Trojaner-Board - win 7 home security 2011, trojaner, spyware

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - win 7 home security 2011, trojaner, spyware (https://www.trojaner-board.de/99104-win-7-home-security-2011-trojaner-spyware.html)

win 7 home security 2011, trojaner, spyware

Hallo, ich habe wie viele anderen auch das Win 7 Home Security 2011 Problem. Ich hab das Malwarebytesprogramm wie vorgeschlagen installiert, und die Fehldateien gefunden und gelöscht. Nun läuft der Rechner immernoch langsamer als gewohnt und ich bin mir nicht sicher ob das Problem behoben wurde. Ich habe weiterhin noch 2 OTL-Berichte erstellt ...

Hier der aktuellste Bericht von Malware:

Datenbank Version: 6576
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
15.05.2011 13:42:06
mbam-log-2011-05-15 (13-42-06).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 169590
Laufzeit: 4 Minute(n), 23 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

Hi, Wow Danke für die schnelle Antwort ...

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6575

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.05.2011 11:20:42
mbam-log-2011-05-14 (11-20-42).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 169631
Laufzeit: 11 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 4
Infizierte Verzeichnisse: 1
Infizierte Dateien: 2

Infizierte Speicherprozesse:
c:\Users\di giorgio\AppData\Local\idt.exe (Trojan.ExeShell.Gen) -> 2364 -> Failed to unload process.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Value: (default) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Di Giorgio\AppData\Local\idt.exe" -a "C:\Program Files (x86)\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Di Giorgio\AppData\Local\idt.exe" -a "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Di Giorgio\AppData\Local\idt.exe" -a "C:\Program Files (x86)\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\exefile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("C:\Users\Di Giorgio\AppData\Local\idt.exe" -a "%1" %*) Good: ("%1" %*) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
c:\program files (x86)\relevantknowledge (Spyware.MarketScore) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\Users\di giorgio\AppData\Local\idt.exe (Trojan.ExeShell.Gen) -> Quarantined and deleted successfully.
c:\Users\di giorgio\downloads\adobeflashplayer_10.7.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

******************************************

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6575

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.05.2011 14:34:50
mbam-log-2011-05-14 (14-34-50).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|J:\|)
Durchsuchte Objekte: 938247
Laufzeit: 2 Stunde(n), 5 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\di giorgio\AppData\Local\jbi.exe (Trojan.ExeShell.Gen) -> Quarantined and deleted successfully.

***************************************

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6575

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.05.2011 14:41:47
mbam-log-2011-05-14 (14-41-47).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 169231
Laufzeit: 3 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

*************************************

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6576

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.05.2011 14:45:22
mbam-log-2011-05-14 (14-45-22).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 169347
Laufzeit: 2 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

****************************************

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6576

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.05.2011 16:02:49
mbam-log-2011-05-14 (16-02-49).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|J:\|)
Durchsuchte Objekte: 631688
Laufzeit: 1 Stunde(n), 17 Minute(n), 3 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

***********************

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6576

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

15.05.2011 13:42:06
mbam-log-2011-05-15 (13-42-06).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 169590
Laufzeit: 4 Minute(n), 23 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox.

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hab die files hochgeladen ...

Habs als Anhang angehängt ---> logfiles

OTL Logfile:

Code:

OTL logfile created on: 15.05.2011 15:53:06 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\Di Giorgio\Downloads

64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 62,00% Memory free

4,00 Gb Paging File | 3,00 Gb Available in Paging File | 68,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 342,43 Gb Total Space | 276,11 Gb Free Space | 80,63% Space Free | Partition Type: NTFS

Drive D: | 342,43 Gb Total Space | 157,77 Gb Free Space | 46,07% Space Free | Partition Type: NTFS

Drive E: | 395,06 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

Drive G: | 465,65 Gb Total Space | 439,32 Gb Free Space | 94,35% Space Free | Partition Type: FAT32

Drive J: | 298,09 Gb Total Space | 261,07 Gb Free Space | 87,58% Space Free | Partition Type: NTFS

 

Computer Name: DIGIORGIO-2010 | User Name: Di Giorgio | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.05.15 15:51:52 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Di Giorgio\Downloads\OTL.exe

PRC - [2011.04.30 21:21:08 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

PRC - [2011.03.22 20:37:06 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\Winamp\winampa.exe

PRC - [2011.03.21 12:29:30 | 000,145,504 | ---- | M] (B.H.A Corporation) -- C:\Windows\SysWOW64\bgsvcgen.exe

PRC - [2011.03.17 19:10:28 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.03.16 05:57:44 | 000,415,072 | ---- | M] () -- C:\Program Files (x86)\Dyyno\Dyyno Broadcaster\launcherd.exe

PRC - [2011.03.09 13:29:16 | 000,366,000 | ---- | M] (Eastman Kodak Company) -- C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe

PRC - [2010.11.06 11:27:37 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2009.09.10 15:42:46 | 000,305,448 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe

PRC - [2009.08.28 11:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

PRC - [2009.08.13 00:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

PRC - [2009.07.04 03:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe

PRC - [2009.05.06 19:53:50 | 001,220,608 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2011.05.15 15:51:52 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Di Giorgio\Downloads\OTL.exe

MOD - [2010.08.21 07:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2009.11.18 07:45:38 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV - [2011.05.09 22:22:13 | 000,403,240 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2011.04.30 21:21:08 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.03.21 12:29:30 | 000,145,504 | ---- | M] (B.H.A Corporation) [Auto | Running] -- C:\Windows\SysWOW64\bgsvcgen.exe -- (bgsvcgen)

SRV - [2011.03.17 19:10:28 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.03.16 05:57:44 | 000,415,072 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Dyyno\Dyyno Broadcaster\launcherd.exe -- (Dyyno Launcher)

SRV - [2011.03.09 13:29:16 | 000,366,000 | ---- | M] (Eastman Kodak Company) [Auto | Running] -- C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe -- (Kodak AiO Network Discovery Service)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.09.10 15:42:46 | 000,305,448 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)

SRV - [2009.08.28 11:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)

SRV - [2009.08.25 19:38:06 | 000,935,208 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)

SRV - [2009.08.13 00:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)

SRV - [2009.07.04 03:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009.05.06 19:53:50 | 001,220,608 | ---- | M] (MAGIX AG) [Unknown | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)

SRV - [2009.04.19 17:34:48 | 000,625,184 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM)

SRV - [2009.04.19 17:34:48 | 000,207,904 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)

SRV - [2008.08.07 12:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)

SRV - [2007.12.04 19:31:02 | 000,020,480 | ---- | M] (Script Soft eK) [Auto | Running] -- C:\Program Files (x86)\LOADSTREET\WinSpeedUp 3\CleanRAMService.exe -- (WLCleanRAM)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.23 23:22:29 | 000,083,120 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2010.08.13 18:11:40 | 000,311,968 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)

DRV:64bit: - [2010.08.13 18:10:07 | 000,043,168 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)

DRV:64bit: - [2010.08.12 13:07:50 | 000,350,952 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)

DRV:64bit: - [2010.07.21 17:58:50 | 000,045,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)

DRV:64bit: - [2010.06.19 09:36:04 | 000,017,920 | ---- | M] (Siliten) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\InputFilter_FlexDef2b.sys -- (InputFilter_Hid_FlexDef2b) Siliten HID Devices(FlexDef2b)

DRV:64bit: - [2010.04.18 17:36:42 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)

DRV:64bit: - [2010.03.02 13:35:01 | 000,116,568 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2009.11.18 08:21:18 | 006,171,136 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)

DRV:64bit: - [2009.09.30 03:34:30 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 22:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)

DRV:64bit: - [2009.06.10 22:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.06.02 13:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)

DRV:64bit: - [2009.06.02 13:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)

DRV:64bit: - [2009.06.02 13:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)

DRV:64bit: - [2009.05.06 01:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)

DRV:64bit: - [2009.05.06 01:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)

DRV:64bit: - [2007.03.19 17:02:32 | 000,049,664 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RLVrtAuCbl.sys -- (ReallusionVirtualAudio)

DRV - [2011.03.21 12:29:30 | 000,033,408 | ---- | M] (B.H.A Corporation) [Kernel | System | Stopped] -- C:\Windows\SysWow64\drivers\CDRBSDRV.SYS -- (cdrbsdrv)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360410kn07974580t65bh4j12w6p

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360410kn07974580t65bh4j12w6p

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360410kn07974580t65bh4j12w6p

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360410kn07974580t65bh4j12w6p

IE - HKLM\..\URLSearchHook: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Program Files (x86)\BittorrentBar_DE\tbBitt.dll (Conduit Ltd.)

