Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: "C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937 startet automatisch

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 13.02.2011, 15:08   #1
anI0n
 
"C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937  startet automatisch - Standard

"C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937 startet automatisch



Hallo zusammen,

seid nun mehr einer Woche, startet der oben beschriebene Prozess von selbst. Wenn ich ihn beenden möchte (über Taskmanager), startet dieser sofort wieder neu.
Ich habe die Systempartition schon formatiert und das Problem besteht immer noch...

Hier mal ein paar logfiles (hijackthis, mbam, OTL, Extras)

1. hijackthis:HiJackthis Logfile:
Code:
ATTFilter
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:47:02, on 13.02.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16722)
Boot mode: Normal
 
Running processes:
C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files (x86)\Opera\opera.exe
F:\HiJackThis204.exe
 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan Enterprise\scriptsn.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O4 - HKLM\..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files (x86)\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Miranda Fusion] C:\Program Files (x86)\MirandaFusion\fusiontools\mfstart.exe
O4 - HKCU\..\Run: [GizmoDriveDelegate] RUNDLL32.EXE C:\PROGRA~2\GIZMO\GDRIVE.DLL,Remount_Startup_Images
O4 - Startup: Logitech . Produktregistrierung.lnk = C:\Program Files (x86)\Logitech\Ereg\eReg.exe
O4 - Startup: Xfire.lnk = C:\Program Files (x86)\Xfire\Xfire.exe
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Gizmo Central - Arainia Solutions - C:\Program Files (x86)\Gizmo\gservice.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\EngineServer.exe
O23 - Service: McAfee Framework-Dienst (McAfeeFramework) - McAfee, Inc. - C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - Unknown owner - C:\Windows\system32\mfevtps.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
 
--
End of file - 8090 bytes
         
--- --- ---


2. mbam:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5753

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

13.02.2011 15:23:49
mbam-log-2011-02-13 (15-23-49).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 155933
Laufzeit: 2 Minute(n), 22 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


3. OTLOTL Logfile:
Code:
ATTFilter
OTL logfile created on: 13.02.2011 15:38:31 - Run 2
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\anI0n\Desktop\MFTools
64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 69,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 150,00 Gb Total Space | 118,11 Gb Free Space | 78,74% Space Free | Partition Type: NTFS
Drive D: | 359,33 Gb Total Space | 104,25 Gb Free Space | 29,01% Space Free | Partition Type: NTFS
Drive E: | 100,00 Gb Total Space | 51,86 Gb Free Space | 51,86% Space Free | Partition Type: NTFS
Drive F: | 89,30 Gb Total Space | 85,13 Gb Free Space | 95,33% Space Free | Partition Type: NTFS
Drive I: | 149,95 Gb Total Space | 95,57 Gb Free Space | 63,73% Space Free | Partition Type: NTFS
Drive J: | 315,81 Gb Total Space | 72,51 Gb Free Space | 22,96% Space Free | Partition Type: NTFS
Drive K: | 186,31 Gb Total Space | 48,34 Gb Free Space | 25,95% Space Free | Partition Type: NTFS
 
