Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Avast Free Antivirus hat eine Bedrohung gefunden- Shadowbox (https://www.trojaner-board.de/134031-avast-free-antivirus-hat-bedrohung-gefunden-shadowbox.html)

akischa 22.04.2013 03:36
Avast Free Antivirus hat eine Bedrohung gefunden- Shadowbox
 
Hallo
Heute bei der Prüfung hat mein Avast was erkannt und es in den Qontainer geschoben. Jetzt steht aber im Bericht das das Problem als Hoch eingestuft wurde. Es handelt sich um
S:lframe-AAV[[Trj]] und kommt aus irgendeiner Shadowbox
Meine Frage ist..was ist das für ein trojaner ( hab bei googel gesucht aber nichts gefunden)..und wie bekomme ich den wieder vom Pc???
Denn auch wenn der im Qontainer ist,bleibt er jedoch auf im Pc.??!! Oder??
Ich will ja nicht meinen Pc :killpc: damit ich den Trojaner los werde.
Bitte um Hilfe.:glaskugel:
im vorraus schon mal :dankeschoen:

cosinus 24.04.2013 11:44
Hallo und :hallo:

Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.

  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.

  • Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

  • Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!

  • Die Logs der aufgegebenen Tools wie zB Malwarebytes sind immer zu posten - egal ob ein Fund dabei war oder nicht!

  • Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


Erstmal eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in CODE-Tags in den Thread.

akischa 26.04.2013 10:17
Hallo Cosinus. Ich habe grade deine Antawort gelesen . Jetzt muss ich aber leider sagen das ich ein völliger Pc Anfänger bin. Ich weiß z.B. nicht was OTL ist. Demnach kann ich auch die OTL.exe nicht finden...bohr was peinlich.
Es wäre nett,wenn du es mir genauer erklären kannst das ich dir das dann posten kann was du brauchst..

lieben Gruß Akischa

Ich hab das OTL gefunden..:applaus: aber weiß jetzt nicht weiter..wie gesagt ich bin ein Computer analphabet.:pfeiff:

cosinus 26.04.2013 10:23
Es ist alles haarklein erklärt, du musst nur die Anleitungen lesen
Wenn du dazu eine Frage hast, dann musst du dir auch mal die Mühe geben gezielt nachzufragen was du nicht verstehst - du machst es dir hier aber gerade sehr einfach, wenn du meinst du verstehst alles nicht und ich müsse die OTL-Anleitung neu erfinden :balla:

Sry, es liegt in der Natur der Sache wenn man Hilfe über ein Forum will, dass auch der Hilfesuchende sich Mühe gibt und Anleitungen genau lesen und umsetzen muss. Will du das nicht, bleibt dir eigentlich nur der kostenpflichtige Computer-Vor-Ort-Service