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360410kn07974580t65bh4j12w6p

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\..\URLSearchHook: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Program Files (x86)\BittorrentBar_DE\tbBitt.dll (Conduit Ltd.)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://google.de"

 

FF - HKLM\software\mozilla\Firefox\Extensions\\FFToolbar@bitdefender.com: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.01 11:02:51 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.27 17:03:55 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.14\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.01 11:02:51 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.14\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.27 17:03:55 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.01 11:02:51 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.27 17:03:55 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.01 11:02:51 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.27 17:03:55 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.01 11:02:51 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.27 17:03:55 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.01 11:02:51 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.27 17:03:55 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.04.29 01:30:20 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2011.04.21 19:15:59 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\Program Files\BitDefender\BitDefender 2010\bdtbext\

 

[2011.04.21 18:57:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Extensions

[2010.04.13 13:02:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2011.04.21 18:57:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Firefox\Profiles\3aylafpa.default\extensions

[2011.04.21 18:57:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Firefox\Profiles\3aylafpa.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}

[2011.02.12 09:52:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Firefox\Profiles\74iw538f.default\extensions

[2011.02.12 09:52:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Firefox\Profiles\74iw538f.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}

[2011.05.14 23:57:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Firefox\Profiles\spsnus7o.default\extensions

[2011.05.07 16:35:39 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Di Giorgio\AppData\Roaming\mozilla\Firefox\Profiles\spsnus7o.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}

[2011.04.21 19:00:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2011.02.21 16:18:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

[2011.02.12 13:26:52 | 000,000,000 | ---D | M] (Yummy Games Player) -- C:\Program Files (x86)\mozilla firefox\extensions\YPlayer@yummy.net

File not found (No name found) -- 

() (No name found) -- C:\USERS\DI GIORGIO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SPSNUS7O.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI

() (No name found) -- C:\USERS\DI GIORGIO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SPSNUS7O.DEFAULT\EXTENSIONS\{C45C406E-AB73-11D8-BE73-000A95BE3B12}.XPI

() (No name found) -- C:\USERS\DI GIORGIO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SPSNUS7O.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\DI GIORGIO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SPSNUS7O.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI

() (No name found) -- C:\USERS\DI GIORGIO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SPSNUS7O.DEFAULT\EXTENSIONS\YOUTUBE2MP3@MONDAYX.DE.XPI

[2011.05.01 11:02:50 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2011.02.02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2011.03.22 20:38:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll

[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O2 - BHO: (BittorrentBar_DE Toolbar) - {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Program Files (x86)\BittorrentBar_DE\tbBitt.dll (Conduit Ltd.)

O2 - BHO: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

O3:64bit: - HKLM\..\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (BittorrentBar_DE Toolbar) - {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Program Files (x86)\BittorrentBar_DE\tbBitt.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (BittorrentBar_DE Toolbar) - {64EAD72B-FFD4-4E01-AA3A-4C71665D73E4} - C:\Program Files (x86)\BittorrentBar_DE\tbBitt.dll (Conduit Ltd.)

O3 - HKCU\..\Toolbar\WebBrowser: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [Conime]  File not found

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1

O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx (WRC Class)

O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010.09.30 13:09:27 | 000,000,044 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]

O33 - MountPoints2\{3cee0917-4b06-11df-a2b5-00262d203210}\Shell - "" = AutoRun

O33 - MountPoints2\{3cee0917-4b06-11df-a2b5-00262d203210}\Shell\AutoRun\command - "" = F:\CitiesXL2011.exe

O33 - MountPoints2\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\Shell\AutoRun\command - "" = E:\START.EXE -- [2010.09.30 12:50:11 | 002,775,202 | R--- | M] (Macromedia, Inc.)

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O35 - HKCU\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKCU\...exe [@ = exefile] -- "%1" %*

 

 

MsConfig:64bit - StartUpReg: Conime - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: EKIJ5000StatusMonitor - hkey= - key= - C:\Windows\SysNative\spool\drivers\x64\3\EKIJ5000MUI.exe (Eastman Kodak Company)

MsConfig:64bit - StartUpReg: WinampAgent - hkey= - key= - C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)

MsConfig:64bit - State: "startup" - Reg Error: Key error.

 

SafeBootMin:64bit: AppMgmt - Service

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: mcmscsvc - Service

SafeBootMin:64bit: MCODS - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: WinDefend - Service

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: mcmscsvc - Service

SafeBootMin: MCODS - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: WinDefend - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - Service

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: mcmscsvc - Service

SafeBootNet:64bit: MCODS - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: MpfService - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WinDefend - Service

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: mcmscsvc - Service

SafeBootNet: MCODS - Service

SafeBootNet: Messenger - Service

SafeBootNet: MpfService - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WinDefend - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {68FCA9B0-CC74-A218-C7BE-0BE61C497E88} - Browser Customizations

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {9EA9D76F-CC51-5564-6C54-FEA6D102B79E} - Offline Browsing Pack

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.2

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.2

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C07FCB49-7A8A-A990-B602-21DB7644355B} - Microsoft VM

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.05.14 11:04:57 | 000,000,000 | ---D | C] -- C:\Users\Di Giorgio\AppData\Roaming\Malwarebytes

[2011.05.14 11:04:41 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys

[2011.05.14 11:04:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.05.14 11:04:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.05.14 11:04:35 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2011.05.14 11:04:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2011.05.14 10:24:37 | 000,000,000 | -HSD | C] -- C:\Users\Di Giorgio\Documents\.BackupManager

[2011.05.14 10:24:36 | 000,000,000 | -HSD | C] -- C:\Users\Di Giorgio\.BackupManager

[2011.05.14 10:24:35 | 000,000,000 | -HSD | C] -- C:\.uuid

[2011.05.14 10:24:35 | 000,000,000 | ---D | C] -- C:\Users\Di Giorgio\IOption

[2011.05.14 10:19:40 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools

[2011.05.09 22:20:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

[2011.05.09 22:20:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Steam

[2011.05.08 15:47:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\kodak

[2011.05.04 02:18:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Focus Home Interactive

[2011.05.04 02:17:16 | 000,000,000 | ---D | C] -- C:\Users\Di Giorgio\AppData\Local\Focus Home Interactive

[2011.04.29 17:26:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2011.04.29 17:26:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7-Zip

[2011.04.29 17:25:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Focus Home Interactive

[2011.04.23 14:19:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SHOUTcast

[2011.04.23 14:11:58 | 000,000,000 | ---D | C] -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DRS 2006

[2011.04.23 14:11:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Borland Shared

[2011.04.23 14:11:53 | 000,000,000 | ---D | C] -- C:\DRS2006

[2011.04.18 08:37:41 | 000,000,000 | ---D | C] -- C:\Users\Di Giorgio\AppData\Roaming\elsterformular

[2011.04.18 08:37:22 | 000,000,000 | ---D | C] -- C:\ProgramData\elsterformular

[2011.04.18 08:37:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular

[2011.04.18 08:36:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ElsterFormular

[2009.10.17 04:04:41 | 000,036,136 | ---- | C] (Oberon Media) -- C:\ProgramData\FullRemove.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.05.15 15:25:00 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011.05.15 13:56:24 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.05.15 13:56:24 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.05.15 13:54:18 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2011.05.15 13:54:18 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2011.05.15 13:54:18 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2011.05.15 13:54:18 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2011.05.15 13:54:18 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2011.05.15 13:49:15 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011.05.15 13:48:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.05.15 13:48:54 | 1609,469,952 | -HS- | M] () -- C:\hiberfil.sys

[2011.05.14 11:05:15 | 000,011,820 | -HS- | M] () -- C:\ProgramData\rs4cm4n2c8jl4hl47h2oo5nj33ef2824

[2011.05.14 11:05:15 | 000,011,820 | -HS- | M] () -- C:\Users\Di Giorgio\AppData\Local\2501828141

[2011.05.14 10:56:07 | 000,011,820 | -HS- | M] () -- C:\Users\Di Giorgio\AppData\Local\rs4cm4n2c8jl4hl47h2oo5nj33ef2824

