Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Incredi Toolbar Trojaner, zweiter Laptop (https://www.trojaner-board.de/122860-incredi-toolbar-trojaner-zweiter-laptop.html)

c_zett 27.08.2012 15:58
Incredi Toolbar Trojaner, zweiter Laptop
 
Hallo,
leider befindet sich auch auf einem zweiten Laptop die Incredi Toolbar. Wahrscheinlich mit einem Download des Adobe Readers aus unbekannter Quelle auf den Rechner gezogen (ist nicht mein Rechner und angeblich hat niemand den Adobe Reader runtergeladen, aber es würde zeitlich passen ;) ).
Habe, nach Angaben in diesem Forum, auch hier den adwCleaner laufen lassen, einen Scan mit Malewarebytes (Funde in Quarantäne verschoben) durchgeführt, den defogger (Fehlermeldung) und OTL laufen lassen.
Wie gehts es jetzt weiter?
Hoffentlich war auch hier bis jetzt alles richtig ;) und vielen Dank schon einmal für die Hilfe!!
Anbei die Logfiles und hier die OTL-Datei:

OTL Logfile:
Code:
OTL logfile created on: 27.08.2012 16:36:49 - Run 1
OTL by OldTimer - Version 3.2.59.1    Folder = C:\Users\Admin\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,91 Gb Total Physical Memory | 2,69 Gb Available Physical Memory | 68,79% Memory free
7,81 Gb Paging File | 6,50 Gb Available in Paging File | 83,19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283,39 Gb Total Space | 188,33 Gb Free Space | 66,46% Space Free | Partition Type: NTFS
Drive D: | 14,41 Gb Total Space | 2,34 Gb Free Space | 16,21% Space Free | Partition Type: NTFS
Drive E: | 99,34 Mb Total Space | 92,75 Mb Free Space | 93,37% Space Free | Partition Type: FAT32
Drive F: | 465,76 Gb Total Space | 255,81 Gb Free Space | 54,92% Space Free | Partition Type: NTFS
 
Computer Name: SARAH-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 360 Days
 
