Hallo alle zusammen,

ich habe das Problem, wovon viele User bereits berichtet haben. Mein Desktop ist komplett schwarz und ich habe keinen Zugriff mehr auf meine Dateien.
Ich habe euren Anweisungen nach einen Vollscan mit Malwarebytes durchführen lassen und hier ist das Ergebnis.

Ich hoffe, ihr könnt mir weiterhelfen.

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6967

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

28.06.2011 19:23:30
mbam-log-2011-06-28 (19-23-30).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 340446
Laufzeit: 1 Stunde(n), 47 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 2
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 4
Infizierte Registrierungswerte: 10
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 92

Infizierte Speicherprozesse:
c:\Windows\Temp\uvltqo\setup.exe (Backdoor.Bot) -> 1700 -> Unloaded process successfully.
c:\Windows\System32\jpp3.exe (Trojan.WerTrans) -> 2076 -> Unloaded process successfully.

Infizierte Speichermodule:
c:\Users\rai\AppData\Local\enajarowijehulal.dll (Trojan.Agent.U) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AMService (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{C689C99E-3A8C-4c87-A79C-C80DC9C81632} (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\svcmsdebug (Trojan.WerTrans) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AMService (Backdoor.Bot) -> Value: AMService -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{8495736E-46E8-F9EA-196F-B03BD29B6BFE} (Trojan.Dropper) -> Value: {8495736E-46E8-F9EA-196F-B03BD29B6BFE} -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{AA9F9655-A3D3-D7E0-196F-B03BD29B6BFE} (Trojan.Dropper) -> Value: {AA9F9655-A3D3-D7E0-196F-B03BD29B6BFE} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{989A9B0D-2FD6-841C-8CFC-BD2A86913978} (Trojan.FakeAlert) -> Value: {989A9B0D-2FD6-841C-8CFC-BD2A86913978} -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{B6907E36-CAED-AA16-8CFC-BD2A86913978} (Trojan.FakeAlert) -> Value: {B6907E36-CAED-AA16-8CFC-BD2A86913978} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4Y3Y0C3AUZZJ4EYWHTBFXNZQMXODFAB (Trojan.Downloader) -> Value: 4Y3Y0C3AUZZJ4EYWHTBFXNZQMXODFAB -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{CE7FB805-E072-5E4E-02AC-A2990AFD8BC9} (Spyware.Passwords.XGen) -> Value: {CE7FB805-E072-5E4E-02AC-A2990AFD8BC9} -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Osacuka (Trojan.Agent.U) -> Value: Osacuka -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4W1W8B7AWZVCYE3GBRAIU (Trojan.SpyEyes) -> Value: 4W1W8B7AWZVCYE3GBRAIU -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Userinit (Trojan.Agent) -> Value: Userinit -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\Recycle.Bin (Trojan.Spyeyes) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\Windows\Temp\uvltqo\setup.exe (Backdoor.Bot) -> Delete on reboot.
c:\Users\rai\AppData\Roaming\Ysymyp\caxoe.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Roaming\Ogtuo\ifab.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\svest\3ed979f3e34.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Roaming\Vodu\fiad.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Recycle.Bin\recycle.bin.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\OUBVS3YD\contacts[1].exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\OUBVS3YD\windows-update-sp2-kb72170-setup[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\RK1F25QS\windows-update-sp3-kb73364-setup[1].exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\SMUQY3NC\windows-update-sp2-kb72906-setup[1].exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\setup1008447532.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\setup1020727048.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\setup1152744780.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\setup1237180152.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\setup1904258508.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\setup352887232.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\setup4053500652.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\setup749304192.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\setup2240559188.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\setup2243471788.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\setup2276230980.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\setup2795684296.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\0.15922482866121335.exe (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\0.18517589546822022.exe (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\0.2504769801470035.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\0.3368059966747582.exe (Trojan.Agent.SZ) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\0.3522637127378212.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\0.5645673212442865.exe (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\AB8C.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\adobe_flash_player.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\ECDF.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\ewacnxrosm.exe (Trojan.Hiloti.Gen) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\F1BE.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\jar_cache4290880000267105886.tmp (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\jar_cache630415511970096761.tmp (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\jar_cache6357648436762506745.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\jar_cache6517129892316717383.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\Temp\tmpD578.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Roaming\Guwy\ilhav.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Roaming\Pylo\nehy.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Roaming\Reeqe\vuuwk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Roaming\Xoofka\atipl.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.8980067592258049.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache3238386791498126793.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.052860187623421595.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.07455465554303697.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.09704681782227886.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.1628810541685567.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.1777911629517276.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.19207205017406903.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.24389376577942812.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.2752289388908823.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.29387172081543833.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.39395244160227794.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.4109070587500694.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.4434258496333292.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.4658762270368998.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.5759064824169595.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.6515418031024994.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.7242342735754141.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.7460659086710065.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.8469139751466319.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.8549601486715639.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\0.8904307322035636.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache4237716315418943234.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache4275951188290372044.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache465038264603885305.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache5189369654252030440.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache5498479796581028483.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache5531312842814268344.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache5723188463717295422.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache6126471028174742749.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache663048289573120938.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache6818879000899940757.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache8727919714605495671.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache8949727319327672710.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache913378390925623342.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache9170446646236397553.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\6096.tmp (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache1508689122658508332.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache1644977468665193643.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache2196339311734675599.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache2305135084482957881.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache2484313631776547057.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache2569165611358110562.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\Temp\jar_cache3159920195863819109.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Roaming\Adobe\shed\thr1.chm (Malware.Trace) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Roaming\Adobe\plugs\mmc195.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Local\enajarowijehulal.dll (Trojan.Agent.U) -> Delete on reboot.
c:\Users\rai\AppData\Roaming\appconf32.exe (Trojan.Agent) -> Delete on reboot.
c:\Windows\System32\jpp3.exe (Trojan.WerTrans) -> Quarantined and deleted successfully.
c:\Recycle.Bin\config.bin (Trojan.Spyeyes) -> Quarantined and deleted successfully.

28.06.2011 19:23:30

Ist ja schon ne Woche her. Bitte Malwarebytes updaten und einen neuen Vollscan machen.
Alle Logs posten, auch ältere falls vorhanden.

So habe erneut einen Vollscan durchgeführt und hier ist das Ergebnis:

Malwarebytes' Anti-Malware 1.51.0.1200
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 7012

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

03.07.2011 20:13:39
mbam-log-2011-07-03 (20-13-39).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 341763
Laufzeit: 1 Stunde(n), 6 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 5
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 5

Infizierte Speicherprozesse:
c:\Windows\System32\config\systemprofile\AppData\Local\nvidia corporation\Update\daemonupd.exe (Trojan.Agent) -> 1908 -> Unloaded process successfully.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvUpdService (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Osacuka (Trojan.Agent.U) -> Value: Osacuka -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{8495736E-46E8-F9EA-196F-B03BD29B6BFE} (Trojan.ZbotR.Gen) -> Value: {8495736E-46E8-F9EA-196F-B03BD29B6BFE} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{CE7FB805-E072-5E4E-02AC-A2990AFD8BC9} (Trojan.ZbotR.Gen) -> Value: {CE7FB805-E072-5E4E-02AC-A2990AFD8BC9} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{989A9B0D-2FD6-841C-8CFC-BD2A86913978} (Trojan.ZbotR.Gen) -> Value: {989A9B0D-2FD6-841C-8CFC-BD2A86913978} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4E3E0230AEBB4E96 (Trojan.SpyEyes) -> Value: 4E3E0230AEBB4E96 -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\Recycle.Bin (Trojan.Spyeyes) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\Users\rai\documents\myfuncards(1).exe (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\Users\rai\documents\myfuncards.exe (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Local\nvidia corporation\Update\daemonupd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\rai\AppData\Roaming\Gaixe\alcu.exe (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully.
c:\Recycle.Bin\config.bin (Trojan.Spyeyes) -> Quarantined and deleted successfully.



Danke für das schnelle antworten.

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die Textbox.

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Klick auf .
• Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

So hier ist das Protokoll:OTL Logfile:

OTL logfile created on: 7/3/2011 11:06:30 PM - Run 2
OTL by OldTimer - Version 3.2.25.0     Folder = C:\Users\rai\Desktop
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.96 Gb Total Physical Memory | 1.26 Gb Available Physical Memory | 64.15% Memory free
3.92 Gb Paging File | 2.91 Gb Available in Paging File | 74.25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 76.22 Gb Total Space | 30.04 Gb Free Space | 39.41% Space Free | Partition Type: NTFS
Drive D: | 141.56 Gb Total Space | 33.60 Gb Free Space | 23.73% Space Free | Partition Type: NTFS
 
Computer Name: RAI-PC | User Name: rai | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011/07/03 23:03:49 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Desktop\OTL.exe
PRC - [2011/05/25 23:14:14 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/04/22 19:04:20 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/03/30 19:49:44 | 000,671,552 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2011/03/30 19:48:00 | 001,523,008 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2011/03/11 01:13:12 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011/02/26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011/02/25 11:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE
PRC - [2010/09/17 18:55:04 | 000,102,400 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Update\NASvc.exe
PRC - [2010/04/20 14:26:44 | 000,300,912 | ---- | M] () -- C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe
PRC - [2010/01/14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/11/04 06:11:48 | 000,835,072 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2009/10/26 13:53:14 | 000,091,136 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
PRC - [2009/10/20 11:12:58 | 000,013,312 | ---- | M] (DoctorSoft) -- C:\Program Files\AnyPC Client\APLangApp.exe
PRC - [2009/10/13 12:03:04 | 000,716,800 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
PRC - [2009/10/07 03:31:56 | 002,246,144 | ---- | M] (SEC) -- C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
PRC - [2009/09/09 10:20:51 | 000,009,728 | ---- | M] () -- C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeLauncher.exe
PRC - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
PRC - [2009/07/14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/07/14 03:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2009/06/03 13:59:02 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2009/04/15 16:52:06 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
PRC - [2009/03/31 09:39:36 | 000,233,472 | ---- | M] (Teruten) -- C:\Windows\System32\FsUsbExService.Exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011/07/03 23:03:49 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Desktop\OTL.exe
MOD - [2010/08/21 07:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011/05/25 23:14:14 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/04/22 19:04:20 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/03/30 19:48:00 | 001,523,008 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011/03/30 19:45:32 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2011/02/28 19:44:14 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/02/25 11:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/01/15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () [Auto | Running] -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe -- (OberonGameConsoleService)
SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2009/03/31 09:39:36 | 000,233,472 | ---- | M] (Teruten) [Auto | Running] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService)
SRV - [2008/04/07 09:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2011/04/22 19:04:20 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/03/11 01:13:12 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/02/10 11:22:58 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2009/11/06 22:53:58 | 001,227,776 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/09/28 11:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/07/14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/07/10 15:44:52 | 000,122,880 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV - [2009/05/11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/05/01 15:41:06 | 000,384,896 | ---- | M] (Phoenix Technologies Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CryptOSD.sys -- (CryptOSD)
DRV - [2009/03/31 09:39:36 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2009/03/20 10:01:26 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdm.sys -- (ss_bmdm)
DRV - [2009/03/20 10:01:26 | 000,090,112 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM)
DRV - [2009/03/20 10:01:26 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter)
DRV - [2007/09/17 15:53:26 | 000,021,632 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2007/07/03 16:58:20 | 000,106,792 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2007/07/03 16:57:24 | 000,011,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2007/07/03 16:54:24 | 000,080,552 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=1e754307000000000000b482fe6bf288&tlver=1.4.19.19&affID=17159
IE - HKLM\..\URLSearchHook: {76aeea42-e04a-4b62-83ab-df4b2be2541e} - C:\Program Files\MessengerPlusLive_Germany_TB\tbMess.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Ask.com Deutschland - die andere Suchmaschine
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
IE - HKCU\..\URLSearchHook: {76aeea42-e04a-4b62-83ab-df4b2be2541e} - C:\Program Files\MessengerPlusLive_Germany_TB\tbMess.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "softonic-de3 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://de.ask.com/?l=dis&o=15421"
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: {76aeea42-e04a-4b62-83ab-df4b2be2541e}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..extensions.enabledItems: {f4e6547e-325b-403c-a3bb-ad29ed37a92f}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2
FF - prefs.js..extensions.enabledItems: {39A08BE0-F3F7-4366-B319-8CCAD7DB14CC}:1.9.1
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?babsrc=toolbar2&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/06/16 07:35:36 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/06/25 09:30:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/19 16:00:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/03/18 22:47:23 | 000,000,000 | ---D | M]
 
