:35:52 | 001,643,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2013.06.02 03:35:52 | 001,424,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013.06.02 03:35:52 | 001,238,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll
[2013.06.02 03:35:52 | 000,648,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2013.06.02 03:35:52 | 000,333,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll
[2013.06.02 03:35:52 | 000,296,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll
[2013.06.02 03:35:52 | 000,245,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll
[2013.06.02 03:35:52 | 000,221,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll
[2013.06.02 03:35:52 | 000,194,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2013.06.02 03:35:52 | 000,187,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll
[2013.06.02 03:26:09 | 001,600,496 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.06.02 02:14:35 | 000,000,308 | ---- | M] () -- C:\Windows\setup.iss
[2013.06.02 00:51:00 | 000,000,202 | ---- | M] () -- C:\Windows\tasks\AutoKMSDaily.job
[2013.06.01 00:55:50 | 000,002,807 | ---- | M] () -- C:\Users\Public\Desktop\Nero Burning ROM 12.lnk
[2013.06.01 00:49:19 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2013.06.01 00:10:20 | 000,000,843 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2013.06.01 00:00:59 | 000,001,019 | ---- | M] () -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.06.01 00:00:20 | 000,000,991 | ---- | M] () -- C:\Users\Maraxos\Desktop\Dropbox.lnk
[2013.05.31 23:58:54 | 000,000,184 | ---- | M] () -- C:\Windows\AutoKMS.ini
[2013.05.31 23:37:52 | 000,000,036 | ---- | M] () -- C:\Windows\SysNative\InstallationInfs
[2013.05.31 23:37:01 | 000,140,936 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwot.sys
[2013.05.31 23:37:01 | 000,132,832 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.05.31 23:37:01 | 000,114,168 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwim.sys
[2013.05.31 23:37:01 | 000,098,848 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.05.31 23:34:44 | 000,000,521 | ---- | M] () -- C:\Users\Maraxos\Desktop\Fraps.lnk
[2013.05.31 23:20:31 | 000,000,582 | ---- | M] () -- C:\Users\Maraxos\Desktop\IrfanView.lnk
[2013.05.31 22:30:42 | 000,001,249 | ---- | M] () -- C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
[2013.05.31 22:26:35 | 000,001,096 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk
[2013.05.31 22:22:38 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2013.05.31 21:58:53 | 000,000,553 | ---- | M] () -- C:\Users\Public\Desktop\Moborobo.lnk
[2013.05.31 21:54:22 | 000,000,639 | ---- | M] () -- C:\Users\Maraxos\Desktop\Notepad++.lnk
[2013.05.31 21:50:48 | 000,000,593 | ---- | M] () -- C:\Users\Maraxos\Desktop\FreeCommander.lnk
[2013.05.31 21:45:19 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.05.31 21:45:19 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.05.31 21:43:39 | 000,866,720 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2013.05.31 21:43:39 | 000,788,896 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2013.05.31 21:43:39 | 000,263,584 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013.05.31 21:43:39 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.05.31 21:43:39 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.05.31 21:43:39 | 000,095,648 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.05.31 21:42:07 | 000,000,653 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.05.31 21:33:20 | 000,000,627 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.05.31 21:30:39 | 000,000,758 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.05.31 20:51:23 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2013.05.31 19:06:02 | 000,016,896 | ---- | M] (ASUS) -- C:\Windows\AsTaskSched.dll
[2013.05.31 19:01:52 | 000,029,532 | ---- | M] () -- C:\Windows\Ascd_tmp.ini
[2013.05.31 19:01:37 | 000,001,769 | ---- | M] () -- C:\Windows\Language_trs.ini
[2013.05.31 18:50:45 | 000,177,271 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2013.05.31 18:50:45 | 000,177,271 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2013.05.16 14:32:46 | 001,277,744 | ---- | M] () -- C:\Windows\SysNative\dmwu.exe
[2013.05.16 14:31:26 | 000,035,328 | ---- | M] (IncrediMail, Ltd.) -- C:\Windows\SysNative\ImHttpComm.dll
[2013.05.16 14:02:40 | 000,829,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcr100.dll
[2013.05.16 14:02:40 | 000,608,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcp100.dll
 
========== Files Created - No Company Name ==========
 
[2013.06.02 22:25:24 | 000,000,000 | ---- | C] () -- C:\Windows\EEventManager.INI
[2013.06.02 22:20:08 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.06.02 22:20:08 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.06.02 22:20:08 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.06.02 22:20:08 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.06.02 22:20:08 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.06.02 20:24:30 | 000,001,191 | ---- | C] () -- C:\Users\Maraxos\Desktop\Desinstaller_HOSTS_Anti-PUPs.lnk
[2013.06.02 20:08:37 | 000,632,031 | ---- | C] () -- C:\Users\Maraxos\Desktop\adwcleaner_2.3.0.1.exe
[2013.06.02 03:49:15 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2013.06.02 03:40:19 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.06.02 03:40:19 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013.06.02 03:14:45 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2013.06.02 02:14:25 | 000,000,308 | ---- | C] () -- C:\Windows\setup.iss
[2013.06.01 00:55:50 | 000,002,807 | ---- | C] () -- C:\Users\Public\Desktop\Nero Burning ROM 12.lnk
[2013.06.01 00:49:19 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.06.01 00:11:40 | 001,277,744 | ---- | C] () -- C:\Windows\SysNative\dmwu.exe
[2013.06.01 00:11:25 | 000,001,198 | ---- | C] () -- C:\Windows\tasks\Plus-HD-2.2-updater.job
[2013.06.01 00:11:22 | 000,001,102 | ---- | C] () -- C:\Windows\tasks\Plus-HD-2.2-enabler.job
[2013.06.01 00:11:21 | 000,001,202 | ---- | C] () -- C:\Windows\tasks\Plus-HD-2.2-codedownloader.job
[2013.06.01 00:11:13 | 000,001,834 | ---- | C] () -- C:\Windows\tasks\Plus-HD-2.2-firefoxinstaller.job
[2013.06.01 00:10:20 | 000,000,843 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2013.05.31 23:53:46 | 000,000,855 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe After Effects CS6.lnk
[2013.05.31 23:50:09 | 000,000,755 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Media Encoder CS6.lnk
[2013.05.31 23:44:30 | 000,000,721 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Dreamweaver CS6.lnk
[2013.05.31 23:43:28 | 000,001,003 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2013.05.31 23:42:57 | 000,001,103 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Widget Browser.lnk
[2013.05.31 23:37:49 | 000,000,036 | ---- | C] () -- C:\Windows\SysNative\InstallationInfs
[2013.05.31 23:35:20 | 000,000,750 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
[2013.05.31 23:34:52 | 000,000,705 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
[2013.05.31 23:34:44 | 000,000,521 | ---- | C] () -- C:\Users\Maraxos\Desktop\Fraps.lnk
[2013.05.31 23:34:26 | 000,000,724 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
[2013.05.31 23:34:12 | 000,000,679 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
[2013.05.31 23:32:32 | 000,000,799 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
[2013.05.31 23:32:28 | 000,001,529 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
[2013.05.31 23:20:31 | 000,000,582 | ---- | C] () -- C:\Users\Maraxos\Desktop\IrfanView.lnk
[2013.05.31 23:05:30 | 001,600,496 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.05.31 22:30:42 | 000,001,249 | ---- | C] () -- C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
[2013.05.31 22:27:33 | 000,000,991 | ---- | C] () -- C:\Users\Maraxos\Desktop\Dropbox.lnk
[2013.05.31 22:26:35 | 000,001,108 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk
[2013.05.31 22:26:35 | 000,001,096 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk
[2013.05.31 22:26:13 | 000,001,019 | ---- | C] () -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.05.31 22:14:38 | 000,000,204 | ---- | C] () -- C:\Windows\tasks\AutoKMS.job
[2013.05.31 22:14:37 | 000,000,202 | ---- | C] () -- C:\Windows\tasks\AutoKMSDaily.job
[2013.05.31 22:14:37 | 000,000,184 | ---- | C] () -- C:\Windows\AutoKMS.ini
[2013.05.31 21:58:57 | 000,012,072 | ---- | C] () -- C:\Windows\SysWow64\drivers\MoborobAssDriver64.sys
[2013.05.31 21:58:53 | 000,000,553 | ---- | C] () -- C:\Users\Public\Desktop\Moborobo.lnk
[2013.05.31 21:56:16 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2013.05.31 21:54:22 | 000,000,639 | ---- | C] () -- C:\Users\Maraxos\Desktop\Notepad++.lnk
[2013.05.31 21:50:48 | 000,000,593 | ---- | C] () -- C:\Users\Maraxos\Desktop\FreeCommander.lnk
[2013.05.31 21:45:19 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.05.31 21:42:07 | 000,000,653 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.05.31 21:42:07 | 000,000,653 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013.05.31 21:32:56 | 000,000,627 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.05.31 21:30:39 | 000,000,758 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.05.31 20:51:23 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2013.05.31 19:03:27 | 000,074,272 | ---- | C] () -- C:\Windows\SysNative\RtNicProp64.dll
[2013.05.31 19:01:37 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2013.05.31 19:01:33 | 000,029,532 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2013.05.31 18:53:58 | 000,001,431 | ---- | C] () -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013.05.31 18:50:36 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2013.05.31 18:50:29 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2013.05.31 18:47:21 | 4251,971,582 | -HS- | C] () -- C:\hiberfil.sys
[2013.03.29 04:13:14 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe
[2013.03.29 04:13:12 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe
[2013.03.29 03:38:08 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2013.03.29 03:38:08 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.11.27 01:18:46 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

Alt 02.06.2013, 22:27   #7
schrauber
/// the machine
/// TB-Ausbilder
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches OTL log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 02.06.2013, 23:47   #8
Maraxos
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


Hier die Logs von JRT:
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Professional x64
Ran by Maraxos on 02.06.2013 at 23:30:06,01
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\sweetim



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02.06.2013 at 23:32:55,70
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Logs von esetmartinstaller:
Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=03f2bc5c12b9b14d9a2c8286f9cf95bf
# engine=13977
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-02 10:28:52
# local_time=2013-06-03 12:28:52 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1801 16775165 100 99 24064 191509388 2460 0
# compatibility_mode=5893 16776573 100 94 7406 121841982 0 0
# scanned=170839
# found=0
# cleaned=0
# scan_time=3165
SecurityCheck Log:
Code:
ATTFilter
 UNSUPPORTED OPERATING SYSTEM! ABORTED!
OTL Folgt...

