hi wie ich schon gesehen habe is dieser trojaner in mode hier wie verlangt die OTL.Txt hoffe das ihr mir helfen könnt!


OTL logfile created on: 17.12.2011 16:52:55 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = D:\Schule
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

6,00 Gb Total Physical Memory | 3,54 Gb Available Physical Memory | 58,95% Memory free
11,99 Gb Paging File | 9,39 Gb Available in Paging File | 78,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,56 Gb Total Space | 41,77 Gb Free Space | 42,82% Space Free | Partition Type: NTFS
Drive D: | 48,83 Gb Total Space | 47,39 Gb Free Space | 97,06% Space Free | Partition Type: NTFS
Drive E: | 600,98 Gb Total Space | 66,00 Gb Free Space | 10,98% Space Free | Partition Type: NTFS
Drive F: | 416,93 Gb Total Space | 324,20 Gb Free Space | 77,76% Space Free | Partition Type: NTFS
Drive H: | 7,68 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive O: | 1,87 Gb Total Space | 0,53 Gb Free Space | 28,43% Space Free | Partition Type: FAT

Computer Name:-------- | User Name: ------- | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found --
PRC - [2011.12.17 16:49:30 | 000,584,192 | ---- | M] (OldTimer Tools) -- D:\Schule\OTL.exe
PRC - [2011.12.06 14:11:58 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011.11.07 20:27:02 | 028,846,216 | ---- | M] (Electronic Arts) -- C:\Program Files (x86)\Origin\Origin.exe
PRC - [2011.10.15 09:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.10.15 00:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2011.08.31 17:00:48 | 001,047,208 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
PRC - [2011.08.31 17:00:48 | 000,449,608 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011.08.25 15:25:00 | 000,886,760 | ---- | M] (Search-Results) -- C:\Program Files (x86)\Ask.com\Updater\Updater.exe
PRC - [2011.06.29 07:48:01 | 000,484,008 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
PRC - [2011.06.29 07:48:00 | 000,400,040 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
PRC - [2011.06.29 07:48:00 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.08 15:49:40 | 001,872,320 | ---- | M] (Emsi Software GmbH) -- C:\Program Files (x86)\a-squared Free\a2service.exe
PRC - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.05.11 14:10:44 | 000,167,040 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
PRC - [2011.05.10 21:28:30 | 003,769,048 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
PRC - [2011.05.10 21:27:38 | 005,607,080 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
PRC - [2011.05.10 21:21:12 | 003,834,456 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDMonSvc.exe
PRC - [2011.05.10 21:18:34 | 003,585,696 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFWSvc.exe
PRC - [2011.05.10 21:18:08 | 003,515,656 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
PRC - [2011.04.29 08:56:01 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.01 14:28:49 | 000,119,608 | ---- | M] (ICQ, LLC.) -- C:\Program Files (x86)\ICQ7.4\ICQ.exe
PRC - [2011.02.25 07:19:30 | 000,067,584 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\firefox.exe
PRC - [2011.02.24 17:30:17 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.02.15 02:32:52 | 001,230,704 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2010.12.02 10:18:56 | 000,760,720 | ---- | M] (Razer USA Ltd) -- C:\Program Files (x86)\Razer\Lachesis 5600\LachesisSysTray.exe
PRC - [2010.09.06 18:56:38 | 000,247,096 | ---- | M] () -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
PRC - [2009.12.28 17:25:40 | 000,036,864 | ---- | M] () -- C:\Program Files (x86)\Belkin\F7D4101\V1\wlansrv.exe
PRC - [2009.11.25 18:45:22 | 000,110,592 | ---- | M] () -- C:\Program Files (x86)\Belkin\F7D4101\V1\PBN.exe
PRC - [2009.11.16 19:59:28 | 000,286,720 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2006.11.17 17:42:46 | 000,053,341 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTSched.exe
PRC - [2006.04.18 03:00:00 | 000,102,400 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE


========== Modules (No Company Name) ==========

MOD - [2011.11.04 23:39:00 | 016,827,392 | R--- | M] () -- C:\Program Files (x86)\Origin\QtWebKit4.dll
MOD - [2011.11.04 23:18:14 | 000,312,320 | R--- | M] () -- C:\Program Files (x86)\Origin\imageformats\qtiff4.dll
MOD - [2011.11.04 23:18:14 | 000,264,192 | R--- | M] () -- C:\Program Files (x86)\Origin\imageformats\qmng4.dll
MOD - [2011.11.04 23:18:14 | 000,211,456 | R--- | M] () -- C:\Program Files (x86)\Origin\imageformats\qjpeg4.dll
MOD - [2011.11.04 23:18:12 | 000,172,544 | R--- | M] () -- C:\Program Files (x86)\Origin\codecs\qjpcodecs4.dll
MOD - [2011.11.04 23:18:12 | 000,158,208 | R--- | M] () -- C:\Program Files (x86)\Origin\codecs\qtwcodecs4.dll
MOD - [2011.11.04 23:18:12 | 000,143,872 | R--- | M] () -- C:\Program Files (x86)\Origin\codecs\qcncodecs4.dll
MOD - [2011.11.04 23:18:12 | 000,079,872 | R--- | M] () -- C:\Program Files (x86)\Origin\codecs\qkrcodecs4.dll
MOD - [2011.11.04 23:18:12 | 000,032,256 | R--- | M] () -- C:\Program Files (x86)\Origin\imageformats\qico4.dll
MOD - [2011.11.04 23:18:12 | 000,028,672 | R--- | M] () -- C:\Program Files (x86)\Origin\imageformats\qgif4.dll
MOD - [2011.11.04 23:16:30 | 000,327,680 | R--- | M] () -- C:\Program Files (x86)\Origin\phonon4.dll
MOD - [2011.11.04 23:16:26 | 000,413,184 | R--- | M] () -- C:\Program Files (x86)\Origin\QtXml4.dll
MOD - [2011.11.04 23:16:24 | 001,152,512 | R--- | M] () -- C:\Program Files (x86)\Origin\QtNetwork4.dll