Computer Name: AKASHA | User Name: anI0n | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.02.13 15:01:38 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\anI0n\Desktop\MFTools\OTL.exe
PRC - [2011.02.11 15:28:56 | 000,031,856 | ---- | M] (Arainia Solutions) -- C:\Program Files (x86)\Gizmo\gservice.exe
PRC - [2010.05.07 18:47:32 | 000,114,008 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\LVPrS64H.exe
PRC - [2010.05.07 18:43:52 | 000,651,096 | ---- | M] () -- C:\Program Files (x86)\Common Files\logishrd\LQCVFX\COCIManager.exe
PRC - [2010.05.07 18:35:22 | 000,165,208 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
PRC - [2010.05.07 18:34:58 | 000,168,792 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
PRC - [2009.10.22 20:07:00 | 000,124,240 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe
PRC - [2009.10.22 20:07:00 | 000,066,896 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe
PRC - [2009.08.25 16:00:00 | 000,226,624 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe
PRC - [2009.08.25 16:00:00 | 000,136,512 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
PRC - [2009.08.25 16:00:00 | 000,103,744 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.02.13 15:01:38 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\anI0n\Desktop\MFTools\OTL.exe
MOD - [2010.08.21 06:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.05.07 18:45:16 | 000,197,976 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe -- (LVPrcS64)
SRV:64bit: - [2010.05.06 10:30:22 | 000,357,456 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV:64bit: - [2009.10.22 20:07:00 | 000,079,504 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Windows\SysNative\mfevtps.exe -- (mfevtp)
SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2011.02.11 15:28:56 | 000,031,856 | ---- | M] (Arainia Solutions) [Auto | Running] -- C:\Program Files (x86)\Gizmo\gservice.exe -- (Gizmo Central)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.10.22 20:07:00 | 000,178,920 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe -- (McShield)
SRV - [2009.10.22 20:07:00 | 000,066,896 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe -- (McTaskManager)
SRV - [2009.10.22 20:07:00 | 000,019,720 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\EngineServer.exe -- (McAfeeEngineService)
SRV - [2009.08.25 16:00:00 | 000,103,744 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe -- (McAfeeFramework)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007.05.31 17:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 17:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2010.11.10 02:45:54 | 004,162,784 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64) Logitech Webcam Pro 9000(UVC)
DRV:64bit: - [2010.11.10 02:44:24 | 000,341,856 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2010.07.21 16:58:50 | 000,045,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2010.07.07 18:18:58 | 000,051,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB)
DRV:64bit: - [2010.05.07 18:43:30 | 000,030,304 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LVPr2M64.sys -- (LVPr2Mon)
DRV:64bit: - [2010.05.07 18:43:30 | 000,030,304 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVPr2M64.sys -- (LVPr2M64)
DRV:64bit: - [2010.03.18 10:00:16 | 000,057,936 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2010.03.18 10:00:00 | 000,063,568 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2010.03.18 09:59:52 | 000,013,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:64bit: - [2010.03.18 09:59:44 | 000,074,320 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:64bit: - [2009.10.22 20:07:00 | 000,469,144 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk)
DRV:64bit: - [2009.10.22 20:07:00 | 000,119,968 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk)
DRV:64bit: - [2009.10.22 20:07:00 | 000,097,576 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeapfk.sys -- (mfeapfk)
DRV:64bit: - [2009.10.22 20:07:00 | 000,083,784 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfetdik.sys -- (mfetdik)
DRV:64bit: - [2009.10.22 20:07:00 | 000,077,104 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mferkdet.sys -- (mferkdet)
DRV:64bit: - [2009.10.02 09:58:38 | 000,514,144 | ---- | M] (ITETech ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AF15BDA.sys -- (AF9035BDA)
DRV:64bit: - [2009.07.30 17:12:56 | 000,339,744 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2009.07.14 02:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009.07.14 02:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009.06.10 21:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009.06.10 21:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2005.03.29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 60 D9 36 07 F6 C9 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.02.11 20:20:15 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.02.11 20:20:13 | 000,000,000 | ---D | M]
 