OTL Erste Hälfte:
Code:
ATTFilter
OTL logfile created on: 03.06.2013 00:48:01 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Maraxos\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
15,95 Gb Total Physical Memory | 13,34 Gb Available Physical Memory | 83,67% Memory free
31,89 Gb Paging File | 28,96 Gb Available in Paging File | 90,82% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 388,97 Gb Free Space | 83,53% Space Free | Partition Type: NTFS
Drive D: | 333,86 Gb Total Space | 333,76 Gb Free Space | 99,97% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 461,87 Gb Free Space | 99,16% Space Free | Partition Type: NTFS
Drive F: | 597,65 Gb Total Space | 597,55 Gb Free Space | 99,98% Space Free | Partition Type: NTFS
Drive G: | 265,59 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: MARAXOS-PC | User Name: Maraxos | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Maraxos\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe ()
PRC - C:\Users\Maraxos\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)
PRC - E:\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe (Adobe Systems, Inc.)
PRC - E:\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe (TeamViewer GmbH)
PRC - C:\Users\Maraxos\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - E:\Moborobo\MoboroboDeviceService.exe ()
PRC - C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
PRC - C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (ABBYY)
PRC - C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe (SEIKO EPSON CORPORATION)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
MOD - E:\Mozilla Firefox\mozjs.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (EpsonScanSvc) -- C:\Windows\SysNative\escsvc64.exe (Seiko Epson Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (HOSTS Anti-PUPs) -- C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe ()
SRV - (AntiVirFirewallService) -- E:\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- E:\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirMailService) -- E:\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- E:\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirSchedulerService) -- E:\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (TeamViewer8) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (MBAMService) -- E:\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- E:\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (MoboroboDeviceService) -- E:\Moborobo\MoboroboDeviceService.exe ()
SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose64) -- C:\Programme\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ABBYY.Licensing.FineReader.Sprint.9.0) -- C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (ABBYY)
SRV - (EpsonBidirectionalService) -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe (SEIKO EPSON CORPORATION)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (avfwot) -- C:\Windows\SysNative\drivers\avfwot.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avfwim) -- C:\Windows\SysNative\drivers\avfwim.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (asmtxhci) -- C:\Windows\SysNative\drivers\asmtxhci.sys (ASMedia Technology Inc)
DRV:64bit: - (asmthub3) -- C:\Windows\SysNative\drivers\asmthub3.sys (ASMedia Technology Inc)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (JRAID) -- C:\Windows\SysNative\drivers\jraid.sys (JMicron Technology Corp.)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (AODDriver4.2) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 9F FE FD C6 36 5E CE 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: E:\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: E:\Mozilla Firefox\plugins
 
[2013.05.31 21:42:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Extensions
[2013.05.31 23:56:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\extensions
[2013.05.31 23:56:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\extensions\extensions
[2013.05.31 23:56:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\01k9v22g.default\extensions
[2013.05.31 23:56:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\djopa765.default\extensions
[2013.05.31 23:56:25 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\djopa765.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2013.05.31 23:56:25 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\extensions\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2013.06.02 20:11:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\i62j7lnb.default\extensions
[2013.05.31 23:56:26 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\i62j7lnb.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2013.05.31 23:56:25 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\i62j7lnb.default\extensions\mail@gutscheinrausch.de
[2013.06.02 20:45:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\jjy2tojg.default\extensions
[2013.06.01 00:49:43 | 000,000,000 | ---D | M] ("Plus-HD-2.2") -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\jjy2tojg.default\extensions\4fdacf00-e9c4-4ad5-b4cf-bf9800f184f6@36857116-74e0-4973-936f-860cd2a102a9.com
[2013.06.01 00:14:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\jjy2tojg.default\extensions\4fdacf00-e9c4-4ad5-b4cf-bf9800f184f6@36857116-74e0-4973-936f-860cd2a102a9.com\chrome\content\extensionCode
[2013.05.31 23:56:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\nygg9wvg.default\extensions
[2013.05.31 23:56:40 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\nygg9wvg.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2013.06.02 20:11:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\o0ul7s80.default\extensions
[2013.05.31 23:56:41 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\o0ul7s80.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2013.05.31 23:56:41 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- C:\Users\Maraxos\AppData\Roaming\mozilla\Firefox\Profiles\o0ul7s80.default\extensions\mail@gutscheinrausch.de
[2013.05.31 23:56:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\SeaMonkey\Profiles\bi46rvla.default\extensions
[2012.12.05 03:17:21 | 000,573,138 | ---- | M] () (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\firefox\profiles\01k9v22g.default\extensions\testpilot@labs.mozilla.com.xpi
[2013.06.02 17:03:25 | 000,004,503 | ---- | M] () (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\firefox\profiles\jjy2tojg.default\extensions\youtubeunblocker@unblocker.yt.xpi
[2013.01.18 19:25:10 | 000,200,692 | ---- | M] () (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\firefox\profiles\jjy2tojg.default\extensions\yslow@yahoo-inc.com.xpi
[2013.06.01 00:14:52 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\firefox\profiles\jjy2tojg.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.07.18 02:09:15 | 001,184,804 | ---- | M] () (No name found) -- C:\Users\Maraxos\AppData\Roaming\mozilla\firefox\profiles\nygg9wvg.default\extensions\testpilot@labs.mozilla.com.xpi
 