[2011.05.14 09:41:44 | 000,000,740 | ---- | M] () -- C:\Users\Di Giorgio\Documents\cc_20110514_094139.reg

[2011.05.14 08:34:10 | 000,028,282 | ---- | M] () -- C:\Users\Di Giorgio\Documents\cc_20110514_083407.reg

[2011.05.14 08:24:31 | 000,001,025 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.05.11 09:26:26 | 000,441,722 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\ITK_Sieger_cms2007.pdf

[2011.05.11 09:26:22 | 000,252,772 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\Arbeitsreferenz_GianlucaDiGiorgio_v1.pdf

[2011.05.11 09:26:13 | 000,024,535 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\faehigkeiten.pdf

[2011.05.11 09:26:10 | 000,017,495 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\anschreiben.pdf

[2011.05.08 15:35:08 | 000,350,260 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\zertifikat php.pdf

[2011.05.08 07:47:30 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\Driver Fetch.job

[2011.04.27 15:29:56 | 000,085,558 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\Curriculum_di_Giorgio_Gianluca.pdf

[2011.04.27 15:27:38 | 000,046,769 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\Bewerbung_di_Giorgio.odt

[2011.04.27 15:13:34 | 000,019,136 | ---- | M] () -- C:\Users\Di Giorgio\Desktop\Bewerbung.odt

[2011.04.23 19:15:44 | 003,894,992 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2011.04.23 14:15:20 | 000,001,810 | ---- | M] () -- C:\Windows\DatabaseUtilityD.INI

[2011.04.21 19:56:39 | 000,048,586 | ---- | M] () -- C:\Users\Di Giorgio\Documents\cc_20110421_195634.reg

 
 ========== Files Created - No Company Name ==========

 

[2011.05.14 10:21:49 | 000,011,820 | -HS- | C] () -- C:\Users\Di Giorgio\AppData\Local\2501828141

[2011.05.14 09:41:42 | 000,000,740 | ---- | C] () -- C:\Users\Di Giorgio\Documents\cc_20110514_094139.reg

[2011.05.14 09:10:47 | 000,011,820 | -HS- | C] () -- C:\Users\Di Giorgio\AppData\Local\rs4cm4n2c8jl4hl47h2oo5nj33ef2824

[2011.05.14 09:10:47 | 000,011,820 | -HS- | C] () -- C:\ProgramData\rs4cm4n2c8jl4hl47h2oo5nj33ef2824

[2011.05.14 08:34:08 | 000,028,282 | ---- | C] () -- C:\Users\Di Giorgio\Documents\cc_20110514_083407.reg

[2011.05.14 08:24:31 | 000,001,025 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.05.11 09:26:26 | 000,441,722 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\ITK_Sieger_cms2007.pdf

[2011.05.11 09:26:12 | 000,024,535 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\faehigkeiten.pdf

[2011.05.11 09:26:06 | 000,017,495 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\anschreiben.pdf

[2011.05.08 15:35:08 | 000,350,260 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\zertifikat php.pdf

[2011.04.27 15:29:55 | 000,085,558 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\Curriculum_di_Giorgio_Gianluca.pdf

[2011.04.27 15:27:36 | 000,046,769 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\Bewerbung_di_Giorgio.odt

[2011.04.27 15:19:07 | 000,252,772 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\Arbeitsreferenz_GianlucaDiGiorgio_v1.pdf

[2011.04.27 15:07:10 | 000,019,136 | ---- | C] () -- C:\Users\Di Giorgio\Desktop\Bewerbung.odt

[2011.04.23 14:15:20 | 000,001,810 | ---- | C] () -- C:\Windows\DatabaseUtilityD.INI

[2011.04.21 19:56:36 | 000,048,586 | ---- | C] () -- C:\Users\Di Giorgio\Documents\cc_20110421_195634.reg

[2011.04.21 19:00:26 | 000,001,154 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2011.04.07 19:00:17 | 000,000,352 | ---- | C] () -- C:\Users\Di Giorgio\AppData\Roaming\burnaware.ini

[2011.04.03 16:12:32 | 000,372,736 | ---- | C] () -- C:\Windows\SysWow64\RSLSP.dll

[2011.03.28 18:15:42 | 000,000,138 | ---- | C] () -- C:\Windows\cdplayer.ini

[2011.03.28 18:02:26 | 000,001,378 | ---- | C] () -- C:\ProgramData\ss.ini

[2011.03.27 00:51:18 | 000,000,023 | ---- | C] () -- C:\Windows\ODBCINST.INI

[2011.03.26 18:50:20 | 000,000,052 | ---- | C] () -- C:\Windows\videodeLuxe.INI

[2011.03.26 18:48:08 | 000,019,968 | ---- | C] () -- C:\Windows\SysWow64\cpuinf32.dll

[2011.03.26 18:41:52 | 000,001,208 | ---- | C] () -- C:\Windows\mgxoschk.ini

[2011.03.26 14:58:35 | 000,000,080 | RHS- | C] () -- C:\Windows\CT4CET.bin

[2011.03.09 20:54:42 | 000,000,028 | ---- | C] () -- C:\Windows\Robota.INI

[2011.03.05 21:45:35 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll

[2011.02.12 09:59:03 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2010.12.13 20:56:40 | 000,005,120 | ---- | C] () -- C:\Users\Di Giorgio\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.11.24 08:12:57 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2010.09.18 13:40:21 | 000,000,015 | ---- | C] () -- C:\Users\Di Giorgio\AppData\Roaming\sys386ll.dat

[2010.09.18 13:39:39 | 000,000,010 | ---- | C] () -- C:\Users\Di Giorgio\AppData\Roaming\hhxprot5

[2010.06.12 12:47:00 | 000,000,025 | ---- | C] () -- C:\Users\Di Giorgio\AppData\Roaming\bdfvconp.ini

[2010.05.16 21:28:22 | 000,373,248 | ---- | C] () -- C:\Windows\EyeCand3.INI

[2010.05.16 17:09:57 | 000,000,025 | ---- | C] () -- C:\Windows\SIERRA.INI

[2010.05.02 20:55:38 | 000,049,152 | ---- | C] () -- C:\Windows\amcap.exe

[2010.04.14 19:46:13 | 000,000,127 | ---- | C] () -- C:\Windows\wininit.ini

[2010.04.13 15:16:13 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2010.04.10 19:21:34 | 000,001,040 | ---- | C] () -- C:\Users\Di Giorgio\AppData\Roaming\wklnhst.dat

[2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

[2007.03.26 10:45:18 | 000,071,208 | ---- | C] () -- C:\Windows\SysWow64\PhysXLoader.dll

[2007.02.20 14:59:08 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll

[2007.02.20 14:59:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll

[2007.02.20 14:59:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll

[2007.02.20 14:59:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll

[2007.02.20 14:59:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll

[2007.02.20 14:59:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll

[2007.02.20 14:59:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll

[2007.02.20 14:59:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll

[2007.02.20 14:59:04 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll

 
 ========== LOP Check ==========

 

[2010.10.24 16:24:00 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\10-Sekunden-Haushaltsbuch

[2010.06.12 12:37:45 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\BitDefender

[2011.05.14 08:29:41 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\BitTorrent

[2011.03.16 17:58:21 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\biu software

[2011.02.16 14:26:11 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Civitas2

[2010.04.18 18:22:05 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\DAEMON Tools Lite

[2011.04.15 15:13:53 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Dyyno

[2011.04.18 08:37:44 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\elsterformular

[2011.05.14 08:29:41 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FileZilla

[2010.04.29 13:50:26 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FireShot

[2010.07.14 21:43:24 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Foxit Software

[2010.04.14 15:43:39 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FreeCommander

[2011.04.08 07:49:02 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FreeScreenToVideo

[2011.03.11 06:48:25 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\GetRightToGo

[2010.12.15 12:23:05 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\HandBrake

[2010.08.06 03:51:11 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Imperium Romanum

[2010.11.23 23:20:32 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\inkscape

[2010.11.30 02:25:21 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\IrfanView

[2010.12.05 20:28:54 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\iScreensaver

[2011.03.05 21:48:28 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\MAGIX

[2011.03.29 06:04:58 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\MP3 Quality Modifier

[2011.04.08 21:16:46 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Mp3tag

[2010.04.20 04:47:58 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\My Games