akischa 26.04.2013 10:41
Code:
OTL logfile created on: 26.04.2013 11:23:44 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Ann Andrea Hegemann\Downloads
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,30 Gb Available Physical Memory | 64,85% Memory free
4,00 Gb Paging File | 3,11 Gb Available in Paging File | 77,71% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 186,31 Gb Total Space | 164,98 Gb Free Space | 88,55% Space Free | Partition Type: NTFS
Drive D: | 148,95 Gb Total Space | 148,67 Gb Free Space | 99,81% Space Free | Partition Type: NTFS
Drive G: | 32,63 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: ANNANDREAHEGEMA | User Name: Ann Andrea Hegemann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Ann Andrea Hegemann\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Google\Update\1.3.21.135\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Users\Ann Andrea Hegemann\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
PRC - C:\Programme\Mobile Partner\Mobile Partner.exe ()
PRC - C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe ()
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Video downloader\ExtensionUpdaterService.exe ()
PRC - C:\Programme\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Programme\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\ProgramData\DatacardService\HWDeviceService.exe ()
PRC - C:\ProgramData\DatacardService\DCSHelper.exe (Huawei Technologies Co., Ltd.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Mobile Partner\QtGui4.dll ()
MOD - C:\Programme\Mobile Partner\QtCore4.dll ()
MOD - C:\Programme\Mobile Partner\QtNetwork4.dll ()
MOD - C:\Programme\Mobile Partner\NDISAPI.dll ()
MOD - C:\Programme\Mobile Partner\AddrBookPlugin.dll ()
MOD - C:\Programme\Mobile Partner\SMSUIPlugin.dll ()
MOD - C:\Programme\Mobile Partner\AddrBookUIPlugin.dll ()
MOD - C:\Programme\Mobile Partner\SmsAppPlugin.dll ()
MOD - C:\Programme\Mobile Partner\CallAppPlugin.dll ()
MOD - C:\Programme\Mobile Partner\CallLogSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\PluginContainer.dll ()
MOD - C:\Programme\Mobile Partner\DeviceMgrUIPlugin.dll ()
MOD - C:\Programme\Mobile Partner\Mobile Partner.exe ()
MOD - C:\Programme\Mobile Partner\NetInfoUIExPlugin.dll ()
MOD - C:\Programme\Mobile Partner\DialupUIPlugin.dll ()
MOD - C:\Programme\Mobile Partner\core.dll ()
MOD - C:\Programme\Mobile Partner\QtXml4.dll ()
MOD - C:\Programme\Mobile Partner\USSDUIPlugin.dll ()
MOD - C:\Programme\Mobile Partner\Proxy.dll ()
MOD - C:\Programme\Mobile Partner\plugins\imageformats\qtiff4.dll ()
MOD - C:\Programme\Mobile Partner\plugins\imageformats\qmng4.dll ()
MOD - C:\Programme\Mobile Partner\DeviceAppPlugin.dll ()
MOD - C:\Programme\Mobile Partner\NetConnectPlugin.dll ()
MOD - C:\Programme\Mobile Partner\StatusBarMgrPlugin.dll ()
MOD - C:\Programme\Mobile Partner\DeviceSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\MenuMgrPlugin.dll ()
MOD - C:\Programme\Mobile Partner\NetInfoSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\AddrBookSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\sdk.dll ()
MOD - C:\Programme\Mobile Partner\LiveUpdateInterface.dll ()
MOD - C:\Programme\Mobile Partner\AtCodec.dll ()
MOD - C:\Programme\Mobile Partner\NetSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\Common.dll ()
MOD - C:\Programme\Mobile Partner\SmsSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\DialUpPlugin.dll ()
MOD - C:\Programme\Mobile Partner\ToolBarMgrPlugin.dll ()
MOD - C:\Programme\Mobile Partner\plugins\imageformats\qjpeg4.dll ()
MOD - C:\Programme\Mobile Partner\XFramePlugin.dll ()
MOD - C:\Programme\Mobile Partner\NDISPlugin.dll ()
MOD - C:\Programme\Mobile Partner\CallSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\XCodec.dll ()
MOD - C:\Programme\Mobile Partner\NetConnectSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\DataServicePlugin.dll ()
MOD - C:\Programme\Mobile Partner\STKSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\USSDSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\Trace.dll ()
MOD - C:\Programme\Mobile Partner\OSDialup.dll ()
MOD - C:\Programme\Mobile Partner\OSNDIS.dll ()
MOD - C:\Programme\Mobile Partner\ATR2SMgr.dll ()
MOD - C:\Programme\Mobile Partner\LayoutPlugin.dll ()
MOD - C:\Programme\Mobile Partner\Win7Support.dll ()
MOD - C:\Programme\Mobile Partner\OSAdapt.dll ()
MOD - C:\Programme\Mobile Partner\NotifyServicePlugin.dll ()
MOD - C:\Programme\Mobile Partner\plugins\imageformats\qgif4.dll ()
MOD - C:\Programme\Mobile Partner\plugins\imageformats\qico4.dll ()
MOD - C:\Programme\Mobile Partner\OSPowerMgr.dll ()
MOD - C:\Programme\Mobile Partner\OSCall.dll ()
MOD - C:\Programme\Mobile Partner\libgcc_s_dw2-1.dll ()
MOD - C:\Programme\Mobile Partner\mingwm10.dll ()
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Mobile Partner. RunOuc) -- C:\Programme\Mobile Partner\UpdateDog\ouc.exe ()
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Video downloader Updater) -- C:\Programme\Video downloader\ExtensionUpdaterService.exe ()
SRV - (avast! Antivirus) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (HWDeviceService.exe) -- C:\ProgramData\DatacardService\HWDeviceService.exe ()
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (ewusbmbb) -- C:\Windows\System32\drivers\ewusbwwan.sys (Huawei Technologies Co., Ltd.)
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (ew_hwusbdev) -- C:\Windows\System32\drivers\ew_hwusbdev.sys (Huawei Technologies Co., Ltd.)
DRV - (huawei_enumerator) -- C:\Windows\System32\drivers\ew_jubusenum.sys (Huawei Technologies Co., Ltd.)
DRV - (aswSnx) -- C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) -- C:\Windows\System32\drivers\aswVmm.sys ()
DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRvrt) -- C:\Windows\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr2.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (ALCXWDM) -- C:\Windows\System32\drivers\RTKVAC.SYS (Realtek Semiconductor Corp.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www1.delta-search.com/?affID=120518&babsrc=HP_ss&mntrId=2CC6001E101F8AAA
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = BE E9 FD FD 45 38 CE 01  [binary data]
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www1.delta-search.com/?q={searchTerms}&affID=120518&babsrc=SP_ss&mntrId=2CC6001E101F8AAA
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.com/webhp?hl=de"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130402
FF - prefs.js..extensions.enabledAddons: firefox%40ghostery.com:2.9.4
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@eximion.com/KalydoPlayer: C:\Users\Ann Andrea Hegemann\AppData\Roaming\Kalydo\KalydoPlayer\bin2\npkalydo.dll (Eximion B.V.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{77BEC163-D389-42c1-91A4-C758846296A5}: C:\Program Files\Video downloader\Firefox [2013.04.13 14:57:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013.04.13 15:59:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.04.13 15:57:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2013.04.13 15:57:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\mozilla\Extensions
[2013.04.18 00:30:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\mozilla\Firefox\Profiles\udwoqoz5.default\Extensions
[2013.04.13 20:14:04 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\mozilla\Firefox\Profiles\udwoqoz5.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013.04.18 00:30:43 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\mozilla\Firefox\Profiles\udwoqoz5.default\Extensions\firefox@ghostery.com
[2013.04.16 15:38:34 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.04.10 08:57:39 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013.04.10 10:18:46 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.04.10 10:18:46 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013.04.10 10:18:46 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2013.04.10 10:18:46 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.04.10 10:18:46 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.04.10 10:18:46 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: hxxp://www1.delta-search.com/?affID=120518&babsrc=HP_ss&mntrId=2CC6001E101F8AAA
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Kalydo Player Plugin for Mozilla (Enabled) = C:\Users\Ann Andrea Hegemann\AppData\Roaming\Kalydo\KalydoPlayer\bin2\npkalydo.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll
CHR - Extension: Docs = C:\Users\Ann Andrea Hegemann\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\
CHR - Extension: Google Drive = C:\Users\Ann Andrea Hegemann\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\
CHR - Extension: YouTube = C:\Users\Ann Andrea Hegemann\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Ann Andrea Hegemann\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: avast! WebRep = C:\Users\Ann Andrea Hegemann\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\8.0.1483_0\
CHR - Extension: Google Mail = C:\Users\Ann Andrea Hegemann\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Video downloader) - {77BEC163-D389-42c1-91A4-C758846296A5} - C:\Programme\Video downloader\Extension32.dll ()
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [SoundMan] C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKU\S-1-5-21-2143736549-818235539-3819372019-1000..\Run: [Mobile Partner] C:\Programme\Mobile Partner\Mobile Partner.exe ()
O4 - HKU\S-1-5-21-2143736549-818235539-3819372019-1000..\Run: [Spotify Web Helper] C:\Users\Ann Andrea Hegemann\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8BE1215B-3AC7-42AE-8DEC-E39F2551F0F4}: NameServer = 193.189.244.225 193.189.244.206
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2011.03.15 01:27:21 | 000,148,320 | R--- | M] () - G:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2008.10.16 11:12:34 | 000,000,045 | R--- | M] () - G:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{8ff5aaa0-a435-11e2-bfa0-00138f70a87b}\Shell - "" = AutoRun
O33 - MountPoints2\{8ff5aaa0-a435-11e2-bfa0-00138f70a87b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2011.03.15 01:27:21 | 000,148,320 | R--- | M] ()
O33 - MountPoints2\{8ff5aab0-a435-11e2-bfa0-00138f70a87b}\Shell - "" = AutoRun
O33 - MountPoints2\{8ff5aab0-a435-11e2-bfa0-00138f70a87b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2011.03.15 01:27:21 | 000,148,320 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.04.23 18:17:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013.04.23 18:13:04 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2013.04.23 18:12:29 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Google
[2013.04.23 12:14:19 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Spotify
[2013.04.23 12:12:54 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Spotify
[2013.04.19 03:02:09 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Kalydo
[2013.04.14 17:05:40 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt
[2013.04.14 16:41:03 | 000,146,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\storport.sys
[2013.04.14 16:41:01 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fsutil.exe
[2013.04.14 16:09:02 | 000,284,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbport.sys
[2013.04.14 16:08:57 | 000,005,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbd.sys
[2013.04.14 02:06:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2013.04.13 18:54:40 | 000,295,424 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2013.04.13 18:54:40 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2013.04.13 18:36:02 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll
[2013.04.13 18:36:01 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe
[2013.04.13 18:36:01 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll
[2013.04.13 17:47:17 | 000,047,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys
[2013.04.13 17:47:16 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wdfres.dll
[2013.04.13 17:41:53 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFPlatform.dll
[2013.04.13 17:41:46 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFCoinstaller.dll
[2013.04.13 17:41:45 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFx.dll
[2013.04.13 17:27:42 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2013.04.13 17:27:42 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2013.04.13 17:27:42 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2013.04.13 17:27:42 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2013.04.13 17:27:42 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2013.04.13 17:27:42 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013.04.13 17:27:42 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2013.04.13 17:27:42 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2013.04.13 17:27:41 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2013.04.13 17:27:41 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.04.13 17:27:41 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013.04.13 17:27:41 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013.04.13 17:27:41 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013.04.13 17:27:41 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2013.04.13 17:27:41 | 000,367,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2013.04.13 17:27:41 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2013.04.13 17:27:41 | 000,353,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2013.04.13 17:27:41 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013.04.13 17:27:41 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2013.04.13 17:27:41 | 000,223,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2013.04.13 17:27:41 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013.04.13 17:27:41 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2013.04.13 17:27:41 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2013.04.13 17:27:41 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2013.04.13 17:27:41 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013.04.13 17:27:41 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2013.04.13 17:27:41 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2013.04.13 17:27:41 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2013.04.13 17:27:41 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2013.04.13 17:27:41 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2013.04.13 17:27:41 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2013.04.13 17:27:41 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2013.04.13 17:27:41 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2013.04.13 17:27:41 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2013.04.13 17:27:41 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2013.04.13 17:27:41 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2013.04.13 17:27:41 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2013.04.13 17:21:09 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Macromedia
[2013.04.13 17:21:09 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Macromedia
[2013.04.13 17:21:09 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Adobe
[2013.04.13 17:19:39 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe
[2013.04.13 17:19:33 | 000,691,592 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.04.13 17:19:33 | 000,071,048 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.04.13 17:19:29 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed
[2013.04.13 17:17:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2013.04.13 17:08:02 | 000,190,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ks.sys
[2013.04.13 17:03:05 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll
[2013.04.13 17:03:05 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll
[2013.04.13 17:02:34 | 001,320,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CertEnroll.dll
[2013.04.13 17:02:33 | 000,507,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winload.exe
[2013.04.13 17:02:32 | 000,442,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winresume.exe
[2013.04.13 17:01:25 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdri.dll
[2013.04.13 17:00:11 | 003,958,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013.04.13 17:00:10 | 003,902,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013.04.13 17:00:09 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[2013.04.13 16:59:59 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.04.13 16:58:45 | 000,131,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\aaclient.dll
[2013.04.13 16:58:45 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tsgqec.dll
[2013.04.13 16:57:25 | 012,625,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2013.04.13 16:57:17 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax
[2013.04.13 16:57:16 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll
[2013.04.13 16:57:16 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax
[2013.04.13 16:57:15 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Mpeg2Data.ax
[2013.04.13 16:57:15 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSDvbNP.ax