[2011.02.11 16:27:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\anI0n\AppData\Roaming\Mozilla\Extensions
[2011.02.11 16:27:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\anI0n\AppData\Roaming\Mozilla\Firefox\Profiles\en2s99z5.default\extensions
[2011.02.11 20:20:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011.02.11 16:30:14 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.12.03 19:14:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.12.03 19:14:08 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.12.03 19:14:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.12.03 19:14:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.12.03 19:14:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan Enterprise\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [itype] c:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files (x86)\McAfee\Common Framework\udaterui.exe (McAfee, Inc.)
O4 - HKLM..\Run: [ShStatEXE] C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKCU..\Run: [GizmoDriveDelegate] C:\Program Files (x86)\Gizmo\gdrive.dll ()
O4 - HKCU..\Run: [Miranda Fusion] C:\Program Files (x86)\MirandaFusion\fusiontools\mfstart.exe (Miranda Fusion Team)
O4 - Startup: C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk = C:\Program Files (x86)\Logitech\Ereg\eReg.exe (Leader Technologies/Logitech)
O4 - Startup: C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files (x86)\Xfire\Xfire.exe (Xfire Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - Reg Error: Key error. - c:\Program Files\Common Files\logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: GizmoDriveDelegate - hkey= - key= - C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.02.13 15:20:30 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011.02.13 15:20:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2011.02.13 15:20:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ERUNT
[2011.02.13 15:03:29 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Malwarebytes
[2011.02.13 15:03:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.02.13 15:03:08 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011.02.13 15:03:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.02.13 15:03:05 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.02.13 15:03:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.02.13 15:02:16 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Local\Diagnostics
[2011.02.13 15:01:32 | 000,000,000 | ---D | C] -- C:\Users\anI0n\Desktop\MFTools
[2011.02.13 14:27:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClearProg
[2011.02.13 14:27:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ClearProg
[2011.02.13 13:53:15 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\WinRAR
[2011.02.12 19:14:45 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\vlc
[2011.02.12 18:39:46 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\TS3Client
[2011.02.11 20:43:30 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Local\S2
[2011.02.11 20:43:27 | 000,000,000 | ---D | C] -- C:\Users\anI0n\Documents\S2
[2011.02.11 20:41:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft
[2011.02.11 20:41:25 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
[2011.02.11 20:39:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ubisoft
[2011.02.11 20:36:45 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Local\Monte Cristo
[2011.02.11 20:02:38 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EveHQ
[2011.02.11 20:02:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EveHQ
[2011.02.11 19:46:02 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\en
[2011.02.11 19:46:02 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0409
[2011.02.11 19:46:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\en-US
[2011.02.11 19:45:38 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\en
[2011.02.11 19:45:37 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0409
[2011.02.11 19:45:36 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\en-US
[2011.02.11 19:37:31 | 000,003,584 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\en-US\pscr.sys.mui
[2011.02.11 19:36:57 | 000,010,240 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrSerIb.sys.mui
[2011.02.11 19:36:56 | 000,010,240 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrSerId.sys.mui
[2011.02.11 19:36:56 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrParwdm.sys.mui
[2011.02.11 18:35:42 | 000,000,000 | ---D | C] -- C:\Users\anI0n\Documents\EVE
[2011.02.11 18:35:36 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Local\CCP
[2011.02.11 18:33:44 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EVE
[2011.02.11 17:38:57 | 000,000,000 | ---D | C] -- C:\ProgramData\CCP
[2011.02.11 17:35:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft-Tastatur
[2011.02.11 17:35:14 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft IntelliType Pro
[2011.02.11 17:29:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft-Maus
[2011.02.11 17:29:29 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft IntelliPoint
[2011.02.11 17:19:48 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2011.02.11 17:02:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
[2011.02.11 16:42:46 | 000,000,000 | ---D | C] -- C:\ProgramData\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
[2011.02.11 16:35:22 | 000,000,000 | ---D | C] -- C:\Users\anI0n\Documents\EveHQ
[2011.02.11 16:35:21 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\EveHQ
[2011.02.11 16:32:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VideoLAN
[2011.02.11 16:32:18 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\skypePM
[2011.02.11 16:31:26 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Xfire
[2011.02.11 16:31:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xfire
[2011.02.11 16:31:21 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011.02.11 16:31:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011.02.11 16:31:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Xfire
[2011.02.11 16:31:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Xfire
[2011.02.11 16:31:01 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2011.02.11 16:30:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2011.02.11 16:30:05 | 000,000,000 | ---D | C] -- C:\Program Files\TeamSpeak 3 Client
[2011.02.11 16:29:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.02.11 16:29:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2011.02.11 16:29:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Miranda Fusion 3
[2011.02.11 16:29:54 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Miranda Fusion
[2011.02.11 16:29:51 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2011.02.11 16:29:47 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Skype
[2011.02.11 16:29:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2011.02.11 16:29:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MirandaFusion
[2011.02.11 16:28:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IsoBuster
[2011.02.11 16:28:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Smart Projects
[2011.02.11 16:28:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\lcc-win32
[2011.02.11 16:27:58 | 000,000,000 | ---D | C] -- C:\Program Files\lcc
[2011.02.11 16:27:04 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Mozilla
[2011.02.11 16:27:04 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Local\Mozilla
[2011.02.11 16:26:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox
[2011.02.11 16:26:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2011.02.11 16:26:03 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\EVEMon
[2011.02.11 16:25:56 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EVEMon
[2011.02.11 16:25:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EVEMon
[2011.02.11 16:23:24 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Local\Adobe
[2011.02.11 16:00:09 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Opera
[2011.02.11 16:00:09 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Local\Opera
[2011.02.11 15:59:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Opera
[2011.02.11 15:54:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2011.02.11 15:53:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Works
[2011.02.11 15:53:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio
[2011.02.11 15:53:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2011.02.11 15:53:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2011.02.11 15:51:32 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2011.02.11 15:50:27 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Local\Microsoft Help