MOD - [2011.11.04 23:16:22 | 009,440,256 | R--- | M] () -- C:\Program Files (x86)\Origin\QtGui4.dll
MOD - [2011.11.04 23:16:20 | 002,694,144 | R--- | M] () -- C:\Program Files (x86)\Origin\QtCore4.dll
MOD - [2011.02.25 07:19:30 | 000,067,584 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\firefox.exe
MOD - [2011.02.15 02:33:34 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011.02.15 02:32:52 | 001,230,704 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
MOD - [2010.12.02 10:18:58 | 000,014,208 | ---- | M] () -- C:\Program Files (x86)\Razer\Lachesis 5600\RzHook.dll
MOD - [2010.11.17 13:16:56 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2009.11.25 18:45:22 | 000,110,592 | ---- | M] () -- C:\Program Files (x86)\Belkin\F7D4101\V1\PBN.exe
MOD - [2009.09.15 19:17:20 | 000,200,704 | ---- | M] () -- C:\Program Files (x86)\Belkin\F7D4101\V1\BelkinwcuiDLL.dll


========== Win32 Services (SafeList) ==========

SRV - [2011.12.08 11:30:01 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.12.06 14:11:58 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.10.15 09:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.10.15 00:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.06.29 07:48:00 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.08 15:49:40 | 001,872,320 | ---- | M] (Emsi Software GmbH) [Auto | Running] -- C:\Program Files (x86)\a-squared Free\a2service.exe -- (a2free)
SRV - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.05.11 14:10:44 | 000,167,040 | ---- | M] (Safer-Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe -- (SDWSCService)
SRV - [2011.05.10 21:28:30 | 003,769,048 | ---- | M] (Safer-Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe -- (SDUpdateService)
SRV - [2011.05.10 21:21:12 | 003,834,456 | ---- | M] (Safer-Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDMonSvc.exe -- (SDMonitorService)
SRV - [2011.05.10 21:18:34 | 003,585,696 | ---- | M] (Safer-Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFWSvc.exe -- (SDFirewallService)
SRV - [2011.05.10 21:18:08 | 003,515,656 | ---- | M] (Safer-Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe -- (SDScannerService)
SRV - [2011.04.29 08:56:01 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.09 13:24:53 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2011.03.09 13:24:36 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2010.09.06 18:56:38 | 000,247,096 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.12.28 17:25:40 | 000,036,864 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Belkin\F7D4101\V1\wlansrv.exe -- (WLANBelkinService)
SRV - [2009.11.16 19:59:28 | 000,286,720 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.10.23 17:45:14 | 000,307,200 | ---- | M] (T-Systems Enterprise Services GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe -- (TDslMgrService)
SRV - [2006.04.18 03:00:00 | 000,102,400 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE -- (EPSON_PM_RPCV4_01) EPSON V3 Service4(01)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011.11.29 21:59:40 | 000,279,616 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.08.31 17:00:50 | 000,025,416 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011.08.28 18:53:24 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2011.08.28 18:53:23 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2011.06.29 07:48:01 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.06.29 07:48:01 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.18 16:36:58 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.01.13 12:58:00 | 000,413,800 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2009.11.06 08:40:26 | 000,838,136 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bcmwlhigh664.sys -- (BCMH43XX)
DRV:64bit: - [2009.07.31 03:40:32 | 000,025,600 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WRfiltv.sys -- (WRfiltv)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2007.08.01 14:49:02 | 000,019,008 | ---- | M] (T-Systems Enterprise Services GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dslmnlwf.sys -- (DslMNLwf)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2001.01.26 13:43:20 | 000,002,144 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\T-Com\DSLCheck\PciDumpr.sys -- (PciDumpr)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.linkury.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A4 7B E1 62 DB D1 CB 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Search-Results"
FF - prefs.js..browser.search.defaultenginename: "Search-Results"
FF - prefs.js..browser.search.order.1: "Search-Results"
FF - prefs.js..browser.search.selectedEngine: "Amazon.de"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: fastdial@telega.phpnet.us:3.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.5
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.13.1.18132
FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.4.4
FF - prefs.js..extensions.enabledItems: djziggy@gmail.com:1.3.7
FF - prefs.js..keyword.URL: "hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:7317400059&cof=FORID:11&sa=Search&siteurl=search.linkury.com&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.102.0: C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@idsoftware.com/QuakeLive: C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Entilsa\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011.03.09 13:42:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011.03.09 13:42:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.21 16:43:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.11.21 16:43:04 | 000,000,000 | ---D | M]

