| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
25.03.2012, 15:43
| #1 | |
| |  Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde? Hallo Leute, also, dumm wie ich war bin ich heute morgen auf eine von Google gesperrte Seite gegangen. Als ich dann, nachdem ich einige Zeit nicht am PC war, wieder weiter zocken wollte, hab ich gesehen dass ich tausende Meldungen von Data Recovery hatte. Zuerst dachte ich, dass es wirklich so sei und hab nach Lösungen gegoogelt, wodurch ich dann auf diese Seite gestoßen bin. So, habe also GuRu's Guide gefunden und soweit auch befolgt. JEDOCH beim ersten Mal nichts gefunden. Hab also neugestartet und dann ging der SPaß von vorne los. Bin grad wieder dabei, es auszuführen. Mit RKill habe ich, hoffentlich - bin mir nicht sicher ob es geklappt hat, jedoch zeigts das "System Check" Symbol nichtmehr unten rechts in der Leiste, alle Prozesse eliminiert. Nun bin ich wieder mit Malwarebytes zugange und hoffe, dass es irgendetwas findet. Jedoch bin ich mir sicher, dass es nichts wird. Daher meine Bitte: Wäre irgendjemand so freundlich, mit mir über Skype/MSN in Kontakt zu setzen und das Problem via TeamViewer zu lösen? Ich weiß nicht ob es erlaubt ist, aber ich würde demjenigen auch ein paar Euro zukommen lassen. (Ich denke da an 5€/h) Vielen Dank. ~ Michi Auch wenn es gegen die Regeln ist, ich muss Bumpen. Ich hab echt Angst um meinen Pc. Achja, was noch zusagen ist: Wenn ich jetzt RKill ausführen will, erscheint die Meldung: Installation fehlgeschlagen (3 Mal) JEDOCH wird Rkill trotzdem ausgeführt, mit folgenden Logs: This log file is located at C:\rkill.log. Please post this only if requested to by the person helping you. Otherwise you can close this log when you wish. Rkill was run on 25.03.2012 at 17:50:47. Operating System: Windows 7 Home Premium Processes terminated by Rkill or while it was running: C:\Windows\SysWOW64\rundll32.exe Rkill completed on 25.03.2012 at 17:51:00. Zitat:
Da ich nicht weiß wo der Editieren-Button ist, muss ich leider zitieren >.< |
|
25.03.2012, 17:43
| #2 |
| /// Malware-holic   | Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde? das pushen von themen wird dir auch nicht helfen, wenn du dir selbst antworten würdest, wäre dein beitrag nicht mehr als unbeantwortet gekennzeichnet und du müsstest dann sogar noch länger warten.
__________________und wenn du sofortige hilfe willst, geh in ein pc geschäft und bezahle dafür.... das hier ist unsere freizeit. Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
__________________ |
|
25.03.2012, 17:55
| #3 |
| | Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde? Entschuldige..
__________________Ok, also B2Topic Was genau meinst du mit 'Kopiere nun den Inhalt [...]'? Soll ich so vorgehen wie es im OTL Thread beschrieben ist oder das was in der Box die du gepostet hast kopieren und in OTL einfügen? Nochmals danke für deine Hilfe. Falls ich das gemacht hab was du meinst, hier:OTL Logfile: Code:
ATTFilter OTL logfile created on: 25.03.2012 19:10:29 - Run 2 OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Michali\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,25 Gb Available Physical Memory | 56,37% Memory free 8,00 Gb Paging File | 6,44 Gb Available in Paging File | 80,50% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 48,73 Gb Total Space | 11,20 Gb Free Space | 22,99% Space Free | Partition Type: NTFS Drive D: | 416,92 Gb Total Space | 305,72 Gb Free Space | 73,33% Space Free | Partition Type: NTFS Drive F: | 931,51 Gb Total Space | 587,63 Gb Free Space | 63,08% Space Free | Partition Type: NTFS Computer Name: MICHALI-PC | User Name: Michali | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Michali\Desktop\OTL.exe (OldTimer Tools) PRC - C:\ProgramData\rhExurxY9nsbJO.exe ( ) PRC - C:\Program Files (x86)\ScreenSnapr\ScreenSnapr.exe (Byteopia) PRC - D:\VIER GESCHICHTE\4Story_DE\PrePatch.exe (Zemi Interactive Inc.) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.) ========== Modules (No Company Name) ========== MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ff30db6905f8ec024fc808ed8779c0f3\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\a09ee392fa90849f2e9313a1ebbe0279\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49f4cb0755ccc34cd35ff96dc2ef9e3\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1f14b3e1ee0847f8662f513e67f92547\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\15742b3597258ce67cbe219005c197e5\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll () MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () ========== Win32 Services (SafeList) ========== SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software) SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe (TuneUp Software) SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (TeamViewer6) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (McComponentHostService) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (esgiguard) -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys File not found DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (teamviewervpn) -- C:\Windows\SysNative\drivers\teamviewervpn.sys (TeamViewer GmbH) DRV:64bit: - (Netaapl) -- C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (MSHUSBVideo) -- C:\Windows\SysNative\drivers\nx6000.sys (Microsoft Corporation) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (s1029unic) Sony Ericsson Device 1029 USB Ethernet Emulation (WDM) -- C:\Windows\SysNative\drivers\s1029unic.sys (MCCI Corporation) DRV:64bit: - (s1029mgmt) Sony Ericsson Device 1029 USB WMC Device Management Drivers (WDM) -- C:\Windows\SysNative\drivers\s1029mgmt.sys (MCCI Corporation) DRV:64bit: - (s1029obex) -- C:\Windows\SysNative\drivers\s1029obex.sys (MCCI Corporation) DRV:64bit: - (s1029mdm) -- C:\Windows\SysNative\drivers\s1029mdm.sys (MCCI Corporation) DRV:64bit: - (s1029nd5) Sony Ericsson Device 1029 USB Ethernet Emulation (NDIS) -- C:\Windows\SysNative\drivers\s1029nd5.sys (MCCI Corporation) DRV:64bit: - (s1029mdfl) -- C:\Windows\SysNative\drivers\s1029mdfl.sys (MCCI