[2011.02.11 15:50:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2011.02.11 15:50:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2011.02.11 15:49:57 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2011.02.11 15:46:47 | 000,000,000 | ---D | C] -- C:\Program Files\PlayReady
[2011.02.11 15:42:17 | 000,469,144 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mfehidk.sys
[2011.02.11 15:42:17 | 000,119,968 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mfeavfk.sys
[2011.02.11 15:42:17 | 000,097,576 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mfeapfk.sys
[2011.02.11 15:42:17 | 000,083,784 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mfetdik.sys
[2011.02.11 15:42:17 | 000,079,504 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\mfevtps.exe
[2011.02.11 15:42:17 | 000,077,104 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mferkdet.sys
[2011.02.11 15:42:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2011.02.11 15:41:44 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2011.02.11 15:41:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Cisco Systems
[2011.02.11 15:41:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\McAfee
[2011.02.11 15:41:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\McAfee
[2011.02.11 15:40:39 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appmgmt
[2011.02.11 15:40:22 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011.02.11 15:37:31 | 000,000,000 | ---D | C] -- C:\Users\anI0n\Documents\WebradioSchweiz
[2011.02.11 15:32:39 | 000,079,504 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\mfevtps.exe.8676.deleteme
[2011.02.11 15:31:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2011.02.11 15:31:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2011.02.11 15:31:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2011.02.11 15:29:33 | 000,000,000 | ---D | C] -- C:\Windows\WindowsMobile
[2011.02.11 15:29:00 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Gizmo
[2011.02.11 15:28:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gizmo Central
[2011.02.11 15:28:57 | 000,032,840 | ---- | C] (Arainia Solutions LLC) -- C:\Windows\SysNative\drivers\gizmodrv.sys
[2011.02.11 15:28:57 | 000,000,000 | ---D | C] -- C:\Users\anI0n\Documents\Gizmo
[2011.02.11 15:28:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Gizmo
[2011.02.11 15:28:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
[2011.02.11 15:28:00 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2011.02.11 15:27:48 | 000,514,144 | ---- | C] (ITETech ) -- C:\Windows\SysNative\drivers\AF15BDA.sys
[2011.02.11 15:27:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\TerraTec
[2011.02.11 15:27:29 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2011.02.11 15:27:09 | 000,067,176 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2011.02.11 15:27:09 | 000,057,960 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2011.02.11 15:26:26 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2011.02.11 15:25:24 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2011.02.11 15:24:20 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\LogiShrd
[2011.02.11 15:24:15 | 000,000,000 | ---D | C] -- C:\Program Files\Logitech
[2011.02.11 15:23:44 | 000,000,000 | ---D | C] -- C:\ProgramData\LogiShrd
[2011.02.11 15:23:43 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Logitech
[2011.02.11 15:23:43 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Logishrd
[2011.02.11 15:21:37 | 000,000,000 | ---D | C] -- C:\NVIDIA
[2011.02.11 15:20:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SystemRequirementsLab
[2011.02.11 15:20:18 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Leadertech
[2011.02.11 15:20:10 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\logishrd
[2011.02.11 15:20:10 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\logishrd
[2011.02.11 15:20:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Logitech
[2011.02.11 15:20:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\LWS
[2011.02.11 15:19:56 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Macromedia
[2011.02.11 15:19:56 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Adobe
[2011.02.11 15:19:54 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2011.02.11 15:19:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
[2011.02.11 15:19:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Logitech
[2011.02.11 15:19:49 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2011.02.11 15:18:04 | 000,000,000 | -H-D | C] -- C:\Windows\AxInstSV
[2011.02.11 15:14:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\logishrd
[2011.02.11 15:14:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\logishrd
[2011.02.11 15:12:17 | 000,000,000 | R--D | C] -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011.02.11 15:12:17 | 000,000,000 | R--D | C] -- C:\Users\anI0n\Searches
[2011.02.11 15:12:17 | 000,000,000 | R--D | C] -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.02.11 15:12:09 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Identities
[2011.02.11 15:12:05 | 000,000,000 | R--D | C] -- C:\Users\anI0n\Contacts
[2011.02.11 15:12:03 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Local\VirtualStore
[2011.02.11 15:11:43 | 000,000,000 | --SD | C] -- C:\Users\anI0n\AppData\Roaming\Microsoft
[2011.02.11 15:11:43 | 000,000,000 | R--D | C] -- C:\Users\anI0n\Videos
[2011.02.11 15:11:43 | 000,000,000 | R--D | C] -- C:\Users\anI0n\Saved Games
[2011.02.11 15:11:43 | 000,000,000 | R--D | C] -- C:\Users\anI0n\Pictures
[2011.02.11 15:11:43 | 000,000,000 | R--D | C] -- C:\Users\anI0n\Music
[2011.02.11 15:11:43 | 000,000,000 | R--D | C] -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011.02.11 15:11:43 | 000,000,000 | R--D | C] -- C:\Users\anI0n\Links
[2011.02.11 15:11:43 | 000,000,000 | R--D | C] -- C:\Users\anI0n\Favorites
[2011.02.11 15:11:43 | 000,000,000 | R--D | C] -- C:\Users\anI0n\Downloads
[2011.02.11 15:11:43 | 000,000,000 | R--D | C] -- C:\Users\anI0n\Documents
[2011.02.11 15:11:43 | 000,000,000 | R--D | C] -- C:\Users\anI0n\Desktop
[2011.02.11 15:11:43 | 000,000,000 | R--D | C] -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\Vorlagen
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\AppData\Local\Verlauf
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\AppData\Local\Temporary Internet Files
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\Startmenü
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\SendTo
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\Recent
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\Netzwerkumgebung
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\Lokale Einstellungen
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\Documents\Eigene Videos
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\Documents\Eigene Musik
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\Eigene Dateien
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\Documents\Eigene Bilder
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\Druckumgebung
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\Cookies
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\AppData\Local\Anwendungsdaten
[2011.02.11 15:11:43 | 000,000,000 | -HSD | C] -- C:\Users\anI0n\Anwendungsdaten
[2011.02.11 15:11:43 | 000,000,000 | -H-D | C] -- C:\Users\anI0n\AppData
[2011.02.11 15:11:43 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Local\Temp
[2011.02.11 15:11:43 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Local\Microsoft
[2011.02.11 15:11:43 | 000,000,000 | ---D | C] -- C:\Users\anI0n\AppData\Roaming\Media Center Programs
[2011.02.11 15:09:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2011.02.11 15:09:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2011.02.11 15:09:16 | 000,000,000 | -HSD | C] -- C:\Recovery
[2011.02.11 15:09:16 | 000,000,000 | -HSD | C] -- C:\Programme
[2011.02.11 15:09:16 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2011.02.11 15:09:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2011.02.11 15:09:16 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2011.02.11 15:09:16 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2011.02.11 15:09:16 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2011.02.11 15:09:16 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2011.02.11 15:09:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2011.02.11 15:09:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Desktop
[2011.02.11 15:09:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2011.02.11 15:09:13 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2011.02.11 14:59:29 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2011.02.11 14:59:20 | 000,000,000 | ---D | C] -- C:\Windows\CSC
[2011.02.11 14:57:50 | 000,000,000 | -HSD | C] -- C:\Boot
 