[2013.04.13 16:57:05 | 001,553,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tquery.dll
[2013.04.13 16:57:05 | 001,401,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssrch.dll
[2013.04.13 16:57:02 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssvp.dll
[2013.04.13 16:57:01 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssph.dll
[2013.04.13 16:57:00 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssphtb.dll
[2013.04.13 16:57:00 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscntrs.dll
[2013.04.13 16:56:53 | 000,187,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\FWPKCLNT.SYS
[2013.04.13 16:56:45 | 000,496,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll
[2013.04.13 16:56:44 | 000,351,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
[2013.04.13 16:56:44 | 000,305,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
[2013.04.13 16:56:43 | 000,179,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\schtasks.exe
[2013.04.13 16:56:33 | 000,442,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2013.04.13 16:56:30 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2013.04.13 16:56:26 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe
[2013.04.13 16:56:01 | 000,400,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\srcore.dll
[2013.04.13 16:55:51 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl
[2013.04.13 16:55:49 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\prevhost.exe
[2013.04.13 16:55:47 | 000,376,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpnet.dll
[2013.04.13 16:55:44 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll
[2013.04.13 16:55:28 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2013.04.13 16:55:25 | 000,197,632 | ---- | C] (Intel(R) Corporation) -- C:\Windows\System32\ir32_32.dll
[2013.04.13 16:55:25 | 000,082,944 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll
[2013.04.13 16:55:23 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2013.04.13 16:55:20 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usb8023.sys
[2013.04.13 16:55:18 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll
[2013.04.13 16:55:11 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll
[2013.04.13 16:55:05 | 000,191,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FXSCOVER.exe
[2013.04.13 16:55:01 | 000,084,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciavi32.dll
[2013.04.13 16:54:46 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browcli.dll
[2013.04.13 16:54:34 | 000,642,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CPFilters.dll
[2013.04.13 16:54:32 | 000,850,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbe.dll
[2013.04.13 16:54:32 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax
[2013.04.13 16:53:55 | 001,328,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2013.04.13 16:53:53 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll
[2013.04.13 16:53:35 | 002,614,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2013.04.13 16:53:10 | 000,490,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2013.04.13 16:52:54 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\System32\oflc-nz.rs
[2013.04.13 16:52:53 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\System32\fpb.rs
[2013.04.13 16:52:53 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\System32\pegibbfc.rs
[2013.04.13 16:52:53 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\System32\csrr.rs
[2013.04.13 16:52:53 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\System32\cob-au.rs
[2013.04.13 16:52:53 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\System32\usk.rs
[2013.04.13 16:52:53 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\System32\djctq.rs
[2013.04.13 16:52:52 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\System32\grb.rs
[2013.04.13 16:52:52 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi-pt.rs
[2013.04.13 16:52:52 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi.rs
[2013.04.13 16:52:51 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wpc.dll
[2013.04.13 16:52:50 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll
[2013.04.13 16:52:48 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\System32\esrb.rs
[2013.04.13 16:52:48 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\System32\oflc.rs
[2013.04.13 16:52:48 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi-fi.rs
[2013.04.13 16:52:47 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\System32\cero.rs
[2013.04.13 16:52:22 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2013.04.13 16:52:16 | 000,314,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webio.dll
[2013.04.13 16:52:15 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sspisrv.dll
[2013.04.13 16:52:10 | 000,319,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbcjt32.dll
[2013.04.13 16:52:09 | 000,122,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbccp32.dll
[2013.04.13 16:52:09 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbccu32.dll
[2013.04.13 16:52:09 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbccr32.dll
[2013.04.13 16:52:08 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbctrac.dll
[2013.04.13 16:52:01 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2013.04.13 16:52:00 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2013.04.13 16:52:00 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2013.04.13 16:51:52 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\synceng.dll
[2013.04.13 16:51:33 | 003,181,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll
[2013.04.13 16:51:30 | 001,619,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVDECOD.DLL
[2013.04.13 16:51:29 | 000,196,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfreadwrite.dll
[2013.04.13 16:51:28 | 001,495,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ExplorerFrame.dll
[2013.04.13 16:51:28 | 000,135,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll
[2013.04.13 16:51:12 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wscapi.dll
[2013.04.13 16:51:12 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\slwga.dll
[2013.04.13 16:51:01 | 000,738,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll
[2013.04.13 16:50:56 | 000,101,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2013.04.13 16:50:34 | 000,365,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll
[2013.04.13 16:50:33 | 000,369,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll
[2013.04.13 16:50:33 | 000,324,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe
[2013.04.13 16:50:33 | 000,320,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe
[2013.04.13 16:50:33 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll
[2013.04.13 16:50:32 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe
[2013.04.13 16:50:32 | 000,277,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe
[2013.04.13 16:50:32 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll
[2013.04.13 16:50:27 | 001,170,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2013.04.13 16:50:27 | 000,739,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2013.04.13 16:50:25 | 001,074,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2013.04.13 16:50:25 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2013.04.13 16:50:25 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2013.04.13 16:50:15 | 001,137,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll
[2013.04.13 16:50:14 | 001,164,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll
[2013.04.13 16:49:45 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\poqexec.exe
[2013.04.13 16:49:44 | 000,026,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\Diskdump.sys
[2013.04.13 16:49:13 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2013.04.13 16:48:16 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2013.04.13 16:48:15 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
[2013.04.13 16:48:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.04.13 16:48:13 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2013.04.13 16:48:13 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.04.13 16:48:13 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2013.04.13 16:48:12 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2013.04.13 16:48:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2013.04.13 16:48:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2013.04.13 16:48:12 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.04.13 16:48:12 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.04.13 16:48:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2013.04.13 16:48:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.04.13 16:48:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2013.04.13 16:48:11 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2013.04.13 16:48:10 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2013.04.13 16:48:10 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2013.04.13 16:48:10 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2013.04.13 16:48:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2013.04.13 16:48:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2013.04.13 16:48:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2013.04.13 16:48:05 | 000,219,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgmms1.sys
[2013.04.13 16:48:05 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2013.04.13 16:15:28 | 000,826,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll
[2013.04.13 16:08:37 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2013.04.13 16:08:36 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2013.04.13 16:08:25 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2013.04.13 16:08:25 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2013.04.13 16:08:25 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2013.04.13 16:08:15 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2013.04.13 16:08:15 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2013.04.13 16:00:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2013.04.13 16:00:29 | 000,368,176 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2013.04.13 16:00:29 | 000,029,816 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2013.04.13 16:00:27 | 000,060,656 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr2.sys
[2013.04.13 16:00:26 | 000,062,376 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2013.04.13 16:00:25 | 000,765,736 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2013.04.13 16:00:21 | 000,228,600 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2013.04.13 16:00:21 | 000,066,336 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2013.04.13 15:59:16 | 000,041,664 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2013.04.13 15:58:48 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2013.04.13 15:57:52 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2013.04.13 15:57:12 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Mozilla
[2013.04.13 15:57:12 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Mozilla
[2013.04.13 15:57:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2013.04.13 15:57:05 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2013.04.13 15:01:24 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2013.04.13 14:57:57 | 000,000,000 | ---D | C] -- C:\Windows\System32\searchplugins
[2013.04.13 14:57:57 | 000,000,000 | ---D | C] -- C:\Windows\System32\Extensions
[2013.04.13 14:57:51 | 000,237,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2013.04.13 14:57:36 | 000,000,000 | ---D | C] -- C:\Program Files\Video downloader
[2013.04.13 14:57:32 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Programs
[2013.04.13 14:57:28 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\SwvUpdater
[2013.04.13 14:57:03 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.04.13 14:56:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2013.04.13 14:56:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2013.04.13 14:56:38 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Babylon
[2013.04.13 14:42:43 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Diagnostics
[2013.04.13 14:30:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mobile Partner
[2013.04.13 14:30:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Mobile Partner
[2013.04.13 14:30:32 | 001,112,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WdfCoInstaller01007.dll
[2013.04.13 14:30:32 | 001,112,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfCoInstaller01007.dll
[2013.04.13 14:30:32 | 000,861,696 | ---- | C] (DiBcom SA) -- C:\Windows\System32\drivers\mod7700.sys
[2013.04.13 14:30:32 | 000,353,280 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbwwan.sys
[2013.04.13 14:30:32 | 000,193,792 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbmdm.sys
[2013.04.13 14:30:32 | 000,181,760 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_juwwanecm.sys
[2013.04.13 14:30:32 | 000,102,784 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_hwusbdev.sys
[2013.04.13 14:30:32 | 000,090,368 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jucdcacm.sys
[2013.04.13 14:30:32 | 000,073,216 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jubusenum.sys
[2013.04.13 14:30:32 | 000,064,384 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jucdcecm.sys
[2013.04.13 14:30:32 | 000,026,624 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_juextctrl.sys
[2013.04.13 14:30:32 | 000,025,856 | ---- | C] (Huawei Tech. Co., Ltd.) -- C:\Windows\System32\drivers\ewdcsc.sys
[2013.04.13 14:30:32 | 000,019,200 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_hwupgrade.sys
[2013.04.13 14:30:32 | 000,011,136 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_usbenumfilter.sys
[2013.04.13 14:30:01 | 000,000,000 | ---D | C] -- C:\Program Files\Mobile Partner
[2013.04.13 14:29:47 | 000,000,000 | ---D | C] -- C:\ProgramData\DatacardService
[2013.04.13 12:54:47 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2013.04.13 12:09:14 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013.04.13 12:09:14 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013.04.13 12:09:13 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Searches
[2013.04.13 12:09:04 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Identities
[2013.04.13 12:09:02 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Contacts
[2013.04.13 12:08:53 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\VirtualStore
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Vorlagen
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Verlauf
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Temporary Internet Files
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Startmenü
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\SendTo
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Recent
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Netzwerkumgebung
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Lokale Einstellungen
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Documents\Eigene Videos
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Documents\Eigene Musik
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Eigene Dateien
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Documents\Eigene Bilder
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Druckumgebung
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Cookies
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Anwendungsdaten
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Anwendungsdaten
[2013.04.13 12:08:49 | 000,000,000 | --SD | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Microsoft
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Videos
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Saved Games
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Pictures
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Music
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Links
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Favorites
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Downloads
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Documents
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Desktop
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013.04.13 12:08:49 | 000,000,000 | -H-D | C] -- C:\Users\Ann Andrea Hegemann\AppData
[2013.04.13 12:08:49 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Temp
[2013.04.13 12:08:49 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Microsoft
[2013.04.13 12:08:49 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Media Center Programs
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\Recovery
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\Programme
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2013.04.13 11:58:50 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2013.04.13 11:55:44 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2013.04.13 11:55:36 | 000,000,000 | -HSD | C] -- C:\System Volume Information
 