[2011.02.21 16:36:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Entilsa\AppData\Roaming\mozilla\Extensions
[2011.12.16 17:04:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Entilsa\AppData\Roaming\mozilla\Firefox\Profiles\fk8o4b8s.default\extensions
[2011.10.03 07:42:44 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Entilsa\AppData\Roaming\mozilla\Firefox\Profiles\fk8o4b8s.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.12.11 10:39:53 | 000,000,000 | ---D | M] (FoxTab) -- C:\Users\Entilsa\AppData\Roaming\mozilla\Firefox\Profiles\fk8o4b8s.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2011.12.11 10:39:47 | 000,000,000 | ---D | M] (LavaFox V1-Blue) -- C:\Users\Entilsa\AppData\Roaming\mozilla\Firefox\Profiles\fk8o4b8s.default\extensions\djziggy@gmail.com
[2011.03.22 12:07:53 | 000,000,000 | ---D | M] (Fast Dial) -- C:\Users\Entilsa\AppData\Roaming\mozilla\Firefox\Profiles\fk8o4b8s.default\extensions\fastdial@telega.phpnet.us
[2011.12.02 17:05:10 | 000,000,000 | ---D | M] (Search-Results Toolbar) -- C:\Users\Entilsa\AppData\Roaming\mozilla\Firefox\Profiles\fk8o4b8s.default\extensions\toolbar@ask.com
[2011.12.13 15:02:42 | 000,000,950 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\Profiles\fk8o4b8s.default\searchplugins\icqplugin-1.xml
[2011.05.01 08:33:24 | 000,000,950 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\Profiles\fk8o4b8s.default\searchplugins\icqplugin-2.xml
[2011.06.24 08:17:34 | 000,000,950 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\Profiles\fk8o4b8s.default\searchplugins\icqplugin-3.xml
[2011.08.21 08:36:49 | 000,000,950 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\Profiles\fk8o4b8s.default\searchplugins\icqplugin-4.xml
[2011.09.01 14:16:53 | 000,000,950 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\Profiles\fk8o4b8s.default\searchplugins\icqplugin-5.xml
[2011.09.16 08:25:17 | 000,000,950 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\Profiles\fk8o4b8s.default\searchplugins\icqplugin-6.xml
[2011.10.05 08:45:01 | 000,000,950 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\Profiles\fk8o4b8s.default\searchplugins\icqplugin-7.xml
[2011.11.21 16:43:11 | 000,000,950 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\Profiles\fk8o4b8s.default\searchplugins\icqplugin-8.xml
[2011.11.29 08:50:15 | 000,000,950 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\Profiles\fk8o4b8s.default\searchplugins\icqplugin-9.xml
[2011.03.23 14:26:37 | 000,001,056 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\Profiles\fk8o4b8s.default\searchplugins\icqplugin.xml
[2011.12.06 13:29:29 | 000,005,604 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\Profiles\fk8o4b8s.default\searchplugins\Linkury Smartbar Search.xml
[2011.08.25 15:21:20 | 000,003,295 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\Profiles\fk8o4b8s.default\searchplugins\search-results.xml
[2011.05.12 09:25:09 | 000,002,330 | ---- | M] () -- C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\Profiles\fk8o4b8s.default\searchplugins\wowprogresscom.xml
[2011.12.08 21:52:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.06.23 08:28:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011.03.09 13:42:19 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video&gt -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\HTML5VIDEO
[2011.03.09 13:42:19 | 000,000,000 | ---D | M] (DivX HiQ) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\WPA
[2011.06.23 08:28:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.12.03 19:14:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.12.03 19:14:08 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.12.03 19:14:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.12.03 19:14:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.12.03 19:14:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

========== Chrome ==========

CHR - default_search_provider: Linkury Smartbar Search (Enabled)
CHR - default_search_provider: search_url = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:5731629158&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
CHR - default_search_provider: suggest_url =
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\15.0.874.121\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: QUAKE LIVE (Enabled) = C:\ProgramData\id Software\QuakeLive\npquakezero.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Entilsa\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: DivX HiQ = C:\Users\Entilsa\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.1.94_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Users\Entilsa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.1.94_0\

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Search-Results)
O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Search-Results)
O3 - HKCU\..\Toolbar\WebBrowser: (Search-Results Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Search-Results)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Search-Results)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Razer Lachesis Driver] C:\Program Files (x86)\Razer\Lachesis 5600\LachesisSysTray.exe (Razer USA Ltd)