========== Files - Modified Within 30 Days ==========
 
[2011.02.13 15:35:41 | 001,507,106 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.02.13 15:35:41 | 000,657,438 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.02.13 15:35:41 | 000,618,714 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.02.13 15:35:41 | 000,130,810 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.02.13 15:35:41 | 000,107,034 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.02.13 15:20:19 | 000,000,924 | ---- | M] () -- C:\Users\anI0n\Desktop\NTREGOPT.lnk
[2011.02.13 15:20:19 | 000,000,905 | ---- | M] () -- C:\Users\anI0n\Desktop\ERUNT.lnk
[2011.02.13 15:18:06 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.02.13 15:18:06 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.02.13 15:12:54 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\lvuvc.hs
[2011.02.13 15:12:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.02.13 15:12:46 | 3220,086,784 | -HS- | M] () -- C:\hiberfil.sys
[2011.02.13 14:07:40 | 001,526,060 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.02.12 19:15:20 | 020,364,702 | ---- | M] () -- C:\Users\anI0n\Documents\vlc-1.1.7-win32.exe
[2011.02.12 17:09:18 | 000,343,608 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.02.11 19:26:46 | 000,000,000 | -H-- | M] () -- C:\Users\anI0n\Documents\Default.rdp
[2011.02.11 17:29:41 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf
[2011.02.11 17:27:26 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01009.Wdf
[2011.02.11 16:32:56 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat
[2011.02.11 16:31:25 | 000,000,999 | ---- | M] () -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
[2011.02.11 15:31:32 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdRapi2_01_00_00.Wdf
[2011.02.11 15:28:57 | 000,032,840 | ---- | M] (Arainia Solutions LLC) -- C:\Windows\SysNative\drivers\gizmodrv.sys
[2011.02.11 15:26:12 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64k_01009.Wdf
[2011.02.11 15:24:38 | 000,001,108 | ---- | M] () -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk
[2011.02.11 15:09:38 | 000,171,136 | RHS- | M] () -- C:\w7ldr
[2011.02.11 15:03:35 | 000,057,050 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2011.02.11 15:03:35 | 000,057,050 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2011.02.11 15:00:08 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2011.02.11 14:57:51 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
 