========== Files - Modified Within 30 Days ==========
 
[2013.04.26 11:18:04 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.04.26 11:14:38 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.04.26 11:14:38 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.04.26 11:14:38 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.04.26 11:14:38 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.04.26 11:11:20 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.04.26 11:11:20 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.04.26 11:07:07 | 000,000,412 | ---- | M] () -- C:\Windows\tasks\AmiUpdXp.job
[2013.04.26 11:06:15 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.04.26 11:05:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.04.26 11:05:42 | 1610,063,872 | -HS- | M] () -- C:\hiberfil.sys
[2013.04.26 01:45:52 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.04.23 18:17:54 | 000,002,201 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013.04.23 15:08:36 | 000,691,592 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.04.23 15:08:36 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.04.23 12:14:17 | 000,001,837 | ---- | M] () -- C:\Users\Ann Andrea Hegemann\Desktop\Spotify.lnk
[2013.04.13 19:35:46 | 000,268,272 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.04.13 17:27:42 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2013.04.13 17:27:42 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2013.04.13 17:27:42 | 000,130,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2013.04.13 17:27:42 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2013.04.13 17:27:42 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2013.04.13 17:27:42 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2013.04.13 17:27:42 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013.04.13 17:27:42 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2013.04.13 17:27:42 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2013.04.13 17:27:41 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2013.04.13 17:27:41 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.04.13 17:27:41 | 001,800,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013.04.13 17:27:41 | 001,427,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013.04.13 17:27:41 | 000,607,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013.04.13 17:27:41 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2013.04.13 17:27:41 | 000,367,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2013.04.13 17:27:41 | 000,353,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2013.04.13 17:27:41 | 000,353,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2013.04.13 17:27:41 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013.04.13 17:27:41 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2013.04.13 17:27:41 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2013.04.13 17:27:41 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013.04.13 17:27:41 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2013.04.13 17:27:41 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2013.04.13 17:27:41 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2013.04.13 17:27:41 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013.04.13 17:27:41 | 000,118,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2013.04.13 17:27:41 | 000,101,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2013.04.13 17:27:41 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2013.04.13 17:27:41 | 000,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2013.04.13 17:27:41 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2013.04.13 17:27:41 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2013.04.13 17:27:41 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2013.04.13 17:27:41 | 000,054,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2013.04.13 17:27:41 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2013.04.13 17:27:41 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2013.04.13 17:27:41 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2013.04.13 17:27:41 | 000,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2013.04.13 16:00:30 | 000,002,075 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013.04.13 16:00:21 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2013.04.13 15:57:07 | 000,001,105 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.04.13 14:30:52 | 000,001,037 | ---- | M] () -- C:\Users\Public\Desktop\Mobile Partner.lnk
[2013.04.13 14:30:39 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_ew_jubusenum_01007.Wdf
[2013.04.13 14:30:06 | 001,112,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WdfCoInstaller01007.dll
[2013.04.13 14:30:06 | 001,112,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfCoInstaller01007.dll
[2013.04.13 14:30:06 | 000,861,696 | ---- | M] (DiBcom SA) -- C:\Windows\System32\drivers\mod7700.sys
[2013.04.13 14:30:06 | 000,353,280 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbwwan.sys
[2013.04.13 14:30:06 | 000,193,792 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbmdm.sys
[2013.04.13 14:30:06 | 000,181,760 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_juwwanecm.sys
[2013.04.13 14:30:06 | 000,102,784 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_hwusbdev.sys
[2013.04.13 14:30:06 | 000,090,368 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jucdcacm.sys
[2013.04.13 14:30:06 | 000,073,216 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jubusenum.sys
[2013.04.13 14:30:06 | 000,064,384 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jucdcecm.sys
[2013.04.13 14:30:06 | 000,026,624 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_juextctrl.sys
[2013.04.13 14:30:06 | 000,025,856 | ---- | M] (Huawei Tech. Co., Ltd.) -- C:\Windows\System32\drivers\ewdcsc.sys
[2013.04.13 14:30:06 | 000,019,200 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_hwupgrade.sys
[2013.04.13 14:30:06 | 000,011,136 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_usbenumfilter.sys
[2013.04.13 14:29:42 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2013.04.13 11:59:35 | 000,057,050 | ---- | M] () -- C:\Windows\System32\license.rtf
[2013.04.13 11:57:58 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2013.04.13 11:57:58 | 000,000,000 | ---- | M] () -- C:\Windows\System32\atiicdxx.dat
 
========== Files Created - No Company Name ==========
 
[2013.04.23 18:17:54 | 000,002,201 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013.04.23 18:13:11 | 000,001,124 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.04.23 18:13:09 | 000,001,120 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.04.23 12:14:17 | 000,001,837 | ---- | C] () -- C:\Users\Ann Andrea Hegemann\Desktop\Spotify.lnk
[2013.04.23 12:14:17 | 000,001,823 | ---- | C] () -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
[2013.04.13 19:38:50 | 000,001,409 | ---- | C] () -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013.04.13 17:47:24 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2013.04.13 17:41:43 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2013.04.13 17:27:41 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2013.04.13 17:19:35 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.04.13 16:00:30 | 000,002,075 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013.04.13 16:00:24 | 000,164,736 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013.04.13 16:00:24 | 000,049,248 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013.04.13 15:57:07 | 000,001,117 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013.04.13 15:57:07 | 000,001,105 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.04.13 14:57:28 | 000,000,412 | ---- | C] () -- C:\Windows\tasks\AmiUpdXp.job
[2013.04.13 14:30:52 | 000,001,037 | ---- | C] () -- C:\Users\Public\Desktop\Mobile Partner.lnk
[2013.04.13 14:30:39 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_ew_jubusenum_01007.Wdf
[2013.04.13 14:29:42 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2013.04.13 11:59:21 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2013.04.13 11:59:12 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2013.04.13 11:57:58 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.04.13 11:57:58 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2013.04.13 11:55:36 | 1610,063,872 | -HS- | C] () -- C:\hiberfil.sys
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 03:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