O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [CreativeTaskScheduler] C:\Program Files (x86)\Creative\Shared Files\CTSched.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [Directory Opus Desktop Dblclk] C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe (GP Software)
O4 - HKCU..\Run: [EADM] C:\Program Files (x86)\Origin\Origin.exe (Electronic Arts)
O4 - HKCU..\Run: [EPSON Stylus DX6000 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBIE.EXE /FU "C:\Windows\TEMP\E_SB5B7.tmp" /EF "HKCU" File not found
O4 - HKCU..\Run: [firefox.exe] C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\firefox.exe ()
O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [PlayNC Launcher] File not found
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\Entilsa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
O4 - Startup: C:\Users\Entilsa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Directory Opus (Startup).lnk = File not found
O4 - Startup: C:\Users\Entilsa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Entilsa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Entilsa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\Entilsa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Entilsa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_07-windows-i586.cab (Java Plug-in 1.5.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A3A6C69F-E70C-41F6-AECF-DCE0B71DE253}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E0CF8BF0-57FC-48D6-93B6-B3B01BAB2505}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {3CF9ECE0-1A9F-11D2-8C73-00C06C2005DE} - C:\Programme\GPSoftware\Directory Opus\dopuslib.dll (GP Software)
O28 - HKLM ShellExecuteHooks: {EE761688-C137-4b04-8FAB-3C9CDF0886F0} - C:\Programme\GPSoftware\Directory Opus\dopuslib32.dll (GP Software)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.11.06 17:33:09 | 000,000,043 | R--- | M] () - H:\Autorun.inf -- [ UDF ]
O33 - MountPoints2\{59201949-3dc8-11e0-ba89-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{59201949-3dc8-11e0-ba89-806e6f6e6963}\Shell\AutoRun\command - "" = G:\setup.exe
O33 - MountPoints2\{5920194a-3dc8-11e0-ba89-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{5920194a-3dc8-11e0-ba89-806e6f6e6963}\Shell\AutoRun\command - "" = H:\Start.exe -- [2006.01.10 14:49:24 | 000,492,032 | R--- | M] ()
O33 - MountPoints2\{7d34ec94-1a9f-11e1-b73f-00241d10df56}\Shell - "" = AutoRun
O33 - MountPoints2\{7d34ec94-1a9f-11e1-b73f-00241d10df56}\Shell\AutoRun\command - "" = N:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.12.17 16:20:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.12.17 16:20:25 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.12.17 16:19:35 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011.12.17 16:19:12 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Roaming\Malwarebytes
[2011.12.17 16:19:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.12.17 16:19:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.12.17 16:19:04 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.12.17 16:19:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.12.17 08:57:29 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{66178F3C-614B-4A6C-A03C-3199498A8488}
[2011.12.17 08:57:16 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{C1E2ED74-DEB2-4D4B-9690-DEA0CAB66A45}
[2011.12.16 19:28:30 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{420B99A1-3495-462F-88B8-A2B81382244C}
[2011.12.16 19:28:20 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{13EAA0A6-2E65-4FEB-B21A-CC5645AF9D11}
[2011.12.16 19:28:10 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{6C81F21A-0486-44FA-998C-DA9AAC0C03C4}
[2011.12.16 19:28:00 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{169CE7D1-8A4C-43AC-81B0-863D806EFF34}
[2011.12.16 07:27:34 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{BB210D55-84C0-4225-AED5-2A29D6FDBECF}
[2011.12.16 07:27:23 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{B715C7A6-4718-42F7-8249-FDC0A6BEBF39}
[2011.12.15 19:26:59 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{475BACE3-2B5C-460F-B22C-A2035879CD01}
[2011.12.15 19:26:50 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{A45F1DF1-4797-4642-87BC-3CAEFFD1CF6D}
[2011.12.15 19:26:40 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{5EDF4763-44B3-4862-9818-1123A861AC50}
[2011.12.15 19:26:30 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{EB527B6D-7E7D-4A19-B0BD-266517205026}
[2011.12.15 07:26:50 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\Documents\My Curse
[2011.12.15 07:26:05 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{7D3F5657-EBEA-4692-890E-79A706F2F859}
[2011.12.15 07:25:54 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{2524E34A-8251-43FF-9721-138683BE84AC}
[2011.12.14 19:17:47 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{6921FF90-C238-4713-AA8F-A7B073429B8B}
[2011.12.14 19:17:37 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{3FA76A97-571C-4FA1-B052-8AE47EA476C0}
[2011.12.14 19:17:27 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{B287D84E-AF72-4B5A-9DDB-44D92C55E2F7}
[2011.12.14 19:17:17 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{51EDAB03-07ED-43F8-AFDB-7116AB1C0520}