========== Files Created - No Company Name ==========
 
[2011.02.13 15:20:19 | 000,000,924 | ---- | C] () -- C:\Users\anI0n\Desktop\NTREGOPT.lnk
[2011.02.13 15:20:19 | 000,000,905 | ---- | C] () -- C:\Users\anI0n\Desktop\ERUNT.lnk
[2011.02.13 14:07:40 | 001,526,060 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.02.12 19:11:32 | 020,364,702 | ---- | C] () -- C:\Users\anI0n\Documents\vlc-1.1.7-win32.exe
[2011.02.11 19:26:46 | 000,000,000 | -H-- | C] () -- C:\Users\anI0n\Documents\Default.rdp
[2011.02.11 17:29:41 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf
[2011.02.11 17:27:26 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01009.Wdf
[2011.02.11 16:32:56 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.02.11 16:31:25 | 000,000,999 | ---- | C] () -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
[2011.02.11 15:59:57 | 000,000,845 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
[2011.02.11 15:31:57 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2011.02.11 15:31:32 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdRapi2_01_00_00.Wdf
[2011.02.11 15:29:49 | 000,002,419 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Mobile Device Center.lnk
[2011.02.11 15:27:08 | 000,007,621 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb
[2011.02.11 15:26:12 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64k_01009.Wdf
[2011.02.11 15:21:53 | 000,006,136 | ---- | C] () -- C:\Windows\SysNative\drivers\nvphy.bin
[2011.02.11 15:20:18 | 000,001,108 | ---- | C] () -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk
[2011.02.11 15:14:23 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\drivers\lvuvc.hs
[2011.02.11 15:12:27 | 000,001,405 | ---- | C] () -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2011.02.11 15:12:18 | 000,001,439 | ---- | C] () -- C:\Users\anI0n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.02.11 15:09:38 | 000,171,136 | RHS- | C] () -- C:\w7ldr
[2011.02.11 15:00:08 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2011.02.11 14:58:59 | 3220,086,784 | -HS- | C] () -- C:\hiberfil.sys
[2011.02.11 14:57:51 | 000,008,192 | RHS- | C] () -- C:\BOOTSECT.BAK
[2011.02.11 14:57:50 | 000,383,562 | RHS- | C] () -- C:\bootmgr
[2010.11.10 02:45:30 | 010,871,128 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2010.11.10 02:45:20 | 000,316,248 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2010.07.09 20:04:40 | 000,041,872 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
 
========== LOP Check ==========
 
[2011.02.12 00:43:48 | 000,000,000 | ---D | M] -- C:\Users\anI0n\AppData\Roaming\EveHQ
[2011.02.11 19:05:26 | 000,000,000 | ---D | M] -- C:\Users\anI0n\AppData\Roaming\EVEMon
[2011.02.11 15:30:11 | 000,000,000 | ---D | M] -- C:\Users\anI0n\AppData\Roaming\Gizmo
[2011.02.11 15:20:18 | 000,000,000 | ---D | M] -- C:\Users\anI0n\AppData\Roaming\Leadertech
[2011.02.11 16:29:54 | 000,000,000 | ---D | M] -- C:\Users\anI0n\AppData\Roaming\Miranda Fusion
[2011.02.11 16:00:09 | 000,000,000 | ---D | M] -- C:\Users\anI0n\AppData\Roaming\Opera
[2011.02.12 18:42:22 | 000,000,000 | ---D | M] -- C:\Users\anI0n\AppData\Roaming\TS3Client
[2009.07.14 06:08:49 | 000,005,166 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.02.11 15:12:04 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.02.11 14:57:50 | 000,000,000 | -HSD | M] -- C:\Boot
[2011.02.13 03:03:04 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2011.02.11 15:09:16 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.02.11 15:49:57 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2011.02.11 15:26:09 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.02.11 17:35:14 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.02.13 15:20:18 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2011.02.13 15:03:08 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011.02.11 15:09:16 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.02.11 15:09:16 | 000,000,000 | -HSD | M] -- C:\Recovery
[2011.02.13 15:39:21 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.02.11 15:11:42 | 000,000,000 | R--D | M] -- C:\Users
[2011.02.13 15:20:30 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: EXPLORER.EXE >
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2009.08.03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2009.08.03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: USERINIT.EXE >
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
 
< MD5 for: WININIT.EXE >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE >
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
 
< End of report >
         
--- --- ---


4. ExtrasOTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 13.02.2011 15:27:36 - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\anI0n\Desktop\MFTools
64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 75,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 86,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 150,00 Gb Total Space | 118,22 Gb Free Space | 78,81% Space Free | Partition Type: NTFS
Drive D: | 359,33 Gb Total Space | 104,25 Gb Free Space | 29,01% Space Free | Partition Type: NTFS
Drive E: | 100,00 Gb Total Space | 51,86 Gb Free Space | 51,86% Space Free | Partition Type: NTFS
Drive F: | 89,30 Gb Total Space | 85,13 Gb Free Space | 95,33% Space Free | Partition Type: NTFS
 