Corporation) DRV:64bit: - (s1029bus) Sony Ericsson Device 1029 driver (WDM) -- C:\Windows\SysNative\drivers\s1029bus.sys (MCCI Corporation) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.) DRV:64bit: - (LGPBTDD) -- C:\Windows\SysNative\drivers\LGPBTDD.sys (Logitech Inc.) DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys (TuneUp Software) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\URLSearchHook: - No CLSID value found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com/?l=dis&o=101702 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F9 F4 BF 61 72 70 CB 01 [binary data] IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - No CLSID value found IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{23E8AE3B-368B-4F2D-B5A2-325B8979A9BB}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=382950&p={searchTerms} IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SKPT_de IE - HKCU\..\SearchScopes\{A6AB4EA8-ADE4-450E-B40A-7B4AF3174A60}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=FXTV5&o=101699&src=kw&q={searchTerms}&locale=&apn_ptnrs=F4&apn_dtid=YYYYYYYYDE&apn_uid=9a6dd342-a612-4f83-88af-d3328a31b16b&apn_sauid=0A1FDA0B-78B1-4646-A6F1-917192819B6E IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Yahoo" FF - prefs.js..browser.search.defaultthis.engineName: "uTorrentBar_DE Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q=" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=382950&ilc=12" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.11 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {a8864317-e18b-4292-99d9-e6e65ab905d3}:3.3.3.2 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {75656794-AB59-4712-BFBC-5D816D56F3BC}:1.1.6 FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.3 FF - prefs.js..extensions.enabledItems: youtubedownloader@mybrowserbar.com:4.3 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2 FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.3.3.2 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9 FF - prefs.js..extensions.enabledItems: {c840e246-6b95-475e-9bd7-caa1c7eca9f2}:3.3.3.2 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: info@djzig.com:1.2.3 FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=382950&p=" FF - prefs.js..network.proxy.type: 0 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll File not found FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Michali\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Michali\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.03.18 01:13:24 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.04.30 13:34:09 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\mozilla_cc@internetdownloadmanager.com: C:\Users\Michali\AppData\Roaming\IDM\idmmzcc5 [2012.02.18 13:54:37 | 000,000,000 | ---D | M] [2010.10.20 18:26:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michali\AppData\Roaming\mozilla\Extensions [2012.03.16 11:35:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michali\AppData\Roaming\mozilla\Firefox\Profiles\rugo9c6x.default\extensions [2012.03.16 11:35:17 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Michali\AppData\Roaming\mozilla\Firefox\Profiles\rugo9c6x.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} [2011.10.10 17:44:05 | 000,002,399 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\askcom.xml [2012.03.22 09:05:49 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-1.xml [2011.09.28 15:20:18 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-2.xml [2011.04.15 17:57:13 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-3.xml [2011.04.29 11:25:53 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-4.xml [2011.06.22 15:39:32 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-5.xml [2011.08.06 15:21:40 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-6.xml [2011.09.08 16:58:10 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-7.xml [2011.09.10 07:55:30 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-8.xml [2011.10.02 01:05:41 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-9.xml [2011.03.16 17:54:42 | 000,001,056 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin.xml [2011.12.31 18:37:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.03.13 16:25:44 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} () (No name found) -- C:\USERS\MICHALI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RUGO9C6X.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI () (No name found) -- C:\USERS\MICHALI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RUGO9C6X.DEFAULT\EXTENSIONS\ICH@MALTEGOETZ.DE.XPI [2012.03.18 01:13:24 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.11.19 14:56:43 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2011.10.01 21:12:39 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.10.01 21:12:39 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011.10.01 21:12:39 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.10.01 21:12:39 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.10.01 21:12:39 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011.10.01 21:12:39 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Michali\AppData\Local\Google\Chrome\Application\17.0.963.83\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Michali\AppData\Local\Google\Chrome\Application\17.0.963.83\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Michali\AppData\Local\Google\Chrome\Application\17.0.963.83\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll CHR - plugin: Skype Toolbars (Enabled) = C:\Users\Michali\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Nexon Game Controller (Enabled) = C:\ProgramData\NexonEU\NGM\npNxGameeu.dll CHR - plugin: Google Update (Enabled) = C:\Users\Michali\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: YouTube = C:\Users\Michali\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\Michali\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\ CHR - Extension: Skype Click to Call = C:\Users\Michali\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\ CHR - Extension: Google Mail = C:\Users\Michali\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2011.04.02 23:01:58 | 000,000,826 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - No CLSID value found. O4:64bit: - HKLM..