========== Processes (SafeList) ==========
 
PRC - File not found --
PRC - [2012.08.27 16:32:54 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Downloads\OTL.exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2010.11.20 14:17:00 | 000,302,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\cmd.exe
PRC - [2010.05.21 00:52:06 | 011,312,128 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2010.05.21 00:52:04 | 011,318,784 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2010.02.24 12:41:16 | 000,088,576 | ---- | M] (ZTE) -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\mcserver.exe
PRC - [2010.01.26 12:35:46 | 000,215,552 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\dbus-daemon.exe
PRC - [2010.01.26 12:35:42 | 000,031,232 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\db_daemon.exe
PRC - [2010.01.26 12:35:36 | 000,043,008 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\gconfd-2.exe
PRC - [2010.01.15 14:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009.10.06 00:08:42 | 000,210,216 | ---- | M] (CyberLink) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
PRC - [2009.04.17 10:09:46 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2006.04.18 05:00:00 | 000,102,400 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.05.04 15:36:28 | 000,970,752 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2010.02.28 09:28:44 | 000,089,600 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\itapi.dll
MOD - [2010.02.28 09:28:38 | 000,054,272 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\coder.dll
MOD - [2010.02.28 09:28:36 | 000,043,008 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\audio.dll
MOD - [2010.02.28 09:28:34 | 000,025,088 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\log.dll
MOD - [2010.02.24 12:41:04 | 000,034,304 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\libctlsvr.dll
MOD - [2010.01.26 12:35:46 | 000,215,552 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\dbus-daemon.exe
MOD - [2010.01.26 12:35:42 | 000,031,232 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\db_daemon.exe
MOD - [2010.01.26 12:35:36 | 000,043,008 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\gconfd-2.exe
MOD - [2010.01.26 12:35:34 | 000,055,808 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\libgconfbackend-xml.dll
MOD - [2010.01.26 12:35:20 | 000,157,696 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\libgconf-2.dll
MOD - [2010.01.26 12:35:06 | 000,594,432 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\dbus-1.dll
MOD - [2010.01.26 12:34:04 | 000,341,504 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\sqlite3.dll
MOD - [2009.10.06 00:08:38 | 000,931,112 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll
MOD - [2009.08.20 13:35:48 | 007,745,536 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
MOD - [2009.08.20 13:35:46 | 002,121,728 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
MOD - [2009.08.20 13:35:46 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
MOD - [2009.03.28 09:19:06 | 000,080,688 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\zlib1.dll
MOD - [2008.05.06 13:50:00 | 000,971,776 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\libxml2.dll
MOD - [2007.09.09 17:07:00 | 000,151,552 | ---- | M] () -- C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\libexpat.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.09.21 22:49:10 | 000,240,640 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\stacsv64.exe -- (STacSV)
SRV:64bit: - [2009.07.08 14:49:02 | 000,030,520 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv)
SRV:64bit: - [2009.03.02 23:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\AESTSr64.exe -- (AESTFilters)
SRV - [2012.07.20 19:02:18 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.09.21 22:49:10 | 000,240,640 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\STacSV64.exe -- (STacSV)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.06.06 02:07:28 | 000,250,616 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2009.04.17 10:09:46 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.03.02 23:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\AESTSr64.exe -- (AESTFilters)
SRV - [2009.02.22 13:00:00 | 000,129,584 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\SysWOW64\ezsvc7.dll -- (ezSharedSvc)
SRV - [2006.04.18 05:00:00 | 000,102,400 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE -- (EPSON_PM_RPCV4_01)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.09.07 03:04:00 | 002,755,072 | ---- | M] (Novatek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvtcam.sys -- (DCamUSBNovatek)
DRV:64bit: - [2009.12.15 04:46:38 | 000,039,552 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tcpipBM.sys -- (tcpipBM)
DRV:64bit: - [2009.12.15 04:46:30 | 000,016,512 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\BMLoad.sys -- (BMLoad)
DRV:64bit: - [2009.11.24 03:49:44 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:64bit: - [2009.11.24 03:49:44 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:64bit: - [2009.11.24 03:49:44 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:64bit: - [2009.11.24 03:49:44 | 000,011,776 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter)
DRV:64bit: - [2009.10.31 06:16:04 | 000,084,584 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2009.10.24 03:53:38 | 000,291,328 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.09.21 22:49:10 | 000,500,736 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009.09.21 20:47:14 | 001,484,800 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.09.03 10:24:20 | 007,369,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.08 14:49:08 | 000,030,008 | ---- | M] (Hewlett-Packard) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpdskflt.sys -- (hpdskflt)
DRV:64bit: - [2009.07.08 14:48:50 | 000,041,272 | ---- | M] (Hewlett-Packard) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelerometer.sys -- (Accelerometer)