akischa 26.04.2013 10:41
Code:
OTL logfile created on: 26.04.2013 11:23:44 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Ann Andrea Hegemann\Downloads
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,30 Gb Available Physical Memory | 64,85% Memory free
4,00 Gb Paging File | 3,11 Gb Available in Paging File | 77,71% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 186,31 Gb Total Space | 164,98 Gb Free Space | 88,55% Space Free | Partition Type: NTFS
Drive D: | 148,95 Gb Total Space | 148,67 Gb Free Space | 99,81% Space Free | Partition Type: NTFS
Drive G: | 32,63 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: ANNANDREAHEGEMA | User Name: Ann Andrea Hegemann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Ann Andrea Hegemann\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Google\Update\1.3.21.135\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Users\Ann Andrea Hegemann\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
PRC - C:\Programme\Mobile Partner\Mobile Partner.exe ()
PRC - C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe ()
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Video downloader\ExtensionUpdaterService.exe ()
PRC - C:\Programme\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Programme\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\ProgramData\DatacardService\HWDeviceService.exe ()
PRC - C:\ProgramData\DatacardService\DCSHelper.exe (Huawei Technologies Co., Ltd.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Mobile Partner\QtGui4.dll ()
MOD - C:\Programme\Mobile Partner\QtCore4.dll ()
MOD - C:\Programme\Mobile Partner\QtNetwork4.dll ()
MOD - C:\Programme\Mobile Partner\NDISAPI.dll ()
MOD - C:\Programme\Mobile Partner\AddrBookPlugin.dll ()
MOD - C:\Programme\Mobile Partner\SMSUIPlugin.dll ()
MOD - C:\Programme\Mobile Partner\AddrBookUIPlugin.dll ()
MOD - C:\Programme\Mobile Partner\SmsAppPlugin.dll ()
MOD - C:\Programme\Mobile Partner\CallAppPlugin.dll ()
MOD - C:\Programme\Mobile Partner\CallLogSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\PluginContainer.dll ()
MOD - C:\Programme\Mobile Partner\DeviceMgrUIPlugin.dll ()
MOD - C:\Programme\Mobile Partner\Mobile Partner.exe ()
MOD - C:\Programme\Mobile Partner\NetInfoUIExPlugin.dll ()
MOD - C:\Programme\Mobile Partner\DialupUIPlugin.dll ()
MOD - C:\Programme\Mobile Partner\core.dll ()
MOD - C:\Programme\Mobile Partner\QtXml4.dll ()
MOD - C:\Programme\Mobile Partner\USSDUIPlugin.dll ()
MOD - C:\Programme\Mobile Partner\Proxy.dll ()
MOD - C:\Programme\Mobile Partner\plugins\imageformats\qtiff4.dll ()
MOD - C:\Programme\Mobile Partner\plugins\imageformats\qmng4.dll ()
MOD - C:\Programme\Mobile Partner\DeviceAppPlugin.dll ()
MOD - C:\Programme\Mobile Partner\NetConnectPlugin.dll ()
MOD - C:\Programme\Mobile Partner\StatusBarMgrPlugin.dll ()
MOD - C:\Programme\Mobile Partner\DeviceSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\MenuMgrPlugin.dll ()
MOD - C:\Programme\Mobile Partner\NetInfoSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\AddrBookSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\sdk.dll ()
MOD - C:\Programme\Mobile Partner\LiveUpdateInterface.dll ()
MOD - C:\Programme\Mobile Partner\AtCodec.dll ()
MOD - C:\Programme\Mobile Partner\NetSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\Common.dll ()
MOD - C:\Programme\Mobile Partner\SmsSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\DialUpPlugin.dll ()
MOD - C:\Programme\Mobile Partner\ToolBarMgrPlugin.dll ()
MOD - C:\Programme\Mobile Partner\plugins\imageformats\qjpeg4.dll ()
MOD - C:\Programme\Mobile Partner\XFramePlugin.dll ()
MOD - C:\Programme\Mobile Partner\NDISPlugin.dll ()
MOD - C:\Programme\Mobile Partner\CallSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\XCodec.dll ()
MOD - C:\Programme\Mobile Partner\NetConnectSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\DataServicePlugin.dll ()
MOD - C:\Programme\Mobile Partner\STKSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\USSDSrvPlugin.dll ()
MOD - C:\Programme\Mobile Partner\Trace.dll ()
MOD - C:\Programme\Mobile Partner\OSDialup.dll ()
MOD - C:\Programme\Mobile Partner\OSNDIS.dll ()
MOD - C:\Programme\Mobile Partner\ATR2SMgr.dll ()
MOD - C:\Programme\Mobile Partner\LayoutPlugin.dll ()
MOD - C:\Programme\Mobile Partner\Win7Support.dll ()
MOD - C:\Programme\Mobile Partner\OSAdapt.dll ()
MOD - C:\Programme\Mobile Partner\NotifyServicePlugin.dll ()
MOD - C:\Programme\Mobile Partner\plugins\imageformats\qgif4.dll ()
MOD - C:\Programme\Mobile Partner\plugins\imageformats\qico4.dll ()
MOD - C:\Programme\Mobile Partner\OSPowerMgr.dll ()
MOD - C:\Programme\Mobile Partner\OSCall.dll ()
MOD - C:\Programme\Mobile Partner\libgcc_s_dw2-1.dll ()
MOD - C:\Programme\Mobile Partner\mingwm10.dll ()
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Mobile Partner. RunOuc) -- C:\Programme\Mobile Partner\UpdateDog\ouc.exe ()
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Video downloader Updater) -- C:\Programme\Video downloader\ExtensionUpdaterService.exe ()
SRV - (avast! Antivirus) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (HWDeviceService.exe) -- C:\ProgramData\DatacardService\HWDeviceService.exe ()
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (ewusbmbb) -- C:\Windows\System32\drivers\ewusbwwan.sys (Huawei Technologies Co., Ltd.)
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (ew_hwusbdev) -- C:\Windows\System32\drivers\ew_hwusbdev.sys (Huawei Technologies Co., Ltd.)
DRV - (huawei_enumerator) -- C:\Windows\System32\drivers\ew_jubusenum.sys (Huawei Technologies Co., Ltd.)
DRV - (aswSnx) -- C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) -- C:\Windows\System32\drivers\aswVmm.sys ()
DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRvrt) -- C:\Windows\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr2.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (ALCXWDM) -- C:\Windows\System32\drivers\RTKVAC.SYS (Realtek Semiconductor Corp.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www1.delta-search.com/?affID=120518&babsrc=HP_ss&mntrId=2CC6001E101F8AAA
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = BE E9 FD FD 45 38 CE 01  [binary data]
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www1.delta-search.com/?q={searchTerms}&affID=120518&babsrc=SP_ss&mntrId=2CC6001E101F8AAA
IE - HKU\S-1-5-21-2143736549-818235539-3819372019-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.com/webhp?hl=de"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130402
FF - prefs.js..extensions.enabledAddons: firefox%40ghostery.com:2.9.4
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@eximion.com/KalydoPlayer: C:\Users\Ann Andrea Hegemann\AppData\Roaming\Kalydo\KalydoPlayer\bin2\npkalydo.dll (Eximion B.V.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{77BEC163-D389-42c1-91A4-C758846296A5}: C:\Program Files\Video downloader\Firefox [2013.04.13 14:57:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013.04.13 15:59:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.04.13 15:57:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2013.04.13 15:57:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\mozilla\Extensions
[2013.04.18 00:30:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\mozilla\Firefox\Profiles\udwoqoz5.default\Extensions
[2013.04.13 20:14:04 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\mozilla\Firefox\Profiles\udwoqoz5.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013.04.18 00:30:43 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\mozilla\Firefox\Profiles\udwoqoz5.default\Extensions\firefox@ghostery.com
[2013.04.16 15:38:34 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.04.10 08:57:39 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013.04.10 10:18:46 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.04.10 10:18:46 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013.04.10 10:18:46 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2013.04.10 10:18:46 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.04.10 10:18:46 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.04.10 10:18:46 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: hxxp://www1.delta-search.com/?affID=120518&babsrc=HP_ss&mntrId=2CC6001E101F8AAA
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Kalydo Player Plugin for Mozilla (Enabled) = C:\Users\Ann Andrea Hegemann\AppData\Roaming\Kalydo\KalydoPlayer\bin2\npkalydo.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll
CHR - Extension: Docs = C:\Users\Ann Andrea Hegemann\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\
CHR - Extension: Google Drive = C:\Users\Ann Andrea Hegemann\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\
CHR - Extension: YouTube = C:\Users\Ann Andrea Hegemann\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Ann Andrea Hegemann\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: avast! WebRep = C:\Users\Ann Andrea Hegemann\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\8.0.1483_0\
CHR - Extension: Google Mail = C:\Users\Ann Andrea Hegemann\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Video downloader) - {77BEC163-D389-42c1-91A4-C758846296A5} - C:\Programme\Video downloader\Extension32.dll ()
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [SoundMan] C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKU\S-1-5-21-2143736549-818235539-3819372019-1000..\Run: [Mobile Partner] C:\Programme\Mobile Partner\Mobile Partner.exe ()
O4 - HKU\S-1-5-21-2143736549-818235539-3819372019-1000..\Run: [Spotify Web Helper] C:\Users\Ann Andrea Hegemann\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8BE1215B-3AC7-42AE-8DEC-E39F2551F0F4}: NameServer = 193.189.244.225 193.189.244.206
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2011.03.15 01:27:21 | 000,148,320 | R--- | M] () - G:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2008.10.16 11:12:34 | 000,000,045 | R--- | M] () - G:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{8ff5aaa0-a435-11e2-bfa0-00138f70a87b}\Shell - "" = AutoRun
O33 - MountPoints2\{8ff5aaa0-a435-11e2-bfa0-00138f70a87b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2011.03.15 01:27:21 | 000,148,320 | R--- | M] ()
O33 - MountPoints2\{8ff5aab0-a435-11e2-bfa0-00138f70a87b}\Shell - "" = AutoRun
O33 - MountPoints2\{8ff5aab0-a435-11e2-bfa0-00138f70a87b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- [2011.03.15 01:27:21 | 000,148,320 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.04.23 18:17:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013.04.23 18:13:04 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2013.04.23 18:12:29 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Google
[2013.04.23 12:14:19 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Spotify
[2013.04.23 12:12:54 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Spotify
[2013.04.19 03:02:09 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Kalydo
[2013.04.14 17:05:40 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt
[2013.04.14 16:41:03 | 000,146,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\storport.sys
[2013.04.14 16:41:01 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fsutil.exe
[2013.04.14 16:09:02 | 000,284,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbport.sys
[2013.04.14 16:08:57 | 000,005,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbd.sys
[2013.04.14 02:06:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2013.04.13 18:54:40 | 000,295,424 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2013.04.13 18:54:40 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2013.04.13 18:36:02 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll
[2013.04.13 18:36:01 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe
[2013.04.13 18:36:01 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll
[2013.04.13 17:47:17 | 000,047,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys
[2013.04.13 17:47:16 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wdfres.dll
[2013.04.13 17:41:53 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFPlatform.dll
[2013.04.13 17:41:46 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFCoinstaller.dll
[2013.04.13 17:41:45 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFx.dll
[2013.04.13 17:27:42 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2013.04.13 17:27:42 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2013.04.13 17:27:42 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2013.04.13 17:27:42 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2013.04.13 17:27:42 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2013.04.13 17:27:42 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013.04.13 17:27:42 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2013.04.13 17:27:42 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2013.04.13 17:27:41 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2013.04.13 17:27:41 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.04.13 17:27:41 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013.04.13 17:27:41 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013.04.13 17:27:41 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013.04.13 17:27:41 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2013.04.13 17:27:41 | 000,367,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2013.04.13 17:27:41 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2013.04.13 17:27:41 | 000,353,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2013.04.13 17:27:41 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013.04.13 17:27:41 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2013.04.13 17:27:41 | 000,223,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2013.04.13 17:27:41 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013.04.13 17:27:41 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2013.04.13 17:27:41 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2013.04.13 17:27:41 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2013.04.13 17:27:41 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013.04.13 17:27:41 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2013.04.13 17:27:41 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2013.04.13 17:27:41 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2013.04.13 17:27:41 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2013.04.13 17:27:41 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2013.04.13 17:27:41 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2013.04.13 17:27:41 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2013.04.13 17:27:41 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2013.04.13 17:27:41 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2013.04.13 17:27:41 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2013.04.13 17:27:41 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2013.04.13 17:27:41 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2013.04.13 17:21:09 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Macromedia
[2013.04.13 17:21:09 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Macromedia
[2013.04.13 17:21:09 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Adobe
[2013.04.13 17:19:39 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe
[2013.04.13 17:19:33 | 000,691,592 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.04.13 17:19:33 | 000,071,048 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.04.13 17:19:29 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed
[2013.04.13 17:17:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2013.04.13 17:08:02 | 000,190,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ks.sys
[2013.04.13 17:03:05 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll
[2013.04.13 17:03:05 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll
[2013.04.13 17:02:34 | 001,320,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CertEnroll.dll
[2013.04.13 17:02:33 | 000,507,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winload.exe
[2013.04.13 17:02:32 | 000,442,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winresume.exe
[2013.04.13 17:01:25 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdri.dll
[2013.04.13 17:00:11 | 003,958,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013.04.13 17:00:10 | 003,902,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013.04.13 17:00:09 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[2013.04.13 16:59:59 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.04.13 16:58:45 | 000,131,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\aaclient.dll
[2013.04.13 16:58:45 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tsgqec.dll
[2013.04.13 16:57:25 | 012,625,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2013.04.13 16:57:17 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax
[2013.04.13 16:57:16 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll
[2013.04.13 16:57:16 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax
[2013.04.13 16:57:15 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Mpeg2Data.ax
[2013.04.13 16:57:15 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSDvbNP.ax
[2013.04.13 16:57:05 | 001,553,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tquery.dll
[2013.04.13 16:57:05 | 001,401,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssrch.dll
[2013.04.13 16:57:02 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssvp.dll
[2013.04.13 16:57:01 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssph.dll
[2013.04.13 16:57:00 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssphtb.dll
[2013.04.13 16:57:00 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscntrs.dll
[2013.04.13 16:56:53 | 000,187,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\FWPKCLNT.SYS
[2013.04.13 16:56:45 | 000,496,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll
[2013.04.13 16:56:44 | 000,351,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
[2013.04.13 16:56:44 | 000,305,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
[2013.04.13 16:56:43 | 000,179,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\schtasks.exe
[2013.04.13 16:56:33 | 000,442,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2013.04.13 16:56:30 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2013.04.13 16:56:26 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe
[2013.04.13 16:56:01 | 000,400,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\srcore.dll
[2013.04.13 16:55:51 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl
[2013.04.13 16:55:49 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\prevhost.exe
[2013.04.13 16:55:47 | 000,376,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpnet.dll
[2013.04.13 16:55:44 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll
[2013.04.13 16:55:28 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2013.04.13 16:55:25 | 000,197,632 | ---- | C] (Intel(R) Corporation) -- C:\Windows\System32\ir32_32.dll
[2013.04.13 16:55:25 | 000,082,944 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll
[2013.04.13 16:55:23 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2013.04.13 16:55:20 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usb8023.sys
[2013.04.13 16:55:18 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll
[2013.04.13 16:55:11 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll
[2013.04.13 16:55:05 | 000,191,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FXSCOVER.exe
[2013.04.13 16:55:01 | 000,084,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciavi32.dll
[2013.04.13 16:54:46 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browcli.dll
[2013.04.13 16:54:34 | 000,642,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CPFilters.dll
[2013.04.13 16:54:32 | 000,850,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbe.dll
[2013.04.13 16:54:32 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax
[2013.04.13 16:53:55 | 001,328,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2013.04.13 16:53:53 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll
[2013.04.13 16:53:35 | 002,614,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2013.04.13 16:53:10 | 000,490,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2013.04.13 16:52:54 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\System32\oflc-nz.rs
[2013.04.13 16:52:53 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\System32\fpb.rs
[2013.04.13 16:52:53 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\System32\pegibbfc.rs
[2013.04.13 16:52:53 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\System32\csrr.rs
[2013.04.13 16:52:53 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\System32\cob-au.rs
[2013.04.13 16:52:53 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\System32\usk.rs
[2013.04.13 16:52:53 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\System32\djctq.rs
[2013.04.13 16:52:52 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\System32\grb.rs
[2013.04.13 16:52:52 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi-pt.rs
[2013.04.13 16:52:52 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi.rs
[2013.04.13 16:52:51 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wpc.dll
[2013.04.13 16:52:50 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll
[2013.04.13 16:52:48 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\System32\esrb.rs
[2013.04.13 16:52:48 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\System32\oflc.rs
[2013.04.13 16:52:48 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi-fi.rs
[2013.04.13 16:52:47 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\System32\cero.rs
[2013.04.13 16:52:22 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2013.04.13 16:52:16 | 000,314,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webio.dll
[2013.04.13 16:52:15 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sspisrv.dll
[2013.04.13 16:52:10 | 000,319,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbcjt32.dll
[2013.04.13 16:52:09 | 000,122,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbccp32.dll
[2013.04.13 16:52:09 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbccu32.dll
[2013.04.13 16:52:09 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbccr32.dll
[2013.04.13 16:52:08 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbctrac.dll
[2013.04.13 16:52:01 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2013.04.13 16:52:00 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2013.04.13 16:52:00 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2013.04.13 16:51:52 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\synceng.dll
[2013.04.13 16:51:33 | 003,181,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll
[2013.04.13 16:51:30 | 001,619,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVDECOD.DLL
[2013.04.13 16:51:29 | 000,196,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfreadwrite.dll