O1 HOSTS File: ([2013.06.02 22:27:16 | 000,104,224 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 00aaf101a7.gougava.asia # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 08sr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 1a2e115593.efacen.pro # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 1f1.fr # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 1facebookhackeronline.blogspot.no # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2010-fr.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2012-new.biz # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 24h00business.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 33black.porn-quest.net # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 4672ee0bc8.laibritec.waw.pl # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 4990usd.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 4xp.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 74.80.131.123 # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 78031d2298.tradorad.waw.pl # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 80323fcc6e.starsogor.waw.pl # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 888.rahon.org # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 8e47c22037.temavi.pro # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 94eb028571.eimeefiewe.pisz.pl # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 96910cbcd4.nicero.pro # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 96fb625592.tysofque.waw.pl:82 # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 98eu.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ack.cdnperformance.info # hosts anti-adware / pups
O1 - Hosts: 1800 more lines...
O2:64bit: - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] E:\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [EEventManager] C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [HOSTS Anti-Adware_PUPs] C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe ()
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [EPLTarget\P0000000000000000] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIME.EXE /EPT "EPLTarget\P0000000000000000" /M "XP-202 203 206 Series" File not found
O4 - HKCU..\Run: [uTorrent] C:\Users\Maraxos\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)
O4 - Startup: C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Maraxos\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: An OneNote s&enden - res://E:\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://E:\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://E:\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://E:\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - Reg Error: Key error. File not found
O9:64bit: - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - Reg Error: Key error. File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - E:\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - E:\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - E:\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - E:\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - E:\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - E:\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - E:\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - E:\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - E:\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - E:\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.3.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1917A94B-9634-4FB6-97F4-73238D08E4CA}: DhcpNameServer = 192.168.3.1
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.12.21 02:00:00 | 000,000,033 | R--- | M] () - G:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.06.02 23:30:33 | 002,347,384 | ---- | C] (ESET) -- C:\Users\Maraxos\Desktop\esetsmartinstaller_enu.exe
[2013.06.02 23:30:04 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.06.02 23:29:59 | 000,000,000 | ---D | C] -- C:\JRT
[2013.06.02 23:29:23 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Maraxos\Desktop\JRT.exe
[2013.06.02 22:33:51 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Maraxos\Desktop\OTL.exe
[2013.06.02 22:27:16 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.06.02 22:20:08 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.06.02 22:20:08 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.06.02 22:20:08 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.06.02 22:20:05 | 000,000,000 | --SD | C] -- C:\ComboFix
[2013.06.02 22:20:02 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.06.02 22:19:51 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.06.02 20:24:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs
[2013.06.02 17:01:39 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Epson
[2013.06.02 03:49:13 | 000,054,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdfLdr.sys
[2013.06.02 03:49:13 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wdfres.dll
[2013.06.02 03:40:20 | 001,054,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013.06.02 03:40:20 | 000,719,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2013.06.02 03:40:20 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.06.02 03:40:20 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.06.02 03:40:20 | 000,226,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll
[2013.06.02 03:40:20 | 000,185,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll
[2013.06.02 03:40:20 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2013.06.02 03:40:20 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe
[2013.06.02 03:40:20 | 000,138,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe
[2013.06.02 03:40:20 | 000,137,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.06.02 03:40:20 | 000,125,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2013.06.02 03:40:20 | 000,117,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2013.06.02 03:40:20 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll
[2013.06.02 03:40:20 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.06.02 03:40:20 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2013.06.02 03:40:20 | 000,079,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.06.02 03:40:20 | 000,073,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013.06.02 03:40:20 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.06.02 03:40:20 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll
[2013.06.02 03:40:20 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll
[2013.06.02 03:40:20 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2013.06.02 03:40:19 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.06.02 03:40:19 | 001,509,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.06.02 03:40:19 | 001,441,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.06.02 03:40:19 | 001,400,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat
[2013.06.02 03:40:19 | 001,400,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat
[2013.06.02 03:40:19 | 000,905,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2013.06.02 03:40:19 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.06.02 03:40:19 | 000,762,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2013.06.02 03:40:19 | 000,629,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2013.06.02 03:40:19 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.06.02 03:40:19 | 000,599,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.06.02 03:40:19 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.06.02 03:40:19 | 000,452,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2013.06.02 03:40:19 | 000,441,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2013.06.02 03:40:19 | 000,361,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2013.06.02 03:40:19 | 000,281,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2013.06.02 03:40:19 | 000,235,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.06.02 03:40:19 | 000,232,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.06.02 03:40:19 | 000,216,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll
[2013.06.02 03:40:19 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2013.06.02 03:40:19 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.06.02 03:40:19 | 000,167,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe
[2013.06.02 03:40:19 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2013.06.02 03:40:19 | 000,144,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe
[2013.06.02 03:40:19 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.06.02 03:40:19 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2013.06.02 03:40:19 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll
[2013.06.02 03:40:19 | 000,102,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2013.06.02 03:40:19 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.06.02 03:40:19 | 000,092,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2013.06.02 03:40:19 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.06.02 03:40:19 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll
[2013.06.02 03:40:19 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2013.06.02 03:40:19 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll
[2013.06.02 03:40:19 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013.06.02 03:40:19 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll
[2013.06.02 03:40:19 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2013.06.02 03:40:19 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.06.02 03:40:19 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013.06.02 03:40:19 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll
[2013.06.02 03:40:19 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll
[2013.06.02 03:40:19 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013.06.02 03:40:19 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.06.02 03:40:19 | 000,027,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2013.06.02 03:40:19 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2013.06.02 03:40:19 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe
[2013.06.02 03:40:19 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2013.06.02 03:35:53 | 003,928,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll
[2013.06.02 03:35:53 | 002,776,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll
[2013.06.02 03:35:53 | 002,565,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll
[2013.06.02 03:35:53 | 002,284,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2013.06.02 03:35:53 | 001,682,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll
[2013.06.02 03:35:53 | 001,158,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll
[2013.06.02 03:35:53 | 000,522,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll
[2013.06.02 03:35:53 | 000,465,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll
[2013.06.02 03:35:53 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll
[2013.06.02 03:35:53 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll
[2013.06.02 03:35:53 | 000,363,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll
[2013.06.02 03:35:53 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.06.02 03:35:53 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.06.02 03:35:53 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.06.02 03:35:53 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.06.02 03:35:52 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013.06.02 03:35:52 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2013.06.02 03:35:52 | 001,504,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013.06.02 03:35:52 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013.06.02 03:35:52 | 001,238,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll
[2013.06.02 03:35:52 | 000,648,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2013.06.02 03:35:52 | 000,333,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll
[2013.06.02 03:35:52 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll
[2013.06.02 03:35:52 | 000,245,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll
[2013.06.02 03:35:52 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll
[2013.06.02 03:35:52 | 000,194,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2013.06.02 03:35:52 | 000,187,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll
[2013.06.02 03:27:40 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe
[2013.06.02 03:15:24 | 000,367,616 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll
[2013.06.02 03:15:24 | 000,295,424 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll
[2013.06.02 03:15:24 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\fontsub.dll
[2013.06.02 03:15:24 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\fontsub.dll
[2013.06.02 03:15:24 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll
[2013.06.02 03:15:24 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll
[2013.06.02 03:14:45 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFx.dll
[2013.06.02 03:14:45 | 000,229,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFHost.exe
[2013.06.02 03:14:45 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFPlatform.dll
[2013.06.02 03:14:45 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFCoinstaller.dll
[2013.06.02 03:13:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2013.06.02 03:13:01 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2013.06.02 03:13:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2013.06.02 03:10:56 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll
[2013.06.02 03:10:56 | 000,023,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\fs_rec.sys
[2013.06.02 03:07:26 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.06.02 02:20:42 | 000,135,168 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EEBAPI.dll
[2013.06.02 02:20:42 | 000,110,592 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EEBDSCVR.dll
[2013.06.02 02:20:42 | 000,077,824 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EBAPI.dll
[2013.06.02 02:20:42 | 000,065,536 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EEBUtil.dll
[2013.06.02 02:20:42 | 000,055,808 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysWow64\EEBSDKIF.dll
[2013.06.02 02:20:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\EPSON
[2013.06.02 02:18:00 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\ABBYY
[2013.06.02 02:17:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ABBYY FineReader 9.0 Sprint
[2013.06.02 02:16:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ABBYY FineReader 9.0 Sprint
[2013.06.02 02:16:51 | 000,000,000 | ---D | C] -- C:\ProgramData\ABBYY
[2013.06.02 02:16:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ABBYY
[2013.06.02 02:15:18 | 000,000,000 | ---D | C] -- C:\ProgramData\UDL
[2013.06.02 02:13:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epson Software
[2013.06.02 02:12:48 | 000,558,592 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\ensppmon.dll
[2013.06.02 02:12:48 | 000,558,592 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\enppmon.dll
[2013.06.02 02:12:48 | 000,535,552 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\ensppui.dll
[2013.06.02 02:12:48 | 000,535,552 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\enppui.dll
[2013.06.02 02:12:48 | 000,219,648 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\enspres.dll
[2013.06.02 02:12:48 | 000,219,648 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\enpres.dll
[2013.06.02 02:12:48 | 000,000,000 | ---D | C] -- C:\Program Files\EpsonNet
[2013.06.02 02:12:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\EPSON
[2013.06.02 02:12:38 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EPSON Software
[2013.06.02 02:12:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EPSON Software
[2013.06.02 02:09:33 | 000,010,752 | ---- | C] (SEIKO EPSON CORP.) -- C:\Windows\SysNative\E_GCINST.DLL
[2013.06.02 02:09:32 | 000,120,320 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\E_ILMIME.DLL