DRV:64bit: - [2009.06.10 23:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009.06.10 23:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009.06.10 23:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009.06.10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009.06.10 22:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.05.25 05:57:42 | 000,243,760 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)
DRV:64bit: - [2009.04.29 09:48:32 | 000,018,432 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV:64bit: - [2008.07.24 12:04:34 | 000,115,328 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2009.09.27 14:47:24 | 000,021,624 | -H-- | M] (DeviceVM, Inc.) [Kernel | System | Running] -- C:\SPLASH.SYS\config\dvmio.sys -- (DVMIO)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [1999.10.13 15:19:20 | 000,012,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\USBSCAN.SYS -- (usbscan)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {39EFC090-4DE4-4FE1-B32F-F2DBE6893280}
IE:64bit: - HKLM\..\SearchScopes\{39EFC090-4DE4-4FE1-B32F-F2DBE6893280}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKLM\..\SearchScopes,DefaultScope = {39EFC090-4DE4-4FE1-B32F-F2DBE6893280}
IE - HKLM\..\SearchScopes\{39EFC090-4DE4-4FE1-B32F-F2DBE6893280}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
IE - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.t-online.de/"
FF - prefs.js..extensions.enabledItems: ff-bmboc@bytemobile.com:4.2.2
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.0.900
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.0.900
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.5.0.8013
FF - prefs.js..extensions.enabledItems: toolbar@web.de:1.7.5
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX OVS Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_34: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.4: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files (x86)\T-Mobile\InternetManager_Z\Bin\addon [2010.02.02 15:19:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011.01.03 01:15:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011.01.03 01:15:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 19:02:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.21 17:56:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.12.19 14:04:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2011.12.19 14:04:41 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 19:02:18 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.21 17:56:26 | 000,000,000 | ---D | M]
 
[2010.09.06 10:11:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions
[2012.08.27 11:37:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\h2r0ta3x.default\extensions
[2012.08.21 12:56:50 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\h2r0ta3x.default\extensions\2020Player_IKEA@2020Technologies.com
[2012.08.10 18:03:43 | 000,000,853 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h2r0ta3x.default\searchplugins\11-suche.xml
[2012.08.10 18:03:43 | 000,002,209 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h2r0ta3x.default\searchplugins\englische-ergebnisse.xml
[2012.08.10 18:03:43 | 000,010,506 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h2r0ta3x.default\searchplugins\gmx-suche.xml
[2012.08.10 18:03:43 | 000,002,368 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h2r0ta3x.default\searchplugins\lastminute.xml
[2012.08.10 18:03:42 | 000,005,489 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\h2r0ta3x.default\searchplugins\webde-suche.xml
[2012.08.20 07:22:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.10.17 21:06:29 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.08.20 07:22:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}
[2010.02.02 15:19:02 | 000,000,000 | ---D | M] (Bytemobile Optimization Client) -- C:\PROGRAM FILES (X86)\T-MOBILE\INTERNETMANAGER_Z\BIN\ADDON
[2012.08.10 18:03:28 | 000,526,409 | ---- | M] () (No name found) -- C:\USERS\ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\H2R0TA3X.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI
[2012.07.20 19:02:18 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.05.06 17:55:34 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.05.06 17:55:34 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.05.06 17:55:34 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.05.06 17:55:34 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.05.06 17:55:34 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.05.06 17:55:34 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider:  ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =
CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.0.900_0\
CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.0.900_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe (EasyBits Software AS)
O4 - HKLM..\Run: [HPCam_Menu] c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-589288160-1231635108-1947154641-1003..\Run: [Adobe Reader Synchronizer] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-21-589288160-1231635108-1947154641-1003..\Run: [EPSON Stylus DX6000 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBIE.EXE /FU "C:\Users\Admin\AppData\Local\Temp\E_S4308.tmp" /EF "HKCU" File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0
O7 - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O7 - HKU\S-1-5-21-589288160-1231635108-1947154641-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe File not found
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe File not found
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab (Java Plug-in 1.6.0_34)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab (Java Plug-in 1.6.0_34)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab (Java Plug-in 1.6.0_34)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{953717A1-2C9D-44DC-A3FF-E0BDBBB3B29B}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll (EasyBits Software Corp.)
O28 - HKLM ShellExecuteHooks: UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 360 Days ==========
 