[2011/01/11 01:56:34 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\rai\AppData\Roaming\mozilla\Extensions
[2011/01/11 01:56:34 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\rai\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/06/25 22:01:34 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions
[2011/06/25 22:01:25 | 000,000,000 | ---D | M] (MessengerPlusLive Germany TB Community Toolbar) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{76aeea42-e04a-4b62-83ab-df4b2be2541e}
[2011/06/25 22:01:28 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2011/06/16 07:35:43 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/06/25 22:01:31 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
[2011/06/25 22:01:34 | 000,000,000 | ---D | M] (SearchElf 1.2 Community Toolbar) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}
[2011/06/16 07:35:43 | 000,000,000 | -H-D | M] (Conduit Engine) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\engine@conduit.com
[2011/06/16 07:35:43 | 000,000,000 | -H-D | M] (Nero Toolbar) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\toolbar@ask.com
[2011/06/16 07:35:43 | 000,000,000 | -H-D | M] (vShare Plugin) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\vshare@toolbar
[2011/05/26 13:16:46 | 000,002,253 | -H-- | M] () -- C:\Users\rai\AppData\Roaming\Mozilla\Firefox\Profiles\8bhp6291.default\searchplugins\askcom.xml
[2010/12/08 16:47:52 | 000,000,927 | -H-- | M] () -- C:\Users\rai\AppData\Roaming\Mozilla\Firefox\Profiles\8bhp6291.default\searchplugins\conduit.xml
[2010/10/30 13:47:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2010/10/30 13:47:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
File not found (No name found) -- 
[2011/06/19 14:54:52 | 000,000,000 | ---D | M] (XULRunner) -- C:\USERS\RAI\APPDATA\LOCAL\{39A08BE0-F3F7-4366-B319-8CCAD7DB14CC}
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] (Java String Helper) -- C:\USERS\RAI\APPDATA\ROAMING\5017
() (No name found) -- C:\USERS\RAI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8BHP6291.DEFAULT\EXTENSIONS\FFXTLBR@BABYLON.COM.XPI
[2011/06/25 09:30:32 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/10/30 13:47:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/06/23 13:34:24 | 002,156,280 | ---- | M] (Myriad Software.) -- C:\Program Files\mozilla firefox\plugins\NPMyrMus.dll
[2011/05/11 17:03:09 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/05/23 17:40:29 | 000,002,423 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2011/05/11 17:03:09 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/05/11 17:03:10 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011/05/11 17:03:10 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/05/11 17:03:10 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/05/11 17:03:10 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
Hosts file not found
O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (MessengerPlusLive Germany TB Toolbar) - {76aeea42-e04a-4b62-83ab-df4b2be2541e} - C:\Program Files\MessengerPlusLive_Germany_TB\tbMess.dll (Conduit Ltd.)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (MessengerPlusLive Germany TB Toolbar) - {76aeea42-e04a-4b62-83ab-df4b2be2541e} - C:\Program Files\MessengerPlusLive_Germany_TB\tbMess.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (MessengerPlusLive Germany TB Toolbar) - {76AEEA42-E04A-4B62-83AB-DF4B2BE2541E} - C:\Program Files\MessengerPlusLive_Germany_TB\tbMess.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APLangApp] C:\Program Files\AnyPC Client\APLangApp.exe (DoctorSoft)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BabylonToolbar] C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe (Babylon Ltd.)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [fsi] C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeLauncher.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [{989A9B0D-2FD6-841C-8CFC-BD2A86913978}]  File not found
O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Free YouTube Download - C:\Users\rai\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .mu3 - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .mus - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .mxl - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .mya - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .myr - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .myt - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .xmz - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: hotmail.com ([]* in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: live.com ([]* in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: msn.com ([]* in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: passport.com ([]* in Vertrauenswürdige Sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{8f591401-766c-11e0-a156-0024542a71d7}\Shell - "" = AutoRun
O33 - MountPoints2\{8f591401-766c-11e0-a156-0024542a71d7}\Shell\AutoRun\command - "" = F:\iStudio.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/07/03 23:03:46 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\rai\Desktop\OTL.exe
[2011/07/03 23:02:56 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\rai\Documents\OTL(2).exe
[2011/06/29 11:50:47 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Tyka
[2011/06/29 11:50:46 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Gaixe
[2011/06/28 17:31:34 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Malwarebytes
[2011/06/28 17:31:28 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys
[2011/06/28 17:31:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/28 17:31:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/06/28 17:31:24 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2011/06/28 17:31:24 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/06/28 17:30:29 | 009,435,312 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\rai\Documents\mbam-setup-1.51.0.1200.exe
[2011/06/24 00:07:45 | 001,064,960 | ---- | C] (The OpenSSL Project, OpenSSL: The Open Source toolkit for SSL/TLS) -- C:\windows\System32\libeay32.dll
[2011/06/24 00:07:45 | 000,200,704 | ---- | C] (The OpenSSL Project, OpenSSL: The Open Source toolkit for SSL/TLS) -- C:\windows\System32\ssleay32.dll
[2011/06/24 00:07:45 | 000,176,128 | ---- | C] (The cURL library, cURL and libcurl) -- C:\windows\System32\libcurl.dll
[2011/06/23 22:31:52 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Guwy
[2011/06/23 22:31:52 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Akpoo
[2011/06/23 09:18:34 | 000,000,000 | ---D | C] -- C:\windows\Minidump
[2011/06/22 09:58:28 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Vodu
[2011/06/22 09:58:28 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Kofui
[2011/06/20 19:00:55 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Xafape
[2011/06/20 19:00:55 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Pylo
[2011/06/20 11:45:32 | 000,000,000 | ---D | C] -- C:\windows\Sun
[2011/06/19 14:54:52 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Local\{39A08BE0-F3F7-4366-B319-8CCAD7DB14CC}
[2011/06/19 12:00:44 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Reeqe
[2011/06/19 12:00:44 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Futo
[2011/06/18 17:58:25 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\rai\Documents\OTL(1).exe
[2011/06/15 22:18:49 | 000,580,608 | -H-- | C] (OldTimer Tools) -- C:\Users\rai\Documents\OTL.exe
[2011/06/15 11:58:27 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Convar
[2011/06/15 11:58:27 | 000,000,000 | ---D | C] -- C:\Program Files\Convar
[2011/06/15 10:47:23 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 Restore
[2011/06/14 22:28:23 | 000,000,000 | -H-D | C] -- C:\Users\rai\Desktop\Handy Uploads
[2011/06/14 22:09:22 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Ynwi
[2011/06/14 22:09:22 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Xoofka
[2011/06/13 22:55:17 | 000,000,000 | -H-D | C] -- C:\Users\rai\Documents\Neuer Ordner (2)
[2011/06/13 10:50:02 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Ogtuo
[2011/06/13 10:50:02 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Duebog
[2011/06/10 15:09:19 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\5017
[2011/06/08 22:36:26 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\5016
[2011/06/07 12:32:34 | 000,000,000 | -H-D | C] -- C:\Users\rai\Documents\Bewerbungen Agentur
[2011/06/06 19:00:36 | 000,000,000 | -H-D | C] -- C:\Users\rai\Documents\Neuer Ordner
[2010/08/25 19:59:08 | 000,004,096 | ---- | C] ( ) -- C:\windows\System32\IGFXDEVLib.dll
[4 C:\Users\rai\AppData\Local\*.tmp files -> C:\Users\rai\AppData\Local\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
[1 C:\Users\rai\AppData\Roaming\*.tmp files -> C:\Users\rai\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011/07/03 23:07:48 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/07/03 23:07:48 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/07/03 23:03:49 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Desktop\OTL.exe
[2011/07/03 23:03:00 | 000,001,092 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/03 23:02:58 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Documents\OTL(2).exe
[2011/07/03 22:59:45 | 000,001,088 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/03 22:59:16 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2011/07/03 22:59:09 | 1579,630,592 | -HS- | M] () -- C:\hiberfil.sys
[2011/07/02 15:29:40 | 002,285,048 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2011/07/02 15:29:40 | 001,131,250 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2011/07/02 15:29:40 | 000,650,156 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2011/07/02 15:29:40 | 000,576,210 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2011/06/30 18:34:33 | 000,009,487 | ---- | M] () -- C:\Users\rai\Documents\267566_10150250517364940_7805409939_7109628_7949230_s.jpg
[2011/06/29 12:13:40 | 000,350,312 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2011/06/28 18:10:25 | 000,000,120 | -H-- | M] () -- C:\Users\rai\AppData\Local\Jyiqobituyi.dat
[2011/06/28 17:31:28 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/28 17:31:01 | 009,435,312 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\rai\Documents\mbam-setup-1.51.0.1200.exe
[2011/06/28 09:17:12 | 000,000,000 | -H-- | M] () -- C:\Users\rai\AppData\Local\Qkoyocigezori.bin
[2011/06/25 10:02:25 | 000,000,000 | ---- | M] () -- C:\Users\rai\AppData\Local\{9E02C3BE-344B-4FFB-9E09-602CD6B087CD}
[2011/06/24 17:40:35 | 000,003,589 | ---- | M] () -- C:\windows\System32\jsaddons.ini
[2011/06/23 19:44:59 | 000,030,393 | ---- | M] () -- C:\Users\rai\Documents\254529_1805511572895_1093067663_31510402_5864814_n.jpg
[2011/06/23 09:18:23 | 237,375,097 | ---- | M] () -- C:\windows\MEMORY.DMP
[2011/06/21 22:57:31 | 000,096,187 | ---- | M] () -- C:\Users\rai\Documents\249464_207123672656310_100000760352992_471385_2137741_n.jpg
[2011/06/20 17:06:54 | 000,000,000 | ---- | M] () -- C:\Users\rai\AppData\Local\{CCB2B7B9-5421-43EC-8F04-48CCA8BAD627}
[2011/06/20 17:02:29 | 000,000,000 | ---- | M] () -- C:\Users\rai\AppData\Local\{349E8643-AC12-4668-9AE4-385FE5B30EFA}
[2011/06/18 22:50:18 | 000,000,000 | ---- | M] () -- C:\Users\rai\AppData\Local\{27E7AFC2-2056-4E6C-8A3E-5534EEE94F54}
[2011/06/18 17:58:39 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Documents\OTL(1).exe
[2011/06/17 22:11:01 | 000,020,311 | -H-- | M] () -- C:\Users\rai\Documents\29444392.jpg
[2011/06/15 22:19:55 | 000,580,608 | -H-- | M] (OldTimer Tools) -- C:\Users\rai\Documents\OTL.exe
[2011/06/15 12:00:33 | 000,001,284 | -H-- | M] () -- C:\Users\rai\Desktop\PC Inspector File Recovery.lnk
[2011/06/15 11:58:08 | 003,462,033 | -H-- | M] () -- C:\Users\rai\Documents\pci_filerecovery.exe
[2011/06/15 11:47:51 | 000,000,392 | -H-- | M] () -- C:\ProgramData\27057912
[2011/06/15 11:45:25 | 000,000,152 | -H-- | M] () -- C:\ProgramData\~27057912r
[2011/06/15 11:45:25 | 000,000,128 | -H-- | M] () -- C:\ProgramData\~27057912
[2011/06/15 10:47:23 | 000,000,633 | -H-- | M] () -- C:\Users\rai\Desktop\Windows 7 Restore.lnk
[2011/06/14 22:33:25 | 000,178,750 | -H-- | M] () -- C:\Users\rai\Documents\Foto371.jpg
[2011/06/14 13:47:40 | 000,068,276 | -H-- | M] () -- C:\Users\rai\Documents\ostsee.jpg
[2011/06/14 11:56:29 | 000,046,662 | -H-- | M] () -- C:\Users\rai\Documents\deepika061111.pdf
[2011/06/13 18:49:15 | 000,086,014 | -H-- | M] () -- C:\Users\rai\Documents\247028_1805452651422_1093067663_31510173_660445_n.jpg
[2011/06/13 12:51:38 | 000,114,329 | -H-- | M] () -- C:\Users\rai\Documents\Guten Morgen Berlin.jpg
[2011/06/13 12:50:09 | 000,063,243 | -H-- | M] () -- C:\Users\rai\Documents\247241_1805529653347_1093067663_31510421_6177808_n.jpg
[2011/06/13 12:44:57 | 000,057,985 | -H-- | M] () -- C:\Users\rai\Documents\255691_1805487932304_1093067663_31510317_2832650_n.jpg
[2011/06/10 19:48:06 | 000,108,860 | -H-- | M] () -- C:\Users\rai\Documents\das richtige Bild.jpg
[2011/06/10 12:15:03 | 003,090,518 | -H-- | M] () -- C:\Users\rai\Documents\Alexandra_Stan_-_Mr._Saxo_Beat_lyrics.mp3
[2011/06/10 01:31:37 | 000,114,443 | -H-- | M] () -- C:\Users\rai\Documents\Eine Zugfahrt die ist... nun ja anders !.jpg
[2011/06/10 01:27:11 | 000,077,035 | -H-- | M] () -- C:\Users\rai\Documents\249272_10150608301755858_758305857_18923591_5096154_n.jpg
[2011/06/10 01:10:01 | 000,090,121 | -H-- | M] () -- C:\Users\rai\Documents\251702_172001396193189_100001499904249_452483_4061762_n - Kopie (2).jpg
[2011/06/10 00:08:35 | 000,116,373 | -H-- | M] () -- C:\Users\rai\Documents\246663_171998719526790_100001499904249_452418_6352249_n.jpg
[2011/06/10 00:08:07 | 000,150,556 | -H-- | M] () -- C:\Users\rai\Documents\253500_171998642860131_100001499904249_452413_2636837_n.jpg
[2011/06/10 00:07:05 | 000,092,886 | -H-- | M] () -- C:\Users\rai\Documents\248993_171998486193480_100001499904249_452410_4837368_n.jpg
[2011/06/10 00:06:21 | 000,096,233 | -H-- | M] () -- C:\Users\rai\Documents\253822_171998412860154_100001499904249_452408_7346243_n.jpg
[2011/06/09 23:58:40 | 000,101,341 | -H-- | M] () -- C:\Users\rai\Documents\248915_171996939526968_100001499904249_452364_1974396_n.jpg
[2011/06/09 23:58:33 | 000,095,441 | -H-- | M] () -- C:\Users\rai\Documents\253862_171996886193640_100001499904249_452363_7360527_n.jpg
[2011/06/09 23:58:26 | 000,149,923 | -H-- | M] () -- C:\Users\rai\Documents\254551_171996819526980_100001499904249_452362_3463874_n.jpg
[2011/06/09 23:58:19 | 000,135,691 | -H-- | M] () -- C:\Users\rai\Documents\248413_171996786193650_100001499904249_452361_6024836_n.jpg
[2011/06/09 23:58:11 | 000,143,779 | -H-- | M] () -- C:\Users\rai\Documents\251255_171996749526987_100001499904249_452360_3782341_n.jpg
[2011/06/09 23:58:03 | 000,143,814 | -H-- | M] () -- C:\Users\rai\Documents\251675_171996726193656_100001499904249_452359_4176518_n.jpg
[2011/06/09 23:57:52 | 000,081,088 | -H-- | M] () -- C:\Users\rai\Documents\254150_171996676193661_100001499904249_452358_4447810_n.jpg
[2011/06/09 23:57:34 | 000,079,762 | -H-- | M] () -- C:\Users\rai\Documents\247353_171996616193667_100001499904249_452357_4628715_n.jpg
[2011/06/09 23:57:26 | 000,083,753 | -H-- | M] () -- C:\Users\rai\Documents\249543_171996589527003_100001499904249_452356_6543620_n.jpg
[2011/06/09 23:57:17 | 000,076,384 | -H-- | M] () -- C:\Users\rai\Documents\246922_171996566193672_100001499904249_452355_8238187_n.jpg
[2011/06/09 23:57:16 | 000,098,462 | -H-- | M] () -- C:\Users\rai\Documents\246643_171996532860342_100001499904249_452353_3318879_n.jpg
[2011/06/09 23:56:56 | 000,097,657 | -H-- | M] () -- C:\Users\rai\Documents\247073_171996479527014_100001499904249_452352_7212322_n.jpg
[2011/06/09 23:56:45 | 000,097,691 | -H-- | M] () -- C:\Users\rai\Documents\247036_171996362860359_100001499904249_452346_5911126_n.jpg
[2011/06/09 22:02:34 | 000,000,000 | -H-- | M] () -- C:\Users\rai\AppData\Local\{200A499A-232A-4DF1-8944-5C2B6A118F1A}
[2011/06/06 23:30:00 | 000,021,925 | -H-- | M] () -- C:\Users\rai\Documents\61489_1427274997217_1093067663_30952567_416746_n.jpg
[2011/06/06 21:21:01 | 000,118,185 | -H-- | M] () -- C:\Users\rai\Documents\Szene-Kurs.pdf
[2011/06/05 23:53:15 | 000,017,817 | -H-- | M] () -- C:\Users\rai\Documents\Deepika - Kopie - Kopie (2) - Kopie - Kopie - Kopie.jpg
[2011/06/05 20:55:58 | 003,615,892 | -H-- | M] () -- C:\Users\rai\Documents\OST_Hanna_-_Container_Park_Chemical_Bros__.mp3
[2011/06/05 15:32:28 | 000,022,663 | -H-- | M] () -- C:\Users\rai\Documents\68205_1526538678747_1093067663_31117010_8271306_n.jpg
[2011/06/05 15:29:43 | 000,010,965 | -H-- | M] () -- C:\Users\rai\Documents\165762_1526534278637_1093067663_31116999_6904840_n.jpg
[2011/06/05 15:29:02 | 000,055,928 | -H-- | M] () -- C:\Users\rai\Documents\7034_133327803817_554748817_2397083_2833397_n.jpg
[2011/06/05 15:25:32 | 000,075,685 | -H-- | M] () -- C:\Users\rai\Documents\68205_1526538678747_1093067663_31117010_8271306_n - Kopie.jpg
[2011/06/05 15:23:54 | 000,014,164 | -H-- | M] () -- C:\Users\rai\Documents\181995_33411753817_554748817_929269_7884239_n.jpg
[2011/06/05 14:21:04 | 000,039,869 | -H-- | M] () -- C:\Users\rai\Documents\168454_1549005760410_1093067663_31168755_5488634_n.jpg
[2011/06/05 14:19:31 | 000,064,885 | -H-- | M] () -- C:\Users\rai\Documents\164352_1549000080268_1093067663_31168721_2091760_n.jpg
[2011/06/05 14:18:23 | 000,040,514 | -H-- | M] () -- C:\Users\rai\Documents\65486_1526526238436_1093067663_31116966_5286005_n.jpg
[2011/06/05 14:13:21 | 000,086,479 | -H-- | M] () -- C:\Users\rai\Documents\26297_1237541133989_1093067663_30543810_7979447_n.jpg
[2011/06/05 11:08:44 | 000,000,000 | -H-- | M] () -- C:\Users\rai\AppData\Local\{8E9E6EE2-D327-42BA-86FA-6F07DCEAAA08}
[4 C:\Users\rai\AppData\Local\*.tmp files -> C:\Users\rai\AppData\Local\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
[1 C:\Users\rai\AppData\Roaming\*.tmp files -> C:\Users\rai\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011/06/30 18:34:28 | 000,009,487 | ---- | C] () -- C:\Users\rai\Documents\267566_10150250517364940_7805409939_7109628_7949230_s.jpg
[2011/06/28 17:31:28 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/25 10:02:07 | 000,000,000 | ---- | C] () -- C:\Users\rai\AppData\Local\{9E02C3BE-344B-4FFB-9E09-602CD6B087CD}
[2011/06/24 14:27:15 | 000,003,589 | ---- | C] () -- C:\windows\System32\jsaddons.ini
[2011/06/24 00:07:45 | 000,073,728 | ---- | C] () -- C:\windows\System32\zlib1.dll
[2011/06/23 19:44:55 | 000,030,393 | ---- | C] () -- C:\Users\rai\Documents\254529_1805511572895_1093067663_31510402_5864814_n.jpg
[2011/06/23 09:18:23 | 237,375,097 | ---- | C] () -- C:\windows\MEMORY.DMP
[2011/06/21 22:56:13 | 000,096,187 | ---- | C] () -- C:\Users\rai\Documents\249464_207123672656310_100000760352992_471385_2137741_n.jpg
[2011/06/20 17:06:54 | 000,000,000 | ---- | C] () -- C:\Users\rai\AppData\Local\{CCB2B7B9-5421-43EC-8F04-48CCA8BAD627}
[2011/06/20 17:02:29 | 000,000,000 | ---- | C] () -- C:\Users\rai\AppData\Local\{349E8643-AC12-4668-9AE4-385FE5B30EFA}
[2011/06/18 22:50:18 | 000,000,000 | ---- | C] () -- C:\Users\rai\AppData\Local\{27E7AFC2-2056-4E6C-8A3E-5534EEE94F54}
[2011/06/17 22:10:58 | 000,020,311 | -H-- | C] () -- C:\Users\rai\Documents\29444392.jpg
[2011/06/15 11:58:28 | 000,001,284 | -H-- | C] () -- C:\Users\rai\Desktop\PC Inspector File Recovery.lnk
[2011/06/15 11:58:04 | 003,462,033 | -H-- | C] () -- C:\Users\rai\Documents\pci_filerecovery.exe
[2011/06/15 10:47:24 | 000,000,152 | -H-- | C] () -- C:\ProgramData\~27057912r
[2011/06/15 10:47:24 | 000,000,128 | -H-- | C] () -- C:\ProgramData\~27057912
[2011/06/15 10:47:23 | 000,000,633 | -H-- | C] () -- C:\Users\rai\Desktop\Windows 7 Restore.lnk
[2011/06/15 10:47:20 | 000,000,392 | -H-- | C] () -- C:\ProgramData\27057912
[2011/06/14 22:36:19 | 000,178,750 | -H-- | C] () -- C:\Users\rai\Documents\Foto371.jpg
[2011/06/14 13:46:20 | 000,068,276 | -H-- | C] () -- C:\Users\rai\Documents\ostsee.jpg
[2011/06/14 11:56:29 | 000,046,662 | -H-- | C] () -- C:\Users\rai\Documents\deepika061111.pdf
[2011/06/13 18:47:28 | 000,086,014 | -H-- | C] () -- C:\Users\rai\Documents\247028_1805452651422_1093067663_31510173_660445_n.jpg
[2011/06/13 12:48:58 | 000,063,243 | -H-- | C] () -- C:\Users\rai\Documents\247241_1805529653347_1093067663_31510421_6177808_n.jpg
[2011/06/13 12:44:56 | 000,057,985 | -H-- | C] () -- C:\Users\rai\Documents\255691_1805487932304_1093067663_31510317_2832650_n.jpg
[2011/06/13 12:42:10 | 000,114,329 | -H-- | C] () -- C:\Users\rai\Documents\Guten Morgen Berlin.jpg
[2011/06/10 12:14:43 | 003,090,518 | -H-- | C] () -- C:\Users\rai\Documents\Alexandra_Stan_-_Mr._Saxo_Beat_lyrics.mp3
[2011/06/10 01:42:29 | 000,108,860 | -H-- | C] () -- C:\Users\rai\Documents\das richtige Bild.jpg
[2011/06/10 01:31:36 | 000,114,443 | -H-- | C] () -- C:\Users\rai\Documents\Eine Zugfahrt die ist... nun ja anders !.jpg
[2011/06/10 01:26:54 | 000,077,035 | -H-- | C] () -- C:\Users\rai\Documents\249272_10150608301755858_758305857_18923591_5096154_n.jpg
[2011/06/10 01:22:24 | 000,090,121 | -H-- | C] () -- C:\Users\rai\Documents\251702_172001396193189_100001499904249_452483_4061762_n - Kopie (2).jpg
[2011/06/10 00:08:14 | 000,116,373 | -H-- | C] () -- C:\Users\rai\Documents\246663_171998719526790_100001499904249_452418_6352249_n.jpg
[2011/06/10 00:07:18 | 000,150,556 | -H-- | C] () -- C:\Users\rai\Documents\253500_171998642860131_100001499904249_452413_2636837_n.jpg
[2011/06/10 00:07:02 | 000,092,886 | -H-- | C] () -- C:\Users\rai\Documents\248993_171998486193480_100001499904249_452410_4837368_n.jpg
[2011/06/10 00:06:13 | 000,096,233 | -H-- | C] () -- C:\Users\rai\Documents\253822_171998412860154_100001499904249_452408_7346243_n.jpg
[2011/06/09 23:58:38 | 000,101,341 | -H-- | C] () -- C:\Users\rai\Documents\248915_171996939526968_100001499904249_452364_1974396_n.jpg
[2011/06/09 23:58:32 | 000,095,441 | -H-- | C] () -- C:\Users\rai\Documents\253862_171996886193640_100001499904249_452363_7360527_n.jpg
[2011/06/09 23:58:25 | 000,149,923 | -H-- | C] () -- C:\Users\rai\Documents\254551_171996819526980_100001499904249_452362_3463874_n.jpg
[2011/06/09 23:58:18 | 000,135,691 | -H-- | C] () -- C:\Users\rai\Documents\248413_171996786193650_100001499904249_452361_6024836_n.jpg
[2011/06/09 23:58:10 | 000,143,779 | -H-- | C] () -- C:\Users\rai\Documents\251255_171996749526987_100001499904249_452360_3782341_n.jpg
[2011/06/09 23:58:02 | 000,143,814 | -H-- | C] () -- C:\Users\rai\Documents\251675_171996726193656_100001499904249_452359_4176518_n.jpg
[2011/06/09 23:57:51 | 000,081,088 | -H-- | C] () -- C:\Users\rai\Documents\254150_171996676193661_100001499904249_452358_4447810_n.jpg
[2011/06/09 23:57:32 | 000,079,762 | -H-- | C] () -- C:\Users\rai\Documents\247353_171996616193667_100001499904249_452357_4628715_n.jpg
[2011/06/09 23:57:24 | 000,083,753 | -H-- | C] () -- C:\Users\rai\Documents\249543_171996589527003_100001499904249_452356_6543620_n.jpg
[2011/06/09 23:57:15 | 000,076,384 | -H-- | C] () -- C:\Users\rai\Documents\246922_171996566193672_100001499904249_452355_8238187_n.jpg
[2011/06/09 23:57:06 | 000,098,462 | -H-- | C] () -- C:\Users\rai\Documents\246643_171996532860342_100001499904249_452353_3318879_n.jpg
[2011/06/09 23:56:51 | 000,097,657 | -H-- | C] () -- C:\Users\rai\Documents\247073_171996479527014_100001499904249_452352_7212322_n.jpg
[2011/06/09 23:56:36 | 000,097,691 | -H-- | C] () -- C:\Users\rai\Documents\247036_171996362860359_100001499904249_452346_5911126_n.jpg
[2011/06/09 22:02:19 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{200A499A-232A-4DF1-8944-5C2B6A118F1A}
[2011/06/06 23:32:13 | 000,017,817 | -H-- | C] () -- C:\Users\rai\Documents\Deepika - Kopie - Kopie (2) - Kopie - Kopie - Kopie.jpg
[2011/06/06 21:21:01 | 000,118,185 | -H-- | C] () -- C:\Users\rai\Documents\Szene-Kurs.pdf
[2011/06/06 20:05:55 | 005,992,658 | -H-- | C] () -- C:\Users\rai\Documents\SAM_1353.JPG
[2011/06/05 20:55:08 | 003,615,892 | -H-- | C] () -- C:\Users\rai\Documents\OST_Hanna_-_Container_Park_Chemical_Bros__.mp3
[2011/06/05 15:29:02 | 000,055,928 | -H-- | C] () -- C:\Users\rai\Documents\7034_133327803817_554748817_2397083_2833397_n.jpg
[2011/06/05 15:28:40 | 000,010,965 | -H-- | C] () -- C:\Users\rai\Documents\165762_1526534278637_1093067663_31116999_6904840_n.jpg
[2011/06/05 15:26:10 | 000,075,685 | -H-- | C] () -- C:\Users\rai\Documents\68205_1526538678747_1093067663_31117010_8271306_n - Kopie.jpg
[2011/06/05 15:25:30 | 000,022,663 | -H-- | C] () -- C:\Users\rai\Documents\68205_1526538678747_1093067663_31117010_8271306_n.jpg
[2011/06/05 15:21:34 | 000,014,164 | -H-- | C] () -- C:\Users\rai\Documents\181995_33411753817_554748817_929269_7884239_n.jpg
[2011/06/05 14:21:03 | 000,039,869 | -H-- | C] () -- C:\Users\rai\Documents\168454_1549005760410_1093067663_31168755_5488634_n.jpg
[2011/06/05 14:19:28 | 000,064,885 | -H-- | C] () -- C:\Users\rai\Documents\164352_1549000080268_1093067663_31168721_2091760_n.jpg
[2011/06/05 14:15:29 | 000,040,514 | -H-- | C] () -- C:\Users\rai\Documents\65486_1526526238436_1093067663_31116966_5286005_n.jpg
[2011/06/05 14:12:30 | 000,086,479 | -H-- | C] () -- C:\Users\rai\Documents\26297_1237541133989_1093067663_30543810_7979447_n.jpg
[2011/06/05 11:06:44 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{8E9E6EE2-D327-42BA-86FA-6F07DCEAAA08}
[2011/05/31 15:23:11 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{4914D555-91E9-4333-81B6-E4C858D598C4}
[2011/05/29 12:44:29 | 000,000,011 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\urhtps.dat
[2011/05/26 13:15:27 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\.NANotifyHere
[2011/05/19 16:00:17 | 000,000,724 | ---- | C] () -- C:\windows\wacam.ini
[2011/05/19 16:00:16 | 000,169,720 | ---- | C] () -- C:\windows\System32\MMPlugHostCtrl.dll
[2011/05/05 15:29:12 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{63A774A9-58AA-419B-BF0C-971ABC1EA064}
[2011/05/01 16:33:24 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{A8380BC7-4C4D-4AEB-9A1C-C49BE66755BC}
[2011/03/30 21:42:07 | 000,000,120 | -H-- | C] () -- C:\Users\rai\AppData\Local\Jyiqobituyi.dat
[2011/03/30 21:42:07 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\Qkoyocigezori.bin
[2010/12/14 00:06:48 | 000,000,235 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\devices.xml
[2010/12/14 00:06:48 | 000,000,012 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\settings.xml
[2010/12/13 23:51:38 | 000,020,458 | ---- | C] () -- C:\windows\hpoins01.dat.temp
[2010/12/13 23:51:38 | 000,016,622 | ---- | C] () -- C:\windows\hpomdl01.dat.temp
[2010/10/13 10:09:40 | 000,000,812 | ---- | C] () -- C:\windows\System32\drivers\scdskr01.dat
[2010/10/13 10:09:40 | 000,000,541 | ---- | C] () -- C:\windows\System32\drivers\scdhkr01.dat
[2010/10/13 10:09:40 | 000,000,500 | ---- | C] () -- C:\windows\System32\drivers\RSTable.dat
[2010/10/13 10:09:40 | 000,000,036 | ---- | C] () -- C:\windows\System32\drivers\scdstr01.dat
[2010/09/17 18:37:50 | 000,110,592 | ---- | C] () -- C:\windows\System32\FsUsbExDevice.Dll
[2010/09/17 18:37:50 | 000,036,608 | ---- | C] () -- C:\windows\System32\FsUsbExDisk.Sys
[2010/09/17 18:37:42 | 000,002,528 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\$_hpcst$.hpc
[2010/09/15 14:19:07 | 000,016,622 | ---- | C] () -- C:\windows\hpomdl01.dat
[2010/08/25 20:30:02 | 000,439,308 | ---- | C] () -- C:\windows\System32\igcompkrng500.bin
[2010/08/25 20:30:00 | 000,982,240 | ---- | C] () -- C:\windows\System32\igkrng500.bin
[2010/08/25 20:30:00 | 000,092,356 | ---- | C] () -- C:\windows\System32\igfcg500m.bin
[2010/08/25 19:57:00 | 000,000,151 | ---- | C] () -- C:\windows\System32\GfxUI.exe.config
[2010/08/25 19:52:00 | 000,208,896 | ---- | C] () -- C:\windows\System32\iglhsip32.dll
[2010/08/25 19:52:00 | 000,143,360 | ---- | C] () -- C:\windows\System32\iglhcp32.dll
[2010/08/18 17:53:31 | 000,000,002 | ---- | C] () -- C:\windows\HotFixList.ini
[2010/08/18 17:38:22 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2009/12/05 22:22:03 | 002,285,048 | ---- | C] () -- C:\windows\System32\perfh007.dat
[2009/12/05 22:22:03 | 000,650,156 | ---- | C] () -- C:\windows\System32\perfc007.dat
[2009/12/05 22:22:03 | 000,295,922 | ---- | C] () -- C:\windows\System32\perfi007.dat
[2009/12/05 22:22:03 | 000,038,104 | ---- | C] () -- C:\windows\System32\perfd007.dat
[2009/12/05 22:01:49 | 000,004,608 | ---- | C] () -- C:\windows\System32\HdmiCoin.dll
[2009/12/05 22:01:47 | 000,134,592 | ---- | C] () -- C:\windows\System32\igfcg500.bin
[2009/12/05 05:17:31 | 000,307,200 | ---- | C] () -- C:\windows\SetDisplayResolution.exe
[2009/07/14 06:57:37 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat
[2009/07/14 06:33:53 | 000,350,312 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT
[2009/07/14 04:05:48 | 001,131,250 | ---- | C] () -- C:\windows\System32\perfh009.dat
[2009/07/14 04:05:48 | 000,576,210 | ---- | C] () -- C:\windows\System32\perfc009.dat
[2009/07/14 04:05:48 | 000,291,294 | ---- | C] () -- C:\windows\System32\perfi009.dat
[2009/07/14 04:05:48 | 000,031,548 | ---- | C] () -- C:\windows\System32\perfd009.dat
[2009/07/14 04:05:05 | 000,000,741 | ---- | C] () -- C:\windows\System32\NOISE.DAT
[2009/07/14 04:04:11 | 000,215,943 | ---- | C] () -- C:\windows\System32\dssec.dat
[2009/07/14 01:55:01 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin
[2009/07/14 01:51:43 | 000,073,728 | ---- | C] () -- C:\windows\System32\BthpanContextHandler.dll
[2009/07/14 01:42:10 | 000,064,000 | ---- | C] () -- C:\windows\System32\BWContextHandler.dll
[2009/06/10 23:26:10 | 000,673,088 | ---- | C] () -- C:\windows\System32\mlang.dat
[2009/05/01 16:24:14 | 000,000,184 | ---- | C] () -- C:\windows\System32\drivers\osdauth.dat
[2009/05/01 15:41:06 | 000,000,020 | ---- | C] () -- C:\windows\System32\drivers\OSDSig.dat
[2007/10/25 17:26:10 | 000,005,632 | ---- | C] () -- C:\windows\System32\drivers\StarOpen.sys
[2003/04/06 06:33:26 | 000,020,458 | ---- | C] () -- C:\windows\hpoins01.dat
 