[2011.12.14 07:21:31 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2011.12.14 07:21:21 | 000,702,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2011.12.14 07:21:21 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011.12.14 07:21:21 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011.12.14 07:21:21 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2011.12.14 07:21:21 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2011.12.14 07:21:21 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2011.12.14 07:21:21 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011.12.14 07:21:15 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2011.12.14 07:21:15 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2011.12.14 07:16:48 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{9DA0DF98-F0F5-4DB3-92BC-05B7AD5A7736}
[2011.12.14 07:16:36 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{36F094EA-6B6E-4D13-96B2-88CCBC797E25}
[2011.12.13 14:52:08 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{B300C29D-DC34-4BB3-9941-3892C9CAE0EA}
[2011.12.13 14:51:58 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{B74DFB76-9DB8-4B6A-9C55-FCE42D0941E9}
[2011.12.12 19:30:38 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{B8B42E4E-B2D2-4EE3-A42E-768D7B15EE6F}
[2011.12.12 19:30:28 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{5D17F10D-B056-4759-A6F2-D5C9AB68B4C0}
[2011.12.12 19:30:19 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{CCFB109F-36ED-4EC6-A2EE-76B8DA2E6CE5}
[2011.12.12 19:30:09 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{B0267C1C-A78B-48D9-9E87-96D95705B89D}
[2011.12.12 07:29:42 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{DFF4456A-3296-4485-9EC1-7B54BB2DA2A9}
[2011.12.12 07:29:30 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{5C4B0378-3E6B-4F3F-A888-6CEEB66FE305}
[2011.12.11 10:36:50 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{9852AD40-512A-4586-B7AD-96710699BCD3}
[2011.12.11 10:36:38 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{2AADCCFA-2810-4856-A4B2-D7A60D898377}
[2011.12.10 21:16:37 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{26D27B70-28CF-4EF3-8E74-C438914BCF1F}
[2011.12.10 21:16:27 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{6D6E4286-95F8-46E1-9232-FD9CE84419DC}
[2011.12.10 09:15:58 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{EEF8EF2C-8E43-464C-9881-A7084BB2743F}
[2011.12.10 09:15:46 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{6E28E192-B6A3-4BCF-897F-A72336776F67}
[2011.12.09 16:21:41 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{71C461B3-852D-4FC0-A733-80D12CD547CC}
[2011.12.09 16:21:30 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{483A40E4-FCA3-47FE-8189-AD17D0A299B1}
[2011.12.08 19:50:03 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{2FF582F8-5D8A-4028-8A6F-A478E0887FA5}
[2011.12.08 19:49:54 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{DCF6F3FE-D3A5-403F-B4F9-B4270B892589}
[2011.12.08 07:49:31 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{0242A8EC-C1A6-4EAA-B026-2937FF1D0650}
[2011.12.08 07:49:19 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{D55F1E94-0F70-4525-8EAA-D21411673C48}
[2011.12.07 19:16:39 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{798F4B74-9BFE-4E7F-A4A3-EFD9C604346A}
[2011.12.07 19:16:29 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{D4A6DDC8-A836-4B8E-B14A-323CFE7D0DE6}
[2011.12.07 19:16:19 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{6F2E9E65-C538-4195-B507-85C98C5B08D8}
[2011.12.07 19:16:10 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{9BF7CBF7-A9F6-4A84-84C7-7137D7427278}
[2011.12.07 07:15:40 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{9A99E061-4350-45C5-A02D-0B4BC62ADA7D}
[2011.12.07 07:15:27 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{593A95DA-06A1-4352-B07C-E2F3518F5408}
[2011.12.06 19:12:41 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{BF64B729-3D87-484A-9315-23C10A140E58}
[2011.12.06 19:12:30 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{426CF1BC-DCBA-4094-A153-5B7CC262235F}
[2011.12.06 19:12:20 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{43297652-6736-4E7A-8B0D-0B4BF57698CE}
[2011.12.06 19:12:10 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{2F1C9C69-8ED6-4D29-B84D-6558999B19E1}
[2011.12.06 07:11:42 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{E078DA88-2D54-4745-B179-0EA6725CB7BA}
[2011.12.06 07:11:31 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{0C036135-348D-4A0B-AF6D-60CBAEA1A139}
[2011.12.05 19:06:38 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{4D32F9C4-6A94-4F9E-8447-061D703A689D}
[2011.12.05 19:06:29 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{6BF08C6B-5FA6-4B4B-A96E-18BC42495D12}
[2011.12.05 19:06:19 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{23B265BD-248C-49D7-B4D3-A961AF423F42}
[2011.12.05 19:06:09 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{D3B2B20E-BE02-4ACF-BCFC-C49F5CA63E49}
[2011.12.05 07:05:38 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{F244559A-8254-4973-B7ED-747A2E637B12}
[2011.12.05 07:05:25 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{87BD4F6B-BB29-4F93-A6E8-6D4BDE4C1281}
[2011.12.04 15:56:24 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{92BD6CE2-F862-4BC0-9589-9BF06AC2AD29}
[2011.12.04 15:56:13 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{88471387-2D32-49B8-B8D1-613770E60074}
[2011.12.03 09:08:33 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{F172D4E7-789F-446B-854F-A0039D8598BD}
[2011.12.03 09:08:21 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{3D398007-4CF8-4E2B-9042-F1DFFE717B55}
[2011.12.02 19:16:33 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{298749B9-D4A0-4663-BF04-275364537C9B}