[2012.08.27 11:44:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2012.08.27 11:44:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.27 11:44:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.27 11:44:18 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.27 11:44:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.23 10:27:23 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\Euro-Gewinner und Verlierer,index-Dateien
[2012.08.20 07:22:02 | 000,157,680 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2012.08.20 07:22:02 | 000,149,488 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2012.08.20 07:22:02 | 000,149,488 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2012.08.15 21:11:18 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\german-wings_170812Itinerary-Dateien
[2012.08.15 08:09:15 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2012.08.15 08:09:15 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2012.08.15 08:09:15 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe
[2012.08.15 08:09:11 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[2012.08.15 08:09:10 | 000,911,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.08.15 08:09:10 | 000,609,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.08.15 08:09:09 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.08.15 08:09:08 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
[2012.08.15 08:09:08 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll
[2012.08.15 08:09:08 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll
[2012.08.15 08:08:50 | 000,735,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.08.15 08:08:50 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.08.15 08:08:50 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.08.15 08:08:50 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.08.15 08:08:50 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.08.15 08:08:49 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.08.15 08:08:49 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.08.15 08:08:40 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
[2012.08.09 20:50:12 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\Hockenheimring
[2012.08.09 12:20:25 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Video Downloader
[2012.08.09 12:19:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\vGrabber-software
[2012.08.09 12:19:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Incredibar.com
[2012.08.04 23:09:18 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\index.php-Dateien
[2012.07.18 21:02:10 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Logitech
[2012.07.17 12:43:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
[2012.07.11 10:08:15 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2012.07.11 10:08:15 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2012.07.11 10:08:04 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012.07.11 10:08:01 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2012.07.11 10:08:01 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2012.07.06 10:00:06 | 000,000,000 | --SD | C] -- C:\Users\Admin\Documents\Eigene Datenquellen
[2012.06.19 18:23:23 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2012.06.19 18:23:23 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2012.06.19 18:23:22 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2012.06.19 18:23:10 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2012.06.19 18:23:10 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2012.06.19 18:23:10 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2012.06.19 18:23:02 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2012.06.19 18:23:02 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2012.06.13 08:02:42 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll
[2012.06.13 08:02:42 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll
[2012.06.13 08:02:42 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe
[2012.06.13 08:02:32 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.06.13 08:02:29 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.06.13 08:02:28 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.06.13 08:02:24 | 003,216,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll
[2012.06.13 08:02:19 | 001,462,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.06.13 08:02:18 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.06.06 20:59:42 | 001,070,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCTL.OCX
[2012.05.21 17:56:26 | 000,477,168 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\npdeployJava1.dll
[2012.05.17 19:49:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012.05.17 19:47:47 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2012.05.17 19:47:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2012.05.10 17:25:50 | 001,544,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2012.05.06 17:55:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.05.06 17:55:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.04.13 19:46:01 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll
[2012.04.13 19:46:01 | 000,023,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\fs_rec.sys
[2012.04.13 19:45:59 | 000,220,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.04.09 11:23:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.03.29 10:50:24 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Rovio
[2012.03.29 10:50:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rovio
[2012.03.29 10:50:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rovio
[2012.03.29 10:31:52 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.03.29 10:31:47 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012.03.29 10:29:56 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\WinRAR
[2012.03.14 08:23:43 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll
[2012.03.14 08:23:43 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll
[2012.03.05 08:04:42 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Media Player Classic
[2012.02.16 20:09:21 | 000,509,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll
[2012.02.16 20:09:17 | 000,515,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\timedate.cpl
[2012.02.16 20:09:16 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl
[2012.02.16 20:09:02 | 000,634,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msvcrt.dll
[2012.02.15 19:38:33 | 000,000,000 | ---D | C] -- C:\Users\Admin\4.0
[2012.02.15 19:38:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\.tfo4
[2012.02.12 18:45:23 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\elsterformular
[2012.02.12 18:44:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular
[2012.02.12 18:44:50 | 000,000,000 | ---D | C] -- C:\ProgramData\elsterformular
[2012.02.12 18:44:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ElsterFormular
[2012.01.31 15:56:58 | 001,447,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2012.01.31 15:56:57 | 000,395,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll
[2012.01.31 15:56:57 | 000,314,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\webio.dll
[2012.01.31 15:56:57 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
[2012.01.31 15:56:56 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
[2012.01.31 15:56:56 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
[2012.01.11 18:44:55 | 001,572,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll
[2012.01.11 18:44:55 | 001,328,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll
[2012.01.11 18:44:55 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll
[2012.01.11 18:44:54 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll
[2012.01.11 18:44:37 | 001,731,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2012.01.11 18:44:24 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\packager.dll
[2012.01.11 18:44:24 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\packager.dll
[2011.12.21 18:10:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
[2011.12.21 18:08:39 | 000,008,704 | ---- | C] (SEIKO EPSON CORP.) -- C:\Windows\SysNative\E_GCINST.DLL
[2011.12.21 18:08:38 | 000,126,976 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\E_ILMBIE.DLL
[2011.12.21 18:08:37 | 000,086,528 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\E_IBCBBIE.DLL
[2011.12.21 18:07:46 | 000,000,000 | ---D | C] -- C:\ProgramData\EPSON
[2011.12.19 14:45:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OLYMPUS CAMEDIA
[2011.12.19 14:04:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime, olympus
[2011.12.15 08:29:15 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2011.12.15 08:28:32 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2011.12.15 08:28:31 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2011.12.10 01:00:13 | 000,000,000 | ---D | C] -- C:\Users\Admin\.jordan
[2011.12.09 20:13:08 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Arbeitsbeispiele
[2011.12.06 17:02:25 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\OneNote-Notizbücher
[2011.11.29 12:50:17 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011.11.23 14:20:57 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2011.10.31 22:07:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\DivX
[2011.10.28 23:04:33 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Apps
[2011.10.17 21:06:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.10.13 07:30:32 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisdecd.dll
[2011.10.13 07:30:32 | 000,108,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisrndr.ax
[2011.10.13 07:30:32 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisrndr.ax
[2011.10.13 07:30:31 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll
[2011.10.13 07:30:31 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSNP.ax
[2011.10.13 07:30:30 | 000,104,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Mpeg2Data.ax
[2011.10.13 07:30:29 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSNP.ax
[2011.10.13 07:30:29 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Mpeg2Data.ax
[2011.10.13 07:30:28 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSDvbNP.ax
[2011.10.13 07:30:28 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSDvbNP.ax
[2011.10.13 07:30:24 | 000,331,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleacc.dll
[2011.10.13 07:30:23 | 000,861,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
[2011.10.05 22:07:40 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
 