========== LOP Check ==========
 
[2011/05/31 08:34:07 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5015
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5016
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5017
[2011/06/23 22:31:52 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Akpoo
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Audacity
[2011/06/27 22:59:13 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Duebog
[2011/01/31 17:02:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\DVDVideoSoftIEHelpers
[2011/06/19 12:00:44 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Futo
[2011/07/03 20:13:39 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Gaixe
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Guwy
[2011/05/28 20:07:22 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\kock
[2011/06/28 18:39:17 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Kofui
[2011/06/28 19:23:29 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Ogtuo
[2010/09/17 18:59:43 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\PC Suite
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Pylo
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Reeqe
[2011/06/16 07:33:59 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Samsung
[2011/06/16 07:35:44 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Thunderbird
[2011/05/26 14:34:14 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\TuneUp Software
[2011/07/03 18:48:27 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Tyka
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Vodu
[2011/06/22 14:36:00 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Wuyco
[2011/06/20 19:00:55 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Xafape
[2011/05/28 20:07:23 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\xmldm
[2011/06/28 19:23:30 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Xoofka
[2011/06/14 22:09:22 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Ynwi
[2011/06/28 19:23:29 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Ysymyp
[2011/06/23 14:15:11 | 000,032,632 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011/05/31 08:34:07 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5015
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5016
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5017
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Adobe
[2011/06/23 22:31:52 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Akpoo
[2010/12/26 13:23:33 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Apple Computer
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Audacity
[2010/09/17 20:00:38 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Avira
[2011/05/19 00:34:42 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\CyberLink
[2011/05/06 01:19:26 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\DivX
[2011/06/27 22:59:13 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Duebog
[2011/01/31 17:02:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\DVDVideoSoftIEHelpers
[2011/06/19 12:00:44 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Futo
[2011/07/03 20:13:39 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Gaixe
[2010/09/12 14:07:05 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Google
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Guwy
[2010/12/14 00:23:17 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Hewlett-Packard
[2010/12/23 15:41:14 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\HpUpdate
[2010/08/18 17:55:13 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Identities
[2011/05/28 20:07:22 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\kock
[2011/06/28 18:39:17 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Kofui
[2010/09/12 14:08:04 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Macromedia
[2011/06/28 17:31:34 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Malwarebytes
[2009/12/05 22:11:14 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Media Center Programs
[2011/06/16 07:35:41 | 000,000,000 | --SD | M] -- C:\Users\rai\AppData\Roaming\Microsoft
[2011/06/16 07:33:56 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Mozilla
[2011/05/26 13:16:17 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Nero
[2011/06/28 19:23:29 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Ogtuo
[2010/09/17 18:59:43 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\PC Suite
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Pylo
[2011/06/16 07:35:44 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Real
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Reeqe
[2011/06/16 07:33:59 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Samsung
[2011/06/16 07:35:44 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Thunderbird
[2011/05/26 14:34:14 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\TuneUp Software
[2011/07/03 18:48:27 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Tyka
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Vodu
[2011/06/22 14:36:00 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Wuyco
[2011/06/20 19:00:55 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Xafape
[2011/05/28 20:07:23 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\xmldm
[2011/06/28 19:23:30 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Xoofka
[2011/06/14 22:09:22 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Ynwi
[2011/06/28 19:23:29 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Ysymyp
 
< %APPDATA%\*.exe /s >
[2010/09/17 18:54:12 | 089,280,248 | -H-- | M] (Samsung Electronics Co., Ltd.                                ) -- C:\Users\rai\AppData\Roaming\Samsung\New PC Studio\LiveUpdate\Setup_For_Full_Update_IH2_7.exe
[2010/11/19 15:03:57 | 142,480,808 | -H-- | M] (Samsung Electronics Co., Ltd.                                ) -- C:\Users\rai\AppData\Roaming\Samsung\New PC Studio\LiveUpdate\Setup_Full_Update_NPS2_10064_2.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2007/05/17 14:34:04 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\CyberLink\PowerDirector\EventLog.dll
 
< MD5 for: IASTOR.SYS  >
[2009/10/13 04:09:36 | 000,331,288 | ---- | M] (Intel Corporation) MD5=0BAA4115DFFFD6A6D809A89D65E1281A -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009/10/13 04:09:36 | 000,331,288 | ---- | M] (Intel Corporation) MD5=0BAA4115DFFFD6A6D809A89D65E1281A -- C:\Windows\System32\drivers\iaStor.sys
[2009/10/13 04:09:36 | 000,331,288 | ---- | M] (Intel Corporation) MD5=0BAA4115DFFFD6A6D809A89D65E1281A -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_3f3653f13a033ed4\iaStor.sys
[2009/10/13 04:16:40 | 000,409,624 | ---- | M] (Intel Corporation) MD5=BE7D72FCF442C26975942007E0831241 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2011/03/11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0033117673c16921\iaStorV.sys
[2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011/03/11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010/11/20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011/03/11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010/11/20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011/03/11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\drivers\nvstor.sys
[2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_38e464dbe521cc7f\nvstor.sys
[2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011/03/11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011/03/11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010/11/20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010/11/20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009/07/14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll
[2009/07/14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010/11/20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009/07/14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:A42A9F39
@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:E1F04E8D

< End of report >
         

--- --- ---

(Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

Überleg dir gut, ob du in Zukunft weiterhin bei AntiVir bleiben willst. Die haben eine sehr fragwürdige Entscheidung getroffen, was nicht gerade seriös wirkt => http://www.trojaner-board.de/100374-...e-und-ask.html

O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (MessengerPlusLive Germany TB Toolbar) - {76aeea42-e04a-4b62-83ab-df4b2be2541e} - C:\Program Files\MessengerPlusLive_Germany_TB\tbMess.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)

Hm, was willst du mit diesen komischen Toolbars auf dem Rechner? Am besten alles entfernen wo Toolbar steht, was in der Systemsteuerung unter Software bzw. Programme und Funktionen zu sehen ist und bei zukünftigen Programminstallation immer die benutzerdefinierte Methode anklicken, damit man bei der Installation mögliche Toolbars abwählen kann.
Deinstalliere bei der Gelegenheit auch alle anderen unnötigen Programme über die Systemsteuerung.

Ich habe nun die Toolbars alle deinstalliert. Absichtlich habe ich die nicht installiert. Nächstes Mal werde ich die benutzerdefinierte Installationsmethode wählen.
Ich habe auch die unnötigen Programme deinstalliert.

Ich wusste nichts von der Zusammenarbeit von AntiVir und Ask. Eigentlich dachte ich, dass dieses Antivirenprogramm recht zuverlässig ist.
Welches Antivirusprogramm würdet ihr mir empfehlen?

Welches Antivirusprogramm würdet ihr mir empfehlen?

Wird im verlinkten Diskussionstrang auch behandelt, da ist die Rede von MSE oder Avast.
Mach bitte ein neues CustomLog mit OTL.

Soll ich das CustomLog mit genau demselben Textinhalt machen wie du bereits beschrieben hast?

Ja einfach ein neues genau wie vorher machen.

Das ist das Ergebnis:OTL Logfile:

OTL logfile created on: 7/4/2011 1:50:54 PM - Run 3
OTL by OldTimer - Version 3.2.25.0     Folder = C:\Users\rai\Desktop
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.96 Gb Total Physical Memory | 1.40 Gb Available Physical Memory | 71.43% Memory free
3.92 Gb Paging File | 3.00 Gb Available in Paging File | 76.39% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 76.22 Gb Total Space | 30.91 Gb Free Space | 40.55% Space Free | Partition Type: NTFS
Drive D: | 141.56 Gb Total Space | 33.60 Gb Free Space | 23.73% Space Free | Partition Type: NTFS
 
Computer Name: RAI-PC | User Name: rai | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011/07/03 23:03:49 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Desktop\OTL.exe
PRC - [2011/05/25 23:14:14 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/04/22 19:04:20 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/03/30 19:49:44 | 000,671,552 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2011/03/30 19:48:00 | 001,523,008 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2011/03/11 01:13:12 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011/02/26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/09/17 18:55:04 | 000,102,400 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Update\NASvc.exe
PRC - [2010/04/20 14:26:44 | 000,300,912 | ---- | M] () -- C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe
PRC - [2010/01/14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/11/04 06:11:48 | 000,835,072 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2009/10/26 13:53:14 | 000,091,136 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
PRC - [2009/10/20 11:12:58 | 000,013,312 | ---- | M] (DoctorSoft) -- C:\Program Files\AnyPC Client\APLangApp.exe
PRC - [2009/10/13 12:03:04 | 000,716,800 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
PRC - [2009/10/07 03:31:56 | 002,246,144 | ---- | M] (SEC) -- C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
PRC - [2009/09/09 10:20:51 | 000,009,728 | ---- | M] () -- C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeLauncher.exe
PRC - [2009/07/14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/07/14 03:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2009/06/03 13:59:02 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2009/04/15 16:52:06 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
PRC - [2009/03/31 09:39:36 | 000,233,472 | ---- | M] (Teruten) -- C:\Windows\System32\FsUsbExService.Exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011/07/03 23:03:49 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Desktop\OTL.exe
MOD - [2010/08/21 07:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011/05/25 23:14:14 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/04/22 19:04:20 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/03/30 19:48:00 | 001,523,008 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011/03/30 19:45:32 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/01/15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2009/03/31 09:39:36 | 000,233,472 | ---- | M] (Teruten) [Auto | Running] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2011/04/22 19:04:20 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/03/11 01:13:12 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/02/10 11:22:58 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2009/11/06 22:53:58 | 001,227,776 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/09/28 11:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/07/14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/07/10 15:44:52 | 000,122,880 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV - [2009/05/11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/05/01 15:41:06 | 000,384,896 | ---- | M] (Phoenix Technologies Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CryptOSD.sys -- (CryptOSD)
DRV - [2009/03/31 09:39:36 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2009/03/20 10:01:26 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdm.sys -- (ss_bmdm)
DRV - [2009/03/20 10:01:26 | 000,090,112 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM)
DRV - [2009/03/20 10:01:26 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter)
DRV - [2007/07/03 16:58:20 | 000,106,792 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2007/07/03 16:57:24 | 000,011,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2007/07/03 16:54:24 | 000,080,552 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=1e754307000000000000b482fe6bf288&tlver=1.4.19.19&affID=17159
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Ask.com Deutschland - die andere Suchmaschine
IE - HKCU\..\URLSearchHook: {76aeea42-e04a-4b62-83ab-df4b2be2541e} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "softonic-de3 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: {76aeea42-e04a-4b62-83ab-df4b2be2541e}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..extensions.enabledItems: {f4e6547e-325b-403c-a3bb-ad29ed37a92f}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2
FF - prefs.js..extensions.enabledItems: {39A08BE0-F3F7-4366-B319-8CCAD7DB14CC}:1.9.1
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?babsrc=toolbar2&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/06/16 07:35:36 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/06/25 09:30:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/19 16:00:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/03/18 22:47:23 | 000,000,000 | ---D | M]
 
[2011/01/11 01:56:34 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\rai\AppData\Roaming\mozilla\Extensions
[2011/01/11 01:56:34 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\rai\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/07/04 11:53:58 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions
[2011/06/25 22:01:25 | 000,000,000 | ---D | M] (MessengerPlusLive Germany TB Community Toolbar) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{76aeea42-e04a-4b62-83ab-df4b2be2541e}
[2011/06/25 22:01:28 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2011/06/16 07:35:43 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/06/25 22:01:31 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
[2011/06/25 22:01:34 | 000,000,000 | ---D | M] (SearchElf 1.2 Community Toolbar) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}
[2011/06/16 07:35:43 | 000,000,000 | -H-D | M] (Conduit Engine) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\engine@conduit.com
[2011/06/16 07:35:43 | 000,000,000 | -H-D | M] (vShare Plugin) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\vshare@toolbar
[2011/05/26 13:16:46 | 000,002,253 | -H-- | M] () -- C:\Users\rai\AppData\Roaming\Mozilla\Firefox\Profiles\8bhp6291.default\searchplugins\askcom.xml
[2010/12/08 16:47:52 | 000,000,927 | -H-- | M] () -- C:\Users\rai\AppData\Roaming\Mozilla\Firefox\Profiles\8bhp6291.default\searchplugins\conduit.xml
[2010/10/30 13:47:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2010/10/30 13:47:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
File not found (No name found) -- 
[2011/06/19 14:54:52 | 000,000,000 | ---D | M] (XULRunner) -- C:\USERS\RAI\APPDATA\LOCAL\{39A08BE0-F3F7-4366-B319-8CCAD7DB14CC}
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] (Java String Helper) -- C:\USERS\RAI\APPDATA\ROAMING\5017
() (No name found) -- C:\USERS\RAI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8BHP6291.DEFAULT\EXTENSIONS\FFXTLBR@BABYLON.COM.XPI
[2011/06/25 09:30:32 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/10/30 13:47:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/06/23 13:34:24 | 002,156,280 | ---- | M] (Myriad Software.) -- C:\Program Files\mozilla firefox\plugins\NPMyrMus.dll
[2011/05/11 17:03:09 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/05/23 17:40:29 | 000,002,423 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2011/05/11 17:03:09 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/05/11 17:03:10 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011/05/11 17:03:10 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/05/11 17:03:10 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/05/11 17:03:10 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
Hosts file not found
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {76AEEA42-E04A-4B62-83AB-DF4B2BE2541E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [APLangApp] C:\Program Files\AnyPC Client\APLangApp.exe (DoctorSoft)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [fsi] C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeLauncher.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [{989A9B0D-2FD6-841C-8CFC-BD2A86913978}]  File not found
O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Free YouTube Download - C:\Users\rai\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation)
O12 - Plugin for: .mu3 - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .mus - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .mxl - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .mya - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .myr - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .myt - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .xmz - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: hotmail.com ([]* in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: live.com ([]* in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: msn.com ([]* in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: passport.com ([]* in Vertrauenswürdige Sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{8f591401-766c-11e0-a156-0024542a71d7}\Shell - "" = AutoRun
O33 - MountPoints2\{8f591401-766c-11e0-a156-0024542a71d7}\Shell\AutoRun\command - "" = F:\iStudio.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/07/04 11:51:34 | 000,000,000 | ---D | C] -- C:\Program Files\ConduitEngine
[2011/07/04 11:51:30 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Local\Conduit
[2011/07/03 23:03:46 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\rai\Desktop\OTL.exe
[2011/07/03 23:02:56 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\rai\Documents\OTL(2).exe
[2011/06/29 11:50:47 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Tyka
[2011/06/29 11:50:46 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Gaixe
[2011/06/28 17:31:34 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Malwarebytes
[2011/06/28 17:31:28 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys
[2011/06/28 17:31:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/28 17:31:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/06/28 17:31:24 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2011/06/28 17:31:24 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/06/28 17:30:29 | 009,435,312 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\rai\Documents\mbam-setup-1.51.0.1200.exe
[2011/06/24 00:07:45 | 001,064,960 | ---- | C] (The OpenSSL Project, OpenSSL: The Open Source toolkit for SSL/TLS) -- C:\windows\System32\libeay32.dll
[2011/06/24 00:07:45 | 000,200,704 | ---- | C] (The OpenSSL Project, OpenSSL: The Open Source toolkit for SSL/TLS) -- C:\windows\System32\ssleay32.dll
[2011/06/24 00:07:45 | 000,176,128 | ---- | C] (The cURL library, cURL and libcurl) -- C:\windows\System32\libcurl.dll
[2011/06/23 22:31:52 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Guwy
[2011/06/23 22:31:52 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Akpoo
[2011/06/23 09:18:34 | 000,000,000 | ---D | C] -- C:\windows\Minidump
[2011/06/22 09:58:28 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Vodu
[2011/06/22 09:58:28 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Kofui
[2011/06/20 19:00:55 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Xafape
[2011/06/20 19:00:55 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Pylo
[2011/06/20 11:45:32 | 000,000,000 | ---D | C] -- C:\windows\Sun
[2011/06/19 14:54:52 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Local\{39A08BE0-F3F7-4366-B319-8CCAD7DB14CC}
[2011/06/19 12:00:44 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Reeqe
[2011/06/19 12:00:44 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Futo
[2011/06/18 17:58:25 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\rai\Documents\OTL(1).exe
[2011/06/15 22:18:49 | 000,580,608 | -H-- | C] (OldTimer Tools) -- C:\Users\rai\Documents\OTL.exe
[2011/06/15 11:58:27 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Convar
[2011/06/15 11:58:27 | 000,000,000 | ---D | C] -- C:\Program Files\Convar
[2011/06/15 10:47:23 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 Restore
[2011/06/14 22:28:23 | 000,000,000 | -H-D | C] -- C:\Users\rai\Desktop\Handy Uploads
[2011/06/14 22:09:22 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Ynwi
[2011/06/14 22:09:22 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Xoofka
[2011/06/13 22:55:17 | 000,000,000 | -H-D | C] -- C:\Users\rai\Documents\Neuer Ordner (2)
[2011/06/13 10:50:02 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Ogtuo
[2011/06/13 10:50:02 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Duebog
[2011/06/10 15:09:19 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\5017
[2011/06/08 22:36:26 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\5016
[2011/06/07 12:32:34 | 000,000,000 | -H-D | C] -- C:\Users\rai\Documents\Bewerbungen Agentur
[2011/06/06 19:00:36 | 000,000,000 | -H-D | C] -- C:\Users\rai\Documents\Neuer Ordner
[2010/08/25 19:59:08 | 000,004,096 | ---- | C] ( ) -- C:\windows\System32\IGFXDEVLib.dll
[4 C:\Users\rai\AppData\Local\*.tmp files -> C:\Users\rai\AppData\Local\*.tmp -> ]
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
[1 C:\Users\rai\AppData\Roaming\*.tmp files -> C:\Users\rai\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011/07/04 13:45:27 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/07/04 13:45:27 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/07/04 13:38:15 | 000,001,088 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/04 13:37:48 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2011/07/04 13:37:42 | 1579,630,592 | -HS- | M] () -- C:\hiberfil.sys
[2011/07/04 12:03:04 | 000,001,092 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/03 23:03:49 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Desktop\OTL.exe
[2011/07/03 23:02:58 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Documents\OTL(2).exe
[2011/07/02 15:29:40 | 002,285,048 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2011/07/02 15:29:40 | 001,131,250 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2011/07/02 15:29:40 | 000,650,156 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2011/07/02 15:29:40 | 000,576,210 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2011/06/30 18:34:33 | 000,009,487 | ---- | M] () -- C:\Users\rai\Documents\267566_10150250517364940_7805409939_7109628_7949230_s.jpg
[2011/06/29 12:13:40 | 000,350,312 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2011/06/28 18:10:25 | 000,000,120 | -H-- | M] () -- C:\Users\rai\AppData\Local\Jyiqobituyi.dat
[2011/06/28 17:31:28 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/28 17:31:01 | 009,435,312 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\rai\Documents\mbam-setup-1.51.0.1200.exe
[2011/06/28 09:17:12 | 000,000,000 | -H-- | M] () -- C:\Users\rai\AppData\Local\Qkoyocigezori.bin
[2011/06/25 10:02:25 | 000,000,000 | ---- | M] () -- C:\Users\rai\AppData\Local\{9E02C3BE-344B-4FFB-9E09-602CD6B087CD}
[2011/06/24 17:40:35 | 000,003,589 | ---- | M] () -- C:\windows\System32\jsaddons.ini
[2011/06/23 19:44:59 | 000,030,393 | ---- | M] () -- C:\Users\rai\Documents\254529_1805511572895_1093067663_31510402_5864814_n.jpg
[2011/06/23 09:18:23 | 237,375,097 | ---- | M] () -- C:\windows\MEMORY.DMP
[2011/06/21 22:57:31 | 000,096,187 | ---- | M] () -- C:\Users\rai\Documents\249464_207123672656310_100000760352992_471385_2137741_n.jpg
[2011/06/20 17:06:54 | 000,000,000 | ---- | M] () -- C:\Users\rai\AppData\Local\{CCB2B7B9-5421-43EC-8F04-48CCA8BAD627}
[2011/06/20 17:02:29 | 000,000,000 | ---- | M] () -- C:\Users\rai\AppData\Local\{349E8643-AC12-4668-9AE4-385FE5B30EFA}
[2011/06/18 22:50:18 | 000,000,000 | ---- | M] () -- C:\Users\rai\AppData\Local\{27E7AFC2-2056-4E6C-8A3E-5534EEE94F54}
[2011/06/18 17:58:39 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Documents\OTL(1).exe
[2011/06/17 22:11:01 | 000,020,311 | -H-- | M] () -- C:\Users\rai\Documents\29444392.jpg
[2011/06/15 22:19:55 | 000,580,608 | -H-- | M] (OldTimer Tools) -- C:\Users\rai\Documents\OTL.exe
[2011/06/15 12:00:33 | 000,001,284 | -H-- | M] () -- C:\Users\rai\Desktop\PC Inspector File Recovery.lnk
[2011/06/15 11:58:08 | 003,462,033 | -H-- | M] () -- C:\Users\rai\Documents\pci_filerecovery.exe
[2011/06/15 11:47:51 | 000,000,392 | -H-- | M] () -- C:\ProgramData\27057912
[2011/06/15 11:45:25 | 000,000,152 | -H-- | M] () -- C:\ProgramData\~27057912r
[2011/06/15 11:45:25 | 000,000,128 | -H-- | M] () -- C:\ProgramData\~27057912
[2011/06/15 10:47:23 | 000,000,633 | -H-- | M] () -- C:\Users\rai\Desktop\Windows 7 Restore.lnk
[2011/06/14 22:33:25 | 000,178,750 | -H-- | M] () -- C:\Users\rai\Documents\Foto371.jpg
[2011/06/14 13:47:40 | 000,068,276 | -H-- | M] () -- C:\Users\rai\Documents\ostsee.jpg
[2011/06/14 11:56:29 | 000,046,662 | -H-- | M] () -- C:\Users\rai\Documents\deepika061111.pdf
[2011/06/13 18:49:15 | 000,086,014 | -H-- | M] () -- C:\Users\rai\Documents\247028_1805452651422_1093067663_31510173_660445_n.jpg
[2011/06/13 12:51:38 | 000,114,329 | -H-- | M] () -- C:\Users\rai\Documents\Guten Morgen Berlin.jpg
[2011/06/13 12:50:09 | 000,063,243 | -H-- | M] () -- C:\Users\rai\Documents\247241_1805529653347_1093067663_31510421_6177808_n.jpg
[2011/06/13 12:44:57 | 000,057,985 | -H-- | M] () -- C:\Users\rai\Documents\255691_1805487932304_1093067663_31510317_2832650_n.jpg
[2011/06/10 19:48:06 | 000,108,860 | -H-- | M] () -- C:\Users\rai\Documents\das richtige Bild.jpg
[2011/06/10 12:15:03 | 003,090,518 | -H-- | M] () -- C:\Users\rai\Documents\Alexandra_Stan_-_Mr._Saxo_Beat_lyrics.mp3
[2011/06/10 01:31:37 | 000,114,443 | -H-- | M] () -- C:\Users\rai\Documents\Eine Zugfahrt die ist... nun ja anders !.jpg
[2011/06/10 01:27:11 | 000,077,035 | -H-- | M] () -- C:\Users\rai\Documents\249272_10150608301755858_758305857_18923591_5096154_n.jpg
[2011/06/10 01:10:01 | 000,090,121 | -H-- | M] () -- C:\Users\rai\Documents\251702_172001396193189_100001499904249_452483_4061762_n - Kopie (2).jpg
[2011/06/10 00:08:35 | 000,116,373 | -H-- | M] () -- C:\Users\rai\Documents\246663_171998719526790_100001499904249_452418_6352249_n.jpg
[2011/06/10 00:08:07 | 000,150,556 | -H-- | M] () -- C:\Users\rai\Documents\253500_171998642860131_100001499904249_452413_2636837_n.jpg
[2011/06/10 00:07:05 | 000,092,886 | -H-- | M] () -- C:\Users\rai\Documents\248993_171998486193480_100001499904249_452410_4837368_n.jpg
[2011/06/10 00:06:21 | 000,096,233 | -H-- | M] () -- C:\Users\rai\Documents\253822_171998412860154_100001499904249_452408_7346243_n.jpg
[2011/06/09 23:58:40 | 000,101,341 | -H-- | M] () -- C:\Users\rai\Documents\248915_171996939526968_100001499904249_452364_1974396_n.jpg
[2011/06/09 23:58:33 | 000,095,441 | -H-- | M] () -- C:\Users\rai\Documents\253862_171996886193640_100001499904249_452363_7360527_n.jpg
[2011/06/09 23:58:26 | 000,149,923 | -H-- | M] () -- C:\Users\rai\Documents\254551_171996819526980_100001499904249_452362_3463874_n.jpg
[2011/06/09 23:58:19 | 000,135,691 | -H-- | M] () -- C:\Users\rai\Documents\248413_171996786193650_100001499904249_452361_6024836_n.jpg
[2011/06/09 23:58:11 | 000,143,779 | -H-- | M] () -- C:\Users\rai\Documents\251255_171996749526987_100001499904249_452360_3782341_n.jpg
[2011/06/09 23:58:03 | 000,143,814 | -H-- | M] () -- C:\Users\rai\Documents\251675_171996726193656_100001499904249_452359_4176518_n.jpg
[2011/06/09 23:57:52 | 000,081,088 | -H-- | M] () -- C:\Users\rai\Documents\254150_171996676193661_100001499904249_452358_4447810_n.jpg
[2011/06/09 23:57:34 | 000,079,762 | -H-- | M] () -- C:\Users\rai\Documents\247353_171996616193667_100001499904249_452357_4628715_n.jpg
[2011/06/09 23:57:26 | 000,083,753 | -H-- | M] () -- C:\Users\rai\Documents\249543_171996589527003_100001499904249_452356_6543620_n.jpg
[2011/06/09 23:57:17 | 000,076,384 | -H-- | M] () -- C:\Users\rai\Documents\246922_171996566193672_100001499904249_452355_8238187_n.jpg
[2011/06/09 23:57:16 | 000,098,462 | -H-- | M] () -- C:\Users\rai\Documents\246643_171996532860342_100001499904249_452353_3318879_n.jpg
[2011/06/09 23:56:56 | 000,097,657 | -H-- | M] () -- C:\Users\rai\Documents\247073_171996479527014_100001499904249_452352_7212322_n.jpg
[2011/06/09 23:56:45 | 000,097,691 | -H-- | M] () -- C:\Users\rai\Documents\247036_171996362860359_100001499904249_452346_5911126_n.jpg
[2011/06/09 22:02:34 | 000,000,000 | -H-- | M] () -- C:\Users\rai\AppData\Local\{200A499A-232A-4DF1-8944-5C2B6A118F1A}
[2011/06/06 23:30:00 | 000,021,925 | -H-- | M] () -- C:\Users\rai\Documents\61489_1427274997217_1093067663_30952567_416746_n.jpg
[2011/06/06 21:21:01 | 000,118,185 | -H-- | M] () -- C:\Users\rai\Documents\Szene-Kurs.pdf
[2011/06/05 23:53:15 | 000,017,817 | -H-- | M] () -- C:\Users\rai\Documents\Deepika - Kopie - Kopie (2) - Kopie - Kopie - Kopie.jpg
[2011/06/05 20:55:58 | 003,615,892 | -H-- | M] () -- C:\Users\rai\Documents\OST_Hanna_-_Container_Park_Chemical_Bros__.mp3
[2011/06/05 15:32:28 | 000,022,663 | -H-- | M] () -- C:\Users\rai\Documents\68205_1526538678747_1093067663_31117010_8271306_n.jpg
[2011/06/05 15:29:43 | 000,010,965 | -H-- | M] () -- C:\Users\rai\Documents\165762_1526534278637_1093067663_31116999_6904840_n.jpg
[2011/06/05 15:29:02 | 000,055,928 | -H-- | M] () -- C:\Users\rai\Documents\7034_133327803817_554748817_2397083_2833397_n.jpg
[2011/06/05 15:25:32 | 000,075,685 | -H-- | M] () -- C:\Users\rai\Documents\68205_1526538678747_1093067663_31117010_8271306_n - Kopie.jpg
[2011/06/05 15:23:54 | 000,014,164 | -H-- | M] () -- C:\Users\rai\Documents\181995_33411753817_554748817_929269_7884239_n.jpg
[2011/06/05 14:21:04 | 000,039,869 | -H-- | M] () -- C:\Users\rai\Documents\168454_1549005760410_1093067663_31168755_5488634_n.jpg
[2011/06/05 14:19:31 | 000,064,885 | -H-- | M] () -- C:\Users\rai\Documents\164352_1549000080268_1093067663_31168721_2091760_n.jpg
[2011/06/05 14:18:23 | 000,040,514 | -H-- | M] () -- C:\Users\rai\Documents\65486_1526526238436_1093067663_31116966_5286005_n.jpg
[2011/06/05 14:13:21 | 000,086,479 | -H-- | M] () -- C:\Users\rai\Documents\26297_1237541133989_1093067663_30543810_7979447_n.jpg
[2011/06/05 11:08:44 | 000,000,000 | -H-- | M] () -- C:\Users\rai\AppData\Local\{8E9E6EE2-D327-42BA-86FA-6F07DCEAAA08}
[4 C:\Users\rai\AppData\Local\*.tmp files -> C:\Users\rai\AppData\Local\*.tmp -> ]
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
[1 C:\Users\rai\AppData\Roaming\*.tmp files -> C:\Users\rai\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011/06/30 18:34:28 | 000,009,487 | ---- | C] () -- C:\Users\rai\Documents\267566_10150250517364940_7805409939_7109628_7949230_s.jpg
[2011/06/28 17:31:28 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/25 10:02:07 | 000,000,000 | ---- | C] () -- C:\Users\rai\AppData\Local\{9E02C3BE-344B-4FFB-9E09-602CD6B087CD}
[2011/06/24 14:27:15 | 000,003,589 | ---- | C] () -- C:\windows\System32\jsaddons.ini
[2011/06/24 00:07:45 | 000,073,728 | ---- | C] () -- C:\windows\System32\zlib1.dll
[2011/06/23 19:44:55 | 000,030,393 | ---- | C] () -- C:\Users\rai\Documents\254529_1805511572895_1093067663_31510402_5864814_n.jpg
[2011/06/23 09:18:23 | 237,375,097 | ---- | C] () -- C:\windows\MEMORY.DMP
[2011/06/21 22:56:13 | 000,096,187 | ---- | C] () -- C:\Users\rai\Documents\249464_207123672656310_100000760352992_471385_2137741_n.jpg
[2011/06/20 17:06:54 | 000,000,000 | ---- | C] () -- C:\Users\rai\AppData\Local\{CCB2B7B9-5421-43EC-8F04-48CCA8BAD627}
[2011/06/20 17:02:29 | 000,000,000 | ---- | C] () -- C:\Users\rai\AppData\Local\{349E8643-AC12-4668-9AE4-385FE5B30EFA}
[2011/06/18 22:50:18 | 000,000,000 | ---- | C] () -- C:\Users\rai\AppData\Local\{27E7AFC2-2056-4E6C-8A3E-5534EEE94F54}
[2011/06/17 22:10:58 | 000,020,311 | -H-- | C] () -- C:\Users\rai\Documents\29444392.jpg
[2011/06/15 11:58:28 | 000,001,284 | -H-- | C] () -- C:\Users\rai\Desktop\PC Inspector File Recovery.lnk
[2011/06/15 11:58:04 | 003,462,033 | -H-- | C] () -- C:\Users\rai\Documents\pci_filerecovery.exe
[2011/06/15 10:47:24 | 000,000,152 | -H-- | C] () -- C:\ProgramData\~27057912r
[2011/06/15 10:47:24 | 000,000,128 | -H-- | C] () -- C:\ProgramData\~27057912
[2011/06/15 10:47:23 | 000,000,633 | -H-- | C] () -- C:\Users\rai\Desktop\Windows 7 Restore.lnk
[2011/06/15 10:47:20 | 000,000,392 | -H-- | C] () -- C:\ProgramData\27057912
[2011/06/14 22:36:19 | 000,178,750 | -H-- | C] () -- C:\Users\rai\Documents\Foto371.jpg
[2011/06/14 13:46:20 | 000,068,276 | -H-- | C] () -- C:\Users\rai\Documents\ostsee.jpg
[2011/06/14 11:56:29 | 000,046,662 | -H-- | C] () -- C:\Users\rai\Documents\deepika061111.pdf
[2011/06/13 18:47:28 | 000,086,014 | -H-- | C] () -- C:\Users\rai\Documents\247028_1805452651422_1093067663_31510173_660445_n.jpg
[2011/06/13 12:48:58 | 000,063,243 | -H-- | C] () -- C:\Users\rai\Documents\247241_1805529653347_1093067663_31510421_6177808_n.jpg
[2011/06/13 12:44:56 | 000,057,985 | -H-- | C] () -- C:\Users\rai\Documents\255691_1805487932304_1093067663_31510317_2832650_n.jpg
[2011/06/13 12:42:10 | 000,114,329 | -H-- | C] () -- C:\Users\rai\Documents\Guten Morgen Berlin.jpg
[2011/06/10 12:14:43 | 003,090,518 | -H-- | C] () -- C:\Users\rai\Documents\Alexandra_Stan_-_Mr._Saxo_Beat_lyrics.mp3
[2011/06/10 01:42:29 | 000,108,860 | -H-- | C] () -- C:\Users\rai\Documents\das richtige Bild.jpg
[2011/06/10 01:31:36 | 000,114,443 | -H-- | C] () -- C:\Users\rai\Documents\Eine Zugfahrt die ist... nun ja anders !.jpg
[2011/06/10 01:26:54 | 000,077,035 | -H-- | C] () -- C:\Users\rai\Documents\249272_10150608301755858_758305857_18923591_5096154_n.jpg
[2011/06/10 01:22:24 | 000,090,121 | -H-- | C] () -- C:\Users\rai\Documents\251702_172001396193189_100001499904249_452483_4061762_n - Kopie (2).jpg
[2011/06/10 00:08:14 | 000,116,373 | -H-- | C] () -- C:\Users\rai\Documents\246663_171998719526790_100001499904249_452418_6352249_n.jpg
[2011/06/10 00:07:18 | 000,150,556 | -H-- | C] () -- C:\Users\rai\Documents\253500_171998642860131_100001499904249_452413_2636837_n.jpg
[2011/06/10 00:07:02 | 000,092,886 | -H-- | C] () -- C:\Users\rai\Documents\248993_171998486193480_100001499904249_452410_4837368_n.jpg
[2011/06/10 00:06:13 | 000,096,233 | -H-- | C] () -- C:\Users\rai\Documents\253822_171998412860154_100001499904249_452408_7346243_n.jpg
[2011/06/09 23:58:38 | 000,101,341 | -H-- | C] () -- C:\Users\rai\Documents\248915_171996939526968_100001499904249_452364_1974396_n.jpg
[2011/06/09 23:58:32 | 000,095,441 | -H-- | C] () -- C:\Users\rai\Documents\253862_171996886193640_100001499904249_452363_7360527_n.jpg
[2011/06/09 23:58:25 | 000,149,923 | -H-- | C] () -- C:\Users\rai\Documents\254551_171996819526980_100001499904249_452362_3463874_n.jpg
[2011/06/09 23:58:18 | 000,135,691 | -H-- | C] () -- C:\Users\rai\Documents\248413_171996786193650_100001499904249_452361_6024836_n.jpg
[2011/06/09 23:58:10 | 000,143,779 | -H-- | C] () -- C:\Users\rai\Documents\251255_171996749526987_100001499904249_452360_3782341_n.jpg
[2011/06/09 23:58:02 | 000,143,814 | -H-- | C] () -- C:\Users\rai\Documents\251675_171996726193656_100001499904249_452359_4176518_n.jpg
[2011/06/09 23:57:51 | 000,081,088 | -H-- | C] () -- C:\Users\rai\Documents\254150_171996676193661_100001499904249_452358_4447810_n.jpg
[2011/06/09 23:57:32 | 000,079,762 | -H-- | C] () -- C:\Users\rai\Documents\247353_171996616193667_100001499904249_452357_4628715_n.jpg
[2011/06/09 23:57:24 | 000,083,753 | -H-- | C] () -- C:\Users\rai\Documents\249543_171996589527003_100001499904249_452356_6543620_n.jpg
[2011/06/09 23:57:15 | 000,076,384 | -H-- | C] () -- C:\Users\rai\Documents\246922_171996566193672_100001499904249_452355_8238187_n.jpg
[2011/06/09 23:57:06 | 000,098,462 | -H-- | C] () -- C:\Users\rai\Documents\246643_171996532860342_100001499904249_452353_3318879_n.jpg
[2011/06/09 23:56:51 | 000,097,657 | -H-- | C] () -- C:\Users\rai\Documents\247073_171996479527014_100001499904249_452352_7212322_n.jpg
[2011/06/09 23:56:36 | 000,097,691 | -H-- | C] () -- C:\Users\rai\Documents\247036_171996362860359_100001499904249_452346_5911126_n.jpg
[2011/06/09 22:02:19 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{200A499A-232A-4DF1-8944-5C2B6A118F1A}
[2011/06/06 23:32:13 | 000,017,817 | -H-- | C] () -- C:\Users\rai\Documents\Deepika - Kopie - Kopie (2) - Kopie - Kopie - Kopie.jpg
[2011/06/06 21:21:01 | 000,118,185 | -H-- | C] () -- C:\Users\rai\Documents\Szene-Kurs.pdf
[2011/06/06 20:05:55 | 005,992,658 | -H-- | C] () -- C:\Users\rai\Documents\SAM_1353.JPG
[2011/06/05 20:55:08 | 003,615,892 | -H-- | C] () -- C:\Users\rai\Documents\OST_Hanna_-_Container_Park_Chemical_Bros__.mp3
[2011/06/05 15:29:02 | 000,055,928 | -H-- | C] () -- C:\Users\rai\Documents\7034_133327803817_554748817_2397083_2833397_n.jpg
[2011/06/05 15:28:40 | 000,010,965 | -H-- | C] () -- C:\Users\rai\Documents\165762_1526534278637_1093067663_31116999_6904840_n.jpg
[2011/06/05 15:26:10 | 000,075,685 | -H-- | C] () -- C:\Users\rai\Documents\68205_1526538678747_1093067663_31117010_8271306_n - Kopie.jpg
[2011/06/05 15:25:30 | 000,022,663 | -H-- | C] () -- C:\Users\rai\Documents\68205_1526538678747_1093067663_31117010_8271306_n.jpg
[2011/06/05 15:21:34 | 000,014,164 | -H-- | C] () -- C:\Users\rai\Documents\181995_33411753817_554748817_929269_7884239_n.jpg
[2011/06/05 14:21:03 | 000,039,869 | -H-- | C] () -- C:\Users\rai\Documents\168454_1549005760410_1093067663_31168755_5488634_n.jpg
[2011/06/05 14:19:28 | 000,064,885 | -H-- | C] () -- C:\Users\rai\Documents\164352_1549000080268_1093067663_31168721_2091760_n.jpg
[2011/06/05 14:15:29 | 000,040,514 | -H-- | C] () -- C:\Users\rai\Documents\65486_1526526238436_1093067663_31116966_5286005_n.jpg
[2011/06/05 14:12:30 | 000,086,479 | -H-- | C] () -- C:\Users\rai\Documents\26297_1237541133989_1093067663_30543810_7979447_n.jpg
[2011/06/05 11:06:44 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{8E9E6EE2-D327-42BA-86FA-6F07DCEAAA08}
[2011/05/31 15:23:11 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{4914D555-91E9-4333-81B6-E4C858D598C4}
[2011/05/29 12:44:29 | 000,000,011 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\urhtps.dat
[2011/05/26 13:15:27 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\.NANotifyHere
[2011/05/19 16:00:17 | 000,000,724 | ---- | C] () -- C:\windows\wacam.ini
[2011/05/19 16:00:16 | 000,169,720 | ---- | C] () -- C:\windows\System32\MMPlugHostCtrl.dll
[2011/05/05 15:29:12 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{63A774A9-58AA-419B-BF0C-971ABC1EA064}
[2011/05/01 16:33:24 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{A8380BC7-4C4D-4AEB-9A1C-C49BE66755BC}
[2011/03/30 21:42:07 | 000,000,120 | -H-- | C] () -- C:\Users\rai\AppData\Local\Jyiqobituyi.dat
[2011/03/30 21:42:07 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\Qkoyocigezori.bin
[2010/12/14 00:06:48 | 000,000,235 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\devices.xml
[2010/12/14 00:06:48 | 000,000,012 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\settings.xml
[2010/12/13 23:51:38 | 000,020,458 | ---- | C] () -- C:\windows\hpoins01.dat.temp
[2010/12/13 23:51:38 | 000,016,622 | ---- | C] () -- C:\windows\hpomdl01.dat.temp
[2010/10/13 10:09:40 | 000,000,812 | ---- | C] () -- C:\windows\System32\drivers\scdskr01.dat
[2010/10/13 10:09:40 | 000,000,541 | ---- | C] () -- C:\windows\System32\drivers\scdhkr01.dat
[2010/10/13 10:09:40 | 000,000,500 | ---- | C] () -- C:\windows\System32\drivers\RSTable.dat
[2010/10/13 10:09:40 | 000,000,036 | ---- | C] () -- C:\windows\System32\drivers\scdstr01.dat
[2010/09/17 18:37:50 | 000,110,592 | ---- | C] () -- C:\windows\System32\FsUsbExDevice.Dll
[2010/09/17 18:37:50 | 000,036,608 | ---- | C] () -- C:\windows\System32\FsUsbExDisk.Sys
[2010/09/17 18:37:42 | 000,002,528 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\$_hpcst$.hpc
[2010/09/15 14:19:07 | 000,016,622 | ---- | C] () -- C:\windows\hpomdl01.dat
[2010/08/25 20:30:02 | 000,439,308 | ---- | C] () -- C:\windows\System32\igcompkrng500.bin
[2010/08/25 20:30:00 | 000,982,240 | ---- | C] () -- C:\windows\System32\igkrng500.bin
[2010/08/25 20:30:00 | 000,092,356 | ---- | C] () -- C:\windows\System32\igfcg500m.bin
[2010/08/25 19:57:00 | 000,000,151 | ---- | C] () -- C:\windows\System32\GfxUI.exe.config
[2010/08/25 19:52:00 | 000,208,896 | ---- | C] () -- C:\windows\System32\iglhsip32.dll
[2010/08/25 19:52:00 | 000,143,360 | ---- | C] () -- C:\windows\System32\iglhcp32.dll
[2010/08/18 17:53:31 | 000,000,002 | ---- | C] () -- C:\windows\HotFixList.ini
[2010/08/18 17:38:22 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2009/12/05 22:22:03 | 002,285,048 | ---- | C] () -- C:\windows\System32\perfh007.dat
[2009/12/05 22:22:03 | 000,650,156 | ---- | C] () -- C:\windows\System32\perfc007.dat
[2009/12/05 22:22:03 | 000,295,922 | ---- | C] () -- C:\windows\System32\perfi007.dat
[2009/12/05 22:22:03 | 000,038,104 | ---- | C] () -- C:\windows\System32\perfd007.dat
[2009/12/05 22:01:49 | 000,004,608 | ---- | C] () -- C:\windows\System32\HdmiCoin.dll
[2009/12/05 22:01:47 | 000,134,592 | ---- | C] () -- C:\windows\System32\igfcg500.bin
[2009/12/05 05:17:31 | 000,307,200 | ---- | C] () -- C:\windows\SetDisplayResolution.exe
[2009/07/14 06:57:37 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat
[2009/07/14 06:33:53 | 000,350,312 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT
[2009/07/14 04:05:48 | 001,131,250 | ---- | C] () -- C:\windows\System32\perfh009.dat
[2009/07/14 04:05:48 | 000,576,210 | ---- | C] () -- C:\windows\System32\perfc009.dat
[2009/07/14 04:05:48 | 000,291,294 | ---- | C] () -- C:\windows\System32\perfi009.dat
[2009/07/14 04:05:48 | 000,031,548 | ---- | C] () -- C:\windows\System32\perfd009.dat
[2009/07/14 04:05:05 | 000,000,741 | ---- | C] () -- C:\windows\System32\NOISE.DAT
[2009/07/14 04:04:11 | 000,215,943 | ---- | C] () -- C:\windows\System32\dssec.dat
[2009/07/14 01:55:01 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin
[2009/07/14 01:51:43 | 000,073,728 | ---- | C] () -- C:\windows\System32\BthpanContextHandler.dll
[2009/07/14 01:42:10 | 000,064,000 | ---- | C] () -- C:\windows\System32\BWContextHandler.dll
[2009/06/10 23:26:10 | 000,673,088 | ---- | C] () -- C:\windows\System32\mlang.dat
[2009/05/01 16:24:14 | 000,000,184 | ---- | C] () -- C:\windows\System32\drivers\osdauth.dat
[2009/05/01 15:41:06 | 000,000,020 | ---- | C] () -- C:\windows\System32\drivers\OSDSig.dat
[2007/10/25 17:26:10 | 000,005,632 | ---- | C] () -- C:\windows\System32\drivers\StarOpen.sys
[2003/04/06 06:33:26 | 000,020,458 | ---- | C] () -- C:\windows\hpoins01.dat
 
========== LOP Check ==========
 
[2011/05/31 08:34:07 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5015
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5016
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5017
[2011/06/23 22:31:52 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Akpoo
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Audacity
[2011/06/27 22:59:13 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Duebog
[2011/01/31 17:02:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\DVDVideoSoftIEHelpers
[2011/06/19 12:00:44 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Futo
[2011/07/03 20:13:39 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Gaixe
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Guwy
[2011/05/28 20:07:22 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\kock
[2011/06/28 18:39:17 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Kofui
[2011/06/28 19:23:29 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Ogtuo
[2010/09/17 18:59:43 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\PC Suite
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Pylo
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Reeqe
[2011/06/16 07:33:59 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Samsung
[2011/06/16 07:35:44 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Thunderbird
[2011/05/26 14:34:14 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\TuneUp Software
[2011/07/03 18:48:27 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Tyka
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Vodu
[2011/06/22 14:36:00 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Wuyco
[2011/06/20 19:00:55 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Xafape
[2011/05/28 20:07:23 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\xmldm
[2011/06/28 19:23:30 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Xoofka
[2011/06/14 22:09:22 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Ynwi
[2011/06/28 19:23:29 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Ysymyp
[2011/06/23 14:15:11 | 000,032,632 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011/05/31 08:34:07 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5015
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5016
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5017
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Adobe
[2011/06/23 22:31:52 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Akpoo
[2010/12/26 13:23:33 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Apple Computer
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Audacity
[2010/09/17 20:00:38 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Avira
[2011/05/19 00:34:42 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\CyberLink
[2011/05/06 01:19:26 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\DivX
[2011/06/27 22:59:13 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Duebog
[2011/01/31 17:02:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\DVDVideoSoftIEHelpers
[2011/06/19 12:00:44 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Futo
[2011/07/03 20:13:39 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Gaixe
[2010/09/12 14:07:05 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Google
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Guwy
[2010/12/14 00:23:17 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Hewlett-Packard
[2010/12/23 15:41:14 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\HpUpdate
[2010/08/18 17:55:13 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Identities
[2011/05/28 20:07:22 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\kock
[2011/06/28 18:39:17 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Kofui
[2010/09/12 14:08:04 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Macromedia
[2011/06/28 17:31:34 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Malwarebytes
[2009/12/05 22:11:14 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Media Center Programs
[2011/06/16 07:35:41 | 000,000,000 | --SD | M] -- C:\Users\rai\AppData\Roaming\Microsoft
[2011/06/16 07:33:56 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Mozilla
[2011/05/26 13:16:17 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Nero
[2011/06/28 19:23:29 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Ogtuo
[2010/09/17 18:59:43 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\PC Suite
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Pylo
[2011/06/16 07:35:44 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Real
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Reeqe
[2011/06/16 07:33:59 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Samsung
[2011/06/16 07:35:44 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Thunderbird
[2011/05/26 14:34:14 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\TuneUp Software
[2011/07/03 18:48:27 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Tyka
[2011/06/28 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Vodu
[2011/06/22 14:36:00 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Wuyco
[2011/06/20 19:00:55 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Xafape
[2011/05/28 20:07:23 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\xmldm
[2011/06/28 19:23:30 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Xoofka
[2011/06/14 22:09:22 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Ynwi
[2011/06/28 19:23:29 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Ysymyp
 
< %APPDATA%\*.exe /s >
[2010/09/17 18:54:12 | 089,280,248 | -H-- | M] (Samsung Electronics Co., Ltd.                                ) -- C:\Users\rai\AppData\Roaming\Samsung\New PC Studio\LiveUpdate\Setup_For_Full_Update_IH2_7.exe
[2010/11/19 15:03:57 | 142,480,808 | -H-- | M] (Samsung Electronics Co., Ltd.                                ) -- C:\Users\rai\AppData\Roaming\Samsung\New PC Studio\LiveUpdate\Setup_Full_Update_NPS2_10064_2.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2007/05/17 14:34:04 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\CyberLink\PowerDirector\EventLog.dll
 
< MD5 for: IASTOR.SYS  >
[2009/10/13 04:09:36 | 000,331,288 | ---- | M] (Intel Corporation) MD5=0BAA4115DFFFD6A6D809A89D65E1281A -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009/10/13 04:09:36 | 000,331,288 | ---- | M] (Intel Corporation) MD5=0BAA4115DFFFD6A6D809A89D65E1281A -- C:\Windows\System32\drivers\iaStor.sys
[2009/10/13 04:09:36 | 000,331,288 | ---- | M] (Intel Corporation) MD5=0BAA4115DFFFD6A6D809A89D65E1281A -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_3f3653f13a033ed4\iaStor.sys
[2009/10/13 04:16:40 | 000,409,624 | ---- | M] (Intel Corporation) MD5=BE7D72FCF442C26975942007E0831241 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2011/03/11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0033117673c16921\iaStorV.sys
[2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011/03/11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010/11/20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011/03/11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010/11/20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011/03/11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\drivers\nvstor.sys
[2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_38e464dbe521cc7f\nvstor.sys
[2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011/03/11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011/03/11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010/11/20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010/11/20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009/07/14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll
[2009/07/14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010/11/20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009/07/14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\windows\system32\*.tmp files -> C:\windows\system32\*.tmp -> ]
 
<           >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:A42A9F39
@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:E1F04E8D

< End of report >
         

--- --- ---

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "softonic-de3 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..keyword.URL: "http://search.babylon.com/?babsrc=toolbar2&q="
[2011/06/25 22:01:28 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2011/06/16 07:35:43 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/06/25 22:01:31 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
[2011/06/25 22:01:34 | 000,000,000 | ---D | M] (SearchElf 1.2 Community Toolbar) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}
[2011/06/16 07:35:43 | 000,000,000 | -H-D | M] (Conduit Engine) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\engine@conduit.com
[2011/06/16 07:35:43 | 000,000,000 | -H-D | M] (vShare Plugin) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\vshare@toolbar
[2011/05/26 13:16:46 | 000,002,253 | -H-- | M] () -- C:\Users\rai\AppData\Roaming\Mozilla\Firefox\Profiles\8bhp6291.default\searchplugins\askcom.xml
[2010/12/08 16:47:52 | 000,000,927 | -H-- | M] () -- C:\Users\rai\AppData\Roaming\Mozilla\Firefox\Profiles\8bhp6291.default\searchplugins\conduit.xml
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {76AEEA42-E04A-4B62-83AB-DF4B2BE2541E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKCU..\Run: [{989A9B0D-2FD6-841C-8CFC-BD2A86913978}]  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{8f591401-766c-11e0-a156-0024542a71d7}\Shell - "" = AutoRun
O33 - MountPoints2\{8f591401-766c-11e0-a156-0024542a71d7}\Shell\AutoRun\command - "" = F:\iStudio.exe
[2011/07/04 11:51:34 | 000,000,000 | ---D | C] -- C:\Program Files\ConduitEngine
[2011/07/04 11:51:30 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Local\Conduit
[2011/06/29 11:50:47 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Tyka
[2011/06/29 11:50:46 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Gaixe
[2011/06/23 22:31:52 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Guwy
[2011/06/23 22:31:52 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Akpoo
[2011/06/22 09:58:28 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Vodu
[2011/06/22 09:58:28 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Kofui
[2011/06/20 19:00:55 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Xafape
[2011/06/20 19:00:55 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Pylo
[2011/06/19 12:00:44 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Reeqe
[2011/06/19 12:00:44 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Futo
[2011/06/15 11:58:27 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Convar
[2011/06/15 11:58:27 | 000,000,000 | ---D | C] -- C:\Program Files\Convar
[2011/06/15 10:47:23 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 Restore
[2011/06/14 22:09:22 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Ynwi
[2011/06/14 22:09:22 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Xoofka
[2011/06/13 10:50:02 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Ogtuo
[2011/06/13 10:50:02 | 000,000,000 | -H-D | C] -- C:\Users\rai\AppData\Roaming\Duebog
[2011/05/31 08:34:07 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5015
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5016
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\5017
[2011/06/28 18:10:25 | 000,000,120 | -H-- | M] () -- C:\Users\rai\AppData\Local\Jyiqobituyi.dat
[2011/06/28 09:17:12 | 000,000,000 | -H-- | M] () -- C:\Users\rai\AppData\Local\Qkoyocigezori.bin
[2011/06/25 10:02:25 | 000,000,000 | ---- | M] () -- C:\Users\rai\AppData\Local\{9E02C3BE-344B-4FFB-9E09-602CD6B087CD}
[2011/06/15 11:47:51 | 000,000,392 | -H-- | M] () -- C:\ProgramData\27057912
[2011/06/15 11:45:25 | 000,000,152 | -H-- | M] () -- C:\ProgramData\~27057912r
[2011/06/15 11:45:25 | 000,000,128 | -H-- | M] () -- C:\ProgramData\~27057912
[2011/06/15 10:47:23 | 000,000,633 | -H-- | M] () -- C:\Users\rai\Desktop\Windows 7 Restore.lnk
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:A42A9F39
@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:E1F04E8D
:Commands
[purity]
[resethosts]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Ich habe es wie beschrieben durchgeführt und hier ist das Logfile:

========== OTL ==========
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "softonic-de3 Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: "Ask.com" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: engine@conduit.com:3.2.5.2 removed from extensions.enabledItems
Prefs.js: "hxxp://search.babylon.com/?babsrc=toolbar2&q=" removed from keyword.URL
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\searchplugin folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\modules folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\META-INF folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\defaults folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\chrome folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}\chrome folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\searchplugin folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\modules folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\META-INF folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\defaults folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\chrome folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}\searchplugin folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}\modules folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}\META-INF folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}\defaults folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}\components folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}\chrome folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{f4e6547e-325b-403c-a3bb-ad29ed37a92f} folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\engine@conduit.com\searchplugin folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\engine@conduit.com\META-INF folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\engine@conduit.com\lib folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\engine@conduit.com\DualPackage folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\engine@conduit.com\defaults folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\engine@conduit.com\components folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\engine@conduit.com\chrome folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\engine@conduit.com folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\vshare@toolbar\META-INF folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\vshare@toolbar\chrome folder moved successfully.
C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\vshare@toolbar folder moved successfully.
C:\Users\rai\AppData\Roaming\Mozilla\Firefox\Profiles\8bhp6291.default\searchplugins\askcom.xml moved successfully.
C:\Users\rai\AppData\Roaming\Mozilla\Firefox\Profiles\8bhp6291.default\searchplugins\conduit.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
C:\Program Files\ConduitEngine\prxConduitEngine.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File C:\Program Files\ConduitEngine\prxConduitEngine.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{76AEEA42-E04A-4B62-83AB-DF4B2BE2541E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76AEEA42-E04A-4B62-83AB-DF4B2BE2541E}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{989A9B0D-2FD6-841C-8CFC-BD2A86913978} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{989A9B0D-2FD6-841C-8CFC-BD2A86913978}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f591401-766c-11e0-a156-0024542a71d7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f591401-766c-11e0-a156-0024542a71d7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f591401-766c-11e0-a156-0024542a71d7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f591401-766c-11e0-a156-0024542a71d7}\ not found.
File F:\iStudio.exe not found.
C:\Program Files\ConduitEngine folder moved successfully.
C:\Users\rai\AppData\Local\Conduit folder moved successfully.
C:\Users\rai\AppData\Roaming\Tyka folder moved successfully.
C:\Users\rai\AppData\Roaming\Gaixe folder moved successfully.
C:\Users\rai\AppData\Roaming\Guwy folder moved successfully.
C:\Users\rai\AppData\Roaming\Akpoo folder moved successfully.
C:\Users\rai\AppData\Roaming\Vodu folder moved successfully.
C:\Users\rai\AppData\Roaming\Kofui folder moved successfully.
C:\Users\rai\AppData\Roaming\Xafape folder moved successfully.
C:\Users\rai\AppData\Roaming\Pylo folder moved successfully.
C:\Users\rai\AppData\Roaming\Reeqe folder moved successfully.
C:\Users\rai\AppData\Roaming\Futo folder moved successfully.
C:\Users\rai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Convar\PC Inspector File Recovery folder moved successfully.
C:\Users\rai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Convar folder moved successfully.
C:\Program Files\Convar\PC Inspector File Recovery folder moved successfully.
C:\Program Files\Convar folder moved successfully.
C:\Users\rai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 Restore folder moved successfully.
C:\Users\rai\AppData\Roaming\Ynwi folder moved successfully.
C:\Users\rai\AppData\Roaming\Xoofka folder moved successfully.
C:\Users\rai\AppData\Roaming\Ogtuo folder moved successfully.
C:\Users\rai\AppData\Roaming\Duebog folder moved successfully.
C:\Users\rai\AppData\Roaming\5015\components folder moved successfully.
C:\Users\rai\AppData\Roaming\5015 folder moved successfully.
C:\Users\rai\AppData\Roaming\5016\components folder moved successfully.
C:\Users\rai\AppData\Roaming\5016 folder moved successfully.
C:\Users\rai\AppData\Roaming\5017\components folder moved successfully.
C:\Users\rai\AppData\Roaming\5017 folder moved successfully.
C:\Users\rai\AppData\Local\Jyiqobituyi.dat moved successfully.
C:\Users\rai\AppData\Local\Qkoyocigezori.bin moved successfully.
C:\Users\rai\AppData\Local\{9E02C3BE-344B-4FFB-9E09-602CD6B087CD} moved successfully.
C:\ProgramData\27057912 moved successfully.
C:\ProgramData\~27057912r moved successfully.
C:\ProgramData\~27057912 moved successfully.
C:\Users\rai\Desktop\Windows 7 Restore.lnk moved successfully.
ADS C:\ProgramData\Temp:A42A9F39 deleted successfully.
ADS C:\ProgramData\Temp:E1F04E8D deleted successfully.
========== COMMANDS ==========
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.25.0 log created on 07042011_145415

Ok. Zur Kontrolle bitte wieder ein neues CustomLog mit OTL erstellen und posten.