[2010.08.03 21:46:36 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\OpenOffice.org

[2011.04.15 14:00:46 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Opera

[2011.03.21 12:39:51 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Pegasys Inc

[2010.12.19 17:49:43 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Process Hacker

[2010.04.26 21:35:21 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Sierra Entertainment

[2011.04.08 17:48:15 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\SMRecorder

[2010.04.29 03:36:26 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Sports Interactive

[2010.07.10 15:54:51 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Stellarium

[2010.05.16 13:06:39 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\streamripper

[2011.05.08 15:36:08 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Temp

[2010.04.10 19:21:37 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Template

[2010.04.13 13:02:57 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Thunderbird

[2011.03.02 02:37:31 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Ubisoft

[2010.12.03 15:17:19 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Webocton - Scriptly

[2010.12.03 21:09:57 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\XnView

[2011.05.08 07:47:30 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\Driver Fetch.job

[2011.04.09 16:09:05 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < Code: >

 
 < --------- >

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2010.10.24 16:24:00 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\10-Sekunden-Haushaltsbuch

[2011.04.08 06:45:07 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Adobe

[2011.04.15 14:05:18 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Apple Computer

[2010.04.07 11:38:32 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\ATI

[2010.06.16 21:43:11 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Avira

[2010.06.12 12:37:45 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\BitDefender

[2011.05.14 08:29:41 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\BitTorrent

[2011.03.16 17:58:21 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\biu software

[2011.02.16 14:26:11 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Civitas2

[2010.04.18 18:22:05 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\DAEMON Tools Lite

[2010.12.13 20:56:40 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\DivX

[2011.04.15 15:13:53 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Dyyno

[2011.04.18 08:37:44 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\elsterformular

[2011.05.14 08:29:41 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FileZilla

[2010.04.29 13:50:26 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FireShot

[2010.07.14 21:43:24 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Foxit Software

[2010.04.14 15:43:39 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FreeCommander

[2011.04.08 07:49:02 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\FreeScreenToVideo

[2011.03.11 06:48:25 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\GetRightToGo

[2010.04.07 11:45:00 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Google

[2010.12.15 12:23:05 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\HandBrake

[2010.04.07 11:37:31 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Identities

[2010.08.06 03:51:11 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Imperium Romanum

[2010.11.23 23:20:32 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\inkscape

[2010.08.18 11:44:43 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\InstallShield

[2010.11.30 02:25:21 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\IrfanView

[2010.12.05 20:28:54 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\iScreensaver

[2010.04.07 11:37:49 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Macromedia

[2011.03.05 21:48:28 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\MAGIX

[2011.05.14 11:04:57 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Malwarebytes

[2009.07.14 09:44:38 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Media Center Programs

[2011.04.08 19:20:31 | 000,000,000 | --SD | M] -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft

[2010.04.18 19:01:47 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft Games

[2010.04.13 12:50:45 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Mozilla

[2011.03.29 06:04:58 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\MP3 Quality Modifier

[2011.04.08 21:16:46 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Mp3tag

[2010.04.20 04:47:58 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\My Games

[2010.04.18 18:18:00 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Nero

[2010.08.03 21:46:36 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\OpenOffice.org

[2011.04.15 14:00:46 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Opera

[2011.03.21 12:39:51 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Pegasys Inc

[2010.12.19 17:49:43 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Process Hacker

[2011.03.26 15:02:18 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Reallusion

[2010.04.26 21:35:21 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Sierra Entertainment

[2011.05.09 22:17:30 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Skype

[2011.05.09 22:16:39 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\skypePM

[2011.04.08 17:48:15 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\SMRecorder

[2010.04.29 03:36:26 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Sports Interactive

[2010.07.10 15:54:51 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Stellarium

[2010.05.16 13:06:39 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\streamripper

[2011.05.08 15:36:08 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Temp

[2010.04.10 19:21:37 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Template

[2010.04.13 13:02:57 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Thunderbird

[2011.03.02 02:37:31 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Ubisoft

[2011.04.08 07:19:52 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\vlc

[2010.12.03 15:17:19 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Webocton - Scriptly

[2011.05.14 08:29:43 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\Winamp

[2010.10.02 12:44:26 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\WinRAR

[2010.12.03 21:09:57 | 000,000,000 | ---D | M] -- C:\Users\Di Giorgio\AppData\Roaming\XnView

 
 < %APPDATA%\*.exe /s >

[2011.04.08 07:50:41 | 000,038,784 | ---- | M] () -- C:\Users\Di Giorgio\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

[2011.03.16 17:58:21 | 000,003,638 | R--- | M] () -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{38AFE2B1-19DB-432A-BA4A-410BFBA78DCE}\_04AE388B2FA7C658E82E73.exe

[2011.03.16 17:58:21 | 000,003,638 | R--- | M] () -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{38AFE2B1-19DB-432A-BA4A-410BFBA78DCE}\_6FEFF9B68218417F98F549.exe

[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\ARPPRODUCTICON.exe

[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut10.exe

[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut1_4.exe

[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut2_4.exe

[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut3_1.exe

[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut4_1.exe

[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut5_1.exe

[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut6_1.exe

[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut7_1.exe

[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut8_1.exe

[2011.04.23 14:11:58 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{9EE5673E-EFFC-473E-9B8F-90066BE7777B}\NewShortcut9_1.exe

[2011.03.21 12:30:17 | 000,151,552 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{B1A455B8-1EC9-44E5-A158-DFBC978383F0}\NewShortcut6_3DE414CF8B684A84B59234BD57B6AF5C.exe

[2011.03.21 12:30:17 | 000,151,552 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{B1A455B8-1EC9-44E5-A158-DFBC978383F0}\NewShortcut7_3DE414CF8B684A84B59234BD57B6AF5C.exe

[2011.04.28 23:26:30 | 000,045,056 | ---- | M] () -- C:\Users\Di Giorgio\AppData\Roaming\Mozilla\Firefox\Profiles\spsnus7o.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fireshot-install.exe

[2011.03.29 05:37:05 | 000,581,120 | ---- | M] () -- C:\Users\Di Giorgio\AppData\Roaming\MP3 Quality Modifier\Encoder.exe

[2011.03.29 05:37:05 | 000,296,960 | ---- | M] () -- C:\Users\Di Giorgio\AppData\Roaming\MP3 Quality Modifier\Validator.exe

 
 < %SYSTEMDRIVE%\*.exe >

[2007.11.07 08:44:20 | 000,855,040 | ---- | M] (Microsoft Corporation) -- C:\install.exe

 

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTORV.SYS  >

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0033117673c16921\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\SysNative\netlogon.dll

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_38e464dbe521cc7f\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\SysNative\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\SysNative\user32.dll

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 < --------- >

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:4CF61E54
 

< End of report >

--- --- ---

Hm, was willst du mit diesen komischen Toolbars auf dem Rechner? Am besten alle entfernen und bei zukünftigen Programminstallation immer die benutzerdefinierte Methode anklicken, damit man bei der Installation mögliche Toolbars abwählen kann.

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010.09.30 13:09:27 | 000,000,044 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]

O33 - MountPoints2\{3cee0917-4b06-11df-a2b5-00262d203210}\Shell - "" = AutoRun

O33 - MountPoints2\{3cee0917-4b06-11df-a2b5-00262d203210}\Shell\AutoRun\command - "" = F:\CitiesXL2011.exe

O33 - MountPoints2\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\Shell\AutoRun\command - "" = E:\START.EXE -- [2010.09.30 12:50:11 | 002,775,202 | R--- | M] (Macromedia, Inc.)