Computer Name: AKASHA | User Name: anI0n | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\opera.exe (Opera Software)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Opera\opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Opera\opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{563F041C-DFDB-437B-A1E8-E141E0906076}" = Microsoft IntelliPoint 8.0
"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile-Gerätecenter
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{98C8DF59-BE5F-4EC2-9B12-FD2A54928EDB}" = Microsoft IntelliType Pro 8.0
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 266.58
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 266.58
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
"SP6" = Logitech SetPoint 6.15
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{147BCE03-C0F1-4C9F-8157-6A89B6D2D973}" = McAfee VirusScan Enterprise
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{87CC8013-56D1-43E1-A0A5-AD406B4EBA95}" = Opera 10.63
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{AA951B10-7089-4D60-B288-516E641F48E6}" = McAfee Agent
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3 - Deutsch
"{B581D589-488E-4465-8A14-9848A0C9628F}" = EveHQ
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Cinergy T Stick MKII" = Cinergy T Stick MKII V9.06.3.01
"ClearProg" = ClearProg 1.6.1 Beta 3
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ERUNT_is1" = ERUNT 1.1j
"EVE" = EVE Online (remove only)
"EVEMon" = EVEMon
"Gizmo Central" = Gizmo Central
"IsoBuster_is1" = IsoBuster 2.8
"lcc-win32 (base system)_is1" = lcc-win32 version 3.2 (base system)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MirandaFusion" = Miranda Fusion 3.0.12
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"S2TNG" = The Settlers II - 10th Anniversary
"SystemRequirementsLab" = System Requirements Lab
"Xfire" = Xfire (remove only)
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 12.02.2011 12:09:18 | Computer Name = akasha | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 12.02.2011 12:09:18 | Computer Name = akasha | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 12.02.2011 12:09:18 | Computer Name = akasha | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 12.02.2011 12:09:19 | Computer Name = akasha | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 12.02.2011 12:09:25 | Computer Name = akasha | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 12.02.2011 14:18:02 | Computer Name = akasha | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 12.02.2011 14:18:02 | Computer Name = akasha | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 12.02.2011 14:18:02 | Computer Name = akasha | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 12.02.2011 14:18:02 | Computer Name = akasha | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 12.02.2011 14:18:02 | Computer Name = akasha | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
[ System Events ]
Error - 11.02.2011 12:00:44 | Computer Name = akasha | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Windows
Search service to connect.
 
Error - 11.02.2011 12:00:44 | Computer Name = akasha | Source = Service Control Manager | ID = 7000
Description = The Windows Search service failed to start due to the following error:
%%1053
 
Error - 11.02.2011 12:01:01 | Computer Name = akasha | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Windows
Search service to connect.
 
Error - 11.02.2011 12:01:01 | Computer Name = akasha | Source = Service Control Manager | ID = 7000
Description = The Windows Search service failed to start due to the following error:
%%1053
 
Error - 11.02.2011 12:01:51 | Computer Name = akasha | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Windows
Search service to connect.
 
Error - 11.02.2011 12:01:51 | Computer Name = akasha | Source = Service Control Manager | ID = 7000
Description = The Windows Search service failed to start due to the following error:
%%1053
 
Error - 11.02.2011 12:18:14 | Computer Name = akasha | Source = Service Control Manager | ID = 7034
Description = The Gizmo Central service terminated unexpectedly. It has done this
1 time(s).
 
Error - 11.02.2011 13:54:48 | Computer Name = akasha | Source = Service Control Manager | ID = 7031
Description = The Windows Search service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 30000 milliseconds:
Neustart des Diensts.
 
Error - 12.02.2011 08:03:33 | Computer Name = akasha | Source = Microsoft-Windows-HAL | ID = 12
Description = The platform firmware has corrupted memory across the previous system
power transition. Please check for updated firmware for your system.
 
Error - 12.02.2011 12:09:00 | Computer Name = akasha | Source = EventLog | ID = 6008
Description = The previous system shutdown at 13:26:08 on ?12.?02.?2011 was unexpected.
 
 
< End of report >
         
--- --- ---


ich hoffe diese Daten können euch weiterhelfen, ich bin leider mit meinem Latein am ende....

Alt 13.02.2011, 20:37   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
"C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937  startet automatisch - Standard

"C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937 startet automatisch



Zitat:
Art des Suchlaufs: Quick-Scan
Hallo und

Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!
__________________

__________________

Alt 14.02.2011, 13:01   #3
anI0n
 
"C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937  startet automatisch - Standard

"C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937 startet automatisch



So, hier ist der Bericht des vollständigen Scans. Leider ist das Problem immernoch da...



Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5760

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.02.2011 13:50:45
mbam-log-2011-02-14 (13-50-45).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|I:\|J:\|K:\|)
Durchsuchte Objekte: 349885
Laufzeit: 1 Stunde(n), 11 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Userinit (Trojan.Agent) -> Value: Userinit -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
i:\downloadz\Appz\Mobile\xda\xda htc diamond programme\pocket pc - griff music studio 1.0\CORE10k.EXE (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.
i:\downloadz\Appz\Mobile\xda\xda htc diamond programme\slovoed 7 crack\paragon.software.slovoed.dictionary.v7.0.build.4614.93.multilingual.xscale.wm05.wm06.cracked-corepda\CORE10k.EXE (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.
c:\Users\anI0n\AppData\Roaming\appconf32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
__________________

Alt 14.02.2011, 13:53   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
"C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937  startet automatisch - Standard

"C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937 startet automatisch



Zitat:
paragon.software.slovoed.dictionary.v7.0.build.4614.93.multilingual.xscale.wm05.wm06.cracked-corepda
Dateien, die crack.exe, keygen.exe oder patch.exe heißen, sind zu 99,9% gefährliche Schädlinge, mit denen man nicht spaßen sollte. Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf Anleitung zur kompletten Neuinstallation!!