\Run: [Launch LCDMon] C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [Launch LgDevAgt] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [4StoryPrePatch] D:\VIER GESCHICHTE\4Story_DE\PrePatch.exe (Zemi Interactive Inc.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [ Malwarebytes Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [XCMsXSJotCWrp.exe] C:\ProgramData\XCMsXSJotCWrp.exe File not found O4 - HKCU..\Run: [rhExurxY9nsbJO] C:\ProgramData\rhExurxY9nsbJO.exe ( ) O4 - HKCU..\Run: [ScreenSnapr] C:\Program Files (x86)\ScreenSnapr\ScreenSnapr.exe (Byteopia) O4 - Startup: C:\Users\Michali\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8:64bit: - Extra context menu item: Download with Xilisoft YouTube Vidéo Téléchargeur - C:\Program Files (x86)\Xilisoft\Download YouTube Video\upod_link.HTM File not found O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html File not found O8 - Extra context menu item: Download with Xilisoft YouTube Vidéo Téléchargeur - C:\Program Files (x86)\Xilisoft\Download YouTube Video\upod_link.HTM File not found O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html File not found O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1C1AEC7B-DA6E-4CE0-B588-CDBD5C35133E}: DhcpNameServer = 139.7.30.125 139.7.30.126 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{58D6F2CF-A09A-403D-A41A-C8DED0025956}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O30:64bit: - LSA: Security Packages - (livessp) - File not found O30 - LSA: Security Packages - (livessp) - File not found O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010.10.07 20:44:13 | 000,000,000 | ---D | M] - F:\AutoMiner Pro -- [ NTFS ] O32 - Unable to obtain root file information for disk F:\ O33 - MountPoints2\{aba02871-dced-11df-bc4c-001fd09ad884}\Shell - "" = AutoRun O33 - MountPoints2\{aba02871-dced-11df-bc4c-001fd09ad884}\Shell\AutoRun\command - "" = G:\Startme.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll (TuneUp Software) MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GamersFirst LIVE!.lnk - - File not found MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ShortKeys Lite.lnk - C:\PROGRA~2\SHORTK~1\shklite.exe - (Insight Software Solutions) MsConfig:64bit - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () MsConfig:64bit - StartUpReg: FGbclJqUjQWpxnTOPNSDvDhItKNQIhKoZUJdULYjSRFqSoBPwO - hkey= - key= - File not found MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.) MsConfig:64bit - StartUpReg: KPeerNexonEU - hkey= - key= - File not found MsConfig:64bit - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= - File not found MsConfig:64bit - StartUpReg: MP3 Skype Recorder - hkey= - key= - File not found MsConfig:64bit - StartUpReg: SearchSettings - hkey= - key= - File not found MsConfig:64bit - StartUpReg: Sony Ericsson PC Companion - hkey= - key= - File not found MsConfig:64bit - StartUpReg: Steam - hkey= - key= - File not found MsConfig:64bit - StartUpReg: swg - hkey= - key= - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.03.25 18:50:28 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\Michali\Desktop\OTL.exe [2012.03.25 18:27:35 | 009,502,424 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Michali\Desktop\mbam-setup-1.60.1.1000.exe [2012.03.25 18:21:14 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Users\Michali\Desktop\OTH.scr [2012.03.25 16:28:38 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012.03.25 15:13:51 | 000,000,000 | ---D | C] -- C:\sh4ldr [2012.03.25 15:13:51 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group [2012.03.25 15:13:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard [2012.03.25 13:35:01 | 000,389,024 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\Michali\Desktop\unhide.exe [2012.03.25 13:26:26 | 000,000,000 | ---D | C] -- C:\Users\Michali\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check [2012.03.24 22:46:37 | 000,000,000 | ---D | C] -- C:\Users\Michali\AppData\Roaming\mIRC [2012.03.24 22:46:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\mIRC [2012.03.24 22:46:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\mIRC [2012.03.24 22:46:21 | 001,909,192 | ---- | C] (mIRC Co. Ltd.) -- C:\Users\Michali\Desktop\mirc722.exe [2012.03.23 14:12:37 | 000,000,000 | ---D | C] -- C:\Users\Michali\AppData\Roaming\Hyperdesktop [2012.03.22 20:29:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScreenSnapr [2012.03.22 20:29:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ScreenSnapr [2012.03.13 16:25:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2012.03.13 16:25:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype [2012.03.12 20:16:57 | 000,000,000 | ---D | C] -- C:\Users\Michali\Documents\My Chat Logs [2012.03.11 21:04:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\konami [2012.03.09 21:02:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CamStudio [2012.03.09 21:02:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CamStudio [2012.02.27 17:15:05 | 000,000,000 | ---D | C] -- C:\Users\Michali\quarterx2 [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.03.25 19:07:18 | 000,020,790 | ---- | M] () -- C:\Users\Michali\Desktop\otllog.rar [2012.03.25 18:50:26 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Michali\Desktop\OTL.exe [2012.03.25 18:47:00 | 000,001,128 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2411381332-2107499652-1412120219-1000UA.job [2012.03.25 18:45:04 | 000,000,264 | ---- | M] () -- C:\ProgramData\~rhExurxY9nsbJO [2012.03.25 18:45:04 | 000,000,176 | ---- | M] () -- C:\ProgramData\~rhExurxY9nsbJOr [2012.03.25 18:44:52 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.03.25 18:44:52 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.03.25 18:44:35 | 000,000,653 | ---- | M] () -- C:\Users\Michali\Desktop\System Check.lnk [2012.03.25 18:42:45 | 000,696,832 