========== Files - Modified Within 360 Days ==========
 
[2012.08.27 16:32:26 | 000,023,024 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.27 16:32:26 | 000,023,024 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.27 16:31:38 | 000,000,000 | ---- | M] () -- C:\Users\Admin\defogger_reenable
[2012.08.27 16:29:21 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.27 16:29:21 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.27 16:29:21 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.27 16:29:21 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.27 16:29:21 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.27 16:25:16 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.27 16:25:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.27 16:24:57 | 3144,839,168 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.27 15:47:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.27 11:44:20 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.23 10:27:25 | 000,162,693 | ---- | M] () -- C:\Users\Admin\Desktop\Euro-Gewinner und Verlierer,index.htm
[2012.08.22 07:51:46 | 000,002,340 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.08.16 10:47:24 | 000,454,416 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.15 21:11:19 | 000,040,849 | ---- | M] () -- C:\Users\Admin\Desktop\german-wings_170812Itinerary.aspx
[2012.08.12 11:05:15 | 000,549,791 | ---- | M] () -- C:\Users\Admin\Desktop\fragebogen_stud_fks-medien.pdf
[2012.08.12 09:51:17 | 000,056,593 | ---- | M] () -- C:\Users\Admin\Desktop\PA-StudInfo6_BA-MA-Diplomverfahren-09-Masterdatei.pdf
[2012.08.12 09:50:26 | 000,037,333 | ---- | M] () -- C:\Users\Admin\Desktop\PA07_Zulassung_Bachelorarbeit.pdf
[2012.08.12 09:49:49 | 000,110,349 | ---- | M] () -- C:\Users\Admin\Desktop\Formulare_K_Bachelor.pdf
[2012.08.09 12:20:25 | 000,001,999 | ---- | M] () -- C:\Users\Admin\Desktop\Video Downloader.lnk
[2012.08.04 23:09:20 | 000,023,939 | ---- | M] () -- C:\Users\Admin\Desktop\index.php.htm
[2012.08.04 18:13:43 | 000,035,441 | ---- | M] () -- C:\Users\Admin\Documents\Caro_Ruecksendung_SIMKarte.rtf
[2012.08.03 16:17:57 | 000,000,766 | ---- | M] () -- C:\Users\Admin\Documents\Amtsgericht_Hildesheim_Beschluss.rtf
[2012.07.30 16:00:55 | 000,030,284 | ---- | M] () -- C:\Users\Admin\Desktop\99080404-1.jpg
[2012.07.26 12:14:54 | 003,652,322 | ---- | M] () -- C:\Users\Admin\Documents\hockenheimring.xps
[2012.07.26 12:09:56 | 003,575,754 | ---- | M] () -- C:\Users\Admin\Documents\hockenheim.xps
[2012.07.26 09:13:15 | 001,432,361 | ---- | M] () -- C:\Users\Admin\Desktop\2012-07-22 15.44.56.jpg
[2012.07.24 18:43:11 | 000,575,270 | ---- | M] () -- C:\Users\Admin\Desktop\IMG_0829.JPG
[2012.07.19 03:31:20 | 000,477,168 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\npdeployJava1.dll
[2012.07.19 03:31:15 | 000,473,072 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2012.07.19 03:26:11 | 000,157,680 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2012.07.19 03:26:05 | 000,149,488 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2012.07.19 03:25:54 | 000,149,488 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2012.07.09 17:31:01 | 000,045,581 | ---- | M] () -- C:\Users\Admin\Documents\Telefonat_Frau _Ela_  03.07.2012.rtf
[2012.07.06 21:42:50 | 000,041,788 | ---- | M] () -- C:\Users\Admin\Documents\Wasabi2.xps
[2012.07.06 21:17:49 | 011,883,918 | ---- | M] () -- C:\Users\Admin\Documents\_Wasabi.rtf
[2012.07.06 15:32:06 | 000,048,645 | ---- | M] () -- C:\Users\Admin\Documents\Wasabi_II.xps
[2012.07.06 15:32:06 | 000,048,645 | ---- | M] () -- C:\Users\Admin\Documents\Wasabi.xps
[2012.07.06 15:29:07 | 000,119,155 | ---- | M] () -- C:\Users\Admin\Documents\II.xpsSarah
[2012.07.06 15:26:17 | 000,119,155 | ---- | M] () -- C:\Users\Admin\Documents\SarahABI.xps
[2012.07.06 10:02:20 | 000,163,921 | ---- | M] () -- C:\Users\Admin\Documents\umsaetze_visa1.2.6.7..pdf
[2012.07.05 00:16:43 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
[2012.07.05 00:13:27 | 000,059,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll
[2012.07.04 23:14:34 | 000,041,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.27 09:06:35 | 000,134,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.06.27 09:03:32 | 000,097,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.06.27 09:03:29 | 000,735,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.06.27 09:02:41 | 000,247,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.06.27 07:53:05 | 000,132,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.06.27 07:51:30 | 000,067,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.06.27 07:50:44 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.06.20 08:46:15 | 000,034,792 | ---- | M] () -- C:\Users\Admin\Documents\reise_andere_formular.pdf
[2012.06.17 15:44:45 | 040,337,496 | ---- | M] () -- C:\Users\Admin\Documents\Danksagung_2_Dokument.rtf
[2012.06.16 07:16:04 | 000,609,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.06.16 07:15:56 | 000,911,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.06.16 06:26:37 | 000,717,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.06.06 20:59:42 | 001,070,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCTL.OCX