[2013.06.02 02:09:32 | 000,083,968 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\E_ID4BIME.DLL
[2013.06.02 02:09:29 | 000,000,000 | ---D | C] -- C:\ProgramData\EPSON
[2013.06.02 02:09:18 | 000,466,432 | ---- | C] (Seiko Epson Corporation) -- C:\Windows\SysNative\esxw2ud.dll
[2013.06.02 02:09:18 | 000,135,824 | ---- | C] (Seiko Epson Corporation) -- C:\Windows\SysNative\escsvc64.exe
[2013.06.02 02:09:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
[2013.06.02 02:09:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\epson
[2013.06.01 03:14:58 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xmllite.dll
[2013.06.01 03:14:54 | 000,750,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2013.06.01 03:14:54 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2013.06.01 03:14:54 | 000,265,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys
[2013.06.01 03:14:54 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
[2013.06.01 03:14:53 | 000,319,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbcjt32.dll
[2013.06.01 03:14:53 | 000,212,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbctrac.dll
[2013.06.01 03:14:53 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbctrac.dll
[2013.06.01 03:14:53 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccp32.dll
[2013.06.01 03:14:53 | 000,122,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccp32.dll
[2013.06.01 03:14:53 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccu32.dll
[2013.06.01 03:14:53 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccr32.dll
[2013.06.01 03:14:53 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccu32.dll
[2013.06.01 03:14:53 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccr32.dll
[2013.06.01 03:14:42 | 000,142,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\poqexec.exe
[2013.06.01 03:14:42 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\poqexec.exe
[2013.06.01 03:14:39 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcore6.dll
[2013.06.01 03:14:39 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dhcpcore6.dll
[2013.06.01 03:14:39 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcsvc6.dll
[2013.06.01 03:14:36 | 003,717,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll
[2013.06.01 03:14:35 | 003,217,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll
[2013.06.01 03:14:35 | 000,158,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aaclient.dll
[2013.06.01 03:14:35 | 000,131,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\aaclient.dll
[2013.06.01 03:14:35 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll
[2013.06.01 03:14:35 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll
[2013.06.01 03:14:32 | 002,871,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2013.06.01 03:14:32 | 002,616,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\explorer.exe
[2013.06.01 03:14:24 | 000,961,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CPFilters.dll
[2013.06.01 03:14:23 | 001,118,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sbe.dll
[2013.06.01 03:14:23 | 000,850,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\sbe.dll
[2013.06.01 03:14:23 | 000,642,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\CPFilters.dll
[2013.06.01 03:14:23 | 000,259,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mpg2splt.ax
[2013.06.01 03:14:23 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mpg2splt.ax
[2013.06.01 03:14:20 | 001,572,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll
[2013.06.01 03:14:19 | 001,328,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll
[2013.06.01 03:14:19 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll
[2013.06.01 03:14:19 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll
[2013.06.01 03:14:18 | 002,315,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tquery.dll
[2013.06.01 03:14:17 | 002,223,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssrch.dll
[2013.06.01 03:14:17 | 001,549,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tquery.dll
[2013.06.01 03:14:17 | 001,401,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssrch.dll
[2013.06.01 03:14:17 | 000,778,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssvp.dll
[2013.06.01 03:14:17 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssvp.dll
[2013.06.01 03:14:17 | 000,491,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssph.dll
[2013.06.01 03:14:17 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssph.dll
[2013.06.01 03:14:17 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssphtb.dll
[2013.06.01 03:14:17 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SearchProtocolHost.exe
[2013.06.01 03:14:17 | 000,113,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SearchFilterHost.exe
[2013.06.01 03:14:17 | 000,075,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msscntrs.dll
[2013.06.01 03:14:17 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msscntrs.dll
[2013.06.01 03:14:15 | 000,509,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll
[2013.06.01 03:14:11 | 001,930,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll
[2013.06.01 03:14:11 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll
[2013.06.01 03:14:11 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shdocvw.dll
[2013.06.01 03:14:11 | 000,111,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe
[2013.06.01 03:14:07 | 000,395,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll
[2013.06.01 03:14:07 | 000,314,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\webio.dll
[2013.06.01 03:14:05 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wwanprotdim.dll
[2013.06.01 03:14:01 | 000,515,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\timedate.cpl
[2013.06.01 03:14:00 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl
[2013.06.01 03:13:55 | 001,359,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfc42u.dll
[2013.06.01 03:13:54 | 001,395,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfc42.dll
[2013.06.01 03:13:54 | 001,164,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc42u.dll
[2013.06.01 03:13:54 | 001,137,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc42.dll
[2013.06.01 03:13:50 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\RNDISMP.sys
[2013.06.01 03:13:48 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usb8023.sys
[2013.06.01 03:13:47 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll
[2013.06.01 03:13:47 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll
[2013.06.01 03:13:47 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe
[2013.06.01 03:13:45 | 001,447,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2013.06.01 03:13:45 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
[2013.06.01 03:13:45 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
[2013.06.01 03:13:45 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
[2013.06.01 03:13:41 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2013.06.01 03:13:41 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2013.06.01 03:13:39 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netcorehc.dll
[2013.06.01 03:13:39 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncsi.dll
[2013.06.01 03:13:39 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netcorehc.dll
[2013.06.01 03:13:39 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ncsi.dll
[2013.06.01 03:13:39 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll
[2013.06.01 03:13:39 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll
[2013.06.01 03:13:35 | 000,027,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\Diskdump.sys
[2013.06.01 03:13:34 | 000,357,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dnsapi.dll
[2013.06.01 03:13:33 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dnscacheugc.exe
[2013.06.01 03:13:33 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dnscacheugc.exe
[2013.06.01 03:13:21 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dpnet.dll
[2013.06.01 03:13:21 | 000,376,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dpnet.dll
[2013.06.01 03:13:15 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2013.06.01 03:13:15 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2013.06.01 03:13:14 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2013.06.01 03:13:14 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2013.06.01 03:13:14 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2013.06.01 03:13:14 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2013.06.01 03:13:14 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2013.06.01 03:13:13 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2013.06.01 03:13:12 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe
[2013.06.01 03:12:46 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\usp10.dll
[2013.06.01 03:12:45 | 000,376,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys
[2013.06.01 03:12:45 | 000,288,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
[2013.06.01 03:12:43 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\fpb.rs
[2013.06.01 03:12:43 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysNative\fpb.rs
[2013.06.01 03:12:43 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc-nz.rs
[2013.06.01 03:12:43 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc-nz.rs
[2013.06.01 03:12:43 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegibbfc.rs
[2013.06.01 03:12:43 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegibbfc.rs
[2013.06.01 03:12:43 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\csrr.rs
[2013.06.01 03:12:43 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysNative\csrr.rs
[2013.06.01 03:12:43 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cob-au.rs
[2013.06.01 03:12:43 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cob-au.rs
[2013.06.01 03:12:43 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\usk.rs
[2013.06.01 03:12:43 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysNative\usk.rs
[2013.06.01 03:12:42 | 002,746,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gameux.dll
[2013.06.01 03:12:42 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\gameux.dll
[2013.06.01 03:12:42 | 000,441,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wpc.dll
[2013.06.01 03:12:42 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Wpc.dll
[2013.06.01 03:12:42 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cero.rs
[2013.06.01 03:12:42 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cero.rs
[2013.06.01 03:12:42 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\esrb.rs
[2013.06.01 03:12:42 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysNative\esrb.rs
[2013.06.01 03:12:42 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc.rs
[2013.06.01 03:12:42 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc.rs
[2013.06.01 03:12:42 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\grb.rs
[2013.06.01 03:12:42 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysNative\grb.rs
[2013.06.01 03:12:42 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-pt.rs
[2013.06.01 03:12:42 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-pt.rs
[2013.06.01 03:12:42 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-fi.rs
[2013.06.01 03:12:42 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-fi.rs
[2013.06.01 03:12:42 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi.rs
[2013.06.01 03:12:42 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi.rs
[2013.06.01 03:12:42 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\djctq.rs
[2013.06.01 03:12:42 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysNative\djctq.rs
[2013.06.01 03:12:37 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisdecd.dll
[2013.06.01 03:12:37 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll
[2013.06.01 03:12:37 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisrndr.ax
[2013.06.01 03:12:36 | 000,108,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisrndr.ax
[2013.06.01 03:12:13 | 003,216,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll
[2013.06.01 03:12:06 | 001,161,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2013.06.01 03:12:06 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2013.06.01 03:12:06 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2013.06.01 03:12:06 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2013.06.01 03:12:06 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2013.06.01 03:12:06 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2013.06.01 03:12:06 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2013.06.01 03:12:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013.06.01 03:12:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2013.06.01 03:12:06 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013.06.01 03:12:06 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013.06.01 03:12:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013.06.01 03:12:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2013.06.01 03:11:55 | 000,605,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.exe
[2013.06.01 03:11:55 | 000,566,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.efi
[2013.06.01 03:11:55 | 000,518,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.exe
[2013.06.01 03:11:55 | 000,095,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\synceng.dll
[2013.06.01 03:11:55 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\synceng.dll
[2013.06.01 03:11:55 | 000,020,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kdusb.dll
[2013.06.01 03:11:55 | 000,019,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kd1394.dll
[2013.06.01 03:11:55 | 000,017,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kdcom.dll
[2013.06.01 03:11:54 | 000,642,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.efi
[2013.06.01 03:11:50 | 000,068,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\taskhost.exe
[2013.06.01 03:11:43 | 000,252,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drvinst.exe
[2013.06.01 03:11:43 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\devrtl.dll
[2013.06.01 03:11:41 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
[2013.06.01 03:11:41 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll
[2013.06.01 03:11:41 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll
[2013.06.01 03:11:40 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\prevhost.exe
[2013.06.01 03:11:40 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\prevhost.exe
[2013.06.01 03:11:39 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[2013.06.01 03:11:31 | 000,267,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\FXSCOVER.exe
[2013.06.01 03:11:30 | 000,634,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msvcrt.dll
[2013.06.01 03:11:27 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
[2013.06.01 03:11:21 | 000,861,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
[2013.06.01 03:11:21 | 000,331,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleacc.dll
[2013.06.01 03:11:19 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2013.06.01 03:11:19 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2013.06.01 03:11:18 | 005,550,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2013.06.01 03:11:18 | 003,968,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2013.06.01 03:11:18 | 003,913,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2013.06.01 03:11:18 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe
[2013.06.01 03:11:18 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2013.06.01 03:11:17 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll
[2013.06.01 03:11:14 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2013.06.01 03:11:13 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2013.06.01 03:11:11 | 001,731,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2013.06.01 03:11:10 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe

Alt 03.06.2013, 00:00   #9
Maraxos
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


OTL Zweitehälfte:
Code:
ATTFilter
[2013.06.01 03:11:06 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2013.06.01 03:11:06 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2013.06.01 03:11:01 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\packager.dll
[2013.06.01 03:11:01 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\packager.dll
[2013.06.01 01:06:30 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Nero
[2013.06.01 00:56:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nero
[2013.06.01 00:55:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Nero
[2013.06.01 00:55:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
[2013.06.01 00:55:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero
[2013.06.01 00:50:41 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\AMD
[2013.06.01 00:50:15 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\ATI
[2013.06.01 00:50:15 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\ATI
[2013.06.01 00:50:15 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2013.06.01 00:25:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT
[2013.06.01 00:25:05 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2013.06.01 00:25:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2013.06.01 00:25:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2013.06.01 00:24:32 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD
[2013.06.01 00:23:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2013.06.01 00:23:35 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2013.06.01 00:23:34 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2013.06.01 00:23:07 | 000,000,000 | ---D | C] -- C:\AMD
[2013.06.01 00:11:40 | 000,035,328 | ---- | C] (IncrediMail, Ltd.) -- C:\Windows\SysNative\ImHttpComm.dll
[2013.06.01 00:11:40 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\jmdp
[2013.06.01 00:11:40 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\ARFC
[2013.06.01 00:11:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Plus-HD-2.2
[2013.06.01 00:08:45 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\uTorrent
[2013.05.31 23:56:14 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\ts3overlay
[2013.05.31 23:55:58 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\TS3Client
[2013.05.31 23:55:58 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\skypePM
[2013.05.31 23:54:26 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Samsung
[2013.05.31 23:54:26 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Origin
[2013.05.31 23:54:25 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Opera
[2013.05.31 23:53:42 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2013.05.31 23:52:48 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Old_minecraft
[2013.05.31 23:52:42 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\LibreOffice
[2013.05.31 23:52:41 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\ICQ
[2013.05.31 23:49:03 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\.minecraft
[2013.05.31 23:42:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe AIR
[2013.05.31 23:39:38 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_42.dll
[2013.05.31 23:39:27 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_42.dll
[2013.05.31 23:39:14 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_40.dll
[2013.05.31 23:39:01 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_35.dll
[2013.05.31 23:38:43 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_34.dll
[2013.05.31 23:38:27 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_30.dll
[2013.05.31 23:35:27 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
[2013.05.31 23:34:44 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps
[2013.05.31 23:33:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2013.05.31 23:32:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2013.05.31 23:30:40 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2013.05.31 23:21:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2013.05.31 23:20:31 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
[2013.05.31 23:16:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2013.05.31 23:16:07 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2013.05.31 23:15:46 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2013.05.31 23:13:07 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Analysis Services
[2013.05.31 23:13:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services
[2013.05.31 23:12:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2013.05.31 23:12:51 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2013.05.31 23:12:42 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2013.05.31 23:04:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2013.05.31 22:45:04 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Macromedia
[2013.05.31 22:45:04 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\Macromedia
[2013.05.31 22:45:04 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Adobe
[2013.05.31 22:30:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2013.05.31 22:29:49 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\DVDVideoSoft
[2013.05.31 22:29:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
[2013.05.31 22:28:27 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll
[2013.05.31 22:28:27 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll
[2013.05.31 22:27:33 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Dropbox
[2013.05.31 22:26:07 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2013.05.31 22:25:36 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\TeamViewer
[2013.05.31 22:25:34 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Dropbox
[2013.05.31 22:25:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamViewer
[2013.05.31 22:22:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.05.31 22:22:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2013.05.31 22:22:37 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2013.05.31 22:11:19 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2013.05.31 22:11:19 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2013.05.31 22:11:19 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2013.05.31 22:11:12 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2013.05.31 22:11:12 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2013.05.31 22:11:12 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2013.05.31 22:11:05 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2013.05.31 22:11:05 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2013.05.31 22:10:12 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2013.05.31 22:08:24 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\MicrosoftStore
[2013.05.31 22:01:05 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\Microsoft Help
[2013.05.31 22:01:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2013.05.31 21:58:55 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\Documents\moborobo
[2013.05.31 21:58:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Moborobo
[2013.05.31 21:58:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Moborobo
[2013.05.31 21:56:20 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Skype
[2013.05.31 21:56:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2013.05.31 21:54:22 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++
[2013.05.31 21:54:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
[2013.05.31 21:54:21 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Notepad++
[2013.05.31 21:50:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeCommander
[2013.05.31 21:49:37 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\FileZilla
[2013.05.31 21:49:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
[2013.05.31 21:48:26 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Foxit Software
[2013.05.31 21:45:19 | 000,692,104 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.05.31 21:45:19 | 000,071,048 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.05.31 21:45:18 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2013.05.31 21:45:17 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2013.05.31 21:45:05 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\Adobe
[2013.05.31 21:44:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2013.05.31 21:43:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2013.05.31 21:43:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.05.31 21:43:44 | 000,866,720 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2013.05.31 21:43:44 | 000,788,896 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2013.05.31 21:43:44 | 000,263,584 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013.05.31 21:43:42 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.05.31 21:43:42 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.05.31 21:43:42 | 000,095,648 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.05.31 21:43:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013.05.31 21:42:13 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Mozilla
[2013.05.31 21:42:13 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\Mozilla
[2013.05.31 21:42:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2013.05.31 21:42:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2013.05.31 21:36:46 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2013.05.31 21:36:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2013.05.31 21:33:54 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\WinRAR
[2013.05.31 21:33:47 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2013.05.31 21:33:08 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\Programs
[2013.05.31 21:32:58 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Malwarebytes
[2013.05.31 21:32:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.05.31 21:32:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.05.31 21:32:55 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.05.31 21:30:43 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Avira
[2013.05.31 21:30:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.05.31 21:30:28 | 000,140,936 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwot.sys
[2013.05.31 21:30:28 | 000,132,832 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.05.31 21:30:28 | 000,114,168 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwim.sys
[2013.05.31 21:30:28 | 000,098,848 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.05.31 21:30:28 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.05.31 21:30:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2013.05.31 20:52:11 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\Desktop\Neuer Ordner
[2013.05.31 19:45:52 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2013.05.31 19:29:20 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\Desktop\Billy Talent 1
[2013.05.31 19:26:29 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\Desktop\Olli Schulz & der Hund Marie
[2013.05.31 19:25:57 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\Desktop\Kings of Convenience
[2013.05.31 19:13:47 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\Desktop\blumentopf
[2013.05.31 19:10:48 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\Desktop\Musik
[2013.05.31 19:06:01 | 000,016,896 | ---- | C] (ASUS) -- C:\Windows\AsTaskSched.dll
[2013.05.31 19:05:07 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM
[2013.05.31 19:05:07 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2013.05.31 19:04:58 | 002,580,824 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib.dll
[2013.05.31 19:04:58 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll
[2013.05.31 19:04:58 | 000,220,496 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysNative\SFNHK64.dll
[2013.05.31 19:04:58 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll
[2013.05.31 19:04:58 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll
[2013.05.31 19:04:58 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll
[2013.05.31 19:04:58 | 000,121,744 | ---- | C] (Sony Corporation) -- C:\Windows\SysNative\SFSS_APO.dll
[2013.05.31 19:04:56 | 000,332,392 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtlCPAPI64.dll
[2013.05.31 19:04:56 | 000,081,232 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysNative\SFCOM64.dll
[2013.05.31 19:04:56 | 000,078,160 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysNative\SFAPO64.dll
[2013.05.31 19:04:56 | 000,074,064 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysWow64\SFCOM.dll
[2013.05.31 19:04:55 | 000,626,792 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkApi64.dll
[2013.05.31 19:04:55 | 000,149,608 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkCfg64.dll
[2013.05.31 19:04:54 | 002,813,544 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkAPO64.dll
[2013.05.31 19:04:54 | 002,186,344 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtPgEx64.dll
[2013.05.31 19:04:54 | 001,247,848 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTCOM64.dll
[2013.05.31 19:04:54 | 001,146,984 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTSnMg64.cpl
[2013.05.31 19:04:53 | 000,544,768 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RCoRes64.dat
[2013.05.31 19:04:53 | 000,375,128 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll
[2013.05.31 19:04:53 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll
[2013.05.31 19:04:53 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll
[2013.05.31 19:04:53 | 000,204,120 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll
[2013.05.31 19:04:53 | 000,101,208 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll
[2013.05.31 19:04:53 | 000,083,048 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RCoInst64.dll
[2013.05.31 19:04:53 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll
[2013.05.31 19:04:51 | 002,197,264 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ.dll
[2013.05.31 19:04:51 | 001,870,680 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek.dll
[2013.05.31 19:04:51 | 001,718,616 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEP64A.dll
[2013.05.31 19:04:51 | 000,421,720 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EED64A.dll
[2013.05.31 19:04:51 | 000,341,336 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO30.dll
[2013.05.31 19:04:51 | 000,334,680 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxVolumeSDAPO.dll
[2013.05.31 19:04:51 | 000,127,832 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEL64A.dll
[2013.05.31 19:04:51 | 000,108,888 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEA64A.dll
[2013.05.31 19:04:51 | 000,074,584 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEG64A.dll
[2013.05.31 19:04:50 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll
[2013.05.31 19:04:47 | 001,937,312 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll
[2013.05.31 19:04:47 | 001,327,208 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2SpeakerDLL64.dll
[2013.05.31 19:04:47 | 001,179,752 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2HeadphoneDLL64.dll
[2013.05.31 19:04:47 | 000,491,112 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSSymmetryDLL64.dll
[2013.05.31 19:04:47 | 000,475,752 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSVoiceClarityDLL64.dll
[2013.05.31 19:04:46 | 001,111,656 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBoostDLL64.dll
[2013.05.31 19:04:46 | 000,504,936 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBassEnhancementDLL64.dll
[2013.05.31 19:04:46 | 000,317,032 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSNeoPCDLL64.dll
[2013.05.31 19:04:46 | 000,269,928 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLimiterDLL64.dll
[2013.05.31 19:04:46 | 000,266,856 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGainCompensatorDLL64.dll
[2013.05.31 19:04:46 | 000,200,800 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\SysNative\AERTAC64.dll
[2013.05.31 19:04:46 | 000,126,056 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLFXAPO64.dll
[2013.05.31 19:04:46 | 000,125,544 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPO64.dll
[2013.05.31 19:04:46 | 000,125,032 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPONS64.dll
[2013.05.31 19:04:46 | 000,108,960 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\SysNative\AERTAR64.dll
[2013.05.31 19:04:21 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp
[2013.05.31 19:04:20 | 001,251,944 | R--- | C] (Realtek Semiconductor Corp.) -- C:\Windows\RtlExUpd.dll
[2013.05.31 19:04:07 | 000,315,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Difxb412.rra
[2013.05.31 19:03:50 | 000,120,408 | ---- | C] (JMicron Technology Corp.) -- C:\Windows\SysNative\drivers\jraid.sys
[2013.05.31 19:03:48 | 000,000,000 | ---D | C] -- C:\Windows\RaidTool
[2013.05.31 19:03:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2013.05.31 19:03:27 | 000,565,352 | ---- | C] (Realtek                                            ) -- C:\Windows\SysNative\drivers\Rt64win7.sys
[2013.05.31 19:03:27 | 000,107,552 | ---- | C] (Realtek Semiconductor Corporation) -- C:\Windows\SysNative\RTNUninst64.dll
[2013.05.31 19:03:21 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2013.05.31 19:03:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek
[2013.05.31 19:02:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ASM104xUSB3
[2013.05.31 19:02:17 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2013.05.31 18:53:56 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013.05.31 18:53:56 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Searches
[2013.05.31 18:53:56 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013.05.31 18:53:49 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Identities
[2013.05.31 18:53:47 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Contacts
[2013.05.31 18:53:46 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\VirtualStore
[2013.05.31 18:53:40 | 000,000,000 | --SD | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Videos
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Saved Games
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Pictures
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Music
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Links
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Favorites
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Downloads
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Documents
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\Desktop
[2013.05.31 18:53:40 | 000,000,000 | R--D | C] -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Vorlagen
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\AppData\Local\Verlauf
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\AppData\Local\Temporary Internet Files
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Startmenü
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\SendTo
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Recent
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Netzwerkumgebung
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Lokale Einstellungen
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Documents\Eigene Videos
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Documents\Eigene Musik
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Eigene Dateien
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Documents\Eigene Bilder
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Druckumgebung
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Cookies
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\AppData\Local\Anwendungsdaten
[2013.05.31 18:53:40 | 000,000,000 | -HSD | C] -- C:\Users\Maraxos\Anwendungsdaten
[2013.05.31 18:53:40 | 000,000,000 | -H-D | C] -- C:\Users\Maraxos\AppData
[2013.05.31 18:53:40 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\Temp
[2013.05.31 18:53:40 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Local\Microsoft
[2013.05.31 18:53:40 | 000,000,000 | ---D | C] -- C:\Users\Maraxos\AppData\Roaming\Media Center Programs
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\Recovery
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\Programme
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2013.05.31 18:53:34 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2013.05.31 18:49:59 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2013.05.31 18:47:53 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2013.05.31 18:47:25 | 000,000,000 | -HSD | C] -- C:\System Volume Information
 