[2011.12.02 19:16:23 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{5ABE9AE0-F72E-4244-8346-C26AFF789B45}
[2011.12.02 07:15:56 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{B929D3EE-D3C6-475A-BC97-EA03E3C901FB}
[2011.12.02 07:15:45 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{0705F77B-25CA-48DF-BA48-D70D58D5EDEB}
[2011.12.01 20:47:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2011.12.01 20:45:42 | 024,742,720 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll
[2011.12.01 20:45:42 | 018,871,616 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll
[2011.12.01 20:45:42 | 000,068,928 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2011.12.01 20:45:42 | 000,061,248 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2011.12.01 20:45:41 | 024,796,992 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll
[2011.12.01 20:45:41 | 017,248,576 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll
[2011.12.01 20:45:41 | 007,581,504 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll
[2011.12.01 20:45:41 | 005,578,560 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll
[2011.12.01 20:45:41 | 002,542,912 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll
[2011.12.01 20:45:41 | 002,401,088 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll
[2011.12.01 20:45:41 | 002,232,128 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll
[2011.12.01 20:45:41 | 002,099,520 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvenc.dll
[2011.12.01 20:45:41 | 001,533,248 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco64.dll
[2011.12.01 20:45:41 | 001,454,400 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvgenco64.dll
[2011.12.01 20:38:51 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\PunkBuster
[2011.12.01 20:38:41 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\Documents\Battlefield 3
[2011.12.01 20:38:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Battlelog Web Plugins
[2011.12.01 20:16:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battlefield 3
[2011.12.01 20:16:18 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Common Files\EAInstaller
[2011.12.01 20:15:37 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_7.dll
[2011.12.01 20:15:37 | 000,518,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_7.dll
[2011.12.01 20:15:37 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_7.dll
[2011.12.01 20:15:37 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_7.dll
[2011.12.01 20:15:37 | 000,077,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_5.dll
[2011.12.01 20:15:37 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_5.dll
[2011.12.01 20:15:35 | 002,526,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_43.dll
[2011.12.01 20:15:35 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_43.dll
[2011.12.01 20:15:34 | 001,907,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_43.dll
[2011.12.01 20:15:34 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_43.dll
[2011.12.01 20:15:34 | 000,276,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_43.dll
[2011.12.01 20:15:34 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_43.dll
[2011.12.01 20:15:33 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_43.dll
[2011.12.01 20:15:33 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_43.dll
[2011.12.01 20:15:29 | 002,401,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_43.dll
[2011.12.01 20:15:29 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_43.dll
[2011.12.01 19:48:28 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2011.12.01 19:38:43 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Roaming\Origin
[2011.12.01 19:38:26 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\Origin
[2011.12.01 19:38:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
[2011.12.01 19:38:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin Games
[2011.12.01 19:38:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin
[2011.12.01 19:37:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin
[2011.12.01 13:37:47 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{B7FBC992-B1CA-4232-AB51-FC3FB62C072B}
[2011.12.01 13:37:33 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{3EB78936-6D7C-44FF-BED7-26D55FF2D270}
[2011.11.30 21:37:51 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{0972C8C0-A668-4413-8A8F-9F6C348ABE07}
[2011.11.30 21:37:41 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{98351C46-229C-45D2-9DD0-5037C5049652}
[2011.11.30 21:37:21 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{816C1565-584A-4E66-AC96-9AC1392389C6}
[2011.11.30 09:37:10 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{14D9E683-0445-458A-BB28-87C19278F5E9}
[2011.11.30 09:37:01 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{1527A667-338D-40FA-92AA-BF0575C9439A}
[2011.11.30 09:36:51 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{44DEE8AD-1E49-40D8-987E-73CC9234AF40}
[2011.11.30 09:36:41 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{62259B21-71DB-4F72-A1A6-B0B5488C21F6}
[2011.11.29 22:02:02 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Roaming\OpenCandy
[2011.11.29 22:00:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
[2011.11.29 21:59:40 | 000,279,616 | ---- | C] (DT Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys
[2011.11.29 21:59:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DAEMON Tools Lite