[2013.04.13 16:51:28 | 001,495,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ExplorerFrame.dll
[2013.04.13 16:51:28 | 000,135,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll
[2013.04.13 16:51:12 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wscapi.dll
[2013.04.13 16:51:12 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\slwga.dll
[2013.04.13 16:51:01 | 000,738,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll
[2013.04.13 16:50:56 | 000,101,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2013.04.13 16:50:34 | 000,365,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll
[2013.04.13 16:50:33 | 000,369,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll
[2013.04.13 16:50:33 | 000,324,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe
[2013.04.13 16:50:33 | 000,320,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe
[2013.04.13 16:50:33 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll
[2013.04.13 16:50:32 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe
[2013.04.13 16:50:32 | 000,277,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe
[2013.04.13 16:50:32 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll
[2013.04.13 16:50:27 | 001,170,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2013.04.13 16:50:27 | 000,739,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2013.04.13 16:50:25 | 001,074,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2013.04.13 16:50:25 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2013.04.13 16:50:25 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2013.04.13 16:50:15 | 001,137,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll
[2013.04.13 16:50:14 | 001,164,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll
[2013.04.13 16:49:45 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\poqexec.exe
[2013.04.13 16:49:44 | 000,026,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\Diskdump.sys
[2013.04.13 16:49:13 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2013.04.13 16:48:16 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2013.04.13 16:48:15 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
[2013.04.13 16:48:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.04.13 16:48:13 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2013.04.13 16:48:13 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.04.13 16:48:13 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2013.04.13 16:48:12 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2013.04.13 16:48:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2013.04.13 16:48:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2013.04.13 16:48:12 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.04.13 16:48:12 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.04.13 16:48:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2013.04.13 16:48:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.04.13 16:48:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2013.04.13 16:48:11 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2013.04.13 16:48:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2013.04.13 16:48:10 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2013.04.13 16:48:10 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2013.04.13 16:48:10 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2013.04.13 16:48:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2013.04.13 16:48:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2013.04.13 16:48:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2013.04.13 16:48:05 | 000,219,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgmms1.sys
[2013.04.13 16:48:05 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2013.04.13 16:15:28 | 000,826,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll
[2013.04.13 16:08:37 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2013.04.13 16:08:36 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2013.04.13 16:08:25 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2013.04.13 16:08:25 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2013.04.13 16:08:25 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2013.04.13 16:08:15 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2013.04.13 16:08:15 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2013.04.13 16:00:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2013.04.13 16:00:29 | 000,368,176 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2013.04.13 16:00:29 | 000,029,816 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2013.04.13 16:00:27 | 000,060,656 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr2.sys
[2013.04.13 16:00:26 | 000,062,376 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2013.04.13 16:00:25 | 000,765,736 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2013.04.13 16:00:21 | 000,228,600 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2013.04.13 16:00:21 | 000,066,336 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2013.04.13 15:59:16 | 000,041,664 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2013.04.13 15:58:48 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2013.04.13 15:57:52 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2013.04.13 15:57:12 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Mozilla
[2013.04.13 15:57:12 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Mozilla
[2013.04.13 15:57:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2013.04.13 15:57:05 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2013.04.13 15:01:24 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2013.04.13 14:57:57 | 000,000,000 | ---D | C] -- C:\Windows\System32\searchplugins
[2013.04.13 14:57:57 | 000,000,000 | ---D | C] -- C:\Windows\System32\Extensions
[2013.04.13 14:57:51 | 000,237,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2013.04.13 14:57:36 | 000,000,000 | ---D | C] -- C:\Program Files\Video downloader
[2013.04.13 14:57:32 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Programs
[2013.04.13 14:57:28 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\SwvUpdater
[2013.04.13 14:57:03 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.04.13 14:56:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2013.04.13 14:56:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2013.04.13 14:56:38 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Babylon
[2013.04.13 14:42:43 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Diagnostics
[2013.04.13 14:30:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mobile Partner
[2013.04.13 14:30:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Mobile Partner
[2013.04.13 14:30:32 | 001,112,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WdfCoInstaller01007.dll
[2013.04.13 14:30:32 | 001,112,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfCoInstaller01007.dll
[2013.04.13 14:30:32 | 000,861,696 | ---- | C] (DiBcom SA) -- C:\Windows\System32\drivers\mod7700.sys
[2013.04.13 14:30:32 | 000,353,280 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbwwan.sys
[2013.04.13 14:30:32 | 000,193,792 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbmdm.sys
[2013.04.13 14:30:32 | 000,181,760 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_juwwanecm.sys
[2013.04.13 14:30:32 | 000,102,784 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_hwusbdev.sys
[2013.04.13 14:30:32 | 000,090,368 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jucdcacm.sys
[2013.04.13 14:30:32 | 000,073,216 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jubusenum.sys
[2013.04.13 14:30:32 | 000,064,384 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jucdcecm.sys
[2013.04.13 14:30:32 | 000,026,624 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_juextctrl.sys
[2013.04.13 14:30:32 | 000,025,856 | ---- | C] (Huawei Tech. Co., Ltd.) -- C:\Windows\System32\drivers\ewdcsc.sys
[2013.04.13 14:30:32 | 000,019,200 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_hwupgrade.sys
[2013.04.13 14:30:32 | 000,011,136 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_usbenumfilter.sys
[2013.04.13 14:30:01 | 000,000,000 | ---D | C] -- C:\Program Files\Mobile Partner
[2013.04.13 14:29:47 | 000,000,000 | ---D | C] -- C:\ProgramData\DatacardService
[2013.04.13 12:54:47 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2013.04.13 12:09:14 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013.04.13 12:09:14 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013.04.13 12:09:13 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Searches
[2013.04.13 12:09:04 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Identities
[2013.04.13 12:09:02 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Contacts
[2013.04.13 12:08:53 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\VirtualStore
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Vorlagen
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Verlauf
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Temporary Internet Files
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Startmenü
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\SendTo
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Recent
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Netzwerkumgebung
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Lokale Einstellungen
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Documents\Eigene Videos
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Documents\Eigene Musik
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Eigene Dateien
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Documents\Eigene Bilder
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Druckumgebung
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Cookies
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Anwendungsdaten
[2013.04.13 12:08:50 | 000,000,000 | -HSD | C] -- C:\Users\Ann Andrea Hegemann\Anwendungsdaten
[2013.04.13 12:08:49 | 000,000,000 | --SD | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Microsoft
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Videos
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Saved Games
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Pictures
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Music
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Links
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Favorites
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Downloads
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Documents
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\Desktop
[2013.04.13 12:08:49 | 000,000,000 | R--D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013.04.13 12:08:49 | 000,000,000 | -H-D | C] -- C:\Users\Ann Andrea Hegemann\AppData
[2013.04.13 12:08:49 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Temp
[2013.04.13 12:08:49 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Local\Microsoft
[2013.04.13 12:08:49 | 000,000,000 | ---D | C] -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Media Center Programs
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\Recovery
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\Programme
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2013.04.13 12:02:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2013.04.13 11:58:50 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2013.04.13 11:55:44 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2013.04.13 11:55:36 | 000,000,000 | -HSD | C] -- C:\System Volume Information
 