Ok, ich habe das CustomLog mit OTL erstellt, aber hat erst beim zweiten Versuch geklappt. Der Laptop hatte sich während OTL scannte von allein ausgeschaltet. Beim Einschalten waren alle Dateien wieder sichtbar, aber transparent.
Ich habe den Scan dann erneut durchgeführt und hier ist das Protokoll:OTL Logfile:

OTL logfile created on: 7/4/2011 3:25:10 PM - Run 4
OTL by OldTimer - Version 3.2.25.0     Folder = C:\Users\rai\Desktop
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.96 Gb Total Physical Memory | 1.19 Gb Available Physical Memory | 60.73% Memory free
3.92 Gb Paging File | 2.97 Gb Available in Paging File | 75.61% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 76.22 Gb Total Space | 30.74 Gb Free Space | 40.33% Space Free | Partition Type: NTFS
Drive D: | 141.56 Gb Total Space | 33.60 Gb Free Space | 23.73% Space Free | Partition Type: NTFS
 
Computer Name: RAI-PC | User Name: rai | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011/07/03 23:03:49 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Desktop\OTL.exe
PRC - [2011/05/25 23:14:14 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/04/22 19:04:20 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/03/30 19:49:44 | 000,671,552 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2011/03/30 19:48:00 | 001,523,008 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2011/03/11 01:13:12 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011/02/26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/09/17 18:55:04 | 000,102,400 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Update\NASvc.exe
PRC - [2010/04/20 14:26:44 | 000,300,912 | ---- | M] () -- C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe
PRC - [2010/01/14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/11/04 06:11:48 | 000,835,072 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2009/10/26 13:53:14 | 000,091,136 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
PRC - [2009/10/13 12:03:04 | 000,716,800 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
PRC - [2009/10/07 03:31:56 | 002,246,144 | ---- | M] (SEC) -- C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
PRC - [2009/09/09 10:20:51 | 000,009,728 | ---- | M] () -- C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeLauncher.exe
PRC - [2009/07/14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/07/14 03:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2009/06/03 13:59:02 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2009/04/15 16:52:06 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
PRC - [2009/03/31 09:39:36 | 000,233,472 | ---- | M] (Teruten) -- C:\Windows\System32\FsUsbExService.Exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011/07/03 23:03:49 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Desktop\OTL.exe
MOD - [2010/08/21 07:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011/05/25 23:14:14 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/04/22 19:04:20 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/03/30 19:48:00 | 001,523,008 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011/03/30 19:45:32 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/01/15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2009/03/31 09:39:36 | 000,233,472 | ---- | M] (Teruten) [Auto | Running] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2011/04/22 19:04:20 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/03/11 01:13:12 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/02/10 11:22:58 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2009/11/06 22:53:58 | 001,227,776 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/09/28 11:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/07/14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/07/10 15:44:52 | 000,122,880 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV - [2009/05/11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/05/01 15:41:06 | 000,384,896 | ---- | M] (Phoenix Technologies Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CryptOSD.sys -- (CryptOSD)
DRV - [2009/03/31 09:39:36 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2009/03/20 10:01:26 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdm.sys -- (ss_bmdm)
DRV - [2009/03/20 10:01:26 | 000,090,112 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM)
DRV - [2009/03/20 10:01:26 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter)
DRV - [2007/07/03 16:58:20 | 000,106,792 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2007/07/03 16:57:24 | 000,011,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2007/07/03 16:54:24 | 000,080,552 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=1e754307000000000000b482fe6bf288&tlver=1.4.19.19&affID=17159
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Ask.com Deutschland - die andere Suchmaschine
IE - HKCU\..\URLSearchHook: {76aeea42-e04a-4b62-83ab-df4b2be2541e} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: ""
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: ""
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?babsrc=toolbar2&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/06/16 07:35:36 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/06/25 09:30:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/19 16:00:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/03/18 22:47:23 | 000,000,000 | ---D | M]
 
[2011/01/11 01:56:34 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\rai\AppData\Roaming\mozilla\Extensions
[2011/01/11 01:56:34 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\rai\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/07/04 14:54:17 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions
[2011/06/25 22:01:25 | 000,000,000 | ---D | M] (MessengerPlusLive Germany TB Community Toolbar) -- C:\Users\rai\AppData\Roaming\mozilla\Firefox\Profiles\8bhp6291.default\extensions\{76aeea42-e04a-4b62-83ab-df4b2be2541e}
[2010/10/30 13:47:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2010/10/30 13:47:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
File not found (No name found) -- 
[2011/06/19 14:54:52 | 000,000,000 | ---D | M] (XULRunner) -- C:\USERS\RAI\APPDATA\LOCAL\{39A08BE0-F3F7-4366-B319-8CCAD7DB14CC}
() (No name found) -- C:\USERS\RAI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8BHP6291.DEFAULT\EXTENSIONS\FFXTLBR@BABYLON.COM.XPI
[2011/06/25 09:30:32 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/10/30 13:47:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/06/23 13:34:24 | 002,156,280 | ---- | M] (Myriad Software.) -- C:\Program Files\mozilla firefox\plugins\NPMyrMus.dll
[2011/05/11 17:03:09 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/05/23 17:40:29 | 000,002,423 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2011/05/11 17:03:09 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/05/11 17:03:10 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011/05/11 17:03:10 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/05/11 17:03:10 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/05/11 17:03:10 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011/07/04 14:54:20 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O4 - HKLM..\Run: [APLangApp] C:\Program Files\AnyPC Client\APLangApp.exe (DoctorSoft)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [fsi] C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeLauncher.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Free YouTube Download - C:\Users\rai\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation)
O12 - Plugin for: .mu3 - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .mus - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .mxl - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .mya - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .myr - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .myt - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O12 - Plugin for: .xmz - C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll (Myriad Software.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: hotmail.com ([]* in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: live.com ([]* in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: msn.com ([]* in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: passport.com ([]* in Vertrauenswürdige Sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/07/04 14:54:16 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/07/03 23:03:46 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\rai\Desktop\OTL.exe
[2011/07/03 23:02:56 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\rai\Documents\OTL(2).exe
[2011/06/28 17:31:34 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Roaming\Malwarebytes
[2011/06/28 17:31:28 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys
[2011/06/28 17:31:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/28 17:31:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/06/28 17:31:24 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2011/06/28 17:31:24 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/06/28 17:30:29 | 009,435,312 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\rai\Documents\mbam-setup-1.51.0.1200.exe
[2011/06/24 00:07:45 | 001,064,960 | ---- | C] (The OpenSSL Project, OpenSSL: The Open Source toolkit for SSL/TLS) -- C:\windows\System32\libeay32.dll
[2011/06/24 00:07:45 | 000,200,704 | ---- | C] (The OpenSSL Project, OpenSSL: The Open Source toolkit for SSL/TLS) -- C:\windows\System32\ssleay32.dll
[2011/06/24 00:07:45 | 000,176,128 | ---- | C] (The cURL library, cURL and libcurl) -- C:\windows\System32\libcurl.dll
[2011/06/23 09:18:34 | 000,000,000 | ---D | C] -- C:\windows\Minidump
[2011/06/20 11:45:32 | 000,000,000 | ---D | C] -- C:\windows\Sun
[2011/06/19 14:54:52 | 000,000,000 | ---D | C] -- C:\Users\rai\AppData\Local\{39A08BE0-F3F7-4366-B319-8CCAD7DB14CC}
[2011/06/18 17:58:25 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\rai\Documents\OTL(1).exe
[2011/06/15 22:18:49 | 000,580,608 | -H-- | C] (OldTimer Tools) -- C:\Users\rai\Documents\OTL.exe
[2011/06/14 22:28:23 | 000,000,000 | -H-D | C] -- C:\Users\rai\Desktop\Handy Uploads
[2011/06/13 22:55:17 | 000,000,000 | -H-D | C] -- C:\Users\rai\Documents\Neuer Ordner (2)
[2011/06/07 12:32:34 | 000,000,000 | -H-D | C] -- C:\Users\rai\Documents\Bewerbungen Agentur
[2011/06/06 19:00:36 | 000,000,000 | -H-D | C] -- C:\Users\rai\Documents\Neuer Ordner
[2010/08/25 19:59:08 | 000,004,096 | ---- | C] ( ) -- C:\windows\System32\IGFXDEVLib.dll
[4 C:\Users\rai\AppData\Local\*.tmp files -> C:\Users\rai\AppData\Local\*.tmp -> ]
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
[1 C:\Users\rai\AppData\Roaming\*.tmp files -> C:\Users\rai\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011/07/04 15:28:33 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/07/04 15:28:33 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/07/04 15:20:54 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2011/07/04 15:20:47 | 1579,630,592 | -HS- | M] () -- C:\hiberfil.sys
[2011/07/04 14:54:20 | 000,000,098 | ---- | M] () -- C:\windows\System32\drivers\etc\Hosts
[2011/07/03 23:03:49 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Desktop\OTL.exe
[2011/07/03 23:02:58 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Documents\OTL(2).exe
[2011/07/02 15:29:40 | 002,285,048 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2011/07/02 15:29:40 | 001,131,250 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2011/07/02 15:29:40 | 000,650,156 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2011/07/02 15:29:40 | 000,576,210 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2011/06/30 18:34:33 | 000,009,487 | ---- | M] () -- C:\Users\rai\Documents\267566_10150250517364940_7805409939_7109628_7949230_s.jpg
[2011/06/29 12:13:40 | 000,350,312 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2011/06/28 17:31:28 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/28 17:31:01 | 009,435,312 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\rai\Documents\mbam-setup-1.51.0.1200.exe
[2011/06/24 17:40:35 | 000,003,589 | ---- | M] () -- C:\windows\System32\jsaddons.ini
[2011/06/23 19:44:59 | 000,030,393 | ---- | M] () -- C:\Users\rai\Documents\254529_1805511572895_1093067663_31510402_5864814_n.jpg
[2011/06/23 09:18:23 | 237,375,097 | ---- | M] () -- C:\windows\MEMORY.DMP
[2011/06/21 22:57:31 | 000,096,187 | ---- | M] () -- C:\Users\rai\Documents\249464_207123672656310_100000760352992_471385_2137741_n.jpg
[2011/06/20 17:06:54 | 000,000,000 | ---- | M] () -- C:\Users\rai\AppData\Local\{CCB2B7B9-5421-43EC-8F04-48CCA8BAD627}
[2011/06/20 17:02:29 | 000,000,000 | ---- | M] () -- C:\Users\rai\AppData\Local\{349E8643-AC12-4668-9AE4-385FE5B30EFA}
[2011/06/18 22:50:18 | 000,000,000 | ---- | M] () -- C:\Users\rai\AppData\Local\{27E7AFC2-2056-4E6C-8A3E-5534EEE94F54}
[2011/06/18 17:58:39 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\rai\Documents\OTL(1).exe
[2011/06/17 22:11:01 | 000,020,311 | -H-- | M] () -- C:\Users\rai\Documents\29444392.jpg
[2011/06/15 22:19:55 | 000,580,608 | -H-- | M] (OldTimer Tools) -- C:\Users\rai\Documents\OTL.exe
[2011/06/15 12:00:33 | 000,001,284 | -H-- | M] () -- C:\Users\rai\Desktop\PC Inspector File Recovery.lnk
[2011/06/15 11:58:08 | 003,462,033 | -H-- | M] () -- C:\Users\rai\Documents\pci_filerecovery.exe
[2011/06/14 22:33:25 | 000,178,750 | -H-- | M] () -- C:\Users\rai\Documents\Foto371.jpg
[2011/06/14 13:47:40 | 000,068,276 | -H-- | M] () -- C:\Users\rai\Documents\ostsee.jpg
[2011/06/14 11:56:29 | 000,046,662 | -H-- | M] () -- C:\Users\rai\Documents\deepika061111.pdf
[2011/06/13 18:49:15 | 000,086,014 | -H-- | M] () -- C:\Users\rai\Documents\247028_1805452651422_1093067663_31510173_660445_n.jpg
[2011/06/13 12:51:38 | 000,114,329 | -H-- | M] () -- C:\Users\rai\Documents\Guten Morgen Berlin.jpg
[2011/06/13 12:50:09 | 000,063,243 | -H-- | M] () -- C:\Users\rai\Documents\247241_1805529653347_1093067663_31510421_6177808_n.jpg
[2011/06/13 12:44:57 | 000,057,985 | -H-- | M] () -- C:\Users\rai\Documents\255691_1805487932304_1093067663_31510317_2832650_n.jpg
[2011/06/10 19:48:06 | 000,108,860 | -H-- | M] () -- C:\Users\rai\Documents\das richtige Bild.jpg
[2011/06/10 12:15:03 | 003,090,518 | -H-- | M] () -- C:\Users\rai\Documents\Alexandra_Stan_-_Mr._Saxo_Beat_lyrics.mp3
[2011/06/10 01:31:37 | 000,114,443 | -H-- | M] () -- C:\Users\rai\Documents\Eine Zugfahrt die ist... nun ja anders !.jpg
[2011/06/10 01:27:11 | 000,077,035 | -H-- | M] () -- C:\Users\rai\Documents\249272_10150608301755858_758305857_18923591_5096154_n.jpg
[2011/06/10 01:10:01 | 000,090,121 | -H-- | M] () -- C:\Users\rai\Documents\251702_172001396193189_100001499904249_452483_4061762_n - Kopie (2).jpg
[2011/06/10 00:08:35 | 000,116,373 | -H-- | M] () -- C:\Users\rai\Documents\246663_171998719526790_100001499904249_452418_6352249_n.jpg
[2011/06/10 00:08:07 | 000,150,556 | -H-- | M] () -- C:\Users\rai\Documents\253500_171998642860131_100001499904249_452413_2636837_n.jpg
[2011/06/10 00:07:05 | 000,092,886 | -H-- | M] () -- C:\Users\rai\Documents\248993_171998486193480_100001499904249_452410_4837368_n.jpg
[2011/06/10 00:06:21 | 000,096,233 | -H-- | M] () -- C:\Users\rai\Documents\253822_171998412860154_100001499904249_452408_7346243_n.jpg
[2011/06/09 23:58:40 | 000,101,341 | -H-- | M] () -- C:\Users\rai\Documents\248915_171996939526968_100001499904249_452364_1974396_n.jpg
[2011/06/09 23:58:33 | 000,095,441 | -H-- | M] () -- C:\Users\rai\Documents\253862_171996886193640_100001499904249_452363_7360527_n.jpg
[2011/06/09 23:58:26 | 000,149,923 | -H-- | M] () -- C:\Users\rai\Documents\254551_171996819526980_100001499904249_452362_3463874_n.jpg
[2011/06/09 23:58:19 | 000,135,691 | -H-- | M] () -- C:\Users\rai\Documents\248413_171996786193650_100001499904249_452361_6024836_n.jpg
[2011/06/09 23:58:11 | 000,143,779 | -H-- | M] () -- C:\Users\rai\Documents\251255_171996749526987_100001499904249_452360_3782341_n.jpg
[2011/06/09 23:58:03 | 000,143,814 | -H-- | M] () -- C:\Users\rai\Documents\251675_171996726193656_100001499904249_452359_4176518_n.jpg
[2011/06/09 23:57:52 | 000,081,088 | -H-- | M] () -- C:\Users\rai\Documents\254150_171996676193661_100001499904249_452358_4447810_n.jpg
[2011/06/09 23:57:34 | 000,079,762 | -H-- | M] () -- C:\Users\rai\Documents\247353_171996616193667_100001499904249_452357_4628715_n.jpg
[2011/06/09 23:57:26 | 000,083,753 | -H-- | M] () -- C:\Users\rai\Documents\249543_171996589527003_100001499904249_452356_6543620_n.jpg
[2011/06/09 23:57:17 | 000,076,384 | -H-- | M] () -- C:\Users\rai\Documents\246922_171996566193672_100001499904249_452355_8238187_n.jpg
[2011/06/09 23:57:16 | 000,098,462 | -H-- | M] () -- C:\Users\rai\Documents\246643_171996532860342_100001499904249_452353_3318879_n.jpg
[2011/06/09 23:56:56 | 000,097,657 | -H-- | M] () -- C:\Users\rai\Documents\247073_171996479527014_100001499904249_452352_7212322_n.jpg
[2011/06/09 23:56:45 | 000,097,691 | -H-- | M] () -- C:\Users\rai\Documents\247036_171996362860359_100001499904249_452346_5911126_n.jpg
[2011/06/09 22:02:34 | 000,000,000 | -H-- | M] () -- C:\Users\rai\AppData\Local\{200A499A-232A-4DF1-8944-5C2B6A118F1A}
[2011/06/06 23:30:00 | 000,021,925 | -H-- | M] () -- C:\Users\rai\Documents\61489_1427274997217_1093067663_30952567_416746_n.jpg
[2011/06/06 21:21:01 | 000,118,185 | -H-- | M] () -- C:\Users\rai\Documents\Szene-Kurs.pdf
[2011/06/05 23:53:15 | 000,017,817 | -H-- | M] () -- C:\Users\rai\Documents\Deepika - Kopie - Kopie (2) - Kopie - Kopie - Kopie.jpg
[2011/06/05 20:55:58 | 003,615,892 | -H-- | M] () -- C:\Users\rai\Documents\OST_Hanna_-_Container_Park_Chemical_Bros__.mp3
[2011/06/05 15:32:28 | 000,022,663 | -H-- | M] () -- C:\Users\rai\Documents\68205_1526538678747_1093067663_31117010_8271306_n.jpg
[2011/06/05 15:29:43 | 000,010,965 | -H-- | M] () -- C:\Users\rai\Documents\165762_1526534278637_1093067663_31116999_6904840_n.jpg
[2011/06/05 15:29:02 | 000,055,928 | -H-- | M] () -- C:\Users\rai\Documents\7034_133327803817_554748817_2397083_2833397_n.jpg
[2011/06/05 15:25:32 | 000,075,685 | -H-- | M] () -- C:\Users\rai\Documents\68205_1526538678747_1093067663_31117010_8271306_n - Kopie.jpg
[2011/06/05 15:23:54 | 000,014,164 | -H-- | M] () -- C:\Users\rai\Documents\181995_33411753817_554748817_929269_7884239_n.jpg
[2011/06/05 14:21:04 | 000,039,869 | -H-- | M] () -- C:\Users\rai\Documents\168454_1549005760410_1093067663_31168755_5488634_n.jpg
[2011/06/05 14:19:31 | 000,064,885 | -H-- | M] () -- C:\Users\rai\Documents\164352_1549000080268_1093067663_31168721_2091760_n.jpg
[2011/06/05 14:18:23 | 000,040,514 | -H-- | M] () -- C:\Users\rai\Documents\65486_1526526238436_1093067663_31116966_5286005_n.jpg
[2011/06/05 14:13:21 | 000,086,479 | -H-- | M] () -- C:\Users\rai\Documents\26297_1237541133989_1093067663_30543810_7979447_n.jpg
[2011/06/05 11:08:44 | 000,000,000 | -H-- | M] () -- C:\Users\rai\AppData\Local\{8E9E6EE2-D327-42BA-86FA-6F07DCEAAA08}
[4 C:\Users\rai\AppData\Local\*.tmp files -> C:\Users\rai\AppData\Local\*.tmp -> ]
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
[1 C:\Users\rai\AppData\Roaming\*.tmp files -> C:\Users\rai\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011/06/30 18:34:28 | 000,009,487 | ---- | C] () -- C:\Users\rai\Documents\267566_10150250517364940_7805409939_7109628_7949230_s.jpg
[2011/06/28 17:31:28 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/24 14:27:15 | 000,003,589 | ---- | C] () -- C:\windows\System32\jsaddons.ini
[2011/06/24 00:07:45 | 000,073,728 | ---- | C] () -- C:\windows\System32\zlib1.dll
[2011/06/23 19:44:55 | 000,030,393 | ---- | C] () -- C:\Users\rai\Documents\254529_1805511572895_1093067663_31510402_5864814_n.jpg
[2011/06/23 09:18:23 | 237,375,097 | ---- | C] () -- C:\windows\MEMORY.DMP
[2011/06/21 22:56:13 | 000,096,187 | ---- | C] () -- C:\Users\rai\Documents\249464_207123672656310_100000760352992_471385_2137741_n.jpg
[2011/06/20 17:06:54 | 000,000,000 | ---- | C] () -- C:\Users\rai\AppData\Local\{CCB2B7B9-5421-43EC-8F04-48CCA8BAD627}
[2011/06/20 17:02:29 | 000,000,000 | ---- | C] () -- C:\Users\rai\AppData\Local\{349E8643-AC12-4668-9AE4-385FE5B30EFA}
[2011/06/18 22:50:18 | 000,000,000 | ---- | C] () -- C:\Users\rai\AppData\Local\{27E7AFC2-2056-4E6C-8A3E-5534EEE94F54}
[2011/06/17 22:10:58 | 000,020,311 | -H-- | C] () -- C:\Users\rai\Documents\29444392.jpg
[2011/06/15 11:58:28 | 000,001,284 | -H-- | C] () -- C:\Users\rai\Desktop\PC Inspector File Recovery.lnk
[2011/06/15 11:58:04 | 003,462,033 | -H-- | C] () -- C:\Users\rai\Documents\pci_filerecovery.exe
[2011/06/14 22:36:19 | 000,178,750 | -H-- | C] () -- C:\Users\rai\Documents\Foto371.jpg
[2011/06/14 13:46:20 | 000,068,276 | -H-- | C] () -- C:\Users\rai\Documents\ostsee.jpg
[2011/06/14 11:56:29 | 000,046,662 | -H-- | C] () -- C:\Users\rai\Documents\deepika061111.pdf
[2011/06/13 18:47:28 | 000,086,014 | -H-- | C] () -- C:\Users\rai\Documents\247028_1805452651422_1093067663_31510173_660445_n.jpg
[2011/06/13 12:48:58 | 000,063,243 | -H-- | C] () -- C:\Users\rai\Documents\247241_1805529653347_1093067663_31510421_6177808_n.jpg
[2011/06/13 12:44:56 | 000,057,985 | -H-- | C] () -- C:\Users\rai\Documents\255691_1805487932304_1093067663_31510317_2832650_n.jpg
[2011/06/13 12:42:10 | 000,114,329 | -H-- | C] () -- C:\Users\rai\Documents\Guten Morgen Berlin.jpg
[2011/06/10 12:14:43 | 003,090,518 | -H-- | C] () -- C:\Users\rai\Documents\Alexandra_Stan_-_Mr._Saxo_Beat_lyrics.mp3
[2011/06/10 01:42:29 | 000,108,860 | -H-- | C] () -- C:\Users\rai\Documents\das richtige Bild.jpg
[2011/06/10 01:31:36 | 000,114,443 | -H-- | C] () -- C:\Users\rai\Documents\Eine Zugfahrt die ist... nun ja anders !.jpg
[2011/06/10 01:26:54 | 000,077,035 | -H-- | C] () -- C:\Users\rai\Documents\249272_10150608301755858_758305857_18923591_5096154_n.jpg
[2011/06/10 01:22:24 | 000,090,121 | -H-- | C] () -- C:\Users\rai\Documents\251702_172001396193189_100001499904249_452483_4061762_n - Kopie (2).jpg
[2011/06/10 00:08:14 | 000,116,373 | -H-- | C] () -- C:\Users\rai\Documents\246663_171998719526790_100001499904249_452418_6352249_n.jpg
[2011/06/10 00:07:18 | 000,150,556 | -H-- | C] () -- C:\Users\rai\Documents\253500_171998642860131_100001499904249_452413_2636837_n.jpg
[2011/06/10 00:07:02 | 000,092,886 | -H-- | C] () -- C:\Users\rai\Documents\248993_171998486193480_100001499904249_452410_4837368_n.jpg
[2011/06/10 00:06:13 | 000,096,233 | -H-- | C] () -- C:\Users\rai\Documents\253822_171998412860154_100001499904249_452408_7346243_n.jpg
[2011/06/09 23:58:38 | 000,101,341 | -H-- | C] () -- C:\Users\rai\Documents\248915_171996939526968_100001499904249_452364_1974396_n.jpg
[2011/06/09 23:58:32 | 000,095,441 | -H-- | C] () -- C:\Users\rai\Documents\253862_171996886193640_100001499904249_452363_7360527_n.jpg
[2011/06/09 23:58:25 | 000,149,923 | -H-- | C] () -- C:\Users\rai\Documents\254551_171996819526980_100001499904249_452362_3463874_n.jpg
[2011/06/09 23:58:18 | 000,135,691 | -H-- | C] () -- C:\Users\rai\Documents\248413_171996786193650_100001499904249_452361_6024836_n.jpg
[2011/06/09 23:58:10 | 000,143,779 | -H-- | C] () -- C:\Users\rai\Documents\251255_171996749526987_100001499904249_452360_3782341_n.jpg
[2011/06/09 23:58:02 | 000,143,814 | -H-- | C] () -- C:\Users\rai\Documents\251675_171996726193656_100001499904249_452359_4176518_n.jpg
[2011/06/09 23:57:51 | 000,081,088 | -H-- | C] () -- C:\Users\rai\Documents\254150_171996676193661_100001499904249_452358_4447810_n.jpg
[2011/06/09 23:57:32 | 000,079,762 | -H-- | C] () -- C:\Users\rai\Documents\247353_171996616193667_100001499904249_452357_4628715_n.jpg
[2011/06/09 23:57:24 | 000,083,753 | -H-- | C] () -- C:\Users\rai\Documents\249543_171996589527003_100001499904249_452356_6543620_n.jpg
[2011/06/09 23:57:15 | 000,076,384 | -H-- | C] () -- C:\Users\rai\Documents\246922_171996566193672_100001499904249_452355_8238187_n.jpg
[2011/06/09 23:57:06 | 000,098,462 | -H-- | C] () -- C:\Users\rai\Documents\246643_171996532860342_100001499904249_452353_3318879_n.jpg
[2011/06/09 23:56:51 | 000,097,657 | -H-- | C] () -- C:\Users\rai\Documents\247073_171996479527014_100001499904249_452352_7212322_n.jpg
[2011/06/09 23:56:36 | 000,097,691 | -H-- | C] () -- C:\Users\rai\Documents\247036_171996362860359_100001499904249_452346_5911126_n.jpg
[2011/06/09 22:02:19 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{200A499A-232A-4DF1-8944-5C2B6A118F1A}
[2011/06/06 23:32:13 | 000,017,817 | -H-- | C] () -- C:\Users\rai\Documents\Deepika - Kopie - Kopie (2) - Kopie - Kopie - Kopie.jpg
[2011/06/06 21:21:01 | 000,118,185 | -H-- | C] () -- C:\Users\rai\Documents\Szene-Kurs.pdf
[2011/06/06 20:05:55 | 005,992,658 | -H-- | C] () -- C:\Users\rai\Documents\SAM_1353.JPG
[2011/06/05 20:55:08 | 003,615,892 | -H-- | C] () -- C:\Users\rai\Documents\OST_Hanna_-_Container_Park_Chemical_Bros__.mp3
[2011/06/05 15:29:02 | 000,055,928 | -H-- | C] () -- C:\Users\rai\Documents\7034_133327803817_554748817_2397083_2833397_n.jpg
[2011/06/05 15:28:40 | 000,010,965 | -H-- | C] () -- C:\Users\rai\Documents\165762_1526534278637_1093067663_31116999_6904840_n.jpg
[2011/06/05 15:26:10 | 000,075,685 | -H-- | C] () -- C:\Users\rai\Documents\68205_1526538678747_1093067663_31117010_8271306_n - Kopie.jpg
[2011/06/05 15:25:30 | 000,022,663 | -H-- | C] () -- C:\Users\rai\Documents\68205_1526538678747_1093067663_31117010_8271306_n.jpg
[2011/06/05 15:21:34 | 000,014,164 | -H-- | C] () -- C:\Users\rai\Documents\181995_33411753817_554748817_929269_7884239_n.jpg
[2011/06/05 14:21:03 | 000,039,869 | -H-- | C] () -- C:\Users\rai\Documents\168454_1549005760410_1093067663_31168755_5488634_n.jpg
[2011/06/05 14:19:28 | 000,064,885 | -H-- | C] () -- C:\Users\rai\Documents\164352_1549000080268_1093067663_31168721_2091760_n.jpg
[2011/06/05 14:15:29 | 000,040,514 | -H-- | C] () -- C:\Users\rai\Documents\65486_1526526238436_1093067663_31116966_5286005_n.jpg
[2011/06/05 14:12:30 | 000,086,479 | -H-- | C] () -- C:\Users\rai\Documents\26297_1237541133989_1093067663_30543810_7979447_n.jpg
[2011/06/05 11:06:44 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{8E9E6EE2-D327-42BA-86FA-6F07DCEAAA08}
[2011/05/31 15:23:11 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{4914D555-91E9-4333-81B6-E4C858D598C4}
[2011/05/29 12:44:29 | 000,000,011 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\urhtps.dat
[2011/05/26 13:15:27 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\.NANotifyHere
[2011/05/19 16:00:17 | 000,000,724 | ---- | C] () -- C:\windows\wacam.ini
[2011/05/19 16:00:16 | 000,169,720 | ---- | C] () -- C:\windows\System32\MMPlugHostCtrl.dll
[2011/05/05 15:29:12 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{63A774A9-58AA-419B-BF0C-971ABC1EA064}
[2011/05/01 16:33:24 | 000,000,000 | -H-- | C] () -- C:\Users\rai\AppData\Local\{A8380BC7-4C4D-4AEB-9A1C-C49BE66755BC}
[2010/12/14 00:06:48 | 000,000,235 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\devices.xml
[2010/12/14 00:06:48 | 000,000,012 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\settings.xml
[2010/12/13 23:51:38 | 000,020,458 | ---- | C] () -- C:\windows\hpoins01.dat.temp
[2010/12/13 23:51:38 | 000,016,622 | ---- | C] () -- C:\windows\hpomdl01.dat.temp
[2010/10/13 10:09:40 | 000,000,812 | ---- | C] () -- C:\windows\System32\drivers\scdskr01.dat
[2010/10/13 10:09:40 | 000,000,541 | ---- | C] () -- C:\windows\System32\drivers\scdhkr01.dat
[2010/10/13 10:09:40 | 000,000,500 | ---- | C] () -- C:\windows\System32\drivers\RSTable.dat
[2010/10/13 10:09:40 | 000,000,036 | ---- | C] () -- C:\windows\System32\drivers\scdstr01.dat
[2010/09/17 18:37:50 | 000,110,592 | ---- | C] () -- C:\windows\System32\FsUsbExDevice.Dll
[2010/09/17 18:37:50 | 000,036,608 | ---- | C] () -- C:\windows\System32\FsUsbExDisk.Sys
[2010/09/17 18:37:42 | 000,002,528 | -H-- | C] () -- C:\Users\rai\AppData\Roaming\$_hpcst$.hpc
[2010/09/15 14:19:07 | 000,016,622 | ---- | C] () -- C:\windows\hpomdl01.dat
[2010/08/25 20:30:02 | 000,439,308 | ---- | C] () -- C:\windows\System32\igcompkrng500.bin
[2010/08/25 20:30:00 | 000,982,240 | ---- | C] () -- C:\windows\System32\igkrng500.bin
[2010/08/25 20:30:00 | 000,092,356 | ---- | C] () -- C:\windows\System32\igfcg500m.bin
[2010/08/25 19:57:00 | 000,000,151 | ---- | C] () -- C:\windows\System32\GfxUI.exe.config
[2010/08/25 19:52:00 | 000,208,896 | ---- | C] () -- C:\windows\System32\iglhsip32.dll
[2010/08/25 19:52:00 | 000,143,360 | ---- | C] () -- C:\windows\System32\iglhcp32.dll
[2010/08/18 17:53:31 | 000,000,002 | ---- | C] () -- C:\windows\HotFixList.ini
[2010/08/18 17:38:22 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2009/12/05 22:22:03 | 002,285,048 | ---- | C] () -- C:\windows\System32\perfh007.dat
[2009/12/05 22:22:03 | 000,650,156 | ---- | C] () -- C:\windows\System32\perfc007.dat
[2009/12/05 22:22:03 | 000,295,922 | ---- | C] () -- C:\windows\System32\perfi007.dat
[2009/12/05 22:22:03 | 000,038,104 | ---- | C] () -- C:\windows\System32\perfd007.dat
[2009/12/05 22:01:49 | 000,004,608 | ---- | C] () -- C:\windows\System32\HdmiCoin.dll
[2009/12/05 22:01:47 | 000,134,592 | ---- | C] () -- C:\windows\System32\igfcg500.bin
[2009/12/05 05:17:31 | 000,307,200 | ---- | C] () -- C:\windows\SetDisplayResolution.exe
[2009/07/14 06:57:37 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat
[2009/07/14 06:33:53 | 000,350,312 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT
[2009/07/14 04:05:48 | 001,131,250 | ---- | C] () -- C:\windows\System32\perfh009.dat
[2009/07/14 04:05:48 | 000,576,210 | ---- | C] () -- C:\windows\System32\perfc009.dat
[2009/07/14 04:05:48 | 000,291,294 | ---- | C] () -- C:\windows\System32\perfi009.dat
[2009/07/14 04:05:48 | 000,031,548 | ---- | C] () -- C:\windows\System32\perfd009.dat
[2009/07/14 04:05:05 | 000,000,741 | ---- | C] () -- C:\windows\System32\NOISE.DAT
[2009/07/14 04:04:11 | 000,215,943 | ---- | C] () -- C:\windows\System32\dssec.dat
[2009/07/14 01:55:01 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin
[2009/07/14 01:51:43 | 000,073,728 | ---- | C] () -- C:\windows\System32\BthpanContextHandler.dll
[2009/07/14 01:42:10 | 000,064,000 | ---- | C] () -- C:\windows\System32\BWContextHandler.dll
[2009/06/10 23:26:10 | 000,673,088 | ---- | C] () -- C:\windows\System32\mlang.dat
[2009/05/01 16:24:14 | 000,000,184 | ---- | C] () -- C:\windows\System32\drivers\osdauth.dat
[2009/05/01 15:41:06 | 000,000,020 | ---- | C] () -- C:\windows\System32\drivers\OSDSig.dat
[2007/10/25 17:26:10 | 000,005,632 | ---- | C] () -- C:\windows\System32\drivers\StarOpen.sys
[2003/04/06 06:33:26 | 000,020,458 | ---- | C] () -- C:\windows\hpoins01.dat
 