[2011.11.29 21:59:08 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Roaming\DAEMON Tools Lite
[2011.11.29 21:59:06 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite
[2011.11.29 21:36:18 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{532A0706-D49E-47E7-A0EA-8C35945D22A2}
[2011.11.29 21:36:08 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{123ADE06-C800-44D6-AA9F-7AFDDE90005B}
[2011.11.29 21:35:59 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{D15D7A47-18EB-48F0-9FFC-9CDCEFA95DE7}
[2011.11.29 21:35:49 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{2AA950BD-9D52-451F-B56D-FDC331CF9C01}
[2011.11.29 18:24:41 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\Skyrim
[2011.11.29 09:35:25 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{851FE5AB-A6ED-4EF2-BCC2-BEAC249D7641}
[2011.11.29 09:35:15 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{46159A6F-C31C-4EDA-9EA3-B5340F21DCDC}
[2011.11.29 09:35:05 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{AC16B0D5-3E0D-41FC-B905-7E1B996F94B6}
[2011.11.29 09:34:55 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{D3B123DD-35A3-468B-98D4-BAF803B4E8D8}
[2011.11.28 21:34:32 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{6B5C73D9-DBBC-40DC-B6ED-A117AB5923C6}
[2011.11.28 21:34:22 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{2CAAE3FF-2424-4D8E-8089-996D87FDCC34}
[2011.11.28 21:34:13 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{23A03ABC-BA1A-410E-BD52-1D2FDF2003C0}
[2011.11.28 15:21:06 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\Desktop\Vokabeltrainer_2.2
[2011.11.28 15:21:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ask.com
[2011.11.28 15:20:33 | 003,383,272 | ---- | C] (Search-Results) -- C:\Users\Entilsa\Desktop\ApnToolbarInstaller.exe
[2011.11.28 09:33:52 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{AD570D31-1D98-4C72-88D7-1C80CACCB0AE}
[2011.11.28 09:33:42 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{4A8E393F-A99D-4BD7-B9C6-99C3EA69D4EA}
[2011.11.28 09:33:33 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{F416192E-1EC5-46A3-84BA-184D1EF82721}
[2011.11.28 09:33:23 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{C6A09219-52C6-4C61-8CCB-6FDA69E06A75}
[2011.11.27 21:32:57 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{28CAFEE6-888A-4AB8-BA1F-D75CB6C6010A}
[2011.11.27 21:32:47 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{19D0FF03-4ED1-4DD7-92BA-07E6D9D8F0BD}
[2011.11.27 21:32:28 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{F3D04720-756B-41E6-8930-B961CCE6BABE}
[2011.11.27 09:32:17 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{69222A1B-2E0F-4EE1-BCC8-4AD99109B635}
[2011.11.27 09:32:08 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{47ABCDCD-4B5B-42CD-8067-2F036548B586}
[2011.11.27 09:31:58 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{4E01C1F6-1767-4D4E-AC58-0CB40F877FF9}
[2011.11.27 09:31:48 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{7903F5BC-9A72-431A-A6D8-9E43FEACEA81}
[2011.11.26 21:31:23 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{897ACC15-2AF1-4951-9F54-8B3D42A4C71F}
[2011.11.26 21:31:14 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{0E6AE376-CA94-4B8D-B524-7CBFC194A6A4}
[2011.11.26 09:30:50 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{753436C0-EA70-4165-B1D8-A5994CBDEE88}
[2011.11.26 09:30:40 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{BA055833-F853-4265-BC89-AD029606EC8B}
[2011.11.25 19:05:48 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{3243640B-3109-4838-9080-AAB2AE2BBDB3}
[2011.11.25 19:05:39 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{6A93B1E0-4CA9-477F-B7D4-99553A7A36A6}
[2011.11.25 17:06:22 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\SWTOR
[2011.11.25 17:06:22 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\Documents\HeroBlade Logs
[2011.11.25 07:05:16 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{5F63B0A2-E591-440A-AE90-1604CF078D0E}
[2011.11.25 07:05:06 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{25C2962D-A961-4C93-A6C5-4701C90DF0CC}
[2011.11.25 07:04:56 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{D4FF70D5-7B14-4E4D-90F5-2F80F5A0982F}
[2011.11.25 07:04:46 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{C71D790B-A4D0-4F44-B17F-8BA3A729CE2E}
[2011.11.24 19:04:22 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{00133910-044F-4B72-85CA-3200F0C78113}
[2011.11.24 19:04:13 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{FFB0A1FD-AEC1-4B98-B2DD-30E4D68B8011}
[2011.11.24 19:04:03 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{F005CB28-E4D8-48DF-8FF6-451EFA160F6F}
[2011.11.24 19:03:53 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{F1A40CA8-85C4-439C-9307-5C32B7A81066}
[2011.11.24 07:03:29 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{67FB6AA7-68F4-4044-975C-EE824372D638}
[2011.11.24 07:03:18 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{054EF070-AD95-4AAB-8E45-3D335FEE13FD}
[2011.11.23 18:58:07 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{CC37D0A6-3E6A-4D4F-95F9-8AEBE77DC928}
[2011.11.23 18:57:57 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{98F40206-439F-4F85-88BC-6B9D6205990B}
[2011.11.23 18:57:48 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{19E4BC7E-C119-431E-BA35-B4AFF3B9746D}
[2011.11.23 18:57:38 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{7B776891-5884-4B08-A073-AF9F574DA46A}