[2012.06.06 08:02:54 | 001,133,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2012.06.06 07:03:06 | 000,805,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2012.06.03 00:19:46 | 000,038,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2012.06.03 00:19:42 | 000,057,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2012.06.03 00:19:42 | 000,044,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2012.06.03 00:19:23 | 000,701,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2012.06.03 00:15:31 | 002,622,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2012.06.03 00:15:08 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2012.06.02 15:19:42 | 000,186,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2012.06.02 15:15:12 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2012.06.02 07:44:21 | 000,307,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012.05.19 23:48:44 | 000,189,951 | ---- | M] () -- C:\Users\Admin\Documents\Unbenannt.jpg
[2012.05.14 07:26:34 | 000,956,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
[2012.05.05 10:36:55 | 000,503,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[2012.05.04 13:06:22 | 005,559,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.05.04 12:03:53 | 003,968,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.05.04 12:03:50 | 003,913,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.04.26 07:41:56 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll
[2012.04.26 07:41:55 | 000,149,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll
[2012.04.26 07:34:27 | 000,009,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe
[2012.04.24 07:37:37 | 000,140,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.04.24 07:37:36 | 001,462,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.04.07 14:31:40 | 003,216,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll
[2012.03.03 08:35:38 | 001,544,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\fs_rec.sys
[2012.03.01 08:38:27 | 000,220,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.03.01 08:33:50 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll
[2012.02.17 08:38:26 | 001,031,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll
[2012.02.17 07:34:22 | 000,826,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll
[2012.02.16 17:24:38 | 000,001,229 | ---- | M] () -- C:\Users\Public\Desktop\ElsterFormular.lnk
[2012.02.11 08:43:47 | 000,751,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2012.02.11 08:36:01 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\splwow64.exe
[2012.02.11 07:43:49 | 000,492,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2012.01.22 17:54:42 | 000,024,417 | ---- | M] () -- C:\Users\Admin\Documents\398012_281653041888125_157708834282547_701407_2029339452_n.jpg
[2012.01.15 00:40:00 | 009,617,757 | ---- | M] () -- C:\Users\Admin\Documents\doku_medienpraxis.pdf
[2012.01.04 12:44:20 | 000,509,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll
[2011.12.30 08:26:08 | 000,515,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\timedate.cpl
[2011.12.30 07:27:56 | 000,478,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl
[2011.12.21 01:04:57 | 000,001,359 | ---- | M] () -- C:\Users\Admin\Documents\Dokument4, Caro.rtf
[2011.12.21 00:09:14 | 000,002,894 | ---- | M] () -- C:\Users\Admin\Documents\Dokument 3, Korrektur Caro.rtf
[2011.12.19 14:45:32 | 000,001,231 | ---- | M] () -- C:\Users\Public\Desktop\CAMEDIA Master.lnk
[2011.12.19 14:04:57 | 000,054,156 | -H-- | M] () -- C:\Windows\QTFont.qfn
[2011.12.19 14:04:57 | 000,001,409 | ---- | M] () -- C:\Windows\QTFont.for
[2011.12.16 10:46:06 | 000,634,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcrt.dll
[2011.12.06 17:02:25 | 000,001,352 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
[2011.11.29 12:50:17 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011.11.23 18:44:37 | 000,543,264 | ---- | M] () -- C:\Users\Admin\Documents\Bewerbung, Lebenslauf, Carolin_Zlotos.pdf
[2011.11.23 18:36:40 | 000,319,581 | ---- | M] () -- C:\Users\Admin\Documents\Bewerbungsschreiben, Carolin_Zlotos.pdf
[2011.11.23 14:36:27 | 000,152,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msclmd.dll
[2011.11.23 14:36:26 | 000,175,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msclmd.dll
[2011.11.19 16:58:00 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\packager.dll
[2011.11.19 16:01:00 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\packager.dll
[2011.11.19 11:56:02 | 000,001,091 | ---- | M] () -- C:\Users\Admin\Desktop\Dokumente - Verknüpfung.lnk
[2011.11.17 08:41:18 | 001,731,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2011.11.17 08:35:28 | 000,395,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll
[2011.11.17 08:35:26 | 000,136,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
[2011.11.17 08:35:26 | 000,029,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
[2011.11.17 08:35:25 | 000,028,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
[2011.11.17 08:35:19 | 001,447,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2011.11.17 07:35:02 | 000,314,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\webio.dll
[2011.10.26 07:25:16 | 001,572,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll
[2011.10.26 07:25:15 | 000,366,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll
[2011.10.26 07:21:20 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2011.10.26 06:32:11 | 001,328,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll
[2011.10.26 06:32:11 | 000,514,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll
[2011.10.17 21:06:18 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.10.15 08:31:56 | 000,723,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2011.10.15 07:38:59 | 000,534,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2011.09.09 21:27:20 | 000,000,136 | ---- | M] () -- C:\Users\Admin\Desktop\Hearts - Verknüpfung.lnk
 