========== Files - Modified Within 30 Days ==========
 
[2013.06.03 00:45:03 | 000,890,839 | ---- | M] () -- C:\Users\Maraxos\Desktop\SecurityCheck.exe
[2013.06.03 00:34:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.03 00:30:30 | 000,020,832 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.03 00:30:30 | 000,020,832 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.03 00:16:00 | 000,001,834 | ---- | M] () -- C:\Windows\tasks\Plus-HD-2.2-firefoxinstaller.job
[2013.06.03 00:11:04 | 000,001,202 | ---- | M] () -- C:\Windows\tasks\Plus-HD-2.2-codedownloader.job
[2013.06.03 00:11:04 | 000,001,198 | ---- | M] () -- C:\Windows\tasks\Plus-HD-2.2-updater.job
[2013.06.03 00:11:00 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\Plus-HD-2.2-enabler.job
[2013.06.02 23:30:34 | 002,347,384 | ---- | M] (ESET) -- C:\Users\Maraxos\Desktop\esetsmartinstaller_enu.exe
[2013.06.02 23:29:27 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Maraxos\Desktop\JRT.exe
[2013.06.02 22:33:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Maraxos\Desktop\OTL.exe
[2013.06.02 22:27:16 | 000,104,224 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.06.02 22:26:57 | 000,000,204 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job
[2013.06.02 22:26:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.02 22:26:34 | 4251,971,582 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.02 22:25:24 | 000,000,000 | ---- | M] () -- C:\Windows\EEventManager.INI
[2013.06.02 20:31:18 | 000,001,191 | ---- | M] () -- C:\Users\Maraxos\Desktop\Desinstaller_HOSTS_Anti-PUPs.lnk
[2013.06.02 20:08:41 | 000,632,031 | ---- | M] () -- C:\Users\Maraxos\Desktop\adwcleaner_2.3.0.1.exe
[2013.06.02 17:05:12 | 001,626,920 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.02 17:05:12 | 000,702,198 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.02 17:05:12 | 000,656,430 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.02 17:05:12 | 000,149,838 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.02 17:05:12 | 000,122,242 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.06.02 16:58:52 | 005,034,992 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.06.02 03:40:20 | 001,054,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013.06.02 03:40:20 | 000,719,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2013.06.02 03:40:20 | 000,690,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.06.02 03:40:20 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.06.02 03:40:20 | 000,226,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll
[2013.06.02 03:40:20 | 000,185,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll
[2013.06.02 03:40:20 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2013.06.02 03:40:20 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe
[2013.06.02 03:40:20 | 000,138,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe
[2013.06.02 03:40:20 | 000,137,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.06.02 03:40:20 | 000,125,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2013.06.02 03:40:20 | 000,117,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2013.06.02 03:40:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll
[2013.06.02 03:40:20 | 000,109,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.06.02 03:40:20 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2013.06.02 03:40:20 | 000,079,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.06.02 03:40:20 | 000,073,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013.06.02 03:40:20 | 000,071,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.06.02 03:40:20 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll
[2013.06.02 03:40:20 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll
[2013.06.02 03:40:20 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2013.06.02 03:40:19 | 003,958,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.06.02 03:40:19 | 001,509,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.06.02 03:40:19 | 001,441,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.06.02 03:40:19 | 001,400,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat
[2013.06.02 03:40:19 | 001,400,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat
[2013.06.02 03:40:19 | 000,905,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2013.06.02 03:40:19 | 000,855,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.06.02 03:40:19 | 000,762,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2013.06.02 03:40:19 | 000,629,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2013.06.02 03:40:19 | 000,603,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.06.02 03:40:19 | 000,599,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.06.02 03:40:19 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.06.02 03:40:19 | 000,452,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2013.06.02 03:40:19 | 000,441,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2013.06.02 03:40:19 | 000,361,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2013.06.02 03:40:19 | 000,281,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2013.06.02 03:40:19 | 000,235,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.06.02 03:40:19 | 000,232,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.06.02 03:40:19 | 000,216,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll
[2013.06.02 03:40:19 | 000,197,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2013.06.02 03:40:19 | 000,173,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.06.02 03:40:19 | 000,167,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe
[2013.06.02 03:40:19 | 000,149,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2013.06.02 03:40:19 | 000,144,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe
[2013.06.02 03:40:19 | 000,136,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.06.02 03:40:19 | 000,136,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2013.06.02 03:40:19 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll
[2013.06.02 03:40:19 | 000,102,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2013.06.02 03:40:19 | 000,097,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.06.02 03:40:19 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2013.06.02 03:40:19 | 000,089,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.06.02 03:40:19 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll
[2013.06.02 03:40:19 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2013.06.02 03:40:19 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll
[2013.06.02 03:40:19 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013.06.02 03:40:19 | 000,062,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll
[2013.06.02 03:40:19 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2013.06.02 03:40:19 | 000,061,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.06.02 03:40:19 | 000,051,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013.06.02 03:40:19 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll
[2013.06.02 03:40:19 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll
[2013.06.02 03:40:19 | 000,039,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013.06.02 03:40:19 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.06.02 03:40:19 | 000,027,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2013.06.02 03:40:19 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.06.02 03:40:19 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2013.06.02 03:40:19 | 000,023,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2013.06.02 03:40:19 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe
[2013.06.02 03:40:19 | 000,012,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2013.06.02 03:35:53 | 003,928,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll
[2013.06.02 03:35:53 | 002,776,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll
[2013.06.02 03:35:53 | 002,565,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll
[2013.06.02 03:35:53 | 002,284,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2013.06.02 03:35:53 | 001,682,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll
[2013.06.02 03:35:53 | 001,504,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013.06.02 03:35:53 | 001,158,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll
[2013.06.02 03:35:53 | 000,522,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll
[2013.06.02 03:35:53 | 000,465,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll
[2013.06.02 03:35:53 | 000,417,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll
[2013.06.02 03:35:53 | 000,364,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll
[2013.06.02 03:35:53 | 000,363,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll
[2013.06.02 03:35:53 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.06.02 03:35:53 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.06.02 03:35:53 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.06.02 03:35:53 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.06.02 03:35:53 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.06.02 03:35:52 | 001,887,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013.06.02 03:35:52 | 001,643,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2013.06.02 03:35:52 | 001,424,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013.06.02 03:35:52 | 001,238,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll
[2013.06.02 03:35:52 | 000,648,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2013.06.02 03:35:52 | 000,333,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll
[2013.06.02 03:35:52 | 000,296,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll
[2013.06.02 03:35:52 | 000,245,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll
[2013.06.02 03:35:52 | 000,221,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll
[2013.06.02 03:35:52 | 000,194,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2013.06.02 03:35:52 | 000,187,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll
[2013.06.02 03:26:09 | 001,600,496 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.06.02 02:14:35 | 000,000,308 | ---- | M] () -- C:\Windows\setup.iss
[2013.06.02 00:51:00 | 000,000,202 | ---- | M] () -- C:\Windows\tasks\AutoKMSDaily.job
[2013.06.01 00:55:50 | 000,002,807 | ---- | M] () -- C:\Users\Public\Desktop\Nero Burning ROM 12.lnk
[2013.06.01 00:49:19 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2013.06.01 00:10:20 | 000,000,843 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2013.06.01 00:00:59 | 000,001,019 | ---- | M] () -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.06.01 00:00:20 | 000,000,991 | ---- | M] () -- C:\Users\Maraxos\Desktop\Dropbox.lnk
[2013.05.31 23:58:54 | 000,000,184 | ---- | M] () -- C:\Windows\AutoKMS.ini
[2013.05.31 23:37:52 | 000,000,036 | ---- | M] () -- C:\Windows\SysNative\InstallationInfs
[2013.05.31 23:37:01 | 000,140,936 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwot.sys
[2013.05.31 23:37:01 | 000,132,832 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.05.31 23:37:01 | 000,114,168 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwim.sys
[2013.05.31 23:37:01 | 000,098,848 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.05.31 23:34:44 | 000,000,521 | ---- | M] () -- C:\Users\Maraxos\Desktop\Fraps.lnk
[2013.05.31 23:20:31 | 000,000,582 | ---- | M] () -- C:\Users\Maraxos\Desktop\IrfanView.lnk
[2013.05.31 22:30:42 | 000,001,249 | ---- | M] () -- C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
[2013.05.31 22:26:35 | 000,001,096 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk
[2013.05.31 22:22:38 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2013.05.31 21:58:53 | 000,000,553 | ---- | M] () -- C:\Users\Public\Desktop\Moborobo.lnk
[2013.05.31 21:54:22 | 000,000,639 | ---- | M] () -- C:\Users\Maraxos\Desktop\Notepad++.lnk
[2013.05.31 21:50:48 | 000,000,593 | ---- | M] () -- C:\Users\Maraxos\Desktop\FreeCommander.lnk
[2013.05.31 21:45:19 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.05.31 21:45:19 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.05.31 21:43:39 | 000,866,720 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2013.05.31 21:43:39 | 000,788,896 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2013.05.31 21:43:39 | 000,263,584 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013.05.31 21:43:39 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.05.31 21:43:39 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.05.31 21:43:39 | 000,095,648 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.05.31 21:42:07 | 000,000,653 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.05.31 21:33:20 | 000,000,627 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.05.31 21:30:39 | 000,000,758 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.05.31 20:51:23 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2013.05.31 19:06:02 | 000,016,896 | ---- | M] (ASUS) -- C:\Windows\AsTaskSched.dll
[2013.05.31 19:01:52 | 000,029,532 | ---- | M] () -- C:\Windows\Ascd_tmp.ini
[2013.05.31 19:01:37 | 000,001,769 | ---- | M] () -- C:\Windows\Language_trs.ini
[2013.05.31 18:50:45 | 000,177,271 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2013.05.31 18:50:45 | 000,177,271 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2013.05.16 14:32:46 | 001,277,744 | ---- | M] () -- C:\Windows\SysNative\dmwu.exe
[2013.05.16 14:31:26 | 000,035,328 | ---- | M] (IncrediMail, Ltd.) -- C:\Windows\SysNative\ImHttpComm.dll
[2013.05.16 14:02:40 | 000,829,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcr100.dll
[2013.05.16 14:02:40 | 000,608,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcp100.dll
 