[2011.11.23 06:56:57 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{2FBADEAE-DF20-4128-B869-FC3C00596865}
[2011.11.23 06:56:45 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{BBC68748-423F-4550-BD10-2C52AB0EC2A4}
[2011.11.22 07:23:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA
[2011.11.22 07:11:54 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{48735A6F-BB3E-4017-BD02-3E3726F14C82}
[2011.11.22 07:11:43 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{2D300143-E5DF-49A6-A128-5D8A7B9481DD}
[2011.11.22 07:11:32 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{D07FFF25-1187-4F76-A5DB-CD3A688B5E8B}
[2011.11.22 07:11:21 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{2443CB54-FDEF-4E67-9A1F-832791CF5FDB}
[2011.11.21 19:10:56 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{73622F5E-756F-4D6F-9125-48C4CEC6356D}
[2011.11.21 19:10:45 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{F0D70897-87C3-40E3-9D3E-D795BB4D8DB9}
[2011.11.21 19:10:34 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{8199805B-F856-44E8-9013-B98CC18E2613}
[2011.11.21 19:10:12 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{5B175270-F262-4D4A-93AD-8B58BC31E222}
[2011.11.21 07:09:36 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{734A034E-60F5-4FBD-A9E8-8D6500A3A5A9}
[2011.11.21 07:09:23 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{50B7F3EF-CCCF-4CF1-B7E2-EA6F4A46CAB3}
[2011.11.20 08:25:34 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{29FE4831-97FD-4781-9F4F-D7CD7E18B45D}
[2011.11.20 08:25:06 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{0DCAF851-886D-4E65-A5C1-A37DAE6FCDDE}
[2011.11.19 13:47:26 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{510408DB-86BC-4346-94DC-EBC4477AB93B}
[2011.11.19 13:47:15 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{BD5FF35E-1472-4B41-B669-717373AFC7C4}
[2011.11.19 13:38:13 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{DC83F0AD-E4FF-4384-8542-7F68C0170978}
[2011.11.19 13:35:19 | 000,040,464 | ---- | C] (CACE Technologies) -- C:\Windows\SysNative\drivers\npf.sys
[2011.11.19 13:34:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Belkin
[2011.11.19 13:33:56 | 000,000,000 | ---D | C] -- C:\Windows\{72E4A482-6DE7-406D-A6CD-59EF1123B0C9}
[2011.11.19 10:10:12 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{810F79F7-9AF2-4A54-B28C-EC0DF9337F05}
[2011.11.18 18:20:22 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{C91E589C-9497-47DE-8FB9-BB7ADC488985}
[2011.11.18 16:23:30 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{AEEF2517-5D4E-493F-B6FC-2D0AB4BB364E}
[2011.11.18 15:28:32 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{5FD3B6F0-4CC5-4678-9576-46F6A3E731FF}
[2011.11.18 07:00:23 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{0969EE31-AA07-4FB7-A7F6-3AEEC3543E39}
[2011.11.17 18:01:55 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{6C3F5982-CB1B-4CA0-8EEF-702902AB2A57}
[2011.11.17 17:27:37 | 000,000,000 | ---D | C] -- C:\Users\Entilsa\AppData\Local\{3D45AE0C-380A-4F8A-8BC5-45681916CB30}
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.12.17 16:20:27 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.12.17 16:19:35 | 000,041,272 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011.12.17 16:19:07 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.12.17 16:06:00 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.12.17 16:06:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.12.17 15:59:53 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.17 15:59:53 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.17 15:52:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.17 15:52:28 | 535,535,615 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.14 15:20:33 | 001,644,414 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.12.14 15:20:33 | 000,707,918 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.12.14 15:20:33 | 000,661,514 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.12.14 15:20:33 | 000,153,404 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.12.14 15:20:33 | 000,125,600 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.12.14 15:15:34 | 000,452,296 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.12.10 18:06:40 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2011.12.10 18:06:40 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.12.07 16:43:03 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2011.12.06 14:12:21 | 000,000,642 | ---- | M] () -- C:\Users\Public\Desktop\Battlefield 3.lnk
[2011.12.06 14:11:58 | 000,075,136 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.12.01 19:42:21 | 000,000,983 | ---- | M] () -- C:\Users\Public\Desktop\Origin.lnk
[2011.11.29 22:02:02 | 000,001,954 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
[2011.11.29 21:59:40 | 000,279,616 | ---- | M] (DT Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys
[2011.11.28 15:20:43 | 003,383,272 | ---- | M] (Search-Results) -- C:\Users\Entilsa\Desktop\ApnToolbarInstaller.exe
[2011.11.28 15:20:38 | 000,437,301 | ---- | M] () -- C:\Users\Entilsa\Desktop\Vokabeltrainer_2.2.zip
[2011.11.22 07:23:04 | 000,000,728 | ---- | M] () -- C:\Users\Public\Desktop\Star Wars - The Old Republic.lnk
[2011.11.19 13:35:30 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_bcmwlhigh664_01009.Wdf
[2011.11.19 13:34:28 | 000,001,029 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Play Wireless USB Adapter Utility.lