hallo werte hijacker,
am letzten wochenende wurde mein wow-account "gehackt".
bevor ich in dieses forum geschaut hab habe ich folgendes unternommen um meine pc´s zu überprüfen:
- a-squared free: scan > hat nen trace gefunden welchen ich gelöscht habe.
- adaware: scan > nur cookies gefunden
- gmer: scann durchgeführt > da ich nicht wusste was man da alles beachten muss dürfte der eh unwichtig sein
- flash zeugs geupdatet
- windows updates durchgeführt
- antivir: hat nichts gefunden
zum letzten update von antivir hat dieser dann doch folgenden trojaner gefunden: (ich kopier mal bericht)
Virus or unwanted program 'TR/PSW.Wow.ybo [trojan]'
detected in file 'C:\Users\Schlotty\AppData\Local\Temp\caisp.dll.
Action performed: Deny access
die warnung wurde ständig wiederholt, weswegen ich dann "deny access" als dauerlösung angegeben hab. löschen lies sich das ding net.
ich hab die datei dann per hand gesucht und gelöscht.
bin grad unter zeit-druck...hier die gewünschten logs:
RSIT:
Code:info.txt logfile of random's system information tool 1.06 2010-03-18 15:50:21 ======Uninstall list====== -->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88564CEF-20A5-4EF2-A05F-309F2EBA9B06}\setup.exe" -l0x7 -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BC12448A-0B41-4E11-B242-B1129512F5B7}\setup.exe" -l0x7 Ad-Aware Email Scanner for Outlook-->MsiExec.exe /I{338F08AB-C262-42C7-B000-34DE1A475273} Ad-Aware-->"C:\ProgramData\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe" REMOVE=TRUE MODIFY=FALSE Ad-Aware-->C:\ProgramData\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe Adobe Reader 9.3 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A93000000001} Advanced Audio FX Engine-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88564CEF-20A5-4EF2-A05F-309F2EBA9B06}\setup.exe" -l0x7 /remove a-squared Free 4.5-->"C:\Program Files\a-squared Free\unins000.exe" Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE BioShock-->C:\Program Files\InstallShield Installation Information\{E280923D-C5D9-4728-8C79-AC9A0DC75875}\setup.exe -runfromtemp -l0x0007 -removeonly Browser Address Error Redirector-->MsiExec.exe /I{62230596-37E5-4618-A329-0D21F529A86F} Cisco EAP-FAST Module-->MsiExec.exe /I{6D3963B0-E13B-4FC3-B0FF-506A304BB043} Cisco LEAP Module-->MsiExec.exe /I{83770D14-21B9-44B3-8689-F7B523F94560} Cisco PEAP Module-->MsiExec.exe /I{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E} Compatibility Pack für 2007 Office System-->MsiExec.exe /X{90120000-0020-0407-0000-0000000FF1CE} Dell Dock-->MsiExec.exe /I{F6CB42B9-F033-4152-8813-FF11DA8E6A78} Dell Handbuch zum Einstieg-->MsiExec.exe /I{FD023F61-65E9-465C-B558-7C64EB2B97E6} Dell Support Center-->MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1} Dell Touchpad-->C:\Program Files\DellTPad\Uninstap.exe ADDREMOVE Dell Video Chat (remove only)-->C:\Program Files\Dell Video Chat\uninst.exe Dell Webcam Central-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BC12448A-0B41-4E11-B242-B1129512F5B7}\setup.exe" -l0x7 /remove Dell-eBay-->MsiExec.exe /I{B935C985-A17F-484B-8470-09E4FC27DC26} Die Sims 2-->C:\Program Files\Sims2\EAUninstall.exe Dienstprogramm für Dell Wireless WLAN Karte-->"C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Dell\Dell Wireless WLAN Card" DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN EDocs-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}\setup.exe" Electronic Arts Product Registration-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{D7D50E0C-27DD-4999-BC05-E026B580F93A} /l1031 GIMP 2.6.7-->"C:\Program Files\GIMP-2.0\setup\unins000.exe" Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_E85CDE7661A53A6A.exe" /uninstall Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C} Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} GoToAssist 8.0.0.514-->C:\Program Files\Citrix\GoToAssist\514\G2AUninstaller.exe /uninstall HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT="" Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT="" Integrated Webcam Driver (1.00.08.0216) -->C:\Windows\CtDrvIns.exe -uninstall -script OA001.uns -plugin OA001Pin.dll -pluginres OA001Pin.crl -nodisconprompt -langid 0x0407 Intel(R) Graphics Media Accelerator Driver-->C:\Windows\system32\igxpun.exe -uninstall Intel(R) Matrix Storage Manager-->C:\Windows\System32\Imsmudlg.exe ITECIR Driver-->C:\Program Files\InstallShield Installation Information\{FCED9B62-34FF-4C15-8A23-F65221F7874D}\setup.exe -runfromtemp -l0x0007 -removeonly Java(TM) 6 Update 18-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216018FF} Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050} Live! Cam Avatar Creator-->C:\Program Files\InstallShield Installation Information\{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}\setup.exe -runfromtemp -l0x0007 -removeonly /remove MediaDirect-->C:\Program Files\InstallShield Installation Information\{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}\setup.exe -runfromtemp -l0x0007 -cluninstall Microsoft .NET Framework 3.5 Language Pack SP1 - DEU-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - deu\setup.exe Microsoft .NET Framework 3.5 Language Pack SP1 - deu-->MsiExec.exe /I{052FDD78-A6EA-3187-8386-C82F4CA3A929} Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} Microsoft Office PowerPoint Viewer 2007 (German)-->MsiExec.exe /X{95120000-00AF-0407-0000-0000000FF1CE} Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118} Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C} Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475} Microsoft Works-->MsiExec.exe /I{39D0E034-1042-4905-BECB-5502909FCB7C} MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71} MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC} Opera 10.10-->MsiExec.exe /X{FB8148DD-C575-4B0A-9F6C-0CFC46937930} PC Connectivity Solution-->MsiExec.exe /I{AC599724-5755-48C1-ABE7-ABB857652930} ProtectDisc Helper Driver 10-->C:\Program Files\ProtectDisc Driver Installer\uninstall_v10.exe Puzzle Master 2-->C:\PROGRA~1\eGames\PUZZLE~1\UNWISE.EXE C:\PROGRA~1\eGames\PUZZLE~1\INSTALL.LOG QuickSet-->MsiExec.exe /I{C4972073-2BFE-475D-8441-564EA97DA161} QuickTime-->C:\Windows\unvise32qt.exe C:\Windows\system32\QuickTime\Uninstall.log Riding Star 3-->C:\PROGRA~1\Spiele\RIDING~1\UNWISE.EXE C:\PROGRA~1\Spiele\RIDING~1\INSTALL.LOG SAMSUNG Mobile Composite Device Software-->C:\Windows\system32\Samsung_USB_Drivers\6_old\SSBCUninstall.exe Samsung Mobile Modem Device Software-->C:\Windows\system32\Samsung_USB_Drivers\7\SSECUninstall.exe SAMSUNG Mobile Modem Driver Set-->C:\Windows\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe Samsung Mobile phone USB driver Software-->C:\Windows\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe SAMSUNG Mobile USB Modem 1.0 Software-->C:\Windows\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe SAMSUNG Mobile USB Modem Software-->C:\Windows\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe Samsung New PC Studio-->"C:\Program Files\InstallShield Installation Information\{F193FC0E-9E18-40FC-A974-509A1BDD240A}\setup.exe" -runfromtemp -l0x0407 -removeonly Samsung New PC Studio-->MsiExec.exe /X{F193FC0E-9E18-40FC-A974-509A1BDD240A} SAMSUNG USB Mobile Device Software-->C:\Windows\system32\Samsung_USB_Drivers\6\SS_BUninstall.exe SamsungConnectivityCableDriver-->MsiExec.exe /X{7E84FAC8-C518-40F9-9807-7455301D6D25} Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003} Sting-->C:\Windows\IsUn0407.exe -f"c:\program files\spiele\Uninst.isu" TeamSpeak 2 RC2-->"C:\Program Files\Teamspeak 2\Teamspeak2_RC2\unins000.exe" The One Ring 3D Screensaver 1.0-->"C:\Program Files\The One Ring 3D Screensaver\unins000.exe" TimeShift-->C:\Program Files\InstallShield Installation Information\{1367FA2F-2B3D-430F-872F-588B93420BFC}\setup.exe -runfromtemp -l0x0007 -removeonly Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT="" Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27} Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\Windows\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT="" Winamp Toolbar-->"C:\Program Files\Winamp Toolbar\uninstall.exe" Winamp-->"C:\Program Files\Winamp\UninstWA.exe" Windows-Treiberpaket - Nokia pccsmcfd (10/12/2007 6.85.4.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\system32\DRVSTORE\pccsmcfd_4A1E30386F4D0DEC8F5DF262CFBD8845EEBAB175\pccsmcfd.inf WinRAR-->C:\Program Files\winrar\uninstall.exe World of Warcraft-->C:\Program Files\Common Files\Blizzard Entertainment\Wrath of the Lich King\Uninstall.exe =====HijackThis Backups===== R3 - URLSearchHook: (no name) - - (no file) [2010-03-14] ======Security center information====== AS: Windows Defender ======System event log====== Computer Name: Charlotte-PC Event Code: 4372 Message: Windows-Wartung setzt das Paket KB971486(Security Update) in den Status Wird bereitgestellt(Staging). Record Number: 102714 Source Name: Microsoft-Windows-Servicing Time Written: 20091015131304.000000-000 Event Type: Informationen User: NT-AUTORITÄT\SYSTEM Computer Name: Charlotte-PC Event Code: 4372 Message: Windows-Wartung setzt das Paket KB971486(Security Update) in den Status Aufgelöst(Resolved). Record Number: 102713 Source Name: Microsoft-Windows-Servicing Time Written: 20091015131304.000000-000 Event Type: Informationen User: NT-AUTORITÄT\SYSTEM Computer Name: Charlotte-PC Event Code: 4383 Message: Windows-Wartung hat das Update 971486-23_neutral_GDR aus Paket KB971486 (Security Update) in den Status Wird aufgelöst(Resolving) gesetzt. Record Number: 102712 Source Name: Microsoft-Windows-Servicing Time Written: 20091015131303.000000-000 Event Type: Informationen User: NT-AUTORITÄT\SYSTEM Computer Name: Charlotte-PC Event Code: 4383 Message: Windows-Wartung hat das Update 971486-22_neutral_LDR aus Paket KB971486 (Security Update) in den Status Wird aufgelöst(Resolving) gesetzt. Record Number: 102711 Source Name: Microsoft-Windows-Servicing Time Written: 20091015131303.000000-000 Event Type: Informationen User: NT-AUTORITÄT\SYSTEM Computer Name: Charlotte-PC Event Code: 4383 Message: Windows-Wartung hat das Update 971486-14_neutral_GDR aus Paket KB971486 (Security Update) in den Status Wird aufgelöst(Resolving) gesetzt. Record Number: 102710 Source Name: Microsoft-Windows-Servicing Time Written: 20091015131303.000000-000 Event Type: Informationen User: NT-AUTORITÄT\SYSTEM =====Application event log===== Computer Name: Charlotte-PC Event Code: 223 Message: WinMail (3116) WindowsMail0: Sicherung von Protokolldateien (Bereich C:\Users\Schlotty\AppData\Local\Microsoft\Windows Mail\edb00001.log - C:\Users\Schlotty\AppData\Local\Microsoft\Windows Mail\edb00001.log) wird gestartet. Record Number: 283 Source Name: ESENT Time Written: 20080829070902.000000-000 Event Type: Informationen User: Computer Name: Charlotte-PC Event Code: 221 Message: WinMail (3116) WindowsMail0: Sicherung der Datei C:\Users\Schlotty\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore wird beendet. Record Number: 282 Source Name: ESENT Time Written: 20080829070902.000000-000 Event Type: Informationen User: Computer Name: Charlotte-PC Event Code: 220 Message: WinMail (3116) WindowsMail0: Sicherung der Datei C:\Users\Schlotty\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore (Größe 2 Mb) beginnt. Record Number: 281 Source Name: ESENT Time Written: 20080829070902.000000-000 Event Type: Informationen User: Computer Name: Charlotte-PC Event Code: 210 Message: WinMail (3116) WindowsMail0: Eine vollständige Sicherung wird gestartet. Record Number: 280 Source Name: ESENT Time Written: 20080829070902.000000-000 Event Type: Informationen User: Computer Name: Charlotte-PC Event Code: 102 Message: WinMail (3116) WindowsMail0: Das Datenbankmodul (6.00.6001.0000) hat eine neue Instanz gestartet (0). Record Number: 279 Source Name: ESENT Time Written: 20080829070901.000000-000 Event Type: Informationen User: =====Security event log===== Computer Name: Charlotte-PC Event Code: 4905 Message: Es wurde versucht, die Registrierung einer Sicherheitsereignisquelle aufzuheben. Antragsteller: Sicherheits-ID: S-1-5-18 Kontoname: CHARLOTTE-PC$ Kontodomäne: WORKGROUP Anmelde-ID: 0x3e7 Prozess: Prozess-ID: 0x370 Prozessname: C:\Windows\System32\VSSVC.exe Ereignisquelle: Quellenname: VSSAudit Ereignisquellen-ID: 0x142e74 Record Number: 9707 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090129165148.011780-000 Event Type: Überwachung erfolgreich User: Computer Name: Charlotte-PC Event Code: 4904 Message: Es wurde versucht, eine Sicherheitsereignisquelle zu registrieren. Antragsteller: Sicherheits-ID: S-1-5-18 Kontoname: CHARLOTTE-PC$ Kontodomäne: WORKGROUP Anmelde-ID: 0x3e7 Prozess: Prozess-ID: 0x370 Prozessname: C:\Windows\System32\VSSVC.exe Ereignisquelle: Quellenname: VSSAudit Ereignisquellen-ID: 0x142e74 Record Number: 9706 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090129165148.011780-000 Event Type: Überwachung erfolgreich User: Computer Name: Charlotte-PC Event Code: 4672 Message: Einer neuen Anmeldung wurden besondere Rechte zugewiesen. Antragsteller: Sicherheits-ID: S-1-5-18 Kontoname: SYSTEM Kontodomäne: NT-AUTORITÄT Anmelde-ID: 0x3e7 Berechtigungen: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Record Number: 9705 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090129165116.969780-000 Event Type: Überwachung erfolgreich User: Computer Name: Charlotte-PC Event Code: 4624 Message: Ein Konto wurde erfolgreich angemeldet. Antragsteller: Sicherheits-ID: S-1-5-18 Kontoname: CHARLOTTE-PC$ Kontodomäne: WORKGROUP Anmelde-ID: 0x3e7 Anmeldetyp: 5 Neue Anmeldung: Sicherheits-ID: S-1-5-18 Kontoname: SYSTEM Kontodomäne: NT-AUTORITÄT Anmelde-ID: 0x3e7 Anmelde-GUID: {00000000-0000-0000-0000-000000000000} Prozessinformationen: Prozess-ID: 0x2a4 Prozessname: C:\Windows\System32\services.exe Netzwerkinformationen: Arbeitsstationsname: Quellnetzwerkadresse: - Quellport: - Detaillierte Authentifizierungsinformationen: Anmeldeprozess: Advapi Authentifizierungspaket: Negotiate Übertragene Dienste: - Paketname (nur NTLM): - Schlüssellänge: 0 Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde. Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe". Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk). Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto. Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben. Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung. - Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren. - Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren. - Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an. - Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0. Record Number: 9704 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090129165116.969780-000 Event Type: Überwachung erfolgreich User: Computer Name: Charlotte-PC Event Code: 4648 Message: Anmeldeversuch mit expliziten Anmeldeinformationen. Antragsteller: Sicherheits-ID: S-1-5-18 Kontoname: CHARLOTTE-PC$ Kontodomäne: WORKGROUP Anmelde-ID: 0x3e7 Anmelde-GUID: {00000000-0000-0000-0000-000000000000} Konto, dessen Anmeldeinformationen verwendet wurden: Kontoname: SYSTEM Kontodomäne: NT-AUTORITÄT Anmelde-GUID: {00000000-0000-0000-0000-000000000000} Zielserver: Zielservername: localhost Weitere Informationen: localhost Prozessinformationen: Prozess-ID: 0x2a4 Prozessname: C:\Windows\System32\services.exe Netzwerkinformationen: Netzwerkadresse: - Port: - Dieses Ereignis wird bei einem Anmeldeversuch durch einen Prozess generiert, wenn ausdrücklich die Anmeldeinformationen des Kontos angegeben werden. Dies ist normalerweise der Fall in Batch-Konfigurationen, z. B. bei geplanten Aufgaben oder wenn der Befehl "runas" verwendet wird. Record Number: 9703 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090129165116.969780-000 Event Type: Überwachung erfolgreich User: ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "Path"=C:\Program Files\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC "PROCESSOR_ARCHITECTURE"=x86 "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "USERNAME"=SYSTEM "windir"=%SystemRoot% "PROCESSOR_LEVEL"=6 "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel "PROCESSOR_REVISION"=0f0d "NUMBER_OF_PROCESSORS"=2 "TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat "DFSTRACINGON"=FALSE -----------------EOF-----------------
defoggerCode:Logfile of random's system information tool 1.06 (written by random/random) Run by Schlotty at 2010-03-18 15:50:07 Microsoft® Windows Vista™ Home Premium Service Pack 2 System drive C: has 131 GB (58%) free of 228 GB Total RAM: 2037 MB (49% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:50:19, on 18.03.2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v7.00 (7.00.6002.18005) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Dell\DellDock\DellDock.exe C:\Windows\system32\conime.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\DellTPad\Apoint.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Windows\System32\WLTRAY.EXE C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe C:\Program Files\Dell\MediaDirect\PCMService.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\QuickTime\qttask.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\DellTPad\ApMsgFwd.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\IDT\WDM\sttray.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Windows\ehome\ehtray.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\DellTPad\HidFind.exe C:\Program Files\DellTPad\Apntex.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\Internet Explorer\IEUser.exe C:\Users\Schlotty\Desktop\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Schlotty.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=4080826 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=4080826 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer bereitgestellt von Dell R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll R3 - URLSearchHook: (no name) - - (no file) O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [Dell Webcam Central] "C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" /mode2 O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe" O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe O4 - HKCU\..\Run: [BrowserChoice] "C:\Windows\System32\browserchoice.exe" /run O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html O13 - Gopher Prefix: O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_238116a1\aestsrv.exe O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe O23 - Service: Google Desktop Manager 5.9.911.3589 (GoogleDesktopManager-110309-193829) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_238116a1\STacSV.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE -- End of file - 8834 bytes ======Scheduled tasks folder====== C:\Windows\tasks\Ad-Aware Update (Weekly).job C:\Windows\tasks\GoogleUpdateTaskMachineCore.job C:\Windows\tasks\GoogleUpdateTaskMachineUA.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] Winamp Toolbar Loader - C:\Program Files\Winamp Toolbar\winamptb.dll [2009-05-06 1262888] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-03-02 279664] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll [2010-03-02 812528] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}] CBrowserHelperObject Object - C:\Program Files\Dell\BAE\BAE.dll [2006-11-09 98304] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-15 41760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - Winamp Toolbar - C:\Program Files\Winamp Toolbar\winamptb.dll [2009-05-06 1262888] {2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-03-02 279664] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184] "ECenter"=C:\Dell\E-Center\EULALauncher.exe [2008-02-29 17920] "Apoint"=C:\Program Files\DellTPad\Apoint.exe [2008-06-30 196608] "IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-10-03 178712] "Broadcom Wireless Manager UI"=C:\Windows\system32\WLTRAY.exe [2008-03-12 3563520] "Google Desktop Search"=C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-12-13 30192] "dscactivate"=C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe [2008-03-11 16384] "Dell Webcam Central"=C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe [2008-06-03 446635] "PCMService"=C:\Program Files\Dell\MediaDirect\PCMService.exe [2008-01-14 132392] "IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-01-09 150040] "HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-01-09 178712] "Persistence"=C:\Windows\system32\igfxpers.exe [2009-01-09 154136] "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-09-30 77824] "NPSStartup"= [] "avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153] "WinampAgent"=C:\Program Files\Winamp\winampa.exe [2010-01-13 37888] "SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2008-06-25 442467] "SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760] "Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-08-26 68856] "ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952] "AutoStartNPSAgent"=C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [2009-04-02 102400] "BrowserChoice"=C:\Windows\System32\browserchoice.exe [2010-02-12 293376] C:\Users\Schlotty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup Dell Dock.lnk - C:\Program Files\Dell\DellDock\DellDock.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GoToAssist] C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll [2008-08-26 10536] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\Windows\system32\igfxdev.dll [2008-12-23 221184] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\GoToAssist] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "BindDirectlyToPropertySetStorage"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] ======List of files/folders created in the last 1 months====== 2010-03-18 15:50:07 ----D---- C:\rsit 2010-03-15 12:00:42 ----D---- C:\Program Files\a-squared Free 2010-03-15 11:37:43 ----SHD---- C:\Config.Msi 2010-03-15 11:28:07 ----D---- C:\ProgramData\Sun 2010-03-15 11:27:24 ----A---- C:\Windows\system32\javaws.exe 2010-03-15 11:27:24 ----A---- C:\Windows\system32\javaw.exe 2010-03-15 11:27:24 ----A---- C:\Windows\system32\java.exe 2010-03-15 11:27:24 ----A---- C:\Windows\system32\deploytk.dll 2010-03-15 11:20:02 ----A---- C:\Windows\system32\browserchoice.exe 2010-03-15 11:19:21 ----D---- C:\Program Files\Microsoft Silverlight 2010-03-15 11:07:47 ----D---- C:\Program Files\Windows Portable Devices 2010-03-15 11:06:41 ----A---- C:\Windows\system32\UIAnimation.dll 2010-03-15 11:06:40 ----A---- C:\Windows\system32\UIRibbonRes.dll 2010-03-15 11:06:40 ----A---- C:\Windows\system32\UIRibbon.dll 2010-03-15 11:05:19 ----A---- C:\Windows\system32\WMPhoto.dll 2010-03-15 11:05:18 ----A---- C:\Windows\system32\XpsRasterService.dll 2010-03-15 11:05:18 ----A---- C:\Windows\system32\XpsGdiConverter.dll 2010-03-15 11:05:18 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll 2010-03-15 11:05:18 ----A---- C:\Windows\system32\d3d10warp.dll 2010-03-15 11:05:18 ----A---- C:\Windows\system32\cdd.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\xpsservices.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\XpsPrint.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\WindowsCodecsExt.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\WindowsCodecs.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe 2010-03-15 11:05:17 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\OpcServices.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\FntCache.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\dxgi.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\dxdiagn.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\dxdiag.exe 2010-03-15 11:05:17 ----A---- C:\Windows\system32\DWrite.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\d3d11.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\d3d10level9.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\d3d10core.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\d3d10_1core.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\d3d10_1.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\d3d10.dll 2010-03-15 11:05:17 ----A---- C:\Windows\system32\d2d1.dll 2010-03-15 11:04:42 ----A---- C:\Windows\system32\WPDShextAutoplay.exe 2010-03-15 11:04:41 ----A---- C:\Windows\system32\BthMtpContextHandler.dll 2010-03-15 11:04:40 ----A---- C:\Windows\system32\wpdbusenum.dll 2010-03-15 11:04:35 ----A---- C:\Windows\system32\PortableDeviceConnectApi.dll 2010-03-15 11:04:32 ----A---- C:\Windows\system32\wpdshext.dll 2010-03-15 11:04:31 ----A---- C:\Windows\system32\WPDSp.dll 2010-03-15 11:04:31 ----A---- C:\Windows\system32\WPDShServiceObj.dll 2010-03-15 11:04:31 ----A---- C:\Windows\system32\wpd_ci.dll 2010-03-15 11:04:31 ----A---- C:\Windows\system32\PortableDeviceWMDRM.dll 2010-03-15 11:04:31 ----A---- C:\Windows\system32\PortableDeviceTypes.dll 2010-03-15 11:04:31 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll 2010-03-15 11:04:31 ----A---- C:\Windows\system32\PortableDeviceApi.dll 2010-03-15 11:03:39 ----A---- C:\Windows\system32\UIAutomationCore.dll 2010-03-15 11:03:39 ----A---- C:\Windows\system32\oleaccrc.dll 2010-03-15 11:03:39 ----A---- C:\Windows\system32\oleacc.dll 2010-03-15 11:01:55 ----A---- C:\Windows\system32\gameux.dll 2010-03-15 11:01:54 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll 2010-03-15 11:01:54 ----A---- C:\Windows\system32\Apphlpdm.dll 2010-03-14 12:50:26 ----A---- C:\Windows\system32\lsdelete.exe 2010-03-14 12:03:50 ----HDC---- C:\ProgramData\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6} 2010-03-14 12:03:39 ----D---- C:\ProgramData\Lavasoft 2010-03-14 12:03:39 ----D---- C:\Program Files\Lavasoft 2010-03-14 11:03:09 ----D---- C:\Windows\system32\eu-ES 2010-03-14 11:03:09 ----D---- C:\Windows\system32\ca-ES 2010-03-14 11:03:08 ----D---- C:\Windows\system32\vi-VN 2010-03-14 10:37:59 ----D---- C:\Windows\system32\EventProviders 2010-03-14 08:13:12 ----D---- C:\Program Files\Trend Micro 2010-03-11 13:38:50 ----A---- C:\Windows\system32\nshhttp.dll 2010-03-11 13:38:48 ----A---- C:\Windows\system32\httpapi.dll 2010-02-24 20:59:19 ----A---- C:\Windows\system32\tzres.dll 2010-02-24 20:59:02 ----A---- C:\Windows\system32\RMActivate_isv.exe 2010-02-24 20:59:02 ----A---- C:\Windows\system32\RMActivate.exe 2010-02-24 20:59:01 ----A---- C:\Windows\system32\secproc_isv.dll 2010-02-24 20:59:01 ----A---- C:\Windows\system32\secproc.dll 2010-02-24 20:59:00 ----A---- C:\Windows\system32\secproc_ssp_isv.dll 2010-02-24 20:59:00 ----A---- C:\Windows\system32\secproc_ssp.dll 2010-02-24 20:59:00 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe 2010-02-24 20:59:00 ----A---- C:\Windows\system32\RMActivate_ssp.exe 2010-02-24 20:59:00 ----A---- C:\Windows\system32\msdrm.dll ======List of files/folders modified in the last 1 months====== 2010-03-18 15:50:18 ----D---- C:\Windows\Temp 2010-03-18 15:48:25 ----D---- C:\Windows\System32 2010-03-18 15:48:25 ----D---- C:\Windows\inf 2010-03-18 15:48:25 ----A---- C:\Windows\system32\PerfStringBackup.INI 2010-03-18 15:45:34 ----D---- C:\Windows\Tasks 2010-03-16 22:42:25 ----HD---- C:\Program Files\InstallShield Installation Information 2010-03-16 22:42:01 ----D---- C:\Windows 2010-03-16 22:41:40 ----SHD---- C:\Windows\Installer 2010-03-16 22:40:38 ----SHD---- C:\System Volume Information 2010-03-16 22:40:19 ----D---- C:\Program Files\Spiele 2010-03-16 22:37:56 ----RD---- C:\Program Files 2010-03-16 22:36:32 ----D---- C:\Program Files\EA GAMES 2010-03-16 22:29:09 ----D---- C:\Windows\system32\Tasks 2010-03-16 22:23:57 ----D---- C:\Program Files\Ubisoft 2010-03-16 22:22:35 ----D---- C:\Program Files\Winamp 2010-03-16 20:25:26 ----D---- C:\Windows\Prefetch 2010-03-15 12:45:11 ----D---- C:\Windows\Minidump 2010-03-15 12:06:30 ----D---- C:\Windows\system32\catroot2 2010-03-15 11:39:02 ----D---- C:\ProgramData\Adobe 2010-03-15 11:38:34 ----D---- C:\Program Files\Common Files\Adobe 2010-03-15 11:38:19 ----D---- C:\Program Files\Adobe 2010-03-15 11:38:06 ----D---- C:\Windows\winsxs 2010-03-15 11:31:36 ----D---- C:\Windows\rescache 2010-03-15 11:28:07 ----HD---- C:\ProgramData 2010-03-15 11:28:06 ----D---- C:\Program Files\Common Files\Java 2010-03-15 11:27:02 ----D---- C:\Program Files\Java 2010-03-15 11:20:09 ----D---- C:\Windows\system32\catroot 2010-03-15 11:14:41 ----D---- C:\Windows\Microsoft.NET 2010-03-15 11:14:40 ----RSD---- C:\Windows\assembly 2010-03-15 11:07:48 ----D---- C:\Windows\system32\de-DE 2010-03-15 11:07:47 ----D---- C:\Windows\system32\wbem 2010-03-15 11:07:47 ----D---- C:\Windows\system32\drivers 2010-03-15 11:07:45 ----D---- C:\Windows\system32\zh-HK 2010-03-15 11:07:45 ----D---- C:\Windows\system32\uk-UA 2010-03-15 11:07:45 ----D---- C:\Windows\system32\sl-SI 2010-03-15 11:07:45 ----D---- C:\Windows\system32\pt-PT 2010-03-15 11:07:45 ----D---- C:\Windows\system32\pt-BR 2010-03-15 11:07:45 ----D---- C:\Windows\system32\pl-PL 2010-03-15 11:07:45 ----D---- C:\Windows\system32\nl-NL 2010-03-15 11:07:45 ----D---- C:\Windows\system32\ko-KR 2010-03-15 11:07:45 ----D---- C:\Windows\system32\it-IT 2010-03-15 11:07:45 ----D---- C:\Windows\system32\hu-HU 2010-03-15 11:07:45 ----D---- C:\Windows\system32\hr-HR 2010-03-15 11:07:45 ----D---- C:\Windows\system32\he-IL 2010-03-15 11:07:45 ----D---- C:\Windows\system32\el-GR 2010-03-15 11:07:45 ----D---- C:\Windows\system32\bg-BG 2010-03-15 11:07:44 ----D---- C:\Windows\system32\zh-TW 2010-03-15 11:07:44 ----D---- C:\Windows\system32\zh-CN 2010-03-15 11:07:44 ----D---- C:\Windows\system32\tr-TR 2010-03-15 11:07:44 ----D---- C:\Windows\system32\th-TH 2010-03-15 11:07:44 ----D---- C:\Windows\system32\sv-SE 2010-03-15 11:07:44 ----D---- C:\Windows\system32\sr-Latn-CS 2010-03-15 11:07:44 ----D---- C:\Windows\system32\sk-SK 2010-03-15 11:07:44 ----D---- C:\Windows\system32\ru-RU 2010-03-15 11:07:44 ----D---- C:\Windows\system32\ro-RO 2010-03-15 11:07:44 ----D---- C:\Windows\system32\nb-NO 2010-03-15 11:07:44 ----D---- C:\Windows\system32\lv-LV 2010-03-15 11:07:44 ----D---- C:\Windows\system32\lt-LT 2010-03-15 11:07:44 ----D---- C:\Windows\system32\ja-JP 2010-03-15 11:07:44 ----D---- C:\Windows\system32\fr-FR 2010-03-15 11:07:44 ----D---- C:\Windows\system32\fi-FI 2010-03-15 11:07:44 ----D---- C:\Windows\system32\et-EE 2010-03-15 11:07:44 ----D---- C:\Windows\system32\es-ES 2010-03-15 11:07:44 ----D---- C:\Windows\system32\en-US 2010-03-15 11:07:44 ----D---- C:\Windows\system32\da-DK 2010-03-15 11:07:44 ----D---- C:\Windows\system32\cs-CZ 2010-03-15 11:07:44 ----D---- C:\Windows\system32\ar-SA 2010-03-15 11:07:42 ----D---- C:\Windows\AppPatch 2010-03-14 12:13:15 ----DC---- C:\Windows\system32\DRVSTORE 2010-03-14 11:14:39 ----SHD---- C:\Boot 2010-03-14 11:04:58 ----D---- C:\Program Files\Windows Mail 2010-03-14 11:04:58 ----D---- C:\Program Files\Windows Calendar 2010-03-14 11:04:58 ----D---- C:\Program Files\Movie Maker 2010-03-14 11:04:55 ----D---- C:\Program Files\Windows Sidebar 2010-03-14 11:04:55 ----D---- C:\Program Files\Internet Explorer 2010-03-14 11:04:54 ----D---- C:\Program Files\Windows Media Player 2010-03-14 11:04:54 ----D---- C:\Program Files\Windows Journal 2010-03-14 11:04:54 ----D---- C:\Program Files\Windows Collaboration 2010-03-14 11:04:51 ----D---- C:\Program Files\Windows Photo Gallery 2010-03-14 11:04:51 ----D---- C:\Program Files\Common Files\System 2010-03-14 11:04:44 ----D---- C:\Windows\servicing 2010-03-14 11:04:44 ----D---- C:\Windows\ehome 2010-03-14 11:04:44 ----D---- C:\Program Files\Windows Defender 2010-03-14 11:04:20 ----D---- C:\Windows\system32\XPSViewer 2010-03-14 11:04:20 ----D---- C:\Windows\IME 2010-03-14 11:04:15 ----D---- C:\Windows\system32\oobe 2010-03-14 11:04:14 ----D---- C:\Windows\system32\migration 2010-03-14 11:04:09 ----D---- C:\Windows\system32\setup 2010-03-14 11:04:09 ----D---- C:\Windows\system32\AdvancedInstallers 2010-03-14 11:04:08 ----D---- C:\Windows\system32\SLUI 2010-03-14 11:04:08 ----D---- C:\Windows\system32\manifeststore 2010-03-14 11:04:03 ----D---- C:\Windows\system32\migwiz 2010-03-14 11:03:18 ----RSD---- C:\Windows\Fonts 2010-03-14 11:03:08 ----D---- C:\Windows\system32\Boot 2010-03-08 22:09:09 ----D---- C:\Users\Schlotty\AppData\Roaming\Winamp 2010-03-02 21:16:13 ----D---- C:\Program Files\Google 2010-03-02 06:30:12 ----A---- C:\Windows\system32\mrt.exe 2010-02-24 09:16:06 ----N---- C:\Windows\system32\MpSigStub.exe ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608] R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-03-30 96104] R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520] R2 acedrv10;acedrv10; \??\C:\Windows\system32\drivers\acedrv10.sys [2007-07-27 330144] R2 acehlp10;acehlp10; \??\C:\Windows\system32\drivers\acehlp10.sys [2007-07-27 251680] R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-12-08 56816] R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2008-03-13 46592] R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2008-03-13 43008] R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2008-03-13 38400] R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP/Vista; C:\Windows\system32\DRIVERS\Apfiltr.sys [2008-06-30 170032] R3 BCM42RLY;BCM42RLY; C:\Windows\system32\drivers\BCM42RLY.sys [2008-03-12 18424] R3 BCM43XX;Treiber für Dell Wireless WLAN Karte; C:\Windows\system32\DRIVERS\bcmwl6.sys [2008-03-12 1205240] R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208] R3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\system32\FsUsbExDisk.SYS [2009-03-31 36608] R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-12-23 2476032] R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI; C:\Windows\system32\drivers\IntcHdmi.sys [2008-09-22 112128] R3 itecir;ITECIR Infrared Receiver; C:\Windows\system32\DRIVERS\itecir.sys [2008-03-14 54784] R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\k57nd60x.sys [2008-03-13 203264] R3 OA001Ufd;Creative Camera OA001 Upper Filter Driver; C:\Windows\system32\DRIVERS\OA001Ufd.sys [2008-03-11 149208] R3 OA001Vid;Creative Camera OA001 Function Driver; C:\Windows\system32\DRIVERS\OA001Vid.sys [2008-03-11 277624] R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088] R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt.sys [2008-06-25 380928] R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-21 11264] S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632] S3 e1express;Intel(R) PRO/1000 PCI Express-Netzwerkverbindungstreiber; C:\Windows\system32\DRIVERS\e1e6032.sys [2008-01-21 220672] S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520] S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192] S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888] S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016] S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632] S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 2028032] S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\Windows\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112] S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\Windows\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976] S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\Windows\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856] S3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328] S3 VST_DPV;VST_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2008-01-21 987648] S3 VSTHWBS2;VSTHWBS2; C:\Windows\system32\DRIVERS\VSTBS23.SYS [2008-01-21 251904] S3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2008-01-21 654336] S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328] S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656] S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 a2free;a-squared Free Service; C:\Program Files\a-squared Free\a2service.exe [2009-10-01 1858144] R2 AESTFilters;Andrea ST Filters Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_238116a1\aestsrv.exe [2008-06-25 73728] R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289] R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089] R2 DockLoginService;Dock Login Service; C:\Program Files\Dell\DellDock\DockLogin.exe [2008-04-28 161048] R2 FsUsbExService;FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [2009-03-31 233472] R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-10-03 358936] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-03-14 1229232] R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_238116a1\STacSV.exe [2008-06-25 221273] R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE [2008-03-12 24064] S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-02 135664] S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504] S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-12-13 30192] S3 GoToAssist;GoToAssist; C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe [2008-08-26 16680] S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-05 182768] S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592] -----------------EOF-----------------
GMERCode:defogger_disable by jpshortstuff (23.02.10.1) Log created at 16:02 on 18/03/2010 (Schlotty) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=-
hjtscanlistCode:GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-03-18 16:36:39 Windows 6.0.6002 Service Pack 2 Running: ygnekn8r.exe; Driver: C:\Users\Schlotty\AppData\Local\Temp\kxroyuog.sys ---- System - GMER 1.0.15 ---- SSDT 81BE825C ZwCreateThread SSDT 81BE8248 ZwOpenProcess SSDT 81BE824D ZwOpenThread SSDT 81BE8257 ZwTerminateProcess ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!KeSetEvent + 221 822AF984 4 Bytes [5C, 82, BE, 81] .text ntkrnlpa.exe!KeSetEvent + 3F1 822AFB54 4 Bytes [48, 82, BE, 81] .text ntkrnlpa.exe!KeSetEvent + 40D 822AFB70 4 Bytes [4D, 82, BE, 81] .text ntkrnlpa.exe!KeSetEvent + 621 822AFD84 4 Bytes [57, 82, BE, 81] .reloc C:\Windows\system32\drivers\acehlp10.sys section is executable [0x805B7B80, 0x37FC7, 0xE0000060] .reloc C:\Windows\system32\drivers\acedrv10.sys section is executable [0xA949F000, 0x459C1, 0xE0000060] ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\a-squared Free\a2service.exe[556] kernel32.dll!CreateThread + 1A 7716C928 4 Bytes CALL 0045495D C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH) ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Program Files\a-squared Free\a2service.exe[556] @ C:\Windows\system32\shell32.dll [KERNEL32.dll!QueueUserWorkItem] [00454AB4] C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH) IAT C:\Program Files\a-squared Free\a2service.exe[556] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!QueueUserWorkItem] [00454AB4] C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH) ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\tdx \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB) AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation) ---- EOF - GMER 1.0.15 ----
Code:$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ º º hjtscanlist v2.0 º º $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Microsoft Windows [Version 6.0.6002] C: C:\hiberfil.sys --------- C:\pagefile.sys --------- 18.03.2010 16:40 C:\aaw7boot.log --------- 3132 18.03.2010 15:57 C:\System Volume Information --------- 28672 18.03.2010 15:50 C:\rsit --------- 0 18.03.2010 15:43 C:\Config.Msi --------- 0 16.03.2010 22:42 C:\Windows --------- 28672 16.03.2010 22:39 C:\MSDOS.SYS --------- 0 16.03.2010 22:39 C:\IO.SYS --------- 0 16.03.2010 22:37 C:\Program Files --------- 24576 15.03.2010 11:28 C:\ProgramData --------- 8192 14.03.2010 11:14 C:\Boot --------- 4096 20.01.2010 22:32 C:\Users --------- 4096 07.08.2009 20:17 C:\Intel --------- 0 31.05.2009 13:54 C:\found.000 --------- 0 11.04.2009 07:36 C:\bootmgr --------- 333257 28.02.2009 16:26 C:\CrashReport --------- 0 30.08.2008 18:36 C:\$Recycle.Bin --------- 4096 29.08.2008 11:36 C:\DELL --------- 8192 29.08.2008 08:04 C:\Programme --------- 0 29.08.2008 08:04 C:\Dokumente und Einstellungen --------- 0 26.08.2008 21:00 C:\dell.sdr --------- 4427 26.05.2008 08:20 C:\doctemp --------- 0 11.03.2008 07:53 C:\Drivers --------- 0 21.01.2008 03:32 C:\PerfLogs --------- 0 18.09.2006 22:43 C:\config.sys --------- 10 18.09.2006 22:43 C:\autoexec.bat --------- 24 ---------------------------------------- C:\Windows 18.03.2010 16:40 C:\Windows\bootstat.dat --------- 67584 18.03.2010 16:44 C:\Windows\WindowsUpdate.log --------- 1892538 15.03.2010 12:45 C:\Windows\MEMORY.DMP --------- 321857845 15.03.2010 11:40 C:\Windows\PFRO.log --------- 29320 15.03.2010 11:07 C:\Windows\setupact.log --------- 181828 03.03.2010 09:04 C:\Windows\ie8_main.log --------- 2067 24.01.2010 19:44 C:\Windows\win.ini --------- 433 20.01.2010 22:28 C:\Windows\ntbtlog.txt --------- 356042 20.12.2009 16:28 C:\Windows\DirectX.log --------- 268952 26.11.2009 13:23 C:\Windows\msxml4-KB973688-enu.LOG --------- 278558 13.11.2009 09:21 C:\Windows\msxml4-KB954430-enu.LOG --------- 288916 10.11.2009 19:29 C:\Windows\DPINST.LOG --------- 23484 11.04.2009 07:27 C:\Windows\explorer.exe --------- 2926592 29.08.2008 08:08 C:\Windows\IMAPIShellExt.dll --------- 720896 29.08.2008 08:08 C:\Windows\BurnImage.exe --------- 81920 26.08.2008 21:00 C:\Windows\csup.txt --------- 12 26.08.2008 13:06 C:\Windows\TSSysprep.log --------- 3652 26.08.2008 11:43 C:\Windows\DtcInstall.log --------- 4506 26.08.2008 11:28 C:\Windows\CT4CET.bin --------- 76 26.08.2008 11:22 C:\Windows\bcmwl.log --------- 12540 26.08.2008 11:16 C:\Windows\ocsetup_install_OEMHelpCustomization.etl --------- 33357824 26.08.2008 11:16 C:\Windows\ocsetup_cbs_install_OEMHelpCustomization.perf --------- 196608 26.08.2008 11:16 C:\Windows\ocsetup_cbs_install_OEMHelpCustomization.dpx --------- 65536 11.03.2008 07:53 C:\Windows\OA001Cfg.exe --------- 39448 11.03.2008 07:53 C:\Windows\OA001.uns --------- 5356 11.03.2008 07:53 C:\Windows\CtDrvIns.exe --------- 96792 21.01.2008 03:43 C:\Windows\WindowsShell.Manifest --------- 749 21.01.2008 03:24 C:\Windows\regedit.exe --------- 134656 21.01.2008 03:24 C:\Windows\bfsvc.exe --------- 58880 21.01.2008 03:24 C:\Windows\fveupdate.exe --------- 13312 21.01.2008 03:24 C:\Windows\HelpPane.exe --------- 498176 21.01.2008 03:23 C:\Windows\notepad.exe --------- 151040 02.11.2006 13:52 C:\Windows\setuperr.log --------- 0 02.11.2006 13:47 C:\Windows\SETUPAPI.LOG --------- 94 02.11.2006 13:35 C:\Windows\WMSysPr9.prx --------- 316640 02.11.2006 13:34 C:\Windows\twunk_16.exe --------- 49680 02.11.2006 13:34 C:\Windows\twunk_32.exe --------- 31232 02.11.2006 13:34 C:\Windows\twain_32.dll --------- 50688 02.11.2006 13:34 C:\Windows\twain.dll --------- 94784 02.11.2006 10:45 C:\Windows\winhlp32.exe --------- 9216 02.11.2006 10:45 C:\Windows\hh.exe --------- 14848 02.11.2006 08:46 C:\Windows\mib.bin --------- 43131 19.09.2006 12:41 C:\Windows\HomePremium.xml --------- 8328 18.09.2006 22:46 C:\Windows\system.ini --------- 219 18.09.2006 22:43 C:\Windows\_default.pif --------- 707 18.09.2006 22:43 C:\Windows\winhelp.exe --------- 256192 18.09.2006 22:30 C:\Windows\msdfmap.ini --------- 1405 10.11.1999 10:05 C:\Windows\unvise32qt.exe --------- 86016 23.01.1998 11:20 C:\Windows\IsUn0407.exe --------- 305664 ---------------------------------------- C:\Windows\System 02.11.2006 13:34 C:\Windows\System\mciseq.drv --------- 25264 02.11.2006 13:34 C:\Windows\System\mciwave.drv --------- 28160 02.11.2006 13:34 C:\Windows\System\avifile.dll --------- 109456 02.11.2006 13:34 C:\Windows\System\avicap.dll --------- 69584 02.11.2006 13:34 C:\Windows\System\mciavi.drv --------- 73376 02.11.2006 13:34 C:\Windows\System\msvideo.dll --------- 126912 02.11.2006 08:10 C:\Windows\System\OLESVR.DLL --------- 24064 02.11.2006 08:10 C:\Windows\System\WFWNET.DRV --------- 12704 02.11.2006 08:10 C:\Windows\System\COMMDLG.DLL --------- 32816 02.11.2006 08:10 C:\Windows\System\TIMER.DRV --------- 4048 02.11.2006 08:10 C:\Windows\System\MMSYSTEM.DLL --------- 68992 02.11.2006 08:10 C:\Windows\System\mmtask.tsk --------- 1152 02.11.2006 08:10 C:\Windows\System\mouse.drv --------- 2032 02.11.2006 08:10 C:\Windows\System\vga.drv --------- 2176 02.11.2006 08:10 C:\Windows\System\sound.drv --------- 1744 02.11.2006 08:10 C:\Windows\System\keyboard.drv --------- 2000 02.11.2006 08:10 C:\Windows\System\SHELL.DLL --------- 5120 02.11.2006 08:10 C:\Windows\System\system.drv --------- 3360 18.09.2006 22:43 C:\Windows\System\ver.dll --------- 9008 18.09.2006 22:43 C:\Windows\System\olecli.dll --------- 82944 18.09.2006 22:43 C:\Windows\System\lzexpand.dll --------- 9936 18.09.2006 22:35 C:\Windows\System\stdole.tlb --------- 5532 ---------------------------------------- C:\Windows\System32 18.03.2010 16:45 C:\Windows\system32\perfh009.dat --------- 587178 18.03.2010 16:45 C:\Windows\system32\perfc009.dat --------- 101250 18.03.2010 16:45 C:\Windows\system32\perfh007.dat --------- 618442 18.03.2010 16:45 C:\Windows\system32\perfc007.dat --------- 122842 18.03.2010 16:45 C:\Windows\system32\PerfStringBackup.INI --------- 1418806 18.03.2010 16:40 C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 --------- 3616 18.03.2010 16:40 C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 --------- 3616 16.03.2010 22:29 C:\Windows\system32\Tasks --------- 4096 16.03.2010 21:47 C:\Windows\system32\The One Ring.log --------- 6899 15.03.2010 12:06 C:\Windows\system32\catroot2 --------- 4096 15.03.2010 11:27 C:\Windows\system32\javaws.exe --------- 153376 15.03.2010 11:27 C:\Windows\system32\javaw.exe --------- 145184 15.03.2010 11:27 C:\Windows\system32\java.exe --------- 145184 15.03.2010 11:27 C:\Windows\system32\deploytk.dll --------- 411368 15.03.2010 11:20 C:\Windows\system32\catroot --------- 0 15.03.2010 11:07 C:\Windows\system32\de-DE --------- 262144 15.03.2010 11:07 C:\Windows\system32\drivers --------- 65536 15.03.2010 11:07 C:\Windows\system32\wbem --------- 65536 15.03.2010 11:07 C:\Windows\system32\pt-BR --------- 0 15.03.2010 11:07 C:\Windows\system32\bg-BG --------- 0 15.03.2010 11:07 C:\Windows\system32\it-IT --------- 0 15.03.2010 11:07 C:\Windows\system32\he-IL --------- 0 15.03.2010 11:07 C:\Windows\system32\pt-PT --------- 0 15.03.2010 11:07 C:\Windows\system32\pl-PL --------- 0 15.03.2010 11:07 C:\Windows\system32\uk-UA --------- 0 15.03.2010 11:07 C:\Windows\system32\ko-KR --------- 0 15.03.2010 11:07 C:\Windows\system32\hu-HU --------- 0 15.03.2010 11:07 C:\Windows\system32\hr-HR --------- 0 15.03.2010 11:07 C:\Windows\system32\sl-SI --------- 0 15.03.2010 11:07 C:\Windows\system32\zh-HK --------- 0 15.03.2010 11:07 C:\Windows\system32\el-GR --------- 0 15.03.2010 11:07 C:\Windows\system32\nl-NL --------- 0 15.03.2010 11:07 C:\Windows\system32\fr-FR --------- 0 15.03.2010 11:07 C:\Windows\system32\fi-FI --------- 0 15.03.2010 11:07 C:\Windows\system32\sr-Latn-CS --------- 0 15.03.2010 11:07 C:\Windows\system32\tr-TR --------- 0 15.03.2010 11:07 C:\Windows\system32\th-TH --------- 0 15.03.2010 11:07 C:\Windows\system32\sv-SE --------- 0 15.03.2010 11:07 C:\Windows\system32\es-ES --------- 0 15.03.2010 11:07 C:\Windows\system32\lv-LV --------- 0 15.03.2010 11:07 C:\Windows\system32\lt-LT --------- 0 15.03.2010 11:07 C:\Windows\system32\zh-TW --------- 0 15.03.2010 11:07 C:\Windows\system32\sk-SK --------- 0 15.03.2010 11:07 C:\Windows\system32\et-EE --------- 0 15.03.2010 11:07 C:\Windows\system32\cs-CZ --------- 0 15.03.2010 11:07 C:\Windows\system32\zh-CN --------- 0 15.03.2010 11:07 C:\Windows\system32\ja-JP --------- 0 15.03.2010 11:07 C:\Windows\system32\ar-SA --------- 0 15.03.2010 11:07 C:\Windows\system32\ro-RO --------- 0 15.03.2010 11:07 C:\Windows\system32\ru-RU --------- 0 15.03.2010 11:07 C:\Windows\system32\nb-NO --------- 0 15.03.2010 11:07 C:\Windows\system32\da-DK --------- 0 15.03.2010 11:07 C:\Windows\system32\en-US --------- 4096 14.03.2010 12:13 C:\Windows\system32\DRVSTORE --------- 0 14.03.2010 12:13 C:\Windows\system32\lsdelete.exe --------- 15880 14.03.2010 11:08 C:\Windows\system32\FNTCACHE.DAT --------- 280152 14.03.2010 11:04 C:\Windows\system32\ca-ES --------- 0 14.03.2010 11:04 C:\Windows\system32\XPSViewer --------- 0 14.03.2010 11:04 C:\Windows\system32\oobe --------- 4096 14.03.2010 11:04 C:\Windows\system32\migration --------- 0 14.03.2010 11:04 C:\Windows\system32\eu-ES --------- 0 14.03.2010 11:04 C:\Windows\system32\AdvancedInstallers --------- 0 14.03.2010 11:04 C:\Windows\system32\setup --------- 0 14.03.2010 11:04 C:\Windows\system32\SLUI --------- 0 14.03.2010 11:04 C:\Windows\system32\manifeststore --------- 0 14.03.2010 11:04 C:\Windows\system32\vi-VN --------- 0 14.03.2010 11:04 C:\Windows\system32\migwiz --------- 4096 14.03.2010 11:03 C:\Windows\system32\Boot --------- 0 14.03.2010 10:37 C:\Windows\system32\EventProviders --------- 0 02.03.2010 06:30 C:\Windows\system32\mrt.exe --------- 31648712 24.02.2010 10:16 C:\Windows\system32\MpSigStub.exe --------- 181632 21.02.2010 00:06 C:\Windows\system32\nshhttp.dll --------- 24064 21.02.2010 00:05 C:\Windows\system32\httpapi.dll --------- 30720 12.02.2010 11:32 C:\Windows\system32\browserchoice.exe --------- 293376 25.01.2010 13:00 C:\Windows\system32\secproc_ssp_isv.dll --------- 152576 25.01.2010 13:00 C:\Windows\system32\secproc_ssp.dll --------- 152064 25.01.2010 13:00 C:\Windows\system32\secproc_isv.dll --------- 471552 25.01.2010 13:00 C:\Windows\system32\secproc.dll --------- 471552 25.01.2010 12:58 C:\Windows\system32\msdrm.dll --------- 332288 25.01.2010 09:21 C:\Windows\system32\RMActivate_ssp_isv.exe --------- 346624 25.01.2010 09:21 C:\Windows\system32\RMActivate_isv.exe --------- 526336 25.01.2010 09:21 C:\Windows\system32\RMActivate_ssp.exe --------- 347136 25.01.2010 09:21 C:\Windows\system32\RMActivate.exe --------- 518144 23.01.2010 10:26 C:\Windows\system32\tzres.dll --------- 2048 06.01.2010 16:39 C:\Windows\system32\gameux.dll --------- 1696256 06.01.2010 16:38 C:\Windows\system32\Apphlpdm.dll --------- 28672 06.01.2010 14:30 C:\Windows\system32\GameUXLegacyGDFs.dll --------- 4240384 18.12.2009 14:01 C:\Windows\system32\ieencode.dll --------- 78336 16.12.2009 12:44 C:\Windows\system32\wininet.dll --------- 834048 16.12.2009 12:44 C:\Windows\system32\urlmon.dll --------- 1176064 16.12.2009 12:42 C:\Windows\system32\mshtml.dll --------- 3600896 16.12.2009 12:42 C:\Windows\system32\ieui.dll --------- 180736 16.12.2009 12:42 C:\Windows\system32\iepeers.dll --------- 193024 16.12.2009 12:42 C:\Windows\system32\ieframe.dll --------- 6079488 16.12.2009 12:42 C:\Windows\system32\ieapfltr.dll --------- 380928 08.12.2009 21:01 C:\Windows\system32\ntkrnlpa.exe --------- 3600456 08.12.2009 21:01 C:\Windows\system32\ntoskrnl.exe --------- 3548216 04.12.2009 19:30 C:\Windows\system32\tsbyuv.dll --------- 12288 04.12.2009 19:29 C:\Windows\system32\quartz.dll --------- 1314816 04.12.2009 19:28 C:\Windows\system32\msyuv.dll --------- 22528 ---------------------------------------- C:\Windows\Prefetch ---------------------------------------- C:\Windows\Tasks 18.03.2010 16:42 C:\Windows\Tasks\Ad-Aware Update (Weekly).job --------- 370 18.03.2010 16:41 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job --------- 1092 18.03.2010 16:41 C:\Windows\Tasks\SA.DAT --------- 6 18.03.2010 16:39 C:\Windows\Tasks\SCHEDLGU.TXT --------- 32554 18.03.2010 16:26 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job --------- 1096 ---------------------------------------- C:\Windows\Temp ---------------------------------------- C:\Users\Schlotty\AppData\Local\Temp 18.03.2010 16:46 C:\Users\Schlotty\AppData\Local\Temp\jusched.log --------- 8394 18.03.2010 16:41 C:\Users\Schlotty\AppData\Local\Temp\~DFDE22.tmp --------- 16384 18.03.2010 16:41 C:\Users\Schlotty\AppData\Local\Temp\AdobeARM.log --------- 8324 18.03.2010 16:41 C:\Users\Schlotty\AppData\Local\Temp\WPDNSE --------- 0 18.03.2010 16:41 C:\Users\Schlotty\AppData\Local\Temp\Schlotty.bmp --------- 31832 18.03.2010 15:45 C:\Users\Schlotty\AppData\Local\Temp\~DF99B1.tmp --------- 16384 16.03.2010 22:54 C:\Users\Schlotty\AppData\Local\Temp\Low --------- 0 16.03.2010 22:41 C:\Users\Schlotty\AppData\Local\Temp\{C4E2A4A7-B623-40CB-8EEA-72F577E49D56} --------- 0 16.03.2010 22:38 C:\Users\Schlotty\AppData\Local\Temp\{704CC178-DA6B-4253-9DC1-5EBCA7CCB2EB} --------- 0 16.03.2010 22:37 C:\Users\Schlotty\AppData\Local\Temp\Google Toolbar --------- 0 16.03.2010 22:36 C:\Users\Schlotty\AppData\Local\Temp\{7BF68B83-5057-4D4B-0093-28285EEB9EE3} --------- 0 16.03.2010 22:29 C:\Users\Schlotty\AppData\Local\Temp\{863e59aa-f313-4384-8e95-be4e5ab10ca2} --------- 0 16.03.2010 22:10 C:\Users\Schlotty\AppData\Local\Temp\~DF5225.tmp --------- 16384 16.03.2010 20:40 C:\Users\Schlotty\AppData\Local\Temp\~DF4F9E.tmp --------- 16384 16.03.2010 20:29 C:\Users\Schlotty\AppData\Local\Temp\~DF78AD.tmp --------- 16384 16.03.2010 20:06 C:\Users\Schlotty\AppData\Local\Temp\~DF5845.tmp --------- 16384 15.03.2010 21:43 C:\Users\Schlotty\AppData\Local\Temp\~e5d141.tmp --------- 36352 15.03.2010 15:37 C:\Users\Schlotty\AppData\Local\Temp\LastScan.txt --------- 1760 15.03.2010 15:36 C:\Users\Schlotty\AppData\Local\Temp\restart.a2s --------- 491 15.03.2010 14:31 C:\Users\Schlotty\AppData\Local\Temp\hsperfdata_Schlotty --------- 0 15.03.2010 14:31 C:\Users\Schlotty\AppData\Local\Temp\AUCHECK_CORE.txt --------- 302 15.03.2010 14:31 C:\Users\Schlotty\AppData\Local\Temp\AUCHECK_PARSER.txt --------- 257 15.03.2010 12:47 C:\Users\Schlotty\AppData\Local\Temp\~DF492.tmp --------- 16384 15.03.2010 12:31 C:\Users\Schlotty\AppData\Local\Temp\~DF6109.tmp --------- 16384 15.03.2010 12:18 C:\Users\Schlotty\AppData\Local\Temp\a2temp --------- 0 15.03.2010 12:11 C:\Users\Schlotty\AppData\Local\Temp\~DF9037.tmp --------- 16384 15.03.2010 11:43 C:\Users\Schlotty\AppData\Local\Temp\~DFB4E4.tmp --------- 16384 15.03.2010 11:37 C:\Users\Schlotty\AppData\Local\Temp\{AC76BA86-7AD7-1031-7B44-A81300000003}.ini --------- 740 15.03.2010 11:28 C:\Users\Schlotty\AppData\Local\Temp\JAUReg.log --------- 255 15.03.2010 11:27 C:\Users\Schlotty\AppData\Local\Temp\java_install_reg.log --------- 2570 15.03.2010 11:27 C:\Users\Schlotty\AppData\Local\Temp\java_install.log --------- 28332 15.03.2010 11:26 C:\Users\Schlotty\AppData\Local\Temp\java_install_sp.log --------- 1918 15.03.2010 11:24 C:\Users\Schlotty\AppData\Local\Temp\jinstall.cfg --------- 1239 15.03.2010 11:19 C:\Users\Schlotty\AppData\Local\Temp\Silverlight0.log --------- 1886 15.03.2010 11:19 C:\Users\Schlotty\AppData\Local\Temp\SilverlightMSI.log --------- 565660 15.03.2010 11:14 C:\Users\Schlotty\AppData\Local\Temp\~DF3824.tmp --------- 16384 15.03.2010 10:58 C:\Users\Schlotty\AppData\Local\Temp\~DF30C.tmp --------- 16384 15.03.2010 10:31 C:\Users\Schlotty\AppData\Local\Temp\~DFFA2B.tmp --------- 16384 14.03.2010 13:46 C:\Users\Schlotty\AppData\Local\Temp\~DF3DDF.tmp --------- 16384 14.03.2010 13:41 C:\Users\Schlotty\AppData\Local\Temp\~DFCDF4.tmp --------- 114688 14.03.2010 12:15 C:\Users\Schlotty\AppData\Local\Temp\~DFEB09.tmp --------- 16384 14.03.2010 12:09 C:\Users\Schlotty\AppData\Local\Temp\info.txt --------- 2016 14.03.2010 11:18 C:\Users\Schlotty\AppData\Local\Temp\~DF2056.tmp --------- 16384 14.03.2010 08:59 C:\Users\Schlotty\AppData\Local\Temp\~DFA6B3.tmp --------- 16384 14.03.2010 05:31 C:\Users\Schlotty\AppData\Local\Temp\~DFF87B.tmp --------- 16384 13.03.2010 17:08 C:\Users\Schlotty\AppData\Local\Temp\~DFBD9E.tmp --------- 16384 13.03.2010 09:57 C:\Users\Schlotty\AppData\Local\Temp\~DFBDA.tmp --------- 16384 12.03.2010 08:38 C:\Users\Schlotty\AppData\Local\Temp\~DF5030.tmp --------- 16384 11.03.2010 14:08 C:\Users\Schlotty\AppData\Local\Temp\~DFD156.tmp --------- 16384 11.03.2010 13:34 C:\Users\Schlotty\AppData\Local\Temp\~DFE7C7.tmp --------- 16384 10.03.2010 13:50 C:\Users\Schlotty\AppData\Local\Temp\~DFF649.tmp --------- 16384 10.03.2010 08:00 C:\Users\Schlotty\AppData\Local\Temp\~DF168B.tmp --------- 16384 09.03.2010 18:28 C:\Users\Schlotty\AppData\Local\Temp\FlashPlayerUpdate01.exe --------- 1924264 09.03.2010 18:27 C:\Users\Schlotty\AppData\Local\Temp\~DFCD3A.tmp --------- 16384 08.03.2010 22:09 C:\Users\Schlotty\AppData\Local\Temp\trkD7C3.tmp --------- 0 07.03.2010 23:54 C:\Users\Schlotty\AppData\Local\Temp\~DF9457.tmp --------- 16384 07.03.2010 10:09 C:\Users\Schlotty\AppData\Local\Temp\~DFEA0B.tmp --------- 16384 06.03.2010 20:07 C:\Users\Schlotty\AppData\Local\Temp\~DF2699.tmp --------- 16384 06.03.2010 18:57 C:\Users\Schlotty\AppData\Local\Temp\~DFD19B.tmp --------- 16384 06.03.2010 17:19 C:\Users\Schlotty\AppData\Local\Temp\~DF2E69.tmp --------- 16384 06.03.2010 11:45 C:\Users\Schlotty\AppData\Local\Temp\~DFCE3F.tmp --------- 16384 06.03.2010 10:56 C:\Users\Schlotty\AppData\Local\Temp\~DF7F37.tmp --------- 16384 05.03.2010 19:24 C:\Users\Schlotty\AppData\Local\Temp\~DF2B0D.tmp --------- 16384 05.03.2010 14:21 C:\Users\Schlotty\AppData\Local\Temp\~DFA362.tmp --------- 16384 04.03.2010 22:14 C:\Users\Schlotty\AppData\Local\Temp\~DFD71D.tmp --------- 16384 04.03.2010 08:57 C:\Users\Schlotty\AppData\Local\Temp\~DFEEB8.tmp --------- 16384 03.03.2010 17:01 C:\Users\Schlotty\AppData\Local\Temp\~e5.0001 --------- 73276 03.03.2010 09:03 C:\Users\Schlotty\AppData\Local\Temp\~DFF23E.tmp --------- 16384 03.03.2010 09:02 C:\Users\Schlotty\AppData\Local\Temp\TFR63C1.tmp --------- 45552 02.03.2010 15:54 C:\Users\Schlotty\AppData\Local\Temp\~DFD887.tmp --------- 16384 28.02.2010 13:59 C:\Users\Schlotty\AppData\Local\Temp\~DFEFB.tmp --------- 16384 27.02.2010 20:08 C:\Users\Schlotty\AppData\Local\Temp\~DFC04F.tmp --------- 16384 27.02.2010 15:57 C:\Users\Schlotty\AppData\Local\Temp\~DF57E3.tmp --------- 16384 27.02.2010 14:26 C:\Users\Schlotty\AppData\Local\Temp\wmplog00.sqm --------- 1806 27.02.2010 14:13 C:\Users\Schlotty\AppData\Local\Temp\wmsetup.log --------- 21541 27.02.2010 14:12 C:\Users\Schlotty\AppData\Local\Temp\~DF591B.tmp --------- 16384 26.02.2010 18:55 C:\Users\Schlotty\AppData\Local\Temp\~DFB5CA.tmp --------- 16384 25.02.2010 15:35 C:\Users\Schlotty\AppData\Local\Temp\~DF2F8A.tmp --------- 16384 19.02.2010 18:51 C:\Users\Schlotty\AppData\Local\Temp\trkFB6B.tmp --------- 0 19.02.2010 17:58 C:\Users\Schlotty\AppData\Local\Temp\trkD821.tmp --------- 0 19.02.2010 12:00 C:\Users\Schlotty\AppData\Local\Temp\trkE47.tmp --------- 0 18.02.2010 14:34 C:\Users\Schlotty\AppData\Local\Temp\trk4E21.tmp --------- 0 17.02.2010 19:24 C:\Users\Schlotty\AppData\Local\Temp\trk67F1.tmp --------- 0 17.02.2010 19:24 C:\Users\Schlotty\AppData\Local\Temp\WT5A59.tmp --------- 675860 17.02.2010 19:24 C:\Users\Schlotty\AppData\Local\Temp\WT5604.tmp --------- 766656 16.02.2010 15:25 C:\Users\Schlotty\AppData\Local\Temp\trk3AA5.tmp --------- 0 16.02.2010 15:24 C:\Users\Schlotty\AppData\Local\Temp\WLZ6798.tmp --------- 0 28.01.2010 08:52 C:\Users\Schlotty\AppData\Local\Temp\Gast.bmp --------- 49208 28.01.2010 08:52 C:\Users\Schlotty\AppData\Local\Temp\Administrator.bmp --------- 32848 20.01.2010 22:30 C:\Users\Schlotty\AppData\Local\Temp\Moni und G�nther.bmp --------- 31832 21.12.2009 09:21 C:\Users\Schlotty\AppData\Local\Temp\{AC76BA86-7AD7-1031-7B44-A81200000003}.ini --------- 1347 20.12.2009 16:39 C:\Users\Schlotty\AppData\Local\Temp\temp.ani --------- 13592 20.12.2009 16:38 C:\Users\Schlotty\AppData\Local\Temp\{88E88074-1E5F-4D3C-AFC3-27B7F645425F} --------- 0 20.12.2009 16:37 C:\Users\Schlotty\AppData\Local\Temp\{19F54CF4-A27E-49E6-96E3-CA289FD14FB7} --------- 4096 19.12.2009 16:44 C:\Users\Schlotty\AppData\Local\Temp\drm_dialogs.dll --------- 65536 19.12.2009 16:44 C:\Users\Schlotty\AppData\Local\Temp\drm_dyndata_7340007.dll --------- 212992 13.12.2009 20:56 C:\Users\Schlotty\AppData\Local\Temp\Temp1_DBM-4.32-r2645-Core-and-WotLK-Mods.zip --------- 0 09.12.2009 23:07 C:\Users\Schlotty\AppData\Local\Temp\Temp4_XPerl-3.0.3b_Release.zip --------- 0 09.12.2009 23:06 C:\Users\Schlotty\AppData\Local\Temp\Temp7_QuestHelper-0.77.zip --------- 0 09.12.2009 23:06 C:\Users\Schlotty\AppData\Local\Temp\Temp3_PowerAuras.zip --------- 0 09.12.2009 23:06 C:\Users\Schlotty\AppData\Local\Temp\Temp4_Omen.zip --------- 0 09.12.2009 23:06 C:\Users\Schlotty\AppData\Local\Temp\Temp2_Necrosis.zip --------- 0 09.12.2009 23:06 C:\Users\Schlotty\AppData\Local\Temp\Temp4_DBM-4.29b-r2049-Core-and-WotLK-Mods.zip --------- 0 09.12.2009 23:06 C:\Users\Schlotty\AppData\Local\Temp\Temp4_Carbonite-3.120.zip --------- 0 09.12.2009 23:06 C:\Users\Schlotty\AppData\Local\Temp\Temp5_AtlasLoot.zip --------- 0 09.12.2009 23:06 C:\Users\Schlotty\AppData\Local\Temp\Temp4_Bartender4-4.3.3.zip --------- 0 09.12.2009 23:05 C:\Users\Schlotty\AppData\Local\Temp\Temp2_Bagnon_1.6.9.zip --------- 0 09.12.2009 23:05 C:\Users\Schlotty\AppData\Local\Temp\Temp2_AtlasLoot-v5.02.06.zip --------- 0 09.12.2009 23:05 C:\Users\Schlotty\AppData\Local\Temp\Temp4_Outfitter.zip --------- 0 09.12.2009 23:05 C:\Users\Schlotty\AppData\Local\Temp\Temp4_AtlasLoot.zip --------- 0 09.12.2009 23:05 C:\Users\Schlotty\AppData\Local\Temp\Temp2_ArkInventory.zip --------- 0 09.12.2009 23:05 C:\Users\Schlotty\AppData\Local\Temp\Temp2_Atlas_v1.13.0.zip --------- 0 09.12.2009 20:45 C:\Users\Schlotty\AppData\Local\Temp\Temp4_Atlas.zip --------- 0 09.12.2009 20:17 C:\Users\Schlotty\AppData\Local\Temp\Temp2_PowerAuras.zip --------- 0 09.12.2009 20:16 C:\Users\Schlotty\AppData\Local\Temp\Temp1_ACP.zip --------- 0 09.12.2009 20:16 C:\Users\Schlotty\AppData\Local\Temp\Temp4_Bartender4.zip --------- 0 09.12.2009 16:45 C:\Users\Schlotty\AppData\Local\Temp\Blizzard Installer Temporary Data - 39e0ff59 --------- 0 06.12.2009 22:18 C:\Users\Schlotty\AppData\Local\Temp\Temp3_Atlas.zip --------- 0 04.12.2009 19:25 C:\Users\Schlotty\AppData\Local\Temp\Temp4_sweb.zip --------- 0 04.12.2009 19:25 C:\Users\Schlotty\AppData\Local\Temp\Temp3_sweb.zip --------- 0 04.12.2009 19:25 C:\Users\Schlotty\AppData\Local\Temp\Temp2_sweb.zip --------- 0 04.12.2009 19:22 C:\Users\Schlotty\AppData\Local\Temp\AVSETUP_4b195269 --------- 0 04.12.2009 19:18 C:\Users\Schlotty\AppData\Local\Temp\dd_vcredistUI4F8A.txt --------- 11414 04.12.2009 19:18 C:\Users\Schlotty\AppData\Local\Temp\dd_vcredistMSI4F8A.txt --------- 420686 02.12.2009 19:52 C:\Users\Schlotty\AppData\Local\Temp\SearchWithGoogleUpdate.exe --------- 410608 29.11.2009 22:19 C:\Users\Schlotty\AppData\Local\Temp\Temp3_en.zip --------- 0 29.11.2009 22:19 C:\Users\Schlotty\AppData\Local\Temp\Temp2_en.zip --------- 0 29.11.2009 22:19 C:\Users\Schlotty\AppData\Local\Temp\Temp1_en.zip --------- 0 29.11.2009 18:58 C:\Users\Schlotty\AppData\Local\Temp\Temp6_windows_skin.zip --------- 0 29.11.2009 18:58 C:\Users\Schlotty\AppData\Local\Temp\Temp5_windows_skin.zip --------- 0 29.11.2009 18:58 C:\Users\Schlotty\AppData\Local\Temp\Temp4_windows_skin.zip --------- 0 29.11.2009 18:58 C:\Users\Schlotty\AppData\Local\Temp\Temp6_standard_skin.zip --------- 0 29.11.2009 18:57 C:\Users\Schlotty\AppData\Local\Temp\Temp5_standard_skin.zip --------- 0 29.11.2009 18:48 C:\Users\Schlotty\AppData\Local\Temp\Temp4_standard_skin.zip --------- 0 18.11.2009 22:23 C:\Users\Schlotty\AppData\Local\Temp\Temp1_PowerAuras.zip --------- 0 15.11.2009 20:23 C:\Users\Schlotty\AppData\Local\Temp\Temp3_Omen.zip --------- 0 15.11.2009 20:23 C:\Users\Schlotty\AppData\Local\Temp\Temp2_Omen.zip --------- 0 15.11.2009 20:23 C:\Users\Schlotty\AppData\Local\Temp\Temp1_Omen.zip --------- 0 15.11.2009 20:23 C:\Users\Schlotty\AppData\Local\Temp\Temp3_DBM-4.29b-r2049-Core-and-WotLK-Mods.zip --------- 0 15.11.2009 20:22 C:\Users\Schlotty\AppData\Local\Temp\Temp2_DBM-4.29b-r2049-Core-and-WotLK-Mods.zip --------- 0 15.11.2009 20:22 C:\Users\Schlotty\AppData\Local\Temp\Temp1_DBM-4.29b-r2049-Core-and-WotLK-Mods.zip --------- 0 10.11.2009 21:44 C:\Users\Schlotty\AppData\Local\Temp\Temp3_resources.zip --------- 0 10.11.2009 21:44 C:\Users\Schlotty\AppData\Local\Temp\Temp2_resources.zip --------- 0 10.11.2009 21:44 C:\Users\Schlotty\AppData\Local\Temp\Temp1_resources.zip --------- 0 10.11.2009 19:29 C:\Users\Schlotty\AppData\Local\Temp\NclRegPermissions(1).log --------- 8170 10.11.2009 19:27 C:\Users\Schlotty\AppData\Local\Temp\54922.mst --------- 113152 07.11.2009 20:26 C:\Users\Schlotty\AppData\Local\Temp\FlashPlayerUpdate.exe --------- 1925680 01.11.2009 23:03 C:\Users\Schlotty\AppData\Local\Temp\Temp2_Atlas.zip --------- 0 12.10.2009 22:08 C:\Users\Schlotty\AppData\Local\Temp\Temp1_Atlas.zip --------- 4096 30.09.2009 20:12 C:\Users\Schlotty\AppData\Local\Temp\ispDFEA.tmp --------- 0 30.09.2009 20:12 C:\Users\Schlotty\AppData\Local\Temp\AAXB5FB.tmp --------- 26584 30.09.2009 19:38 C:\Users\Schlotty\AppData\Local\Temp\AAX3F17.tmp --------- 26584 30.09.2009 18:44 C:\Users\Schlotty\AppData\Local\Temp\AAX9965.tmp --------- 26584 30.09.2009 18:32 C:\Users\Schlotty\AppData\Local\Temp\AAXD6C2.tmp --------- 26584 03.09.2009 13:30 C:\Users\Schlotty\AppData\Local\Temp\7bf0b8.mst --------- 31744 01.09.2009 14:53 C:\Users\Schlotty\AppData\Local\Temp\fontconfig --------- 0 18.08.2009 23:25 C:\Users\Schlotty\AppData\Local\Temp\Temp1_ArkInventory.zip --------- 0 17.08.2009 16:16 C:\Users\Schlotty\AppData\Local\Temp\aax87D.tmp --------- 0 17.08.2009 16:16 C:\Users\Schlotty\AppData\Local\Temp\aaxCEE6.tmp --------- 0 17.08.2009 16:16 C:\Users\Schlotty\AppData\Local\Temp\aaxCAD1.tmp --------- 0 17.08.2009 16:15 C:\Users\Schlotty\AppData\Local\Temp\DWPUpgradeInstaller.exe --------- 4780760 13.08.2009 20:32 C:\Users\Schlotty\AppData\Local\Temp\Temp1_SexyMap.zip --------- 0 07.08.2009 21:02 C:\Users\Schlotty\AppData\Local\Temp\Temp3_Carbonite-3.210.zip --------- 0 07.08.2009 21:02 C:\Users\Schlotty\AppData\Local\Temp\Temp2_Carbonite-3.210.zip --------- 0 07.08.2009 21:02 C:\Users\Schlotty\AppData\Local\Temp\Temp1_Carbonite-3.210.zip --------- 0 07.08.2009 21:02 C:\Users\Schlotty\AppData\Local\Temp\Temp3_XPerl.zip --------- 0 07.08.2009 21:02 C:\Users\Schlotty\AppData\Local\Temp\Temp2_XPerl.zip --------- 0 07.08.2009 21:02 C:\Users\Schlotty\AppData\Local\Temp\Temp1_XPerl.zip --------- 0 07.08.2009 21:02 C:\Users\Schlotty\AppData\Local\Temp\Temp3_FuBar.zip --------- 0 07.08.2009 21:02 C:\Users\Schlotty\AppData\Local\Temp\Temp2_FuBar.zip --------- 0 07.08.2009 21:02 C:\Users\Schlotty\AppData\Local\Temp\Temp1_FuBar.zip --------- 0 07.08.2009 21:02 C:\Users\Schlotty\AppData\Local\Temp\Temp3_AtlasQuest.zip --------- 0 07.08.2009 21:02 C:\Users\Schlotty\AppData\Local\Temp\Temp2_AtlasQuest.zip --------- 0 07.08.2009 21:02 C:\Users\Schlotty\AppData\Local\Temp\Temp1_AtlasQuest.zip --------- 0 07.08.2009 21:02 C:\Users\Schlotty\AppData\Local\Temp\Temp3_AtlasLoot.zip --------- 0 07.08.2009 21:02 C:\Users\Schlotty\AppData\Local\Temp\Temp2_AtlasLoot.zip --------- 0 07.08.2009 21:01 C:\Users\Schlotty\AppData\Local\Temp\Temp1_AtlasLoot.zip --------- 0 07.08.2009 21:01 C:\Users\Schlotty\AppData\Local\Temp\Temp3_Outfitter.zip --------- 0 07.08.2009 21:01 C:\Users\Schlotty\AppData\Local\Temp\Temp2_Outfitter.zip --------- 0 07.08.2009 21:01 C:\Users\Schlotty\AppData\Local\Temp\Temp1_Outfitter.zip --------- 0 07.08.2009 21:01 C:\Users\Schlotty\AppData\Local\Temp\Temp3_Bagnon.zip --------- 0 07.08.2009 21:01 C:\Users\Schlotty\AppData\Local\Temp\Temp2_Bagnon.zip --------- 0 07.08.2009 21:01 C:\Users\Schlotty\AppData\Local\Temp\Temp1_Bagnon.zip --------- 0 07.08.2009 21:01 C:\Users\Schlotty\AppData\Local\Temp\Temp3_Bartender4.zip --------- 0 07.08.2009 21:00 C:\Users\Schlotty\AppData\Local\Temp\Temp2_Bartender4.zip --------- 0 07.08.2009 21:00 C:\Users\Schlotty\AppData\Local\Temp\Temp1_Bartender4.zip --------- 0 07.08.2009 20:23 C:\Users\Schlotty\AppData\Local\Temp\JET8007.tmp --------- 0 07.08.2009 20:23 C:\Users\Schlotty\AppData\Local\Temp\WinSAT_DX.etl --------- 3145728 07.08.2009 20:23 C:\Users\Schlotty\AppData\Local\Temp\WinSAT_KernelLog.etl --------- 5242880 07.08.2009 20:18 C:\Users\Schlotty\AppData\Local\Temp\Temp1_winvista_15115.zip --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV2AB.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV2AA.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV2A9.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV298.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV297.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV296.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV295.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV294.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV293.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV292.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV291.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV290.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV280.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV27F.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV27E.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV27D.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV27C.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV27B.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV27A.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV279.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV278.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV267.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV266.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV265.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV264.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV263.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV262.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV261.tmp --------- 0 06.08.2009 14:18 C:\Users\Schlotty\AppData\Local\Temp\PPV251.tmp --------- 0 05.08.2009 17:48 C:\Users\Schlotty\AppData\Local\Temp\JETC13B.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAFD.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAFC.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAFB.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAFA.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAF9.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAF8.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAF7.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAE7.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAE6.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAE5.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAE4.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAE3.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAE2.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAE1.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAE0.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFADF.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFADE.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFADD.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFADC.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFADB.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFADA.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAC9.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAC7.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAC8.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAC6.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAB5.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAB4.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAB3.tmp --------- 0 03.07.2009 23:58 C:\Users\Schlotty\AppData\Local\Temp\PPVFAA3.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV96A3.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV96A2.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV96A1.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV9691.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV9690.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV968F.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV968E.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV968D.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV968C.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV968B.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV968A.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV9679.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV9678.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV9677.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV9676.