[2011.05.14 11:05:15 | 000,011,820 | -HS- | M] () -- C:\ProgramData\rs4cm4n2c8jl4hl47h2oo5nj33ef2824

[2011.05.14 11:05:15 | 000,011,820 | -HS- | M] () -- C:\Users\Di Giorgio\AppData\Local\2501828141

[2011.05.14 10:56:07 | 000,011,820 | -HS- | M] () -- C:\Users\Di Giorgio\AppData\Local\rs4cm4n2c8jl4hl47h2oo5nj33ef2824

@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:4CF61E54

:Commands

[purity]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

ok, das ist der bericht, ... die toolbars sollte ich wirklich deinstallieren

========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File move failed. E:\AUTORUN.INF scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3cee0917-4b06-11df-a2b5-00262d203210}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3cee0917-4b06-11df-a2b5-00262d203210}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3cee0917-4b06-11df-a2b5-00262d203210}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3cee0917-4b06-11df-a2b5-00262d203210}\ not found.
File F:\CitiesXL2011.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fd6d68eb-57e9-11db-bdc4-806e6f6e6963}\ not found.
File move failed. E:\START.EXE scheduled to be moved on reboot.
C:\ProgramData\rs4cm4n2c8jl4hl47h2oo5nj33ef2824 moved successfully.
C:\Users\Di Giorgio\AppData\Local\2501828141 moved successfully.
C:\Users\Di Giorgio\AppData\Local\rs4cm4n2c8jl4hl47h2oo5nj33ef2824 moved successfully.
ADS C:\ProgramData\TEMP:4CF61E54 deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.22.3 log created on 05152011_175000

Files\Folders moved on Reboot...
File move failed. E:\AUTORUN.INF scheduled to be moved on reboot.
File move failed. E:\START.EXE scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