========== Files - Modified Within 30 Days ==========
 
[2013.04.26 11:18:04 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.04.26 11:14:38 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.04.26 11:14:38 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.04.26 11:14:38 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.04.26 11:14:38 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.04.26 11:11:20 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.04.26 11:11:20 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.04.26 11:07:07 | 000,000,412 | ---- | M] () -- C:\Windows\tasks\AmiUpdXp.job
[2013.04.26 11:06:15 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.04.26 11:05:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.04.26 11:05:42 | 1610,063,872 | -HS- | M] () -- C:\hiberfil.sys
[2013.04.26 01:45:52 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.04.23 18:17:54 | 000,002,201 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013.04.23 15:08:36 | 000,691,592 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.04.23 15:08:36 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.04.23 12:14:17 | 000,001,837 | ---- | M] () -- C:\Users\Ann Andrea Hegemann\Desktop\Spotify.lnk
[2013.04.13 19:35:46 | 000,268,272 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.04.13 17:27:42 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2013.04.13 17:27:42 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2013.04.13 17:27:42 | 000,130,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2013.04.13 17:27:42 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2013.04.13 17:27:42 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2013.04.13 17:27:42 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2013.04.13 17:27:42 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013.04.13 17:27:42 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2013.04.13 17:27:42 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2013.04.13 17:27:41 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2013.04.13 17:27:41 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.04.13 17:27:41 | 001,800,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013.04.13 17:27:41 | 001,427,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013.04.13 17:27:41 | 000,607,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013.04.13 17:27:41 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2013.04.13 17:27:41 | 000,367,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2013.04.13 17:27:41 | 000,353,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2013.04.13 17:27:41 | 000,353,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2013.04.13 17:27:41 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013.04.13 17:27:41 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2013.04.13 17:27:41 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2013.04.13 17:27:41 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013.04.13 17:27:41 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2013.04.13 17:27:41 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2013.04.13 17:27:41 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2013.04.13 17:27:41 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013.04.13 17:27:41 | 000,118,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2013.04.13 17:27:41 | 000,101,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2013.04.13 17:27:41 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2013.04.13 17:27:41 | 000,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2013.04.13 17:27:41 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2013.04.13 17:27:41 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2013.04.13 17:27:41 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2013.04.13 17:27:41 | 000,054,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2013.04.13 17:27:41 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2013.04.13 17:27:41 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2013.04.13 17:27:41 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2013.04.13 17:27:41 | 000,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2013.04.13 16:00:30 | 000,002,075 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013.04.13 16:00:21 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2013.04.13 15:57:07 | 000,001,105 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.04.13 14:30:52 | 000,001,037 | ---- | M] () -- C:\Users\Public\Desktop\Mobile Partner.lnk
[2013.04.13 14:30:39 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_ew_jubusenum_01007.Wdf
[2013.04.13 14:30:06 | 001,112,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WdfCoInstaller01007.dll
[2013.04.13 14:30:06 | 001,112,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfCoInstaller01007.dll
[2013.04.13 14:30:06 | 000,861,696 | ---- | M] (DiBcom SA) -- C:\Windows\System32\drivers\mod7700.sys
[2013.04.13 14:30:06 | 000,353,280 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbwwan.sys
[2013.04.13 14:30:06 | 000,193,792 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbmdm.sys
[2013.04.13 14:30:06 | 000,181,760 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_juwwanecm.sys
[2013.04.13 14:30:06 | 000,102,784 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_hwusbdev.sys
[2013.04.13 14:30:06 | 000,090,368 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jucdcacm.sys
[2013.04.13 14:30:06 | 000,073,216 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jubusenum.sys
[2013.04.13 14:30:06 | 000,064,384 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jucdcecm.sys
[2013.04.13 14:30:06 | 000,026,624 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_juextctrl.sys
[2013.04.13 14:30:06 | 000,025,856 | ---- | M] (Huawei Tech. Co., Ltd.) -- C:\Windows\System32\drivers\ewdcsc.sys
[2013.04.13 14:30:06 | 000,019,200 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_hwupgrade.sys
[2013.04.13 14:30:06 | 000,011,136 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_usbenumfilter.sys
[2013.04.13 14:29:42 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2013.04.13 11:59:35 | 000,057,050 | ---- | M] () -- C:\Windows\System32\license.rtf
[2013.04.13 11:57:58 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2013.04.13 11:57:58 | 000,000,000 | ---- | M] () -- C:\Windows\System32\atiicdxx.dat
 
========== Files Created - No Company Name ==========
 
[2013.04.23 18:17:54 | 000,002,201 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013.04.23 18:13:11 | 000,001,124 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.04.23 18:13:09 | 000,001,120 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.04.23 12:14:17 | 000,001,837 | ---- | C] () -- C:\Users\Ann Andrea Hegemann\Desktop\Spotify.lnk
[2013.04.23 12:14:17 | 000,001,823 | ---- | C] () -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
[2013.04.13 19:38:50 | 000,001,409 | ---- | C] () -- C:\Users\Ann Andrea Hegemann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013.04.13 17:47:24 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2013.04.13 17:41:43 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2013.04.13 17:27:41 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2013.04.13 17:19:35 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.04.13 16:00:30 | 000,002,075 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013.04.13 16:00:24 | 000,164,736 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013.04.13 16:00:24 | 000,049,248 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013.04.13 15:57:07 | 000,001,117 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013.04.13 15:57:07 | 000,001,105 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.04.13 14:57:28 | 000,000,412 | ---- | C] () -- C:\Windows\tasks\AmiUpdXp.job
[2013.04.13 14:30:52 | 000,001,037 | ---- | C] () -- C:\Users\Public\Desktop\Mobile Partner.lnk
[2013.04.13 14:30:39 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_ew_jubusenum_01007.Wdf
[2013.04.13 14:29:42 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2013.04.13 11:59:21 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2013.04.13 11:59:12 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2013.04.13 11:57:58 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.04.13 11:57:58 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2013.04.13 11:55:36 | 1610,063,872 | -HS- | C] () -- C:\hiberfil.sys
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 03:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

cosinus 26.04.2013 15:07
Zitat:
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Warum hast du eine Ultimate-Edition von Windows, brauchst du das als Heimanwender?
Oder ist das rein zufällig ein Büro-/Firmen-PC bzw. ein Uni-Rechner?

akischa 30.04.2013 17:56
Hallo,ich habe das Betriebssystem von einem Kollegen abgekauft. Also rein zufällig..
Ist denn damit was nicht in Ordnung?
Kannst du mir denn schon sagen wie ich diesen Trojaner los werde?..ich denke das,auch wenn der Trojaner in Quarantäne ist,er nicht vom Pc ist.

cosinus 30.04.2013 22:43
Rootkitscan mit GMER

Bitte lade dir GMER Rootkit Scanner GMER herunter: (Dateiname zufällig)
  • Schließe alle anderen Programme, deaktiviere deinen Virenscanner und trenne den Rechner vom Internet bevor du GMER startest.
  • Sollte sich nach dem Start ein Fenster mit folgender Warnung öffnen:
    WARNING !!!
    GMER has found system modification, which might have been caused by ROOTKIT activity.
    Do you want to fully scan your system ?
    Unbedingt auf "No" klicken.
  • Entferne rechts den Haken bei: IAT/EAT und Show All
  • Setze den Haken bei Quickscan und entferne ihn bei allen anderen Laufwerken.
  • Starte den Scan mit "Scan".
  • Mache nichts am Computer während der Scan läuft.
  • Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.
Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!


Tauchen Probleme auf?
  • Probiere alternativ den abgesicherten Modus.
  • Erhältst du einen Bluescreen, dann entferne den Haken vor Devices.


Anschließend bitte MBAR ausführen:

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

akischa 01.05.2013 19:57
Code:
Malwarebytes Anti-Rootkit BETA 1.05.0.1001
www.malwarebytes.org

Database version: v2013.03.22.01

Windows 7 x86 NTFS
Internet Explorer 9.0.8112.16421
Ann Andrea Hegemann :: ANNANDREAHEGEMA [administrator]

01.05.2013 20:34:52
mbar-log-2013-05-01 (20-34-52).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 26451
Time elapsed: 8 minute(s), 7 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 6
HKLM\SOFTWARE\CLASSES\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Software.Updater) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\TYPELIB\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Software.Updater) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\INTERFACE\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Software.Updater) -> Delete on reboot.
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Software.Updater) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\Updater.AmiUpd.1 (PUP.Software.Updater) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\Updater.AmiUpd (PUP.Software.Updater) -> Delete on reboot.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
c:\Users\Ann Andrea Hegemann\AppData\Local\SwvUpdater\Updater.exe (PUP.Software.Updater) -> Delete on reboot.
c:\Windows\Tasks\AmiUpdXp.job (PUP.Software.Updater) -> Delete on reboot.

(end)
ich hoffe ich habe alles richtig gemacht.

cosinus 01.05.2013 21:48
Was ist mit GMER?
Hast du MBAR zur Kontrolle ein zweites Mal laufen lassen?


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:04 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55