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV9675.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV9674.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV9673.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV9672.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV9671.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV9661.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV9660.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV965F.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV965E.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV965D.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV965C.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV965B.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV965A.tmp --------- 0 21.06.2009 14:36 C:\Users\Schlotty\AppData\Local\Temp\PPV9649.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE59D.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE59C.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE59B.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE58A.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE589.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE588.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE587.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE586.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE585.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE584.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE583.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE573.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE572.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE571.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE570.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE56F.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE56E.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE56D.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE56C.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE56B.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE55A.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE559.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE558.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE557.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE556.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE555.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE554.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE553.tmp --------- 0 21.06.2009 14:21 C:\Users\Schlotty\AppData\Local\Temp\PPVE542.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4ECA.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4EC9.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4EC8.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4EC7.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4EB7.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4EB6.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4EB5.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4EB4.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4EB3.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4EB2.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4EB1.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4EB0.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4EAF.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E8F.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E8E.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E8D.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E8C.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E7B.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E7A.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E79.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E78.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E77.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E76.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E75.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E74.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E63.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E53.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E52.tmp --------- 0 21.06.2009 14:12 C:\Users\Schlotty\AppData\Local\Temp\PPV4E22.tmp --------- 0 21.06.2009 11:19 C:\Users\Schlotty\AppData\Local\Temp\JET2AF6.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EEF.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EDE.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EDD.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EDC.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EDB.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EDA.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2ED9.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2ED8.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2ED7.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2ED6.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EC6.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EC5.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EC4.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EC3.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EC2.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EC1.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EC0.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EBF.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EBE.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EBD.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EAC.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EAB.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EAA.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EA9.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EA8.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EA7.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EA6.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2EA5.tmp --------- 0 18.06.2009 21:48 C:\Users\Schlotty\AppData\Local\Temp\PPV2E94.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB260.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB25F.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB25E.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB25D.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB25C.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB24C.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB24B.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB24A.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB249.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB248.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB247.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB246.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB245.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB244.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB233.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB232.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB231.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB230.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB22F.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB22E.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB22D.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB22C.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB22B.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB21A.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB219.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB218.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB217.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB216.tmp --------- 0 18.06.2009 21:42 C:\Users\Schlotty\AppData\Local\Temp\PPVB215.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV226D.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV226C.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV226B.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV226A.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2269.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2268.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2258.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2257.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2256.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2255.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2254.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2253.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2252.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2251.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2250.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV223F.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV223E.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV223D.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV223C.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV223B.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV223A.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2239.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2238.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2237.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2227.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2226.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2225.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2224.tmp --------- 0 18.06.2009 18:36 C:\Users\Schlotty\AppData\Local\Temp\PPV2223.tmp --------- 0 31.05.2009 21:04 C:\Users\Schlotty\AppData\Local\Temp\JET76B5.tmp --------- 0 28.05.2009 14:56 C:\Users\Schlotty\AppData\Local\Temp\JETD641.tmp --------- 0 18.05.2009 17:43 C:\Users\Schlotty\AppData\Local\Temp\Temp1_Necrosis.zip --------- 0 17.05.2009 09:11 C:\Users\Schlotty\AppData\Local\Temp\Temp3_Carbonite-3.120.zip --------- 0 17.05.2009 09:11 C:\Users\Schlotty\AppData\Local\Temp\Temp2_Carbonite-3.120.zip --------- 0 17.05.2009 09:11 C:\Users\Schlotty\AppData\Local\Temp\Temp1_Carbonite-3.120.zip --------- 0 17.05.2009 09:11 C:\Users\Schlotty\AppData\Local\Temp\Temp3_Bartender4-4.3.3.zip --------- 0 17.05.2009 09:11 C:\Users\Schlotty\AppData\Local\Temp\Temp2_Bartender4-4.3.3.zip --------- 0 17.05.2009 09:03 C:\Users\Schlotty\AppData\Local\Temp\Temp1_Bartender4-4.3.3.zip --------- 0 17.05.2009 09:03 C:\Users\Schlotty\AppData\Local\Temp\Temp3_XPerl-3.0.3b_Release.zip --------- 0 17.05.2009 09:02 C:\Users\Schlotty\AppData\Local\Temp\Temp2_XPerl-3.0.3b_Release.zip --------- 0 17.05.2009 09:02 C:\Users\Schlotty\AppData\Local\Temp\Temp1_XPerl-3.0.3b_Release.zip --------- 0 13.05.2009 16:25 C:\Users\Schlotty\AppData\Local\Temp\Temp2_sounds.zip --------- 0 13.05.2009 16:25 C:\Users\Schlotty\AppData\Local\Temp\Temp6_images.zip --------- 0 13.04.2009 09:42 C:\Users\Schlotty\AppData\Local\Temp\UNI5B39.tmp --------- 49152 23.03.2009 13:03 C:\Users\Schlotty\AppData\Local\Temp\Temp3_content.zip --------- 0 23.03.2009 12:44 C:\Users\Schlotty\AppData\Local\Temp\Temp5_images.zip --------- 0 13.03.2009 12:29 C:\Users\Schlotty\AppData\Local\Temp\IcqUpdater.exe --------- 83968 10.03.2009 11:12 C:\Users\Schlotty\AppData\Local\Temp\data.xml --------- 216 10.03.2009 07:59 C:\Users\Schlotty\AppData\Local\Temp\interface.xml --------- 45077 10.03.2009 03:06 C:\Users\Schlotty\AppData\Local\Temp\texture4.xml --------- 59399 10.03.2009 03:04 C:\Users\Schlotty\AppData\Local\Temp\texture2.xml --------- 41852 10.03.2009 03:03 C:\Users\Schlotty\AppData\Local\Temp\texture1.xml --------- 45615 10.03.2009 03:03 C:\Users\Schlotty\AppData\Local\Temp\texture0.xml --------- 24312 10.03.2009 03:01 C:\Users\Schlotty\AppData\Local\Temp\motion.xml --------- 6821 10.03.2009 03:01 C:\Users\Schlotty\AppData\Local\Temp\model.xml --------- 147858 28.02.2009 00:12 C:\Users\Schlotty\AppData\Local\Temp\Temp3_windows_skin.zip --------- 0 28.02.2009 00:12 C:\Users\Schlotty\AppData\Local\Temp\Temp2_windows_skin.zip --------- 0 28.02.2009 00:12 C:\Users\Schlotty\AppData\Local\Temp\Temp1_windows_skin.zip --------- 0 28.02.2009 00:12 C:\Users\Schlotty\AppData\Local\Temp\Temp3_standard_skin.zip --------- 0 28.02.2009 00:11 C:\Users\Schlotty\AppData\Local\Temp\Temp2_standard_skin.zip --------- 0 28.02.2009 00:11 C:\Users\Schlotty\AppData\Local\Temp\Temp1_standard_skin.zip --------- 0 24.02.2009 09:12 C:\Users\Schlotty\AppData\Local\Temp\sound.xml --------- 9835 24.02.2009 09:12 C:\Users\Schlotty\AppData\Local\Temp\other.xml --------- 976 14.02.2009 10:29 C:\Users\Schlotty\AppData\Local\Temp\Blizzard Launcher Temporary - 050c4c20 --------- 0 06.02.2009 18:22 C:\Users\Schlotty\AppData\Local\Temp\Temp1_sims2_keygen.zip --------- 0 06.02.2009 18:00 C:\Users\Schlotty\AppData\Local\Temp\JETB0F6.tmp --------- 0 06.02.2009 17:06 C:\Users\Schlotty\AppData\Local\Temp\JETA3FB.tmp --------- 0 30.01.2009 19:56 C:\Users\Schlotty\AppData\Local\Temp\JETDCE6.tmp --------- 0 17.01.2009 12:10 C:\Users\Schlotty\AppData\Local\Temp\JETBDE1.tmp --------- 0 11.01.2009 14:26 C:\Users\Schlotty\AppData\Local\Temp\JETD4CB.tmp --------- 0 07.01.2009 20:16 C:\Users\Schlotty\AppData\Local\Temp\Temp2_content.zip --------- 0 07.01.2009 20:02 C:\Users\Schlotty\AppData\Local\Temp\Temp4_images.zip --------- 0 04.01.2009 22:10 C:\Users\Schlotty\AppData\Local\Temp\JETCCCF.tmp --------- 0 04.01.2009 22:05 C:\Users\Schlotty\AppData\Local\Temp\JETB7C9.tmp --------- 0 03.01.2009 11:28 C:\Users\Schlotty\AppData\Local\Temp\JETF369.tmp --------- 0 27.12.2008 09:38 C:\Users\Schlotty\AppData\Local\Temp\Temp6_QuestHelper-0.77.zip --------- 0 27.12.2008 09:38 C:\Users\Schlotty\AppData\Local\Temp\Temp1_Bagnon_1.6.9.zip --------- 0 27.12.2008 09:37 C:\Users\Schlotty\AppData\Local\Temp\Temp1_AtlasLoot-v5.02.06.zip --------- 0 27.12.2008 09:02 C:\Users\Schlotty\AppData\Local\Temp\Temp1_Atlas_v1.13.0.zip --------- 0 25.12.2008 09:20 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[84].png --------- 1180 24.12.2008 19:36 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[83].png --------- 1180 24.12.2008 14:15 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[82].png --------- 1180 21.12.2008 16:19 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[81].png --------- 1180 21.12.2008 10:29 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[80].png --------- 1180 18.12.2008 11:58 C:\Users\Schlotty\AppData\Local\Temp\Temp5_QuestHelper-0.77.zip --------- 0 18.12.2008 11:54 C:\Users\Schlotty\AppData\Local\Temp\Temp4_QuestHelper-0.77.zip --------- 0 18.12.2008 11:54 C:\Users\Schlotty\AppData\Local\Temp\Temp3_QuestHelper-0.77.zip --------- 0 18.12.2008 11:54 C:\Users\Schlotty\AppData\Local\Temp\Temp2_QuestHelper-0.77.zip --------- 0 18.12.2008 11:54 C:\Users\Schlotty\AppData\Local\Temp\Temp1_QuestHelper-0.77.zip --------- 0 18.12.2008 10:11 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[79].png --------- 1180 17.12.2008 20:32 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[78].png --------- 1180 16.12.2008 18:53 C:\Users\Schlotty\AppData\Local\Temp\nsdC29.tmp --------- 0 16.12.2008 12:43 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[77].png --------- 1180 15.12.2008 17:52 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[76].png --------- 1180 15.12.2008 15:11 C:\Users\Schlotty\AppData\Local\Temp\Temp3_images.zip --------- 0 15.12.2008 15:10 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[75].png --------- 1180 15.12.2008 15:09 C:\Users\Schlotty\AppData\Local\Temp\Blizzard --------- 0 14.12.2008 15:15 C:\Users\Schlotty\AppData\Local\Temp\Temp3_teeworlds-0.4.3-win32.zip --------- 0 14.12.2008 15:15 C:\Users\Schlotty\AppData\Local\Temp\Temp3_sims2_keygen.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_ffjcext.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_zoopaloola.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_zlango1.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp2_images.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp3_admirer.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp2_admirer.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_admirer.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_word_puzzle.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_warsheep.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_teddy2.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_teddy.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_sms_activation.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_slide-a-lama.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_sudoku.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_soccer.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_horoskope.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_connectfour.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_auto.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_rps.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_pool.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_poker.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_photo.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_pccw_pay_gmib.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_pccw_billing.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_p7_billing.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_p7_topModel.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_shirtstudio.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_p7_playground.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_planet_popstars.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_n24.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_mobile_shop.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_p7_cinema.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_oddcast.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_images.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp2_games_center.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_welcome.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_sounds.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_icq_dialer.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_icq_card.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp3_flower.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_xtratranspdlg2.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_games_center.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_funky_neighbours.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_email_nudnik.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_infofeed.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_darts.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp2_flower.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_comming_up.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_checkers.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_bob.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_backgammon.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_flower.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_avatar.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_content.zip --------- 0 14.12.2008 15:07 C:\Users\Schlotty\AppData\Local\Temp\Temp1_random_service5.zip --------- 0 14.12.2008 15:05 C:\Users\Schlotty\AppData\Local\Temp\Temp1_python24.zip --------- 0 14.12.2008 15:03 C:\Users\Schlotty\AppData\Local\Temp\Temp1_psyco.zip --------- 0 14.12.2008 15:00 C:\Users\Schlotty\AppData\Local\Temp\Temp1_other.zip --------- 0 14.12.2008 15:00 C:\Users\Schlotty\AppData\Local\Temp\Temp1_extra.zip --------- 0 14.12.2008 14:58 C:\Users\Schlotty\AppData\Local\Temp\Temp1_core3.zip --------- 0 14.12.2008 14:58 C:\Users\Schlotty\AppData\Local\Temp\Temp1_core1.zip --------- 0 14.12.2008 14:58 C:\Users\Schlotty\AppData\Local\Temp\Temp1_sweb.zip --------- 0 14.12.2008 14:34 C:\Users\Schlotty\AppData\Local\Temp\Temp2_teeworlds-0.4.3-win32.zip --------- 0 14.12.2008 14:34 C:\Users\Schlotty\AppData\Local\Temp\Temp2_sims2_keygen.zip --------- 0 14.12.2008 14:28 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[74].png --------- 1180 14.12.2008 12:26 C:\Users\Schlotty\AppData\Local\Temp\status.txt --------- 6 05.12.2008 17:05 C:\Users\Schlotty\AppData\Local\Temp\Temp1_teeworlds-0.4.3-win32.zip --------- 0 03.12.2008 18:32 C:\Users\Schlotty\AppData\Local\Temp\JETB2BB.tmp --------- 0 21.11.2008 21:54 C:\Users\Schlotty\AppData\Local\Temp\MPTelemetrySubmit --------- 0 13.11.2008 21:18 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[73].png --------- 1180 13.11.2008 21:15 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[72].png --------- 1180 13.11.2008 21:14 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[71].png --------- 1180 12.11.2008 17:00 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[70].png --------- 1180 11.11.2008 13:33 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[69].png --------- 1180 10.11.2008 19:38 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[68].png --------- 1180 10.11.2008 12:39 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[67].png --------- 1180 09.11.2008 15:16 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[66].png --------- 1180 09.11.2008 10:35 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[65].png --------- 1180 07.11.2008 11:06 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[64].png --------- 1180 06.11.2008 09:44 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[63].png --------- 1180 06.11.2008 00:51 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[62].png --------- 1180 31.10.2008 08:46 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[61].png --------- 1180 30.10.2008 18:59 C:\Users\Schlotty\AppData\Local\Temp\PatchByFile.tmp --------- 0 30.10.2008 18:56 C:\Users\Schlotty\AppData\Local\Temp\{AC76BA86-7AD7-1031-7B44-A81000000003}.ini --------- 642 30.10.2008 18:53 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[60].png --------- 1180 30.10.2008 15:05 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[59].png --------- 1180 28.10.2008 22:37 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[58].png --------- 1180 28.10.2008 13:20 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[57].png --------- 1180 27.10.2008 14:54 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[56].png --------- 1180 27.10.2008 12:42 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[55].png --------- 1180 26.10.2008 18:28 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[54].png --------- 1180 26.10.2008 18:12 C:\Users\Schlotty\AppData\Local\Temp\TMP1E09.EMF --------- 12608 26.10.2008 18:12 C:\Users\Schlotty\AppData\Local\Temp\LEXE396.tmp --------- 0 26.10.2008 18:12 C:\Users\Schlotty\AppData\Local\Temp\~Qil2201.tmp --------- 16384 26.10.2008 18:07 C:\Users\Schlotty\AppData\Local\Temp\WKS559.tmp --------- 16896 26.10.2008 11:00 C:\Users\Schlotty\AppData\Local\Temp\Bioshock_Data_DFE --------- 0 26.10.2008 10:57 C:\Users\Schlotty\AppData\Local\Temp\{177C689E-86EE-4BBA-847D-DEF8E1930250} --------- 0 26.10.2008 10:56 C:\Users\Schlotty\AppData\Local\Temp\vcredist_x86.log --------- 1151648 26.10.2008 09:23 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[53].png --------- 1180 26.10.2008 08:18 C:\Users\Schlotty\AppData\Local\Temp\~Qil0708.tmp --------- 32768 26.10.2008 08:17 C:\Users\Schlotty\AppData\Local\Temp\~Qil3034.tmp --------- 16384 26.10.2008 08:16 C:\Users\Schlotty\AppData\Local\Temp\LEXBC3.tmp --------- 0 26.10.2008 08:15 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[52].png --------- 1180 25.10.2008 14:18 C:\Users\Schlotty\AppData\Local\Temp\MSI3c3ad.LOG --------- 316 25.10.2008 14:18 C:\Users\Schlotty\AppData\Local\Temp\~B644.tmp --------- 0 25.10.2008 14:01 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[51].png --------- 1180 23.10.2008 07:22 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[50].png --------- 1180 22.10.2008 13:56 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[49].png --------- 1180 21.10.2008 12:16 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[48].png --------- 1180 20.10.2008 14:34 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[47].png --------- 1180 20.10.2008 11:37 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[46].png --------- 1180 19.10.2008 18:10 C:\Users\Schlotty\AppData\Local\Temp\Cli7A36.tmp --------- 221184 19.10.2008 17:15 C:\Users\Schlotty\AppData\Local\Temp\Cli8D0A.tmp --------- 221184 19.10.2008 08:08 C:\Users\Schlotty\AppData\Local\Temp\Cli559B.tmp --------- 221184 19.10.2008 08:07 C:\Users\Schlotty\AppData\Local\Temp\{E26D8E3E-84B3-4B45-B3BD-94B0C85988C8} --------- 0 19.10.2008 07:57 C:\Users\Schlotty\AppData\Local\Temp\ispF9C8.tmp --------- 0 19.10.2008 07:56 C:\Users\Schlotty\AppData\Local\Temp\isp44CB.tmp --------- 0 19.10.2008 07:51 C:\Users\Schlotty\AppData\Local\Temp\{BD31A599-B9F9-4635-A7EA-18194B30B0E4} --------- 0 19.10.2008 07:40 C:\Users\Schlotty\AppData\Local\Temp\isp4C98.tmp --------- 0 19.10.2008 07:35 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[45].png --------- 1180 16.10.2008 15:41 C:\Users\Schlotty\AppData\Local\Temp\1c9c7d.mst --------- 196608 16.10.2008 15:41 C:\Users\Schlotty\AppData\Local\Temp\4ff6572.mst --------- 196608 15.10.2008 16:23 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[44].png --------- 1180 15.10.2008 16:23 C:\Users\Schlotty\AppData\Local\Temp\JETC753.tmp --------- 0 14.10.2008 23:44 C:\Users\Schlotty\AppData\Local\Temp\de14b.mst --------- 590336 14.10.2008 21:35 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[43].png --------- 1180 14.10.2008 12:46 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[42].png --------- 1180 13.10.2008 21:53 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[41].png --------- 1180 13.10.2008 14:05 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[40].png --------- 1180 13.10.2008 11:37 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[39].png --------- 1180 12.10.2008 10:32 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[38].png --------- 1180 10.10.2008 09:19 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[37].png --------- 1180 09.10.2008 18:04 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[36].png --------- 1180 06.10.2008 12:32 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[35].png --------- 1180 06.10.2008 11:15 C:\Users\Schlotty\AppData\Local\Temp\Temp1_vtmb_1_2.zip --------- 0 06.10.2008 11:14 C:\Users\Schlotty\AppData\Local\Temp\{d98bf4aa-9060-42b7-9b09-198f986f67f3} --------- 0 06.10.2008 08:21 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[34].png --------- 1180 04.10.2008 15:34 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[33].png --------- 1180 04.10.2008 11:39 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[32].png --------- 1180 04.10.2008 08:29 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[31].png --------- 1180 02.10.2008 23:09 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[30].png --------- 1180 01.10.2008 10:46 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[29].png --------- 1180 30.09.2008 20:44 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[28].png --------- 1180 30.09.2008 18:58 C:\Users\Schlotty\AppData\Local\Temp\{8740D6BA-8AFA-407F-BD21-1C0DB142BF53} --------- 0 30.09.2008 18:57 C:\Users\Schlotty\AppData\Local\Temp\rb --------- 0 30.09.2008 18:28 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[27].png --------- 1180 28.09.2008 21:37 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[26].png --------- 1180 24.09.2008 17:27 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[25].png --------- 1180 24.09.2008 15:29 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[24].png --------- 1180 23.09.2008 21:18 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[23].png --------- 1180 23.09.2008 12:16 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[22].png --------- 1180 22.09.2008 19:41 C:\Users\Schlotty\AppData\Local\Temp\Adobe --------- 0 22.09.2008 13:54 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[21].png --------- 1180 21.09.2008 14:53 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[20].png --------- 1180 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_thunderstorm.png --------- 3388 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_sunny.png --------- 2200 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_storm.png --------- 3579 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_snow.png --------- 3223 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_rain.png --------- 3335 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_mostlycloudy.png --------- 3600 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_mostlysunny.png --------- 3131 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_mostlycloudy_night.png --------- 2725 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_mostlyclear_night.png --------- 2362 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_icy.png --------- 