2011/05/15 18:35:55.0021 3368 TDSS rootkit removing tool 2.5.1.0 May 13 2011 13:20:29
2011/05/15 18:35:55.0209 3368 ================================================================================
2011/05/15 18:35:55.0209 3368 SystemInfo:
2011/05/15 18:35:55.0209 3368
2011/05/15 18:35:55.0209 3368 OS Version: 6.1.7600 ServicePack: 0.0
2011/05/15 18:35:55.0209 3368 Product type: Workstation
2011/05/15 18:35:55.0209 3368 ComputerName: DIGIORGIO-2010
2011/05/15 18:35:55.0209 3368 UserName: Di Giorgio
2011/05/15 18:35:55.0209 3368 Windows directory: C:\Windows
2011/05/15 18:35:55.0209 3368 System windows directory: C:\Windows
2011/05/15 18:35:55.0209 3368 Running under WOW64
2011/05/15 18:35:55.0209 3368 Processor architecture: Intel x64
2011/05/15 18:35:55.0209 3368 Number of processors: 2
2011/05/15 18:35:55.0209 3368 Page size: 0x1000
2011/05/15 18:35:55.0209 3368 Boot type: Normal boot
2011/05/15 18:35:55.0209 3368 ================================================================================
2011/05/15 18:35:58.0173 3368 Initialize success
2011/05/15 18:36:02.0603 1352 ================================================================================
2011/05/15 18:36:02.0603 1352 Scan started
2011/05/15 18:36:02.0603 1352 Mode: Manual;
2011/05/15 18:36:02.0603 1352 ================================================================================
2011/05/15 18:36:04.0787 1352 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys
2011/05/15 18:36:04.0834 1352 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys
2011/05/15 18:36:04.0881 1352 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys
2011/05/15 18:36:04.0927 1352 adfs (2f0683fd2df1d92e891caca14b45a8c1) C:\Windows\system32\drivers\adfs.sys
2011/05/15 18:36:05.0005 1352 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/05/15 18:36:05.0052 1352 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
2011/05/15 18:36:05.0099 1352 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
2011/05/15 18:36:05.0146 1352 AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys
2011/05/15 18:36:05.0193 1352 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys
2011/05/15 18:36:05.0239 1352 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys
2011/05/15 18:36:05.0271 1352 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys
2011/05/15 18:36:05.0302 1352 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
2011/05/15 18:36:05.0349 1352 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
2011/05/15 18:36:05.0395 1352 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys
2011/05/15 18:36:05.0427 1352 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/05/15 18:36:05.0458 1352 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys
2011/05/15 18:36:05.0520 1352 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
2011/05/15 18:36:05.0551 1352 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
2011/05/15 18:36:05.0583 1352 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
2011/05/15 18:36:05.0614 1352 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/05/15 18:36:05.0645 1352 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys
2011/05/15 18:36:05.0692 1352 AtiHdmiService (fb7602c5c508be281368aae0b61b51c6) C:\Windows\system32\drivers\AtiHdmi.sys
2011/05/15 18:36:05.0848 1352 atikmdag (b5fb227a09a9ec28163fa4b45487c3c7) C:\Windows\system32\DRIVERS\atikmdag.sys
2011/05/15 18:36:06.0019 1352 atksgt (1fd0fa6618b31fad14385740d0f6c333) C:\Windows\system32\DRIVERS\atksgt.sys
2011/05/15 18:36:06.0097 1352 avgntflt (39c2e2870fc0c2ae0595b883cbe716b4) C:\Windows\system32\DRIVERS\avgntflt.sys
2011/05/15 18:36:06.0129 1352 avipbb (c98fa6e5ad0e857d22716bd2b8b1f399) C:\Windows\system32\DRIVERS\avipbb.sys
2011/05/15 18:36:06.0175 1352 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
2011/05/15 18:36:06.0222 1352 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
2011/05/15 18:36:06.0269 1352 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
2011/05/15 18:36:06.0316 1352 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/05/15 18:36:06.0347 1352 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys
2011/05/15 18:36:06.0378 1352 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/05/15 18:36:06.0409 1352 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/05/15 18:36:06.0441 1352 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
2011/05/15 18:36:06.0503 1352 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/05/15 18:36:06.0534 1352 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
2011/05/15 18:36:06.0565 1352 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/05/15 18:36:06.0597 1352 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/05/15 18:36:06.0628 1352 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/05/15 18:36:06.0690 1352 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys
2011/05/15 18:36:06.0737 1352 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
2011/05/15 18:36:06.0768 1352 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
2011/05/15 18:36:06.0815 1352 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/05/15 18:36:06.0846 1352 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys
2011/05/15 18:36:06.0877 1352 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys
2011/05/15 18:36:06.0909 1352 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
2011/05/15 18:36:06.0940 1352 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys
2011/05/15 18:36:06.0971 1352 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/05/15 18:36:07.0033 1352 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys
2011/05/15 18:36:07.0065 1352 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
2011/05/15 18:36:07.0096 1352 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
2011/05/15 18:36:07.0143 1352 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
2011/05/15 18:36:07.0205 1352 DXGKrnl (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys
2011/05/15 18:36:07.0361 1352 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
2011/05/15 18:36:07.0486 1352 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
2011/05/15 18:36:07.0533 1352 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys
2011/05/15 18:36:07.0579 1352 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
2011/05/15 18:36:07.0642 1352 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
2011/05/15 18:36:07.0673 1352 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
2011/05/15 18:36:07.0720 1352 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
2011/05/15 18:36:07.0751 1352 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
2011/05/15 18:36:07.0782 1352 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/05/15 18:36:07.0829 1352 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
2011/05/15 18:36:07.0891 1352 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
2011/05/15 18:36:07.0923 1352 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
2011/05/15 18:36:07.0969 1352 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys
2011/05/15 18:36:08.0001 1352 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/05/15 18:36:08.0047 1352 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
2011/05/15 18:36:08.0079 1352 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
2011/05/15 18:36:08.0110 1352 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/05/15 18:36:08.0141 1352 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/05/15 18:36:08.0172 1352 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
2011/05/15 18:36:08.0188 1352 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
2011/05/15 18:36:08.0219 1352 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
2011/05/15 18:36:08.0266 1352 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys
2011/05/15 18:36:08.0313 1352 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
2011/05/15 18:36:08.0359 1352 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
2011/05/15 18:36:08.0391 1352 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/05/15 18:36:08.0437 1352 iaStorV (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys
2011/05/15 18:36:08.0484 1352 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
2011/05/15 18:36:08.0531 1352 InputFilter_Hid_FlexDef2b (caa8bc6737dfa3bf1a50175cfb226788) C:\Windows\system32\DRIVERS\InputFilter_FlexDef2b.sys
2011/05/15 18:36:08.0640 1352 IntcAzAudAddService (bc64b75e8e0a0b8982ab773483164e72) C:\Windows\system32\drivers\RTKVHD64.sys
2011/05/15 18:36:08.0734 1352 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys
2011/05/15 18:36:08.0749 1352 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
2011/05/15 18:36:08.0781 1352 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/05/15 18:36:08.0812 1352 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys
2011/05/15 18:36:08.0827 1352 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
2011/05/15 18:36:08.0859 1352 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
2011/05/15 18:36:08.0874 1352 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys
2011/05/15 18:36:08.0921 1352 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/05/15 18:36:08.0968 1352 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/05/15 18:36:08.0983 1352 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/05/15 18:36:09.0030 1352 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys
2011/05/15 18:36:09.0077 1352 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys
2011/05/15 18:36:09.0124 1352 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
2011/05/15 18:36:09.0186 1352 lirsgt (5ea407821bb3104c31a705175ab4f309) C:\Windows\system32\DRIVERS\lirsgt.sys
2011/05/15 18:36:09.0233 1352 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
2011/05/15 18:36:09.0280 1352 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/05/15 18:36:09.0311 1352 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/05/15 18:36:09.0342 1352 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/05/15 18:36:09.0373 1352 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/05/15 18:36:09.0405 1352 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
2011/05/15 18:36:09.0436 1352 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
2011/05/15 18:36:09.0467 1352 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/05/15 18:36:09.0514 1352 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
2011/05/15 18:36:09.0545 1352 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
2011/05/15 18:36:09.0576 1352 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
2011/05/15 18:36:09.0607 1352 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
2011/05/15 18:36:09.0639 1352 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
2011/05/15 18:36:09.0670 1352 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys
2011/05/15 18:36:09.0717 1352 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
2011/05/15 18:36:09.0748 1352 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
2011/05/15 18:36:09.0795 1352 mrxsmb (b7f3d2c40bdf8ffb73ebfb19c77734e2) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/05/15 18:36:09.0841 1352 mrxsmb10 (86c6f88b5168ce21cf8d69d0b3ff5d19) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/05/15 18:36:09.0873 1352 mrxsmb20 (b081069251c8e9f42cb8769d07148f9c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/05/15 18:36:09.0904 1352 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys
2011/05/15 18:36:09.0919 1352 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys
2011/05/15 18:36:09.0966 1352 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
2011/05/15 18:36:09.0997 1352 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
2011/05/15 18:36:10.0029 1352 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys
2011/05/15 18:36:10.0091 1352 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
2011/05/15 18:36:10.0138 1352 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/05/15 18:36:10.0153 1352 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
2011/05/15 18:36:10.0185 1352 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
2011/05/15 18:36:10.0216 1352 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/05/15 18:36:10.0231 1352 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
2011/05/15 18:36:10.0263 1352 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/05/15 18:36:10.0294 1352 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
2011/05/15 18:36:10.0341 1352 mwlPSDFilter (6ffecc25b39dc7652a0cec0ada9db589) C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
2011/05/15 18:36:10.0372 1352 mwlPSDNServ (0befe32ca56d6ee89d58175725596a85) C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
2011/05/15 18:36:10.0419 1352 mwlPSDVDisk (d43bc633b8660463e446e28e14a51262) C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
2011/05/15 18:36:10.0465 1352 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
2011/05/15 18:36:10.0528 1352 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys
2011/05/15 18:36:10.0590 1352 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
2011/05/15 18:36:10.0606 1352 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/05/15 18:36:10.0653 1352 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/05/15 18:36:10.0684 1352 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/05/15 18:36:10.0715 1352 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
2011/05/15 18:36:10.0746 1352 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
2011/05/15 18:36:10.0777 1352 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
2011/05/15 18:36:10.0840 1352 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
2011/05/15 18:36:10.0855 1352 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
2011/05/15 18:36:10.0887 1352 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
2011/05/15 18:36:10.0996 1352 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys
2011/05/15 18:36:11.0105 1352 NTIDrvr (64ddd0dee976302f4bd93e5efcc2f013) C:\Windows\system32\drivers\NTIDrvr.sys
2011/05/15 18:36:11.0136 1352 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
2011/05/15 18:36:11.0183 1352 NVENETFD (a85b4f2ef3a7304a5399ef0526423040) C:\Windows\system32\DRIVERS\nvm62x64.sys
2011/05/15 18:36:11.0401 1352 nvlddmkm (dd81fbc57ab9134cddc5ce90880bfd80) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/05/15 18:36:11.0651 1352 NVNET (0ad267a4674805b61a5d7b911d2a978a) C:\Windows\system32\DRIVERS\nvmf6264.sys
2011/05/15 18:36:11.0698 1352 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys
2011/05/15 18:36:11.0745 1352 nvsmu (afde3015bb8d76e26bec3b287c5443a0) C:\Windows\system32\DRIVERS\nvsmu.sys
2011/05/15 18:36:11.0791 1352 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys
2011/05/15 18:36:11.0823 1352 nvstor64 (7c7eef51979658ce15bbc04f96a77d56) C:\Windows\system32\DRIVERS\nvstor64.sys
2011/05/15 18:36:11.0854 1352 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys
2011/05/15 18:36:11.0901 1352 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/05/15 18:36:11.0932 1352 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
2011/05/15 18:36:11.0963 1352 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys
2011/05/15 18:36:12.0010 1352 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys
2011/05/15 18:36:12.0025 1352 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys
2011/05/15 18:36:12.0072 1352 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/05/15 18:36:12.0103 1352 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
2011/05/15 18:36:12.0150 1352 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
2011/05/15 18:36:12.0275 1352 Point64 (b8d8ec78b0f9ed8e220506181274f3d3) C:\Windows\system32\DRIVERS\point64.sys
2011/05/15 18:36:12.0322 1352 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
2011/05/15 18:36:12.0353 1352 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
2011/05/15 18:36:12.0415 1352 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
2011/05/15 18:36:12.0493 1352 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
2011/05/15 18:36:12.0587 1352 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/05/15 18:36:12.0618 1352 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
2011/05/15 18:36:12.0649 1352 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
2011/05/15 18:36:12.0681 1352 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/05/15 18:36:12.0727 1352 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/05/15 18:36:12.0759 1352 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/05/15 18:36:12.0774 1352 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
2011/05/15 18:36:12.0805 1352 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
2011/05/15 18:36:12.0837 1352 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
2011/05/15 18:36:12.0868 1352 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/05/15 18:36:12.0899 1352 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
2011/05/15 18:36:12.0915 1352 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
2011/05/15 18:36:12.0946 1352 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys
2011/05/15 18:36:12.0977 1352 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys
2011/05/15 18:36:13.0039 1352 ReallusionVirtualAudio (138ece3e53db1a808156c9f1e9af5fc5) C:\Windows\system32\DRIVERS\RLVrtAuCbl.sys
2011/05/15 18:36:13.0086 1352 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
2011/05/15 18:36:13.0133 1352 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys
2011/05/15 18:36:13.0149 1352 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
2011/05/15 18:36:13.0195 1352 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
2011/05/15 18:36:13.0242 1352 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
2011/05/15 18:36:13.0258 1352 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
2011/05/15 18:36:13.0289 1352 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
2011/05/15 18:36:13.0336 1352 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
2011/05/15 18:36:13.0367 1352 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
2011/05/15 18:36:13.0398 1352 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\drivers\sffp_sd.sys
2011/05/15 18:36:13.0414 1352 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/05/15 18:36:13.0445 1352 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/05/15 18:36:13.0476 1352 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/05/15 18:36:13.0507 1352 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
2011/05/15 18:36:13.0554 1352 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
2011/05/15 18:36:13.0648 1352 sptd (602884696850c86434530790b110e8eb) C:\Windows\system32\Drivers\sptd.sys
2011/05/15 18:36:13.0648 1352 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 602884696850c86434530790b110e8eb
2011/05/15 18:36:13.0663 1352 sptd - detected LockedFile.Multi.Generic (1)
2011/05/15 18:36:13.0726 1352 srv (148d50904d2a0df29a19778715eb35bb) C:\Windows\system32\DRIVERS\srv.sys
2011/05/15 18:36:13.0788 1352 srv2 (ce2189fe31d36678ac9eb7ddee08ec96) C:\Windows\system32\DRIVERS\srv2.sys
2011/05/15 18:36:13.0851 1352 srvnet (cb69edeb069a49577592835659cd0e46) C:\Windows\system32\DRIVERS\srvnet.sys
2011/05/15 18:36:13.0897 1352 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
2011/05/15 18:36:13.0929 1352 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
2011/05/15 18:36:14.0038 1352 Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys
2011/05/15 18:36:14.0163 1352 TCPIP6 (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys
2011/05/15 18:36:14.0209 1352 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
2011/05/15 18:36:14.0241 1352 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
2011/05/15 18:36:14.0272 1352 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
2011/05/15 18:36:14.0287 1352 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
2011/05/15 18:36:14.0303 1352 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys
2011/05/15 18:36:14.0350 1352 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/05/15 18:36:14.0381 1352 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
2011/05/15 18:36:14.0412 1352 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
2011/05/15 18:36:14.0443 1352 UBHelper (2e22c1fd397a5a9ffef55e9d1fc96c00) C:\Windows\system32\drivers\UBHelper.sys
2011/05/15 18:36:14.0490 1352 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys
2011/05/15 18:36:14.0537 1352 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys
2011/05/15 18:36:14.0584 1352 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys
2011/05/15 18:36:14.0599 1352 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
2011/05/15 18:36:14.0662 1352 usbaudio (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys
2011/05/15 18:36:14.0693 1352 usbccgp (7b6a127c93ee590e4d79a5f2a76fe46f) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/05/15 18:36:14.0740 1352 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys
2011/05/15 18:36:14.0771 1352 usbehci (92969ba5ac44e229c55a332864f79677) C:\Windows\system32\DRIVERS\usbehci.sys
2011/05/15 18:36:14.0818 1352 usbhub (e7df1cfd28ca86b35ef5add0735ceef3) C:\Windows\system32\DRIVERS\usbhub.sys
2011/05/15 18:36:14.0849 1352 usbohci (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\Windows\system32\DRIVERS\usbohci.sys
2011/05/15 18:36:14.0880 1352 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
2011/05/15 18:36:14.0927 1352 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
2011/05/15 18:36:14.0958 1352 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\drivers\USBSTOR.SYS
2011/05/15 18:36:15.0005 1352 usbuhci (bc3070350a491d84b518d7cca9abd36f) C:\Windows\system32\drivers\usbuhci.sys
2011/05/15 18:36:15.0052 1352 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\system32\Drivers\usbvideo.sys
2011/05/15 18:36:15.0099 1352 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys
2011/05/15 18:36:15.0130 1352 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/05/15 18:36:15.0161 1352 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
2011/05/15 18:36:15.0192 1352 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys
2011/05/15 18:36:15.0223 1352 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys
2011/05/15 18:36:15.0239 1352 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys
2011/05/15 18:36:15.0286 1352 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
2011/05/15 18:36:15.0317 1352 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys
2011/05/15 18:36:15.0348 1352 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/05/15 18:36:15.0379 1352 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
2011/05/15 18:36:15.0411 1352 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
2011/05/15 18:36:15.0442 1352 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
2011/05/15 18:36:15.0457 1352 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
2011/05/15 18:36:15.0489 1352 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
2011/05/15 18:36:15.0520 1352 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
2011/05/15 18:36:15.0582 1352 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/05/15 18:36:15.0598 1352 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
2011/05/15 18:36:15.0676 1352 WinUsb (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys
2011/05/15 18:36:15.0707 1352 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/05/15 18:36:15.0769 1352 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
2011/05/15 18:36:15.0801 1352 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys
2011/05/15 18:36:15.0832 1352 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/05/15 18:36:15.0972 1352 ================================================================================
2011/05/15 18:36:15.0972 1352 Scan finished
2011/05/15 18:36:15.0972 1352 ================================================================================
2011/05/15 18:36:15.0972 3512 Detected object count: 1
2011/05/15 18:36:27.0922 3512 LockedFile.Multi.Generic(sptd) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Combofix Logfile:

Code:

ComboFix 11-05-15.03 - Di Giorgio 16.05.2011   1:45.1.2 - x64

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.2047.934 [GMT 2:00]

ausgeführt von:: c:\users\Di Giorgio\Desktop\cofi.exe

AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\Install.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-04-15 bis 2011-05-15  ))))))))))))))))))))))))))))))

.

.

2011-05-15 23:53 . 2011-05-15 23:53        --------        d-----w-        c:\users\Gast\AppData\Local\temp

2011-05-15 23:53 . 2011-05-15 23:53        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-05-15 15:50 . 2011-05-15 15:50        --------        d-----w-        C:\_OTL

2011-05-15 11:49 . 2011-05-15 11:49        404640        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-05-14 09:04 . 2011-05-14 09:04        --------        d-----w-        c:\users\Di Giorgio\AppData\Roaming\Malwarebytes

2011-05-14 09:04 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\SysWow64\drivers\mbamswissarmy.sys

2011-05-14 09:04 . 2011-05-14 09:04        --------        d-----w-        c:\programdata\Malwarebytes

2011-05-14 09:04 . 2010-12-20 16:08        24152        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-05-14 09:04 . 2011-05-14 09:04        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2011-05-14 08:24 . 2011-05-14 08:35        --------        d-sh--w-        c:\users\Di Giorgio\.BackupManager

2011-05-14 08:24 . 2011-05-14 08:24        --------        d-----w-        c:\users\Di Giorgio\IOption

2011-05-14 08:24 . 2011-05-14 08:24        --------        d-----w-        C:\.uuid

2011-05-14 08:19 . 2011-05-14 08:19        --------        d-----w-        c:\programdata\PC Tools

2011-05-13 06:45 . 2011-04-11 08:21        8802128        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{5539FA6D-3189-440B-A402-479CC44A5462}\mpengine.dll

2011-05-11 06:23 . 2011-04-09 06:45        5509504        ----a-w-        c:\windows\system32\ntoskrnl.exe

2011-05-11 06:23 . 2011-04-09 06:13        3957632        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2011-05-11 06:23 . 2011-04-09 06:13        3901824        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2011-05-11 06:23 . 2011-03-25 03:23        324608        ----a-w-        c:\windows\system32\drivers\usbport.sys

2011-05-11 06:23 . 2011-03-25 03:22        52224        ----a-w-        c:\windows\system32\drivers\usbehci.sys

2011-05-11 06:23 . 2011-03-25 03:23        343040        ----a-w-        c:\windows\system32\drivers\usbhub.sys

2011-05-11 06:23 . 2011-03-25 03:23        98816        ----a-w-        c:\windows\system32\drivers\usbccgp.sys

2011-05-11 06:23 . 2011-03-25 03:22        25600        ----a-w-        c:\windows\system32\drivers\usbohci.sys

2011-05-11 06:23 . 2011-03-25 03:22        30720        ----a-w-        c:\windows\system32\drivers\usbuhci.sys

2011-05-11 06:23 . 2011-03-25 03:22        7936        ----a-w-        c:\windows\system32\drivers\usbd.sys

2011-05-09 20:20 . 2011-05-15 22:08        --------        d-----w-        c:\program files (x86)\Steam

2011-05-08 14:28 . 2011-03-03 05:58        232960        ----a-w-        c:\windows\system32\Spool\prtprocs\x64\EKIJ5000PPR.dll

2011-05-08 13:47 . 2011-05-08 13:47        --------        d-----w-        c:\windows\SysWow64\kodak

2011-05-04 00:17 . 2011-05-04 00:17        --------        d-----w-        c:\users\Di Giorgio\AppData\Local\Focus Home Interactive

2011-04-29 15:26 . 2011-04-29 15:26        --------        d-----w-        c:\program files (x86)\7-Zip

2011-04-29 15:25 . 2011-04-29 15:25        --------        d-----w-        c:\program files (x86)\Focus Home Interactive

2011-04-23 12:19 . 2011-04-23 12:19        --------        d-----w-        c:\program files (x86)\SHOUTcast

2011-04-21 17:00 . 2011-05-01 09:02        713632        ----a-w-        c:\program files (x86)\Mozilla Firefox\uninstall\helper.exe

2011-04-18 06:37 . 2011-04-18 06:37        --------        d-----w-        c:\users\Di Giorgio\AppData\Roaming\elsterformular

2011-04-18 06:37 . 2011-04-18 06:37        --------        d-----w-        c:\programdata\elsterformular

2011-04-18 06:36 . 2011-04-18 06:37        --------        d-----w-        c:\program files (x86)\ElsterFormular

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-21 10:30 . 2011-03-21 10:30        151552        ----a-r-        c:\users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{B1A455B8-1EC9-44E5-A158-DFBC978383F0}\NewShortcut7_3DE414CF8B684A84B59234BD57B6AF5C.exe