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.03.25 18:42:45 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.03.25 18:42:45 | 000,148,128 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.03.25 18:42:45 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.03.25 18:42:44 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.03.25 18:35:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.03.25 18:29:50 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.03.25 18:27:45 | 009,502,424 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Michali\Desktop\mbam-setup-1.60.1.1000.exe [2012.03.25 18:25:59 | 000,001,584 | ---- | M] () -- C:\Users\Michali\Desktop\mbam - Verknüpfung.lnk [2012.03.25 18:21:07 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Users\Michali\Desktop\OTH.scr [2012.03.25 17:45:21 | 000,000,560 | ---- | M] () -- C:\ProgramData\rhExurxY9nsbJO [2012.03.25 15:55:24 | 000,000,062 | ---- | M] () -- C:\ProgramData\rhExurxY9nsbJO.lic [2012.03.25 13:34:20 | 000,389,024 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\Michali\Desktop\unhide.exe [2012.03.25 13:26:13 | 000,361,472 | ---- | M] ( ) -- C:\ProgramData\rhExurxY9nsbJO.exe [2012.03.25 12:31:48 | 000,000,046 | ---- | M] () -- C:\Users\Michali\jagex_runescape_preferences.dat [2012.03.25 11:07:18 | 000,000,129 | ---- | M] () -- C:\Users\Michali\jagex_runescape_preferences2.dat [2012.03.24 22:46:37 | 000,000,955 | ---- | M] () -- C:\Users\Public\Desktop\mIRC.lnk [2012.03.24 22:45:59 | 001,909,192 | ---- | M] (mIRC Co. Ltd.) -- C:\Users\Michali\Desktop\mirc722.exe [2012.03.24 22:21:44 | 000,000,032 | ---- | M] () -- C:\Users\Michali\jagex_cl_runescape_LIVE.dat [2012.03.24 20:47:00 | 000,001,076 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2411381332-2107499652-1412120219-1000Core.job [2012.03.24 12:43:21 | 000,088,202 | ---- | M] () -- C:\Users\Michali\Desktop\coolbro.jpg [2012.03.23 14:12:37 | 000,000,921 | ---- | M] () -- C:\Users\Michali\Desktop\Hyperdesktop.lnk [2012.03.23 09:41:47 | 000,002,413 | ---- | M] () -- C:\Users\Michali\Desktop\Google Chrome.lnk [2012.03.22 20:29:23 | 000,001,047 | ---- | M] () -- C:\Users\Public\Desktop\ScreenSnapr.lnk [2012.03.17 21:22:08 | 000,331,947 | ---- | M] () -- C:\Users\Michali\Desktop\3316297_700b.jpg [2012.03.17 21:04:19 | 000,001,014 | ---- | M] () -- C:\Users\Michali\Desktop\U7O1O - Imgur.gif [2012.03.17 21:04:15 | 000,001,136 | ---- | M] () -- C:\Users\Michali\Desktop\isF99 - Imgur.gif [2012.03.17 21:04:10 | 000,001,279 | ---- | M] () -- C:\Users\Michali\Desktop\1yVGB - Imgur.gif [2012.03.17 21:02:27 | 000,001,130 | ---- | M] () -- C:\Users\Michali\Desktop\WDoQA - Imgur.gif [2012.03.17 21:02:23 | 000,001,845 | ---- | M] () -- C:\Users\Michali\Desktop\xPoFX - Imgur.gif [2012.03.17 21:02:18 | 000,001,562 | ---- | M] () -- C:\Users\Michali\Desktop\ipNSU - Imgur.gif [2012.03.16 17:29:39 | 001,829,531 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0081.JPG [2012.03.15 22:54:33 | 002,335,823 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0079.JPG [2012.03.15 20:21:08 | 000,000,047 | ---- | M] () -- C:\Users\Michali\jagex_cl_runescape_LIVE1.dat [2012.03.15 00:44:12 | 004,853,912 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.03.13 16:25:31 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2012.03.11 21:04:58 | 000,001,639 | ---- | M] () -- C:\Users\Public\Desktop\Yu-Gi-Oh! ONLINE 3.lnk [2012.03.11 20:28:31 | 000,000,191 | ---- | M] () -- C:\Users\Michali\Documents\serviceidygoo.rtf [2012.03.11 13:04:48 | 002,585,116 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0059.JPG [2012.03.11 12:52:49 | 000,090,869 | ---- | M] () -- C:\Users\Michali\Desktop\heavy-rain-move-edition-platinum--sony-ps3-.gif [2012.03.11 12:44:22 | 000,025,825 | ---- | M] () -- C:\Users\Michali\Desktop\popup_images_image_10005563-UK_1.jpg [2012.03.11 12:30:47 | 000,028,865 | ---- | M] () -- C:\Users\Michali\Desktop\1902737.jpg [2012.03.11 11:00:45 | 001,489,811 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0058.JPG [2012.03.11 10:06:04 | 000,005,687 | ---- | M] () -- C:\Users\Michali\Documents\ayo.rtf [2012.03.10 21:04:37 | 002,333,392 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0057.JPG [2012.03.10 20:46:59 | 002,478,503 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0056.JPG [2012.03.10 19:57:52 | 002,219,464 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0049.JPG [2012.03.10 19:57:44 | 001,831,321 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0050.JPG [2012.03.09 21:02:08 | 000,001,018 | ---- | M] () -- C:\Users\Public\Desktop\CamStudio.lnk [2012.03.08 21:21:02 | 001,621,750 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0005.JPG [2012.03.07 20:34:02 | 001,079,503 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_07032012_193413.png [2012.03.04 00:41:06 | 000,001,011 | ---- | M] () -- C:\Users\Michali\Desktop\SwiftKit.lnk [2012.03.03 21:55:28 | 002,002,044 | ---- | M] () -- C:\Users\Michali\Desktop\ScreenShot001.png [2012.03.01 22:58:47 | 000,024,471 | ---- | M] () -- C:\Users\Michali\Desktop\mlp_omg.jpg [2012.03.01 21:19:18 | 000,000,193 | ---- | M] () -- C:\Windows\WORDPAD.INI [2012.02.29 23:55:37 | 000,001,332 | ---- | M] () -- C:\Users\Michali\Desktop\tshirts.rtf [2012.02.27 23:45:33 | 000,000,304 | ---- | M] () -- C:\Users\Michali\Desktop\Fortsetzen Download League of Legends.url [2012.02.27 23:40:04 | 002,403,335 | ---- | M] () -- C:\Users\Michali\Desktop\electro test.mp3 [2012.02.27 19:22:00 | 000,007,622 | ---- | M] () -- C:\Users\Michali\AppData\Local\Resmon.ResmonCfg [2012.02.25 23:50:56 | 000,000,274 | ---- | M] () -- C:\Users\Michali\.jupload.properties [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.03.25 19:07:04 | 000,020,790 | ---- | C] () -- C:\Users\Michali\Desktop\otllog.rar [2012.03.25 18:44:35 | 000,000,653 | ---- | C] () -- C:\Users\Michali\Desktop\System Check.lnk [2012.03.25 18:29:50 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.03.25 18:25:59 | 000,001,584 | ---- | C] () -- C:\Users\Michali\Desktop\mbam - Verknüpfung.lnk [2012.03.25 15:55:24 | 