1079 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_haze.png --------- 2817 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_fog.png --------- 2268 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_flurries.png --------- 3296 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_chanceofstorm.png --------- 3579 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_cloudy.png --------- 2662 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_chanceofsnow.png --------- 3223 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_clear_night.png --------- 1351 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_chanceofthunderstorm.png --------- 3388 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\hover_glow.png --------- 526 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_chanceofsleet.png --------- 3463 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_thunderstorm.png --------- 26675 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\icon_chanceofrain.png --------- 3335 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_sunnyNight.png --------- 9259 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_storm.png --------- 23978 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_snow.png --------- 22162 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_mostlySunnyNight.png --------- 14666 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_rain.png --------- 20549 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_sleet.png --------- 23053 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_mostlySunnyDay.png --------- 19229 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_mostlyCloudyDay.png --------- 22987 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_mostlyCloudyNight.png --------- 16676 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_icy.png --------- 4989 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_haze.png --------- 19842 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_fog.png --------- 16687 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_flurries.png --------- 20935 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\gd_weather_cloudy.png --------- 16776 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\slate_open.png --------- 2883 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\slate_main.png --------- 1780 21.09.2008 14:08 C:\Users\Schlotty\AppData\Local\Temp\slate_closed.png --------- 1293 20.09.2008 10:20 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[19].png --------- 1180 17.09.2008 18:09 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[18].png --------- 1180 16.09.2008 14:34 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[17].png --------- 1180 16.09.2008 09:37 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[16].png --------- 1180 16.09.2008 06:01 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[15].png --------- 1180 15.09.2008 18:24 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[14].png --------- 1180 15.09.2008 11:25 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[13].png --------- 1180 02.09.2008 21:37 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[12].png --------- 1180 02.09.2008 18:28 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[11].png --------- 1180 31.08.2008 16:39 C:\Users\Schlotty\AppData\Local\Temp\AAX454.tmp --------- 26584 31.08.2008 16:26 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[10].png --------- 1180 31.08.2008 09:50 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[9].png --------- 1180 30.08.2008 16:59 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[8].png --------- 1180 30.08.2008 13:44 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[7].png --------- 1180 30.08.2008 13:41 C:\Users\Schlotty\AppData\Local\Temp\AAX28D5.tmp --------- 26584 30.08.2008 13:38 C:\Users\Schlotty\AppData\Local\Temp\AAXF576.tmp --------- 26584 30.08.2008 13:34 C:\Users\Schlotty\AppData\Local\Temp\ispEB99.tmp --------- 0 30.08.2008 13:34 C:\Users\Schlotty\AppData\Local\Temp\AAX9CEB.tmp --------- 26584 30.08.2008 13:27 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[6].png --------- 1180 30.08.2008 12:06 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[5].png --------- 1180 30.08.2008 07:31 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[4].png --------- 1180 30.08.2008 05:35 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[3].png --------- 1180 29.08.2008 22:27 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[2].png --------- 1180 29.08.2008 17:54 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[1].png --------- 1180 29.08.2008 08:10 C:\Users\Schlotty\AppData\Local\Temp\undocked-sunny.png --------- 7205 29.08.2008 08:10 C:\Users\Schlotty\AppData\Local\Temp\undocked-sunny[0].png --------- 7205 29.08.2008 08:10 C:\Users\Schlotty\AppData\Local\Temp\plugin_small[0].png --------- 1180 29.08.2008 08:10 C:\Users\Schlotty\AppData\Local\Temp\Google Gadget Cache --------- 0 29.08.2008 08:09 C:\Users\Schlotty\AppData\Local\Temp\Log --------- 0 29.11.2007 11:30 C:\Users\Schlotty\AppData\Local\Temp\WKSB17.tmp --------- 13824 27.02.2007 17:08 C:\Users\Schlotty\AppData\Local\Temp\_isBE13.exe --------- 456416 20.01.2007 00:46 C:\Users\Schlotty\AppData\Local\Temp\_isEAAC.exe --------- 455600 06.04.2005 19:39 C:\Users\Schlotty\AppData\Local\Temp\setF7F1.tmp --------- 121064 06.04.2005 19:39 C:\Users\Schlotty\AppData\Local\Temp\set41AD.tmp --------- 121064 06.04.2005 19:39 C:\Users\Schlotty\AppData\Local\Temp\set7E05.tmp --------- 121064 06.04.2005 19:39 C:\Users\Schlotty\AppData\Local\Temp\set48FD.tmp --------- 121064 10.02.2005 17:41 C:\Users\Schlotty\AppData\Local\Temp\eauninstall.exe --------- 352256 22.10.2004 14:16 C:\Users\Schlotty\AppData\Local\Temp\setC3DA.tmp --------- 118736 22.10.2004 14:16 C:\Users\Schlotty\AppData\Local\Temp\setDD48.tmp --------- 118736 22.10.2004 13:16 C:\Users\Schlotty\AppData\Local\Temp\setE87A.tmp --------- 118736 22.10.2004 13:16 C:\Users\Schlotty\AppData\Local\Temp\set41B1.tmp --------- 118736 14.10.2004 21:55 C:\Users\Schlotty\AppData\Local\Temp\_is8870.tmp --------- 229376 18.08.2004 09:37 C:\Users\Schlotty\AppData\Local\Temp\AutoRun.exe --------- 663552 18.08.2004 09:34 C:\Users\Schlotty\AppData\Local\Temp\VP6Install.exe --------- 23040 18.08.2004 09:34 C:\Users\Schlotty\AppData\Local\Temp\VP6VFW.dll --------- 442368 18.08.2004 09:34 C:\Users\Schlotty\AppData\Local\Temp\VP6.reg --------- 340 18.08.2004 09:33 C:\Users\Schlotty\AppData\Local\Temp\Sims2Logo.jpg --------- 32295 18.08.2004 09:33 C:\Users\Schlotty\AppData\Local\Temp\First15.exe --------- 1453843 18.08.2004 09:33 C:\Users\Schlotty\AppData\Local\Temp\external.txt --------- 7178 18.08.2004 09:33 C:\Users\Schlotty\AppData\Local\Temp\AutoRunGUI.dll --------- 598016 02.12.2002 15:33 C:\Users\Schlotty\AppData\Local\Temp\setD0D5.tmp --------- 107512 28.02.2001 10:04 C:\Users\Schlotty\AppData\Local\Temp\set7B47.tmp --------- 139264 03.11.1999 11:34 C:\Users\Schlotty\AppData\Local\Temp\GLF49E9.tmp --------- 9728 ---------------------------------------- C:\Program Files 16.03.2010 22:42 C:\Program Files\InstallShield Installation Information --------- 8192 16.03.2010 22:40 C:\Program Files\Spiele --------- 106496 16.03.2010 22:36 C:\Program Files\EA GAMES --------- 0 16.03.2010 22:23 C:\Program Files\Ubisoft --------- 0 16.03.2010 22:22 C:\Program Files\Winamp --------- 4096 15.03.2010 12:22 C:\Program Files\a-squared Free --------- 8192 15.03.2010 11:38 C:\Program Files\Adobe --------- 0 15.03.2010 11:27 C:\Program Files\Java --------- 4096 15.03.2010 11:19 C:\Program Files\Microsoft Silverlight --------- 0 15.03.2010 11:07 C:\Program Files\Windows Portable Devices --------- 0 14.03.2010 12:03 C:\Program Files\Lavasoft --------- 0 14.03.2010 11:04 C:\Program Files\Windows Calendar --------- 0 14.03.2010 11:04 C:\Program Files\Windows Mail --------- 4096 14.03.2010 11:04 C:\Program Files\Movie Maker --------- 4096 14.03.2010 11:04 C:\Program Files\Windows Sidebar --------- 4096 14.03.2010 11:04 C:\Program Files\Internet Explorer --------- 4096 14.03.2010 11:04 C:\Program Files\Windows Media Player --------- 4096 14.03.2010 11:04 C:\Program Files\Windows Collaboration --------- 4096 14.03.2010 11:04 C:\Program Files\Windows Journal --------- 4096 14.03.2010 11:04 C:\Program Files\Windows Photo Gallery --------- 4096 14.03.2010 11:04 C:\Program Files\Windows Defender --------- 4096 14.03.2010 08:13 C:\Program Files\Trend Micro --------- 0 02.03.2010 21:16 C:\Program Files\Google --------- 4096 16.02.2010 15:22 C:\Program Files\Winamp Detect --------- 0 16.02.2010 15:22 C:\Program Files\Winamp Toolbar --------- 4096 04.12.2009 19:20 C:\Program Files\Avira --------- 0 29.11.2009 18:42 C:\Program Files\Opera --------- 4096 13.11.2009 09:20 C:\Program Files\MSXML 4.0 --------- 0 10.11.2009 19:29 C:\Program Files\Samsung --------- 0 10.11.2009 19:29 C:\Program Files\DIFX --------- 0 10.11.2009 19:29 C:\Program Files\PC Connectivity Solution --------- 12288 10.11.2009 19:26 C:\Program Files\MarkAny --------- 0 07.10.2009 20:14 C:\Program Files\The One Ring 3D Screensaver --------- 4096 30.09.2009 18:43 C:\Program Files\Ubi Soft --------- 0 30.09.2009 18:43 C:\Program Files\QuickTime --------- 4096 05.09.2009 12:56 C:\Program Files\ProtectDisc Driver Installer --------- 0 03.09.2009 13:30 C:\Program Files\Electronic Arts --------- 0 01.09.2009 14:52 C:\Program Files\GIMP-2.0 --------- 0 11.06.2009 13:21 C:\Program Files\Microsoft Works --------- 24576 28.02.2009 16:04 C:\Program Files\winrar --------- 4096 16.12.2008 18:54 C:\Program Files\DivX --------- 4096 16.12.2008 18:54 C:\Program Files\Common Files --------- 4096 14.12.2008 12:57 C:\Program Files\Sims2 --------- 4096 26.10.2008 10:43 C:\Program Files\2K Games --------- 0 02.10.2008 23:11 C:\Program Files\Activision --------- 0 30.09.2008 18:57 C:\Program Files\ICQ6Toolbar --------- 0 21.09.2008 14:25 C:\Program Files\Teamspeak 2 --------- 0 29.08.2008 08:04 C:\Program Files\Windows NT --------- 4096 29.08.2008 08:04 C:\Program Files\Gemeinsame Dateien --------- 0 26.08.2008 20:59 C:\Program Files\DellTPad --------- 4096 26.08.2008 13:05 C:\Program Files\IDT --------- 0 26.08.2008 11:36 C:\Program Files\Dell --------- 4096 26.08.2008 11:31 C:\Program Files\Citrix --------- 0 26.08.2008 11:29 C:\Program Files\CyberLink --------- 0 26.08.2008 11:29 C:\Program Files\Dell Video Chat --------- 4096 26.08.2008 11:28 C:\Program Files\Creative --------- 0 26.08.2008 11:27 C:\Program Files\Dell Webcam --------- 0 26.08.2008 11:27 C:\Program Files\Creative Live Cam --------- 0 26.08.2008 11:27 C:\Program Files\Microsoft Office --------- 0 26.08.2008 11:25 C:\Program Files\Dell Support Center --------- 4096 26.08.2008 11:22 C:\Program Files\Cisco --------- 0 26.08.2008 11:22 C:\Program Files\Intel --------- 0 21.01.2008 03:43 C:\Program Files\desktop.ini --------- 174 02.11.2006 14:01 C:\Program Files\Uninstall Information --------- 0 02.11.2006 13:37 C:\Program Files\Microsoft Games --------- 4096 02.11.2006 13:37 C:\Program Files\MSBuild --------- 0 02.11.2006 13:37 C:\Program Files\Reference Assemblies --------- 0 ---------------------------------------- C:\ProgramData\.. Schlotty Public Default User All Users Default desktop.ini ---------------------------------------- C:\Windows\system32\drivers\etc\hosts ::1 localhost ---------------------------------------- Abbildname PID Sitzungsname Sitz.-Nr. Speichernutzung ========================= ======== ================ =========== =============== System Idle Process 0 Services 0 24 K SYSTEM 4 Services 0 1.272 K smss.exe 452 Services 0 1.408 K csrss.exe 592 Services 0 9.796 K wininit.exe 636 Services 0 10.448 K csrss.exe 648 Console 1 16.340 K services.exe 684 Services 0 14.956 K lsass.exe 696 Services 0 1.936 K lsm.exe 704 Services 0 10.152 K winlogon.exe 824 Console 1 13.172 K svchost.exe 900 Services 0 17.408 K svchost.exe 984 Services 0 5.608 K svchost.exe 1024 Services 0 22.036 K svchost.exe 1092 Services 0 10.672 K svchost.exe 1132 Services 0 64.428 K svchost.exe 1168 Services 0 21.616 K stacsv.exe 1200 Services 0 18.212 K audiodg.exe 1264 Services 0 5.924 K SLsvc.exe 1412 Services 0 25.520 K svchost.exe 1476 Services 0 41.448 K DockLogin.exe 1580 Services 0 24.092 K svchost.exe 1628 Services 0 9.744 K WLTRYSVC.EXE 1764 Services 0 8.260 K BCMWLTRY.EXE 1784 Services 0 71.036 K AAWService.exe 1840 Services 0 61.952 K spoolsv.exe 1960 Services 0 37.460 K sched.exe 1988 Services 0 884 K svchost.exe 2004 Services 0 11.076 K a2service.exe 804 Services 0 27.512 K AEstSrv.exe 1164 Services 0 4.192 K avguard.exe 1184 Services 0 43.992 K FsUsbExService.Exe 1564 Services 0 24.556 K IAANTmon.exe 1852 Services 0 28.332 K svchost.exe 2096 Services 0 4.192 K svchost.exe 2148 Services 0 4.972 K svchost.exe 2180 Services 0 1.956 K SearchIndexer.exe 2224 Services 0 60.580 K taskeng.exe 2820 Services 0 26.008 K dwm.exe 2876 Console 1 17.388 K taskeng.exe 2972 Console 1 8.492 K explorer.exe 3044 Console 1 107.960 K DellDock.exe 3256 Console 1 88.556 K unsecapp.exe 3408 Services 0 3.512 K WmiPrvSE.exe 3644 Services 0 18.700 K conime.exe 3668 Console 1 10.584 K MSASCui.exe 3752 Console 1 32.824 K Apoint.exe 3784 Console 1 29.108 K IAAnotif.exe 3812 Console 1 28.464 K WLTRAY.EXE 3828 Console 1 62.908 K GoogleDesktop.exe 3848 Console 1 25.908 K WebcamDell.exe 3924 Console 1 33.380 K PCMService.exe 3936 Console 1 40.540 K igfxtray.exe 3976 Console 1 30.072 K hkcmd.exe 3984 Console 1 24.664 K igfxpers.exe 4012 Console 1 24.680 K qttask.exe 4036 Console 1 41.776 K avgnt.exe 4052 Console 1 31.136 K winampa.exe 4060 Console 1 23.340 K sttray.exe 4068 Console 1 34.704 K jusched.exe 2084 Console 1 24.468 K igfxsrvc.exe 2204 Console 1 12.884 K GoogleToolbarNotifier.exe 772 Console 1 32.644 K ehtray.exe 2644 Console 1 25.672 K NPSAgent.exe 2740 Console 1 28.136 K ehmsas.exe 2988 Console 1 11.148 K ApMsgFwd.exe 3264 Console 1 10.024 K unsecapp.exe 2648 Console 1 13.348 K hidfind.exe 1772 Console 1 12.948 K ApntEx.exe 1828 Console 1 24.148 K AAWTray.exe 2888 Console 1 30.312 K opera.exe 3464 Console 1 61.244 K SearchProtocolHost.exe 760 Services 0 7.972 K cmd.exe 2636 Console 1 6.344 K dllhost.exe 3244 Console 1 4.172 K tasklist.exe 2456 Console 1 4.628 K WmiPrvSE.exe 3804 Services 0 5.656 K ***** Ende des Scans 18.03.2010 um 16:47:41,91 ***
danke schon mal
Zitat von Eddi