2011-03-21 10:30 . 2011-03-21 10:30        151552        ----a-r-        c:\users\Di Giorgio\AppData\Roaming\Microsoft\Installer\{B1A455B8-1EC9-44E5-A158-DFBC978383F0}\NewShortcut6_3DE414CF8B684A84B59234BD57B6AF5C.exe

2011-03-21 10:29 . 2011-03-21 10:30        59488        ----a-w-        c:\windows\SysWow64\GenSvcInst.exe

2011-03-21 10:29 . 2011-03-21 10:30        33408        ----a-w-        c:\windows\SysWow64\drivers\CDRBSDRV.SYS

2011-03-21 10:29 . 2011-03-21 10:30        145504        ----a-w-        c:\windows\SysWow64\bgsvcgen.exe

2011-03-11 06:19 . 2011-04-15 02:47        1395712        ----a-w-        c:\windows\system32\mfc42.dll

2011-03-11 06:19 . 2011-04-15 02:47        1359872        ----a-w-        c:\windows\system32\mfc42u.dll

2011-03-11 05:40 . 2011-04-15 02:47        1164288        ----a-w-        c:\windows\SysWow64\mfc42u.dll

2011-03-11 05:40 . 2011-04-15 02:47        1137664        ----a-w-        c:\windows\SysWow64\mfc42.dll

2011-03-08 06:14 . 2011-04-15 02:47        976896        ----a-w-        c:\windows\system32\inetcomm.dll

2011-03-08 05:38 . 2011-04-15 02:47        740864        ----a-w-        c:\windows\SysWow64\inetcomm.dll

2011-03-04 06:17 . 2011-04-27 05:26        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2011-03-04 06:17 . 2011-04-27 05:26        347648        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll

2011-03-03 06:17 . 2011-04-15 02:47        182272        ----a-w-        c:\windows\system32\dnsrslvr.dll

2011-03-03 06:14 . 2011-04-15 02:47        30208        ----a-w-        c:\windows\system32\dnscacheugc.exe

2011-03-03 06:03 . 2011-03-03 06:03        143360        ----a-w-        c:\windows\system32\EKIJCOINST12.dll

2011-03-03 05:57 . 2011-03-03 05:57        613376        ----a-w-        c:\windows\system32\EKIJ5000MON.dll

2011-03-03 05:27 . 2011-04-15 02:47        28672        ----a-w-        c:\windows\SysWow64\dnscacheugc.exe

2011-03-03 03:58 . 2011-04-15 02:47        3133440        ----a-w-        c:\windows\system32\win32k.sys

2011-02-24 06:30 . 2011-04-15 02:48        476160        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2011-02-24 06:29 . 2011-04-15 02:47        1197056        ----a-w-        c:\windows\system32\wininet.dll

2011-02-24 06:24 . 2011-04-15 02:47        57856        ----a-w-        c:\windows\system32\licmgr10.dll

2011-02-24 05:32 . 2011-04-15 02:48        288256        ----a-w-        c:\windows\SysWow64\XpsGdiConverter.dll

2011-02-24 05:32 . 2011-04-15 02:47        981504        ----a-w-        c:\windows\SysWow64\wininet.dll

2011-02-24 05:30 . 2011-04-15 02:47        44544        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2011-02-24 05:05 . 2011-04-15 02:47        482816        ----a-w-        c:\windows\system32\html.iec

2011-02-24 04:24 . 2011-04-15 02:47        1638912        ----a-w-        c:\windows\system32\mshtml.tlb

2011-02-24 04:23 . 2011-04-15 02:47        386048        ----a-w-        c:\windows\SysWow64\html.iec

2011-02-24 03:50 . 2011-04-15 02:47        1638912        ----a-w-        c:\windows\SysWow64\mshtml.tlb

2011-02-23 05:16 . 2011-04-15 02:47        461312        ----a-w-        c:\windows\system32\drivers\srv.sys

2011-02-23 05:16 . 2011-04-15 02:47        401920        ----a-w-        c:\windows\system32\drivers\srv2.sys

2011-02-23 05:15 . 2011-04-15 02:47        161792        ----a-w-        c:\windows\system32\drivers\srvnet.sys

2011-02-23 05:15 . 2011-04-15 02:47        157696        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys

2011-02-23 05:15 . 2011-04-15 02:47        286720        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys

2011-02-23 05:15 . 2011-04-15 02:47        126464        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys

2011-02-23 05:15 . 2011-04-15 02:47        90624        ----a-w-        c:\windows\system32\drivers\bowser.sys

2011-02-19 06:37 . 2011-03-09 09:56        1135104        ----a-w-        c:\windows\system32\FntCache.dll

2011-02-19 06:37 . 2011-03-09 09:56        1540608        ----a-w-        c:\windows\system32\DWrite.dll

2011-02-19 06:36 . 2011-03-09 09:56        902656        ----a-w-        c:\windows\system32\d2d1.dll

2011-02-19 06:36 . 2011-04-15 02:47        46080        ----a-w-        c:\windows\system32\atmlib.dll

2011-02-19 05:32 . 2011-03-09 09:56        1074176        ----a-w-        c:\windows\SysWow64\DWrite.dll

2011-02-19 05:32 . 2011-03-09 09:56        739840        ----a-w-        c:\windows\SysWow64\d2d1.dll

2011-02-19 05:32 . 2011-04-15 02:47        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll

2011-02-19 04:13 . 2011-04-15 02:47        367104        ----a-w-        c:\windows\system32\atmfd.dll

2011-02-19 03:37 . 2011-04-15 02:47        294912        ----a-w-        c:\windows\SysWow64\atmfd.dll

2011-02-18 06:37 . 2011-04-15 02:47        612352        ----a-w-        c:\windows\system32\vbscript.dll

2011-02-18 05:36 . 2011-04-15 02:47        428032        ----a-w-        c:\windows\SysWow64\vbscript.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2010-09-28 20:44        1400712        ----a-w-        c:\program files (x86)\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-09-10 13:41        120104        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-18 98304]

"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2011-03-22 74752]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-11-06 281768]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]

"EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe" [2011-03-03 2922496]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux9"=wdmaud.drv

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 136176]

R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 136176]

R3 InputFilter_Hid_FlexDef2b;Siliten HID Devices(FlexDef2b) Driver Service;c:\windows\system32\DRIVERS\InputFilter_FlexDef2b.sys [x]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-30 136360]

S2 Dyyno Launcher;Dyyno Service;c:\program files (x86)\Dyyno\Dyyno Broadcaster\launcherd.exe [2011-03-16 415072]

S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-05-06 1220608]

S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]

S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files (x86)\Kodak\AiO\Center\EKAiOHostService.exe [2011-03-09 366000]

S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-12 62208]

S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]

S2 WLCleanRAM;WinLube memory clean up scheduler;c:\program files (x86)\LOADSTREET\WinSpeedUp 3\CleanRAMService.exe [2007-12-04 20480]

S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]

S3 ReallusionVirtualAudio;Reallusion Virtual Audio;c:\windows\system32\DRIVERS\RLVrtAuCbl.sys [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

2011-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 16:15]

.

2011-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 16:15]

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-09-10 13:44        137512        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-20 7981088]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

uLocal Page = c:\windows\system32\blank.htm

mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_x1301&r=17360410kn07974580t65bh4j12w6p

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

FF - ProfilePath - c:\users\Di Giorgio\AppData\Roaming\Mozilla\Firefox\Profiles\spsnus7o.default\

FF - prefs.js: browser.startup.homepage - hxxp://google.de

.

.

------- Dateityp-Verknüpfung -------

.

.txt=

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

URLSearchHooks-{64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - (no file)

Toolbar-Locked - (no file)

Wow6432Node-HKLM-Run-Conime - c:\windows\system32\conime.exe

SafeBoot-mcmscsvc

SafeBoot-MCODS

Toolbar-Locked - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{64EAD72B-FFD4-4E01-AA3A-4C71665D73E4} - (no file)

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2011-05-16  01:55:35

ComboFix-quarantined-files.txt  2011-05-15 23:55

.

Vor Suchlauf: 12 Verzeichnis(se), 295.425.671.168 Bytes frei

Nach Suchlauf: 18 Verzeichnis(se), 295.290.408.960 Bytes frei

.

- - End Of File - - F797F5F0B5698788C17556BA36FE8671

--- --- ---