========== Files Created - No Company Name ==========
 
[2013.06.03 00:44:48 | 000,890,839 | ---- | C] () -- C:\Users\Maraxos\Desktop\SecurityCheck.exe
[2013.06.02 22:25:24 | 000,000,000 | ---- | C] () -- C:\Windows\EEventManager.INI
[2013.06.02 22:20:08 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.06.02 22:20:08 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.06.02 22:20:08 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.06.02 22:20:08 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.06.02 22:20:08 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.06.02 20:24:30 | 000,001,191 | ---- | C] () -- C:\Users\Maraxos\Desktop\Desinstaller_HOSTS_Anti-PUPs.lnk
[2013.06.02 20:08:37 | 000,632,031 | ---- | C] () -- C:\Users\Maraxos\Desktop\adwcleaner_2.3.0.1.exe
[2013.06.02 03:49:15 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2013.06.02 03:40:19 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.06.02 03:40:19 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013.06.02 03:14:45 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2013.06.02 02:14:25 | 000,000,308 | ---- | C] () -- C:\Windows\setup.iss
[2013.06.01 00:55:50 | 000,002,807 | ---- | C] () -- C:\Users\Public\Desktop\Nero Burning ROM 12.lnk
[2013.06.01 00:49:19 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.06.01 00:11:40 | 001,277,744 | ---- | C] () -- C:\Windows\SysNative\dmwu.exe
[2013.06.01 00:11:25 | 000,001,198 | ---- | C] () -- C:\Windows\tasks\Plus-HD-2.2-updater.job
[2013.06.01 00:11:22 | 000,001,102 | ---- | C] () -- C:\Windows\tasks\Plus-HD-2.2-enabler.job
[2013.06.01 00:11:21 | 000,001,202 | ---- | C] () -- C:\Windows\tasks\Plus-HD-2.2-codedownloader.job
[2013.06.01 00:11:13 | 000,001,834 | ---- | C] () -- C:\Windows\tasks\Plus-HD-2.2-firefoxinstaller.job
[2013.06.01 00:10:20 | 000,000,843 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2013.05.31 23:53:46 | 000,000,855 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe After Effects CS6.lnk
[2013.05.31 23:50:09 | 000,000,755 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Media Encoder CS6.lnk
[2013.05.31 23:44:30 | 000,000,721 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Dreamweaver CS6.lnk
[2013.05.31 23:43:28 | 000,001,003 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2013.05.31 23:42:57 | 000,001,103 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Widget Browser.lnk
[2013.05.31 23:37:49 | 000,000,036 | ---- | C] () -- C:\Windows\SysNative\InstallationInfs
[2013.05.31 23:35:20 | 000,000,750 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
[2013.05.31 23:34:52 | 000,000,705 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
[2013.05.31 23:34:44 | 000,000,521 | ---- | C] () -- C:\Users\Maraxos\Desktop\Fraps.lnk
[2013.05.31 23:34:26 | 000,000,724 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
[2013.05.31 23:34:12 | 000,000,679 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
[2013.05.31 23:32:32 | 000,000,799 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
[2013.05.31 23:32:28 | 000,001,529 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
[2013.05.31 23:20:31 | 000,000,582 | ---- | C] () -- C:\Users\Maraxos\Desktop\IrfanView.lnk
[2013.05.31 23:05:30 | 001,600,496 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.05.31 22:30:42 | 000,001,249 | ---- | C] () -- C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
[2013.05.31 22:27:33 | 000,000,991 | ---- | C] () -- C:\Users\Maraxos\Desktop\Dropbox.lnk
[2013.05.31 22:26:35 | 000,001,108 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk
[2013.05.31 22:26:35 | 000,001,096 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk
[2013.05.31 22:26:13 | 000,001,019 | ---- | C] () -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.05.31 22:14:38 | 000,000,204 | ---- | C] () -- C:\Windows\tasks\AutoKMS.job
[2013.05.31 22:14:37 | 000,000,202 | ---- | C] () -- C:\Windows\tasks\AutoKMSDaily.job
[2013.05.31 22:14:37 | 000,000,184 | ---- | C] () -- C:\Windows\AutoKMS.ini
[2013.05.31 21:58:57 | 000,012,072 | ---- | C] () -- C:\Windows\SysWow64\drivers\MoborobAssDriver64.sys
[2013.05.31 21:58:53 | 000,000,553 | ---- | C] () -- C:\Users\Public\Desktop\Moborobo.lnk
[2013.05.31 21:56:16 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2013.05.31 21:54:22 | 000,000,639 | ---- | C] () -- C:\Users\Maraxos\Desktop\Notepad++.lnk
[2013.05.31 21:50:48 | 000,000,593 | ---- | C] () -- C:\Users\Maraxos\Desktop\FreeCommander.lnk
[2013.05.31 21:45:19 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.05.31 21:42:07 | 000,000,653 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.05.31 21:42:07 | 000,000,653 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013.05.31 21:32:56 | 000,000,627 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.05.31 21:30:39 | 000,000,758 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.05.31 20:51:23 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2013.05.31 19:03:27 | 000,074,272 | ---- | C] () -- C:\Windows\SysNative\RtNicProp64.dll
[2013.05.31 19:01:37 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2013.05.31 19:01:33 | 000,029,532 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2013.05.31 18:53:58 | 000,001,431 | ---- | C] () -- C:\Users\Maraxos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013.05.31 18:50:36 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2013.05.31 18:50:29 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2013.05.31 18:47:21 | 4251,971,582 | -HS- | C] () -- C:\hiberfil.sys
[2013.03.29 04:13:14 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe
[2013.03.29 04:13:12 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe
[2013.03.29 03:38:08 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2013.03.29 03:38:08 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.11.27 01:18:46 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >
Extras von OTL:
Code:
ATTFilter
OTL Extras logfile created on: 03.06.2013 00:48:01 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Maraxos\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
15,95 Gb Total Physical Memory | 13,34 Gb Available Physical Memory | 83,67% Memory free
31,89 Gb Paging File | 28,96 Gb Available in Paging File | 90,82% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 388,97 Gb Free Space | 83,53% Space Free | Partition Type: NTFS
Drive D: | 333,86 Gb Total Space | 333,76 Gb Free Space | 99,97% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 461,87 Gb Free Space | 99,16% Space Free | Partition Type: NTFS
Drive F: | 597,65 Gb Total Space | 597,55 Gb Free Space | 99,98% Space Free | Partition Type: NTFS
Drive G: | 265,59 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: MARAXOS-PC | User Name: Maraxos | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- E:\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- E:\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView] -- "E:\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- E:\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView] -- "E:\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{FD83439F-9F1F-437E-93D4-4DD0843D3B14}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09EBF597-D518-43C7-81E1-5453D0253893}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe | 
"{13D70166-D73F-4A88-ABC8-E1BD6BD0758A}" = protocol=6 | dir=in | app=c:\users\maraxos\appdata\roaming\utorrent\utorrent.exe | 
"{227E3E99-CDD9-4699-9556-0ED27A5C0C30}" = protocol=6 | dir=in | app=c:\windows\syswow64\arfc\wrtc.exe | 
"{268A58DE-B170-44B5-876F-A5FFC2CA2775}" = protocol=17 | dir=in | app=c:\users\maraxos\appdata\roaming\dropbox\bin\dropbox.exe | 
"{3AF9871F-EB1E-4498-8940-3E189CCA1823}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe | 
"{3D0D83A2-EBB0-4483-8B6D-C074AABCA504}" = protocol=17 | dir=in | app=c:\users\maraxos\appdata\roaming\utorrent\utorrent.exe | 
"{55F71867-246A-493D-A63E-8881946871CE}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe | 
"{5C537089-C2E9-47B1-ABE8-21AFACCB18F3}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe | 
"{5F5DD809-0657-4C55-900F-9B8E6C9D3061}" = protocol=17 | dir=in | app=c:\windows\syswow64\arfc\wrtc.exe | 
"{73B55C52-BC32-44F7-A915-4F82C929C1ED}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{8B877E99-BEA3-430B-B189-0A9BEFE0B557}" = protocol=6 | dir=in | app=c:\windows\syswow64\arfc\wrtc.exe | 
"{A9C5ED02-5315-41C3-9D21-8096810E8E37}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe | 
"{B92405E0-7EAD-4381-895D-B9592933C218}" = protocol=6 | dir=in | app=e:\moborobo\update.exe | 
"{C081B51C-9663-4995-9CE5-F8B4DD9A21C6}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe | 
"{C65CFA0D-615F-4FF8-BF59-7A61C286F2D0}" = protocol=6 | dir=in | app=c:\users\maraxos\appdata\roaming\dropbox\bin\dropbox.exe | 
"{CF733D28-F74D-4A50-8A95-93781DA394F2}" = dir=in | app=e:\moborobo\update.exe | 
"{DD4DB7D4-0F31-4BB0-98EF-C79FA0DE315A}" = protocol=17 | dir=in | app=c:\windows\syswow64\arfc\wrtc.exe | 
"{E2067C5B-CC64-49D0-8059-C0E696D9B768}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{ECCCD2A9-08B2-42DB-8C99-3B8ADA6C70A8}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{F01B881F-485C-4ED9-93ED-AC885E846E35}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe | 
"{F462E264-FD4B-461B-A05E-CC7265987961}" = protocol=17 | dir=in | app=e:\moborobo\update.exe | 
"{F8B74FF8-7EAC-4BE3-8CF2-CC66E00FB9AE}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}" = Microsoft .NET Framework 4.5
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{55B348BE-A3BE-9AE7-58BD-BE45B9A28F82}" = AMD Media Foundation Decoders
"{5B73E1AA-CA9D-E76A-2F2D-E0EFB41CE087}" = AMD Accelerated Video Transcoding
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-0015-0407-1000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-1000-0000000FF1CE}_Office14.SingleImage_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-1000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-1000-0000000FF1CE}_Office14.SingleImage_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-1000-0000000FF1CE}_Office14.SingleImage_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-1000-0000000FF1CE}_Office14.SingleImage_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-1000-0000000FF1CE}_Office14.SingleImage_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-1000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-1000-0000000FF1CE}_Office14.SingleImage_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-1000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-1000-0000000FF1CE}_Office14.SingleImage_{70A3169E-288F-454F-A08D-20DF66639B50}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-1000-0000000FF1CE}_Office14.SingleImage_{0242505C-4E90-407F-9299-B5B275F50D86}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-1000-0000000FF1CE}_Office14.SingleImage_{B51389C8-2890-4633-81D8-47D2A7402274}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-1000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-1000-0000000FF1CE}_Office14.SingleImage_{3013A793-10A7-4D1F-B8B4-2FAA82F4D259}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-1000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-1000-0000000FF1CE}_Office14.SingleImage_{98782D5D-A9EE-43C6-88AD-B50AD8530E78}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-1000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010
"{90140000-0043-0000-1000-0000000FF1CE}_Office14.SingleImage_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0407-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (German) 2010
"{90140000-0043-0407-1000-0000000FF1CE}_Office14.SingleImage_{8DFD91C7-66AE-4E54-9901-5D5F401AD329}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-1000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-1000-0000000FF1CE}_Office14.SingleImage_{8299B64F-1537-4081-974C-033EAB8F098E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-1000-0000000FF1CE}_Office14.SingleImage_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B01875AA-1BD4-5B9F-D2B9-23D909F4280B}" = AMD Drag and Drop Transcoding
"{C8807716-1F6F-5C43-3C32-7295A45CF060}" = AMD Catalyst Install Manager
"{CC1FE395-D90F-712C-E013-EBDCC30433B1}" = AMD Fuel
"{E54A949B-C4AE-28B6-EC97-FCB9E402D338}" = ccc-utility64
"EPSON XP-202 203 206 Series" = Druckerdeinstallation für EPSON XP-202 203 206 Series
"Office14.SingleImage" = Microsoft Office Professional 2010
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR 4.20 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02B934E4-C574-4605-842B-01CD16295185}_is1" = Moborobo 2.1.0.631
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{11F2C5EC-35AA-7237-B62B-A4F041859C2A}" = CCC Help Spanish
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{229EDE35-4677-BDE6-70ED-A5A4C711DDC3}" = CCC Help Norwegian
"{2432E589-6256-4513-B0BF-EFA8E325D5F0}" = Nero SharedVideoCodecs
"{2470F2F2-8491-5A0B-B8F5-8B72A8D74597}" = Catalyst Control Center InstallProxy
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{27B56E28-94B2-BDF8-D209-EC8D2FF4838E}" = Catalyst Control Center Graphics Previews Common
"{2890E324-6F3B-4975-8B95-E7D6D80E0226}" = Nero Burning ROM Help (CHM)
"{30E01116-5666-4807-8EF1-D80E9FF16717}" = Epson Easy Photo Print 2
"{33D4FA83-02C0-93B3-08ED-5D7378930CFA}" = CCC Help Turkish
"{37D0F3C2-8FFD-134D-FBDF-2D711E169D78}" = AMD VISION Engine Control Center
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMicron JMB36X Driver
"{3AAB08A3-F129-4BD5-B409-AE674F93759D}" = Prerequisite installer
"{3D9167B2-87EB-4713-90B4-E46F2CAFE28D}" = Nero BurningROM 12
"{3E31400D-274E-4647-916C-2CACC3741799}" = EpsonNet Print
"{42FECCEF-63CD-DF98-D6BC-DDBB27E4A580}" = CCC Help Japanese
"{46594DA4-2D0A-B2D4-C0E0-A5CCA3260025}" = CCC Help Hungarian
"{4817D846-700B-474E-A31B-80892B3E92E3}" = Adobe After Effects CS6
"{485B8152-C59F-8569-15BC-46BDA2A1E4A9}" = CCC Help Polish
"{490F47E6-585C-531A-1BF8-4DE44ED9AED7}" = CCC Help Russian
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{50F87176-7DB3-4C75-D9DC-25CB4561D0F8}" = CCC Help Danish
"{52E706AA-B4E9-423A-1651-62E61E06DF9A}" = CCC Help Greek
"{5963F4B4-D138-47CD-ADEF-470E87E185BD}" = Nero Burning ROM
"{5FB51C12-62AE-0990-E419-C6F62B776E5C}" = CCC Help Portuguese
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{66B46617-A156-F25B-3CC0-5E46343AEA95}" = CCC Help Thai
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}" = Adobe Photoshop CS6
"{81543139-18AE-703B-D3B1-F6B3A0CB2EAC}" = CCC Help English
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8FA20FAC-719F-7CCD-5790-6B59D691C370}" = CCC Help Chinese Traditional
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{940B28E7-320B-5AC8-0A8A-32D6A7B404A1}" = CCC Help Swedish
"{99C382AB-CA1D-8577-66D3-AA850DB5FD00}" = CCC Help Korean
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A4ED5E53-7AA0-11E1-BF04-B2D4D4A5360E}" = Adobe Dreamweaver CS6
"{A68C4D16-8046-5333-CB64-5E622C795785}" = CCC Help Dutch
"{ABC88553-8770-4B97-B43E-5A90647A5B63}" = Nero ControlCenter
"{AF37176A-78CA-545B-34EF-8B6A21514DD1}" = Adobe Help Manager
"{B2D55EB8-32C5-4B43-9006-9E97DECBA178}" = Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
"{BE0B654E-FC60-40AE-F60B-06526508B5FD}" = CCC Help Italian
"{BE0E1491-B2DC-6447-217C-342D8F7100EA}" = CCC Help Czech
"{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components
"{BECE9CCD-83F6-4BAA-9B26-227DF7D2E932}" = Epson Event Manager
"{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}" = PDF Settings CS6
"{C5EADF55-3B49-B545-E16F-402B443DDC77}" = CCC Help German
"{C994C746-C6D0-4EBA-B09E-DF7B18381B69}" = Nero ControlCenter Help (CHM)
"{CBDFF724-E925-2964-E647-0A83D2F9165C}" = CCC Help French
"{D5341564-7B93-ADAC-E737-C24AA85CC5FF}" = CCC Help Chinese Standard
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E3FB1E5A-1C24-D581-6BC8-6F8AC2D343AD}" = CCC Help Finnish
"{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}" = Asmedia ASM104x USB 3.0 Host Controller Driver
"{E728441A-7820-4B1C-87C9-DE7BE37B2953}" = Download Navigator
"{EEE6C374-6118-11DC-9C72-001320C79847}" = SweetPacks Toolbar For Firefox 1.13.0.0
"{EFBE6DD5-B224-96E5-72B9-68D328CB12A6}" = Adobe Widget Browser
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E79BE5-20F5-82F4-6579-2A91AED3F066}" = Catalyst Control Center Localization All
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F9000000-0018-0000-0000-074957833700}" = ABBYY FineReader 9.0 Sprint
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"ABBYY FineReader 9.0 Sprint" = ABBYY FineReader 9.0 Sprint
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Internet Security 2012
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Help Manager
"com.adobe.WidgetBrowser" = Adobe Widget Browser
"EPSON Scanner" = EPSON Scan
"EPSON XP-202 203 206 Series Netg" = Netzwerkhandbuch EPSON XP-202 203 206 Series
"FileZilla Client" = FileZilla Client 3.7.0.2
"Fraps" = Fraps (remove only)
"Free Studio_is1" = Free Studio version 2013
"FreeCommander_is1" = FreeCommander 2009.02b
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Notepad++" = Notepad++
"Plus-HD-2.2" = Plus-HD-2.2
"TeamViewer 8" = TeamViewer 8
"uTorrent" = µTorrent
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 02.06.2013 17:34:27 | Computer Name = Maraxos-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Maraxos\Desktop\esetsmartinstaller_enu.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 02.06.2013 18:42:51 | Computer Name = Maraxos-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files
 (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in  Manifest- oder
 Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion
 steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt
 stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
 