========== Files Created - No Company Name ==========
 
[2012.08.27 16:31:38 | 000,000,000 | ---- | C] () -- C:\Users\Admin\defogger_reenable
[2012.08.27 11:44:20 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.23 10:27:22 | 000,162,693 | ---- | C] () -- C:\Users\Admin\Desktop\Euro-Gewinner und Verlierer,index.htm
[2012.08.15 21:11:18 | 000,040,849 | ---- | C] () -- C:\Users\Admin\Desktop\german-wings_170812Itinerary.aspx
[2012.08.12 11:05:15 | 000,549,791 | ---- | C] () -- C:\Users\Admin\Desktop\fragebogen_stud_fks-medien.pdf
[2012.08.12 09:51:17 | 000,056,593 | ---- | C] () -- C:\Users\Admin\Desktop\PA-StudInfo6_BA-MA-Diplomverfahren-09-Masterdatei.pdf
[2012.08.12 09:50:26 | 000,037,333 | ---- | C] () -- C:\Users\Admin\Desktop\PA07_Zulassung_Bachelorarbeit.pdf
[2012.08.12 09:49:49 | 000,110,349 | ---- | C] () -- C:\Users\Admin\Desktop\Formulare_K_Bachelor.pdf
[2012.08.09 12:20:25 | 000,001,999 | ---- | C] () -- C:\Users\Admin\Desktop\Video Downloader.lnk
[2012.08.04 23:09:18 | 000,023,939 | ---- | C] () -- C:\Users\Admin\Desktop\index.php.htm
[2012.08.04 18:13:43 | 000,035,441 | ---- | C] () -- C:\Users\Admin\Documents\Caro_Ruecksendung_SIMKarte.rtf
[2012.08.03 16:04:30 | 000,000,766 | ---- | C] () -- C:\Users\Admin\Documents\Amtsgericht_Hildesheim_Beschluss.rtf
[2012.07.30 16:00:54 | 000,030,284 | ---- | C] () -- C:\Users\Admin\Desktop\99080404-1.jpg
[2012.07.26 12:14:41 | 003,652,322 | ---- | C] () -- C:\Users\Admin\Documents\hockenheimring.xps
[2012.07.26 12:09:41 | 003,575,754 | ---- | C] () -- C:\Users\Admin\Documents\hockenheim.xps
[2012.07.26 12:02:37 | 001,432,361 | ---- | C] () -- C:\Users\Admin\Desktop\2012-07-22 15.44.56.jpg
[2012.07.24 18:41:47 | 000,575,270 | ---- | C] () -- C:\Users\Admin\Desktop\IMG_0829.JPG
[2012.07.06 21:42:50 | 000,041,788 | ---- | C] () -- C:\Users\Admin\Documents\Wasabi2.xps
[2012.07.06 21:24:31 | 000,048,645 | ---- | C] () -- C:\Users\Admin\Documents\Wasabi_II.xps
[2012.07.06 15:32:05 | 000,048,645 | ---- | C] () -- C:\Users\Admin\Documents\Wasabi.xps
[2012.07.06 15:29:07 | 000,119,155 | ---- | C] () -- C:\Users\Admin\Documents\II.xpsSarah
[2012.07.06 15:26:16 | 000,119,155 | ---- | C] () -- C:\Users\Admin\Documents\SarahABI.xps
[2012.07.06 15:04:13 | 011,883,918 | ---- | C] () -- C:\Users\Admin\Documents\_Wasabi.rtf
[2012.07.06 10:56:16 | 000,045,581 | ---- | C] () -- C:\Users\Admin\Documents\Telefonat_Frau _Ela_  03.07.2012.rtf
[2012.07.06 09:57:15 | 000,163,921 | ---- | C] () -- C:\Users\Admin\Documents\umsaetze_visa1.2.6.7..pdf
[2012.06.20 08:46:15 | 000,034,792 | ---- | C] () -- C:\Users\Admin\Documents\reise_andere_formular.pdf
[2012.06.17 15:39:54 | 040,337,496 | ---- | C] () -- C:\Users\Admin\Documents\Danksagung_2_Dokument.rtf
[2012.05.19 23:48:26 | 000,189,951 | ---- | C] () -- C:\Users\Admin\Documents\Unbenannt.jpg
[2012.05.06 17:55:42 | 000,001,142 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.02.12 18:44:51 | 000,001,229 | ---- | C] () -- C:\Users\Public\Desktop\ElsterFormular.lnk
[2012.01.22 17:54:41 | 000,024,417 | ---- | C] () -- C:\Users\Admin\Documents\398012_281653041888125_157708834282547_701407_2029339452_n.jpg
[2012.01.15 00:54:09 | 009,617,757 | ---- | C] () -- C:\Users\Admin\Documents\doku_medienpraxis.pdf
[2012.01.06 15:45:24 | 002,783,175 | ---- | C] () -- C:\Users\Admin\Desktop\Meerschweinchen I 002.JPG
[2011.12.21 00:15:38 | 000,001,359 | ---- | C] () -- C:\Users\Admin\Documents\Dokument4, Caro.rtf
[2011.12.20 22:14:59 | 000,002,894 | ---- | C] () -- C:\Users\Admin\Documents\Dokument 3, Korrektur Caro.rtf
[2011.12.19 14:02:45 | 000,054,156 | -H-- | C] () -- C:\Windows\QTFont.qfn
[2011.12.19 14:02:45 | 000,001,409 | ---- | C] () -- C:\Windows\QTFont.for
[2011.12.12 10:23:34 | 001,851,875 | ---- | C] () -- C:\Users\Admin\Desktop\Juli1984-Ostern1985,0095.jpg
[2011.12.09 20:11:26 | 000,001,046 | ---- | C] () -- C:\Users\Admin\Documents\SF Launcher.lnk
[2011.12.09 20:05:40 | 000,001,046 | ---- | C] () -- C:\Users\Admin\Documents\SF Launcher_Diabearbeitungsprogramm.lnk
[2011.12.09 20:05:07 | 011,352,862 | ---- | C] () -- C:\Users\Admin\Documents\SFde-6.6.2r3(AFL).exe
[2011.12.06 17:02:25 | 000,001,352 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
[2011.11.23 18:43:32 | 000,543,264 | ---- | C] () -- C:\Users\Admin\Documents\Bewerbung, Lebenslauf, Carolin_Zlotos.pdf
[2011.11.23 18:36:40 | 000,319,581 | ---- | C] () -- C:\Users\Admin\Documents\Bewerbungsschreiben, Carolin_Zlotos.pdf
[2011.11.19 11:56:02 | 000,001,091 | ---- | C] () -- C:\Users\Admin\Desktop\Dokumente - Verknüpfung.lnk
[2011.09.09 21:27:20 | 000,000,136 | ---- | C] () -- C:\Users\Admin\Desktop\Hearts - Verknüpfung.lnk
[2011.03.31 09:53:14 | 000,178,176 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2011.03.31 09:53:14 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2011.03.31 09:53:10 | 000,881,664 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2011.03.31 09:53:10 | 000,205,824 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2011.03.31 09:53:08 | 000,085,504 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2010.11.24 19:49:07 | 001,164,210 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD0039.1
[2010.11.24 19:49:04 | 001,199,142 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD0039.JPG
[2010.11.24 19:49:03 | 002,211,482 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD0039.0
[2010.11.23 15:48:28 | 000,841,157 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD_UND_CLAUDIA0019.JPG
[2010.11.23 15:48:26 | 000,860,359 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD_UND_CLAUDIA0019.0
[2010.11.23 15:47:20 | 000,436,015 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD_UND_CLAUDIA0032.3
[2010.11.23 15:47:15 | 000,429,976 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD_UND_CLAUDIA0032.2
[2010.11.23 15:47:12 | 000,433,797 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD_UND_CLAUDIA0032.1
[2010.11.23 15:47:08 | 001,038,272 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD_UND_CLAUDIA0032.JPG