Alt 14.02.2011, 18:16   #5
anI0n
 
"C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937  startet automatisch - Standard

"C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937 startet automatisch



schade, aber trotzdem danke...


Antwort

Themen zu "C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937 startet automatisch
64-bit, bho, c:\windows\system32\rundll32.exe, desktop, error, failed, firefox, flash player, hijack, hijackthis, ieframe.dll, iexplore.exe, install.exe, internet, internet explorer, langs, location, media center, microsoft office word, monte, mozilla, object, oldtimer, plug-in, problem, programdata, proxy, prozess, registry, rundll, saver, searchplugins, security, security update, shell32.dll, shortcut, skype.exe, software, start menu, stick, syswow64, taskmanager, teamspeak, usb, webcheck, windows



Ähnliche Themen: "C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937 startet automatisch


  1. Win8.1: "C:\Program Files (x86)\Sid Meier's Civilization 4\Civilization4.exe" startet nicht mehr
    Log-Analyse und Auswertung - 29.09.2015 (19)
  2. Internet Explorer öffnet Pup ups von "lpcloudbox" nach Installation von FreeYoutubeDownloader "update"
    Log-Analyse und Auswertung - 07.09.2014 (5)
  3. Virus als Avira getarnt? - "C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe" /showMiniGui
    Plagegeister aller Art und deren Bekämpfung - 08.08.2014 (3)
  4. Windows 8.1: Avira findet "TR/Swrort.A.10259" in "C:\Program Files (x86)\Google\Chrome\Application\old_chrome.exe"
    Plagegeister aller Art und deren Bekämpfung - 23.07.2014 (3)
  5. Log Files Beurteilung: insb. Vorgehen bei Meldung in Log Files "Files to move or delete:..."
    Log-Analyse und Auswertung - 20.05.2014 (15)
  6. Win7: Nach Neustart erscheint RunDLL-Window mit "Problem beim Starten von C:\Program Files (x86)\HomeTab\TBUpdater.dll"
    Plagegeister aller Art und deren Bekämpfung - 17.12.2013 (8)
  7. Win7: Nach Neustart erscheint RunDLL-Window mit "Problem beim Starten von C:\Program Files (x86)\HomeTab\TBUpdater.dll"
    Log-Analyse und Auswertung - 04.11.2013 (7)
  8. Windows 8 x64 - "TR/ATRAPS.Gen2" in C:\Program Files (x86)\Google\Desktop\...\80000032.@ und ...\80000064.@ und ...{80000000.@
    Log-Analyse und Auswertung - 10.08.2013 (5)
  9. "System Care Antivirus" startet automatisch, dann kein Internetzugang mehr
    Plagegeister aller Art und deren Bekämpfung - 28.07.2013 (13)
  10. "Licensevalidator.exe" u.A. in den Anwendungsordnern - iexplore.exe startet im hintergrund.
    Plagegeister aller Art und deren Bekämpfung - 21.04.2012 (32)
  11. C:\Program Files\Internet Explorer\1906\8AE.exe und bds/gbot.gatk Browser leitet auf andere Seiten
    Log-Analyse und Auswertung - 10.11.2011 (37)
  12. Auch bei mir Dateien aus "Program Files (x86)" nach dem Hochfahren gelöscht...
    Log-Analyse und Auswertung - 23.08.2011 (19)
  13. Dateien aus "Program Files (x86)" nach dem Hochfahren gelöscht...
    Log-Analyse und Auswertung - 30.05.2011 (5)
  14. problem mit "C:\Program Files\Navilog1\gnc.exe"
    Log-Analyse und Auswertung - 21.02.2010 (1)
  15. iexplore.exe startet dauernd = Bildschirm "flackern" ...
    Log-Analyse und Auswertung - 27.07.2007 (3)
  16. Internet Explorer öffnet sich automatisch in einem "unschließbaren" Fenster
    Plagegeister aller Art und deren Bekämpfung - 08.05.2007 (14)
  17. "E:\Programme\Internet Explorer\iexplore.exe" -Embedding
    Plagegeister aller Art und deren Bekämpfung - 08.04.2005 (1)

Zum Thema "C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937 startet automatisch - Hallo zusammen, seid nun mehr einer Woche, startet der oben beschriebene Prozess von selbst. Wenn ich ihn beenden möchte (über Taskmanager), startet dieser sofort wieder neu. Ich habe die Systempartition - "C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937 startet automatisch...
Archiv
Du betrachtest: "C:\program files\internet explorer\iexplore.exe" SCODEF:2356 CREDAT:71937 startet automatisch auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.