< End of report >

Alt 03.06.2013, 06:29   #10
schrauber
/// the machine
/// TB-Ausbilder
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 03.06.2013, 08:02   #11
Maraxos
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


Ne nicht mehr danke, frag mich wie ich den mist bekommen habe und was das ist^^

Alt 03.06.2013, 09:00   #12
schrauber
/// the machine
/// TB-Ausbilder
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


Meist bei ner Installation von irgendwas


Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.


Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 03.06.2013, 11:46   #13
Maraxos
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


Hi wolle kurz fragen ob du meinst ob ich Defogger oder Combofix benutzt habe? wenn ja was ist das vom namen her sagen die mir jetz nichts.

Wenn ich von der Arbeit nachhause komme werde ich die Punkte ababeiten

Alt 03.06.2013, 11:52   #14
schrauber
/// the machine
/// TB-Ausbilder
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


Haben wir nicht benutzt
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 04.06.2013, 18:12   #15
Maraxos
 
Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Standard

Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


Ok hab alles fertig gemacht, Danke dir noch mals

Antwort
Seite 1 von 2 1 2

Themen zu Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?
administrator, appdatalow, avira, computer, dateien, explorer, externe festplatte, festplatte, firefox, frage, internet browser, löschen, malwarebytes, microsoft, mozilla, neu, neue, opera, ordner, programme, registrierungsdatenbank, scan, seiten, server, software, suche, sweetpacks, teamspeak, temp


« "nero.bat"-Fenster bei jedem Start | GUV-Trojaner bei Zugriff auf den Desktop »


Ähnliche Themen: Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?


  1. mein rechner hängt sich zunehmend häufig auf, "blue screen"
    Plagegeister aller Art und deren Bekämpfung - 19.10.2015 (19)
  2. Avast: "Eine Bedrohung wurde gefunden" eagl, was im Browser gemacht wird
    Plagegeister aller Art und deren Bekämpfung - 15.08.2015 (11)
  3. Avast meldet "Eine Bedrohung wurde gefunden" - svchost.exe beteiligt
    Plagegeister aller Art und deren Bekämpfung - 18.06.2015 (33)
  4. Windows7 64Bit: mit malwarebyts schädliche Elemente gefunden, außerdem wurde eine "Telekom-Rechnung" mit Anhang geöffnet.
    Plagegeister aller Art und deren Bekämpfung - 05.12.2014 (5)
  5. Windows 7: Bin mir nicht sicher, ob mein Computer vollständig "desinfiziert" wurde
    Plagegeister aller Art und deren Bekämpfung - 11.03.2014 (17)
  6. "Prozedureinsprungpunkt"_iob_func" wurde in der DLL "MSVCR70.dll" nicht gefunden
    Plagegeister aller Art und deren Bekämpfung - 11.03.2014 (4)
  7. Malwarebytes hat "Babylon" entdeckt und beseitigt, ist mein Rechner jetzt sauber?
    Plagegeister aller Art und deren Bekämpfung - 13.10.2013 (15)
  8. Beim Systemstart "Das angegebene Modul wurde nicht gefunden"
    Log-Analyse und Auswertung - 18.08.2013 (7)
  9. Wurde mein Rapidshare-Account durch einen Keylogger, etc. "gehackt"?
    Plagegeister aller Art und deren Bekämpfung - 07.05.2012 (0)
  10. RunDLL "Das angegebene Modul wurde nicht gefunden."
    Plagegeister aller Art und deren Bekämpfung - 12.04.2012 (39)
  11. Aus Sicherheitsgründen wurde "MEIN" Windowssystem blockiert
    Plagegeister aller Art und deren Bekämpfung - 20.03.2012 (1)
  12. "Ihr Rechner wurde gesperrt" - Windows XP
    Plagegeister aller Art und deren Bekämpfung - 02.03.2012 (1)
  13. Mein Windows wurde auch aus "Sicherheitsgründen" gesperrt
    Plagegeister aller Art und deren Bekämpfung - 29.12.2011 (31)
  14. JAVA/Exdoer.CU.2 in Quarantäne. Ist mein Rechner wieder "sauber"?
    Plagegeister aller Art und deren Bekämpfung - 09.11.2011 (19)
  15. fehlermeldung Der Prozedureinsprungpunkt "CreatePo" wurde in der DLL "USER32.dll" nicht gefunden.
    Plagegeister aller Art und deren Bekämpfung - 14.03.2011 (3)
  16. TR/Crypt.ZPACK.Gen ist mein Rechner jetzt "sauber"?
    Plagegeister aller Art und deren Bekämpfung - 26.06.2010 (15)
  17. Crypt.ZPACK.Gen - ist mein Rechner jetzt endlich wieder "sauber"
    Plagegeister aller Art und deren Bekämpfung - 11.04.2010 (1)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? - Hi Leute, Ich habe mein Computer am 31.5.2013 neu gemacht, nun habe ich Mbam auf mein Computer installiert sowie Avira und meine Programme die ich benötige. Ich habe aber bevor - Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun?...
Archiv
Du betrachtest: Auf mein Rechner wurde eine "pud.installBrain" gefunden, was tun? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129