[2010.11.23 15:47:08 | 001,038,272 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpBERNHARD_UND_CLAUDIA0032.0
[2010.10.21 16:39:57 | 000,954,561 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHERV0093.JPG
[2010.10.21 16:39:54 | 001,126,731 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHERV0093.0
[2010.10.19 16:58:34 | 001,350,693 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCLAUDIA_UND_BERNHARD0022.JPG
[2010.10.16 23:30:21 | 002,191,509 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_II0028.JPG
[2010.10.16 22:19:52 | 001,535,510 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_II0013.JPG
[2010.10.16 10:45:56 | 001,124,921 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0084.JPG
[2010.10.16 10:45:54 | 001,433,261 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0084.0
[2010.10.16 10:40:12 | 001,377,885 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0050.JPG
[2010.10.16 10:40:10 | 001,740,620 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0050.0
[2010.10.15 11:35:25 | 001,306,410 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0019.JPG
[2010.10.15 11:35:23 | 001,417,403 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0019.0
[2010.10.15 11:32:41 | 001,699,093 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0069.JPG
[2010.10.15 11:32:39 | 002,169,717 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0069.0
[2010.10.15 11:32:03 | 001,627,020 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0059.JPG
[2010.10.15 11:32:01 | 001,602,851 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0059.0
[2010.10.15 11:26:55 | 001,559,904 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0077.JPG
[2010.10.15 11:26:53 | 001,210,538 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0077.0
[2010.10.13 17:07:22 | 001,196,642 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpCHRISTOPHER_I0007.JPG
[2010.10.12 08:39:19 | 002,050,757 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp1986_KORSIKA0135.JPG
[2010.10.12 08:36:54 | 001,730,500 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp1986_KORSIKA0137.JPG
[2010.10.11 21:23:32 | 001,900,148 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp1986_KORSIKA0111.JPG
[2010.10.11 11:54:24 | 001,014,872 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp28.09.'87_0008.JPG
[2010.10.11 11:54:23 | 001,210,324 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp28.09.'87_0008.0
[2010.10.11 11:53:07 | 001,262,893 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp1986_KORSIKA0033.JPG
[2010.10.11 11:53:05 | 001,527,371 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp1986_KORSIKA0033.0
[2010.10.11 11:51:05 | 001,498,053 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp1986_KORSIKA0040.JPG
[2010.10.11 11:43:37 | 001,639,225 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmp1986_KORSIKA0007.JPG
[2010.10.10 19:27:36 | 001,378,170 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0108.JPG
[2010.10.10 19:27:34 | 001,541,825 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0108.0
[2010.10.10 19:25:01 | 001,380,154 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0109.JPG
[2010.10.10 19:24:59 | 001,430,216 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0109.0
[2010.10.10 18:58:30 | 001,748,900 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0096.JPG
[2010.10.10 18:52:38 | 000,010,496 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0091_navi.JPG
[2010.10.10 18:52:37 | 001,747,796 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0091.JPG
[2010.10.10 18:50:49 | 001,199,361 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpJULI1984-OSTERN1985 DORIS,BRUNI,BERNHGB85,0096.0
[2010.10.10 14:47:29 | 001,695,624 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpWEIHNACHTEN87_0020.JPG
[2010.10.10 10:33:39 | 001,960,139 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpWEIHNACHTEN87_0019.JPG
[2010.10.10 09:53:13 | 002,034,118 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpDEZEMBER_'870015.JPG
[2010.10.10 09:52:22 | 001,927,602 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpDEZEMBER_'870016.JPG
[2010.10.10 09:51:18 | 001,248,285 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpDEZEMBER_'870014.JPG
[2010.10.10 09:51:16 | 001,447,221 | ---- | C] () -- C:\Users\Admin\AppData\Local\tmpDEZEMBER_'870014.0
[2010.10.07 20:47:29 | 000,155,648 | ---- | C] () -- C:\Windows\SysWow64\daspi32u.dll
[2010.10.07 20:19:28 | 000,020,531 | -H-- | C] () -- C:\ProgramData\M33KI
[2010.09.15 18:27:21 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.09.06 10:04:05 | 000,193,664 | ---- | C] () -- C:\Windows\SysWow64\bmsdk.exe
[2010.09.06 10:04:05 | 000,002,960 | ---- | C] () -- C:\Windows\SysWow64\boc.ini
[2010.09.06 10:04:05 | 000,000,519 | ---- | C] () -- C:\Windows\SysWow64\bocinstall.ini

< End of report >
--- --- ---

t'john 27.08.2012 18:59
:hallo:

1. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

c_zett 28.08.2012 09:53
Hallo,
im Anhang die Logfiles von den zweiten Suchdurchläufen, nun wurde nichts mehr gefunden.
Lg

t'john 28.08.2012 19:32
Wo ist AdwCleaner[S1].txt ?

c_zett 28.08.2012 20:35
Das ist im ersten Beitrag im angehängten Zip-Archiv mit drin.

t'john 29.08.2012 02:54
:)

Sehr gut! :daumenhoc


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

c_zett 30.08.2012 12:14
Hier der Bericht, Funde sind in Quarantäne.

t'john 30.08.2012 19:59
Sehr gut! :daumenhoc


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
  • Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.
Los geht's

  • Lade und starte Eset Smartinstaller
  • Haken setzen bei YES, I accept the Terms of Use.
  • Klick auf Start.
  • Haken setzen bei Remove found threads und Scan archives.
  • Klick auf Start.
  • Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Finish drücken.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

t'john 17.10.2012 14:56
Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:03 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131