========== LOP Check ==========
 
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Audacity
[2011/01/31 17:02:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\DVDVideoSoftIEHelpers
[2011/05/28 20:07:22 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\kock
[2010/09/17 18:59:43 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\PC Suite
[2011/06/16 07:33:59 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Samsung
[2011/06/16 07:35:44 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Thunderbird
[2011/05/26 14:34:14 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\TuneUp Software
[2011/06/22 14:36:00 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Wuyco
[2011/05/28 20:07:23 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\xmldm
[2011/06/28 19:23:29 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Ysymyp
[2011/07/04 15:20:59 | 000,032,640 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Adobe
[2010/12/26 13:23:33 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Apple Computer
[2011/06/16 07:35:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Audacity
[2010/09/17 20:00:38 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Avira
[2011/05/19 00:34:42 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\CyberLink
[2011/05/06 01:19:26 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\DivX
[2011/01/31 17:02:41 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\DVDVideoSoftIEHelpers
[2010/09/12 14:07:05 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Google
[2010/12/14 00:23:17 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Hewlett-Packard
[2010/12/23 15:41:14 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\HpUpdate
[2010/08/18 17:55:13 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Identities
[2011/05/28 20:07:22 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\kock
[2010/09/12 14:08:04 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Macromedia
[2011/06/28 17:31:34 | 000,000,000 | ---D | M] -- C:\Users\rai\AppData\Roaming\Malwarebytes
[2009/12/05 22:11:14 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Media Center Programs
[2011/06/16 07:35:41 | 000,000,000 | --SD | M] -- C:\Users\rai\AppData\Roaming\Microsoft
[2011/06/16 07:33:56 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Mozilla
[2011/05/26 13:16:17 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Nero
[2010/09/17 18:59:43 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\PC Suite
[2011/06/16 07:35:44 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Real
[2011/06/16 07:33:59 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Samsung
[2011/06/16 07:35:44 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Thunderbird
[2011/05/26 14:34:14 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\TuneUp Software
[2011/06/22 14:36:00 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Wuyco
[2011/05/28 20:07:23 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\xmldm
[2011/06/28 19:23:29 | 000,000,000 | -H-D | M] -- C:\Users\rai\AppData\Roaming\Ysymyp
 
< %APPDATA%\*.exe /s >
[2010/09/17 18:54:12 | 089,280,248 | -H-- | M] (Samsung Electronics Co., Ltd.                                ) -- C:\Users\rai\AppData\Roaming\Samsung\New PC Studio\LiveUpdate\Setup_For_Full_Update_IH2_7.exe
[2010/11/19 15:03:57 | 142,480,808 | -H-- | M] (Samsung Electronics Co., Ltd.                                ) -- C:\Users\rai\AppData\Roaming\Samsung\New PC Studio\LiveUpdate\Setup_Full_Update_NPS2_10064_2.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2007/05/17 14:34:04 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\CyberLink\PowerDirector\EventLog.dll
 
< MD5 for: IASTOR.SYS  >
[2009/10/13 04:09:36 | 000,331,288 | ---- | M] (Intel Corporation) MD5=0BAA4115DFFFD6A6D809A89D65E1281A -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009/10/13 04:09:36 | 000,331,288 | ---- | M] (Intel Corporation) MD5=0BAA4115DFFFD6A6D809A89D65E1281A -- C:\Windows\System32\drivers\iaStor.sys
[2009/10/13 04:09:36 | 000,331,288 | ---- | M] (Intel Corporation) MD5=0BAA4115DFFFD6A6D809A89D65E1281A -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_3f3653f13a033ed4\iaStor.sys
[2009/10/13 04:16:40 | 000,409,624 | ---- | M] (Intel Corporation) MD5=BE7D72FCF442C26975942007E0831241 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2011/03/11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0033117673c16921\iaStorV.sys
[2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011/03/11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010/11/20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011/03/11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010/11/20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011/03/11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\drivers\nvstor.sys
[2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_38e464dbe521cc7f\nvstor.sys
[2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011/03/11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011/03/11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010/11/20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010/11/20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009/07/14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll
[2009/07/14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010/11/20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009/07/14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\windows\system32\*.tmp files -> C:\windows\system32\*.tmp -> ]

< End of report >
         

--- --- ---