000,000,062 | ---- | C] () -- C:\ProgramData\rhExurxY9nsbJO.lic [2012.03.25 15:17:30 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2012.03.25 15:17:30 | 000,002,213 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk [2012.03.25 15:17:30 | 000,002,193 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities 2011.lnk [2012.03.25 15:17:30 | 000,001,866 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk [2012.03.25 15:17:30 | 000,001,783 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2012.03.25 15:17:30 | 000,001,639 | ---- | C] () -- C:\Users\Public\Desktop\Yu-Gi-Oh! ONLINE 3.lnk [2012.03.25 15:17:30 | 000,001,166 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk [2012.03.25 15:17:30 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\Foxit Reader 5.0.lnk [2012.03.25 15:17:30 | 000,001,047 | ---- | C] () -- C:\Users\Public\Desktop\ScreenSnapr.lnk [2012.03.25 15:17:30 | 000,001,039 | ---- | C] () -- C:\Users\Public\Desktop\DiskAid.lnk [2012.03.25 15:17:30 | 000,001,023 | ---- | C] () -- C:\Users\Public\Desktop\iExplorer.lnk [2012.03.25 15:17:30 | 000,000,986 | ---- | C] () -- C:\Users\Public\Desktop\Gyazo.lnk [2012.03.25 15:17:30 | 000,000,955 | ---- | C] () -- C:\Users\Public\Desktop\mIRC.lnk [2012.03.25 15:17:29 | 000,001,246 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk [2012.03.25 15:17:29 | 000,001,018 | ---- | C] () -- C:\Users\Public\Desktop\CamStudio.lnk [2012.03.25 15:17:29 | 000,000,691 | ---- | C] () -- C:\Users\Public\Desktop\4Story.lnk [2012.03.25 15:17:28 | 000,001,547 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk [2012.03.25 15:17:28 | 000,001,210 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk [2012.03.25 15:17:27 | 000,002,205 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2011.lnk [2012.03.25 15:17:27 | 000,001,352 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk [2012.03.25 15:17:27 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk [2012.03.25 15:17:24 | 000,001,864 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2012.03.25 15:17:24 | 000,001,102 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk [2012.03.25 15:17:23 | 000,001,330 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk [2012.03.25 15:17:19 | 000,001,150 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.03.25 15:17:18 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk [2012.03.25 15:17:14 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk [2012.03.25 15:17:14 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk [2012.03.25 13:26:26 | 000,000,264 | ---- | C] () -- C:\ProgramData\~rhExurxY9nsbJO [2012.03.25 13:26:26 | 000,000,176 | ---- | C] () -- C:\ProgramData\~rhExurxY9nsbJOr [2012.03.25 13:26:23 | 000,000,560 | ---- | C] () -- C:\ProgramData\rhExurxY9nsbJO [2012.03.25 13:26:13 | 000,361,472 | ---- | C] ( ) -- C:\ProgramData\rhExurxY9nsbJO.exe [2012.03.24 12:43:21 | 000,088,202 | ---- | C] () -- C:\Users\Michali\Desktop\coolbro.jpg [2012.03.23 14:12:37 | 000,000,921 | ---- | C] () -- C:\Users\Michali\Desktop\Hyperdesktop.lnk [2012.03.17 21:22:07 | 000,331,947 | ---- | C] () -- C:\Users\Michali\Desktop\3316297_700b.jpg [2012.03.17 21:04:18 | 000,001,014 | ---- | C] () -- C:\Users\Michali\Desktop\U7O1O - Imgur.gif [2012.03.17 21:04:14 | 000,001,136 | ---- | C] () -- C:\Users\Michali\Desktop\isF99 - Imgur.gif [2012.03.17 21:04:10 | 000,001,279 | ---- | C] () -- C:\Users\Michali\Desktop\1yVGB - Imgur.gif [2012.03.17 21:02:27 | 000,001,130 | ---- | C] () -- C:\Users\Michali\Desktop\WDoQA - Imgur.gif [2012.03.17 21:02:23 | 000,001,845 | ---- | C] () -- C:\Users\Michali\Desktop\xPoFX - Imgur.gif [2012.03.17 21:02:17 | 000,001,562 | ---- | C] () -- C:\Users\Michali\Desktop\ipNSU - Imgur.gif [2012.03.16 17:29:30 | 001,829,531 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0081.JPG [2012.03.15 22:56:29 | 002,335,823 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0079.JPG [2012.03.11 20:28:31 | 000,000,191 | ---- | C] () -- C:\Users\Michali\Documents\serviceidygoo.rtf [2012.03.11 13:09:22 | 002,585,116 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0059.JPG [2012.03.11 13:09:18 | 001,621,750 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0005.JPG [2012.03.11 12:52:48 | 000,090,869 | ---- | C] () -- C:\Users\Michali\Desktop\heavy-rain-move-edition-platinum--sony-ps3-.gif [2012.03.11 12:44:22 | 000,025,825 | ---- | C] () -- C:\Users\Michali\Desktop\popup_images_image_10005563-UK_1.jpg [2012.03.11 12:30:46 | 000,028,865 | ---- | C] () -- C:\Users\Michali\Desktop\1902737.jpg [2012.03.11 11:00:36 | 001,489,811 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0058.JPG [2012.03.11 10:06:04 | 000,005,687 | ---- | C] () -- C:\Users\Michali\Documents\ayo.rtf [2012.03.10 21:04:28 | 002,333,392 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0057.JPG [2012.03.10 20:46:51 | 002,478,503 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0056.JPG [2012.03.10 19:57:36 | 001,831,321 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0050.JPG [2012.03.10 19:57:29 | 002,219,464 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0049.JPG [2012.03.07 20:33:19 | 001,079,503 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_07032012_193413.png [2012.03.04 00:41:06 | 000,001,011 | ---- | C] () -- C:\Users\Michali\Desktop\SwiftKit.lnk [2012.03.03 21:55:12 | 002,002,044 | ---- | C] () -- C:\Users\Michali\Desktop\ScreenShot001.png [2012.03.01 22:58:45 | 000,024,471 | ---- | C] () -- C:\Users\Michali\Desktop\mlp_omg.jpg [2012.03.01 21:19:18 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI [2012.02.29 23:55:03 | 000,001,332 | ---- | C] () -- C:\Users\Michali\Desktop\tshirts.rtf [2012.02.27 23:45:33 | 000,000,304 | ---- | C] () -- C:\Users\Michali\Desktop\Fortsetzen Download League of Legends.url [2012.02.27 23:39:18 | 002,403,335 | ---- | C] () -- C:\Users\Michali\Desktop\electro test.mp3 [2012.02.27 19:22:00 | 000,007,622 | ---- | C] () -- C:\Users\Michali\AppData\Local\Resmon.ResmonCfg [2012.01.20 20:48:38 | 001,589,618 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.01.08 23:08:42 | 000,100,712 | ---- | C] () -- C:\Windows\SysWow64\mlfcache.dat [2011.09.20 17:44:23 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2011.07.01 23:04:51 | 000,000,080 | RHS- | C] () -- C:\Windows\SysWow64\98BB2AED3C.dll [2011.03.31 21:23:47 | 000,004,608 | ---- | C] () -- C:\Users\Michali\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.10.20 18:21:34 | 000,000,056 | ---- | C] () -- C:\ProgramData\ezsidmv.dat [2010.10.20 16:37:01 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI ========== LOP Check ========== [2012.03.23 15:02:49 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\.minecraft [2011.05.07 21:52:06 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Auslogics [2012.01.16 13:08:20 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Babylon [2012.02.12 12:45:55 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\DiskAid [2011.07.10 19:46:41 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\DMCache [2011.09.06 22:33:23 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\DVDVideoSoft [2012.02.10 14:20:58 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\DVDVideoSoftIEHelpers [2011.09.09 11:10:20 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Foxit Software [2011.06.02 16:48:26 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\FreeFLVConverter [2011.11.12 12:24:42 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\GetRightToGo [2011.05.28 08:40:03 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\go [2012.02.12 22:18:51 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Gyazo [2012.03.23 14:12:37 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Hyperdesktop [2011.03.02 10:21:06 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\ICQ [2012.02.18 13:55:14 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\IDM [2011.04.01 13:39:05 | 000,000,000 | RHSD | M] -- C:\Users\Michali\AppData\Roaming\install [2011.05.20 13:10:27 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\IObit [2010.10.21 00:36:58 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Macro Recorder [2010.12.22 17:41:44 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\MP3SkypeRecorder [2011.01.22 00:54:34 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\OpenOffice.org [2010.12.02 12:35:44 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\PhotoScape [2012.01.20 20:29:22 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\redsn0w [2011.10.31 14:12:05 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Sony [2011.06.06 22:26:15 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Stu Bedore [2011.02.25 17:18:27 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\TeamViewer [2011.08.01 19:21:13 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\TS3Client [2011.06.12 20:49:35 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\TuneUp Software [2010.11.09 23:04:54 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Windows SideBar [2011.03.12 19:05:41 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\WindSolutions [2011.07.22 17:28:15 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Xilisoft [2012.03.05 14:35:12 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2010.10.19 16:38:57 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2011.04.16 22:52:27 | 000,000,000 | ---D | M] -- C:\.562_cache_32v4 [2010.12.25 16:13:32 | 000,000,000 | ---D | M] -- C:\.cache03_32 [2010.12.02 18:42:32 | 000,000,000 | ---D | M] -- C:\.jagex_cache_32 [2012.03.25 18:35:40 | 000,000,000 | -HSD | M] -- C:\Config.Msi [2011.09.20 17:44:30 | 000,000,000 | ---D | M] -- C:\ConverterOutput [2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2010.10.19 16:38:40 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2010.11.27 18:48:36 | 000,000,000 | ---D | M] -- C:\DSPK [2011.12.26 23:06:41 | 000,000,000 | ---D | M] -- C:\Inceptioncache81 [2010.10.19 17:05:28 | 000,000,000 | ---D | M] -- C:\Intel [2010.12.07 20:57:24 | 000,000,000 | ---D | M] -- C:\jc-scape_cache_32 [2011.04.28 20:36:57 | 000,000,000 | ---D | M] -- C:\Nexon [2010.10.19 17:19:11 | 000,000,000 | ---D | M] -- C:\NVIDIA [2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs [2012.03.25 15:13:51 | 000,000,000 | R--D | M] -- C:\Program Files [2012.03.24 22:46:37 | 000,000,000 | R--D | M] -- C:\Program Files (x86) [2012.03.25 18:36:36 | 000,000,000 | ---D | M] -- C:\ProgramData [2010.10.19 16:38:40 | 000,000,000 | -HSD | M] -- C:\Programme [2010.10.19 16:38:40 | 000,000,000 | -HSD | M] -- C:\Recovery [2011.04.10 09:30:08 | 000,000,000 | ---D | M] -- C:\Screenshots [2012.03.25 16:28:39 | 000,000,000 | ---D | M] -- C:\sh4ldr [2012.03.25 19:11:43 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.12.04 15:34:11 | 000,000,000 | R--D | M] -- C:\Users [2012.03.25 18:35:58 | 000,000,000 | ---D | M] -- C:\Windows [2011.09.20 17:44:38 | 000,000,000 | ---D | M] -- C:\YouTubeDownload [2010.10.22 11:44:28 | 000,000,000 | ---D | M] -- C:\zee_store < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < MD5 for: AGP440.SYS > [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll [2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll < MD5 for: EXPLORER.EXE > [2011.02.26 08:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\explorer.exe [2011.02.26 08:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe [2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe [2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\SysWOW64\explorer.exe [2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe [2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe [2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe [2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX0\procs\explorer.exe [2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX1\procs\explorer.exe [2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX10\procs\explorer.exe [2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX11\procs\explorer.exe [2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX12\procs\explorer.exe [2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX2\procs\explorer.exe [2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX3\procs\explorer.exe [2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX4\procs\explorer.exe [2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX5\procs\explorer.exe [2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX6\procs\explorer.exe [2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX7\procs\explorer.exe [2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX8\procs\explorer.exe [2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX9\procs\explorer.exe [2009.08.03 08:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe [2009.10.31 08:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX0\h\explorer.exe [2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX1\h\explorer.exe [2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX10\h\explorer.exe [2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX11\h\explorer.exe [2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX12\h\explorer.exe [2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX2\h\explorer.exe [2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX3\h\explorer.exe [2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX4\h\explorer.exe [2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX5\h\explorer.exe [2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX6\h\explorer.exe [2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX7\h\explorer.exe [2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX8\h\explorer.exe [2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX9\h\explorer.exe [2009.10.31 08:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2011.02.26 08:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe [2009.08.03 08:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe < MD5 for: IASTORV.SYS > [2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys [2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys [2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\SysNative\drivers\iaStorV.sys [2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0033117673c16921\iaStorV.sys [2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys [2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys [2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\SysNative\netlogon.dll [2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys [2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\SysNative\drivers\nvstor.sys [2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_38e464dbe521cc7f\nvstor.sys [2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys [2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys [2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys [2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll [2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\SysNative\scecli.dll [2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\SysNative\user32.dll [2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll [2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll [2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll < MD5 for: USERINIT.EXE > [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe [2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX0\userinit.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX1\userinit.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX10\userinit.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX11\userinit.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX12\userinit.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX2\userinit.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX3\userinit.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX4\userinit.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX5\userinit.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX6\userinit.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX7\userinit.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX8\userinit.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX9\userinit.exe < MD5 for: WINLOGON.EXE > [2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX0\winlogon.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX1\winlogon.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX10\winlogon.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX11\winlogon.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX12\winlogon.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX2\winlogon.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX3\winlogon.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX4\winlogon.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX5\winlogon.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX6\winlogon.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX7\winlogon.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX8\winlogon.exe [2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX9\winlogon.exe [2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe [2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\system32\*.dll /lockedfiles > [2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] < %USERPROFILE%\*.* > [2012.02.25 23:50:56 | 000,000,274 | ---- | M] () -- C:\Users\Michali\.jupload.properties [2010.11.21 23:01:45 | 006,239,070 | ---- | M] () -- C:\Users\Michali\01 Alles Neu(192Kbps).mp3 [2010.11.21 23:01:51 | 005,215,816 | ---- | M] () -- C:\Users\Michali\02 Schwarz Zu Blau(192Kbps).mp3 [2010.11.21 22:55:52 | 005,225,576 | ---- | M] () -- C:\Users\Michali\03 Haus Am See(192Kbps).mp3 [2010.11.21 23:01:44 | 004,882,158 | ---- | M] () -- C:\Users\Michali\04 Kopf Verloren(192Kbps).mp3 [2010.11.21 23:00:46 | 005,642,748 | ---- | M] () -- C:\Users\Michali\05 Das Zweite Gesicht(192Kbps).mp3 [2010.11.21 22:59:51 | 004,754,454 | ---- | M] () -- C:\Users\Michali\07 Ich Steine, Du Steine(192Kbps).mp3 [2010.11.21 23:01:04 | 005,419,266 | ---- | M] () -- C:\Users\Michali\08 Lok Auf 2 Beinen(192Kbps).mp3 [2010.11.21 23:01:32 | 005,301,322 | ---- | M] () -- C:\Users\Michali\09 Stadtaffe(192Kbps).mp3 [2010.11.21 23:02:18 | 006,128,894 | ---- | M] () -- C:\Users\Michali\10 Fieber(192Kbps).mp3 [2010.11.21 22:57:43 | 004,145,982 | ---- | M] () -- C:\Users\Michali\11 Schüttel Deinen Speck(192Kbps).mp3 [2010.11.21 23:01:16 | 004,768,852 | ---- | M] () -- C:\Users\Michali\12 Zucker(192Kbps).mp3 [2011.07.06 22:12:07 | 000,916,570 | ---- | M] () -- C:\Users\Michali\2011_07_06_22_10_04_w0_Gyllian.jpg [2011.07.06 22:12:06 | 000,894,487 | ---- | M] () -- C:\Users\Michali\2011_07_06_22_10_29_w0_Gyllian.jpg [2011.07.11 20:46:38 | 000,845,697 | ---- | M] () -- C:\Users\Michali\2011_07_11_03_29_28_w0_xXBlueDiamondXx.jpg [2011.07.11 20:46:45 | 000,830,580 | ---- | M] () -- C:\Users\Michali\2011_07_11_03_32_51_w0_xXBlueDiamondXx.jpg [2011.07.23 21:46:41 | 000,971,530 | ---- | M] () -- C:\Users\Michali\2011_07_23_20_32_17_w0_Gyllian.jpg [2011.07.23 21:46:43 | 000,968,430 | ---- | M] () -- C:\Users\Michali\2011_07_23_20_33_34_w0_Gyllian.jpg [2011.07.23 21:46:43 | 000,948,155 | ---- | M] () -- C:\Users\Michali\2011_07_23_20_36_30_w0_Gyllian.jpg [2011.07.23 21:46:33 | 000,927,359 | ---- | M] () -- C:\Users\Michali\2011_07_23_20_37_07_w0_Gyllian.jpg [2011.10.04 18:48:42 | 000,922,001 | ---- | M] () -- C:\Users\Michali\2011_10_03_23_52_17_w0_Gordon.jpg [2011.10.04 18:48:42 | 000,946,298 | ---- | M] () -- C:\Users\Michali\2011_10_03_23_52_25_w0_Gordon.jpg [2010.12.07 20:57:24 | 000,000,000 | ---- | M] () -- C:\Users\Michali\614_preferences.dat [2011.04.17 22:29:41 | 000,000,004 | ---- | M] () -- C:\Users\Michali\cache.dat [2011.06.05 10:04:29 | 000,001,101 | ---- | M] () -- C:\Users\Michali\Dokumente.lnk [2012.01.02 13:39:23 | 000,000,046 | ---- | M] () -- C:\Users\Michali\exemptionx_ExemptionX 634_preferences.dat [2012.01.02 13:39:59 | 000,000,099 | ---- | M] () -- C:\Users\Michali\exemptionx_ExemptionX 634_preferences2.dat [2012.01.02 13:38:58 | 000,000,000 | ---- | M] () -- C:\Users\Michali\exemptionx__preferences3.dat [2011.02.13 00:04:05 | 000,000,000 | ---- | M] () -- C:\Users\Michali\Foto 0391.jpg [2011.03.01 17:22:53 | 000,000,024 | ---- | M] () -- C:\Users\Michali\jagexappletviewer.preferences [2012.03.24 22:21:44 | 000,000,032 | ---- | M] () -- C:\Users\Michali\jagex_cl_runescape_LIVE.dat [2012.03.15 20:21:08 | 000,000,047 | ---- | M] () -- C:\Users\Michali\jagex_cl_runescape_LIVE1.dat [2012.03.25 12:31:48 | 000,000,046 | ---- | M] () -- C:\Users\Michali\jagex_runescape_preferences.dat [2012.03.25 11:07:18 | 000,000,129 | ---- | M] () -- C:\Users\Michali\jagex_runescape_preferences2.dat [2010.12.07 21:15:56 | 000,000,000 | ---- | M] () -- C:\Users\Michali\jagex__preferences3.dat [2012.03.25 19:14:52 | 002,883,584 | -HS- | M] () -- C:\Users\Michali\ntuser.dat [2012.03.25 19:14:52 | 000,262,144 | -HS- | M] () -- C:\Users\Michali\ntuser.dat.LOG1 [2010.10.19 16:38:47 | 000,000,000 | -HS- | M] () -- C:\Users\Michali\ntuser.dat.LOG2 [2011.06.14 22:24:06 | 000,000,000 | -HS- | M] () -- C:\Users\Michali\NTUSER.DAT_tureg_new.LOG1 [2011.06.14 22:24:06 | 000,000,000 | -HS- | M] () -- C:\Users\Michali\NTUSER.DAT_tureg_new.LOG2 [2011.10.31 21:33:30 | 002,621,440 | -HS- | M] () -- C:\Users\Michali\NTUSER.DAT_tureg_old [2010.10.19 16:39:25 | 000,065,536 | -HS- | M] () -- C:\Users\Michali\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf [2010.10.19 16:39:25 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms [2010.10.19 16:39:25 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms [2011.11.01 01:32:36 | 000,065,536 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{05f5e566-03f7-11e1-9e49-806e6f6e6963}.TM.blf [2011.11.01 01:32:36 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{05f5e566-03f7-11e1-9e49-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms [2011.11.01 01:32:36 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{05f5e566-03f7-11e1-9e49-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms [2011.06.14 22:59:21 | 000,065,536 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{0d74b6ee-96c4-11e0-b0b9-806e6f6e6963}.TM.blf [2011.06.14 22:59:21 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{0d74b6ee-96c4-11e0-b0b9-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms [2011.06.14 22:59:21 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{0d74b6ee-96c4-11e0-b0b9-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms [2011.05.29 00:21:15 | 000,065,536 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{464e8eb1-88f1-11e0-a199-001fd09ad884}.TM.blf [2011.05.29 00:21:15 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{464e8eb1-88f1-11e0-a199-001fd09ad884}.TMContainer00000000000000000001.regtrans-ms [2011.05.29 00:21:15 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{464e8eb1-88f1-11e0-a199-001fd09ad884}.TMContainer00000000000000000002.regtrans-ms [2011.05.20 23:00:43 | 000,065,536 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{d62385c4-82be-11e0-ac06-001fd09ad884}.TM.blf [2011.05.20 23:00:43 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{d62385c4-82be-11e0-ac06-001fd09ad884}.TMContainer00000000000000000001.regtrans-ms [2011.05.20 23:00:43 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{d62385c4-82be-11e0-ac06-001fd09ad884}.TMContainer00000000000000000002.regtrans-ms [2010.10.19 16:38:47 | 000,000,020 | -HS- | M] () -- C:\Users\Michali\ntuser.ini [2011.11.10 21:30:42 | 005,108,736 | ---- | M] () -- C:\Users\Michali\P1010112.JPG [2011.11.10 21:30:58 | 005,467,648 | ---- | M] () -- C:\Users\Michali\P1010114.JPG [2011.04.02 20:51:36 | 000,000,435 | ---- | M] () -- C:\Users\Michali\umbrella0.log < %USERPROFILE%\Local Settings\Temp\*.exe > < %USERPROFILE%\Local Settings\Temp\*.dll > < %USERPROFILE%\Application Data\*.exe > < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 < End of report > Geändert von Cataracs (25.03.2012 um 18:24 Uhr) |
|
| Themen zu Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde? |
| check, data, erlaubt, euro, freundlich, funde, gen, google, heute, hoffe, kontakt, leute, malwarebytes, meldungen, morgen, nicht sicher, nichts, problem, prozesse, rechts, recovery, seite, setzen, symbol, system, windows 7 home, windows 7 home premium, wirklich, würde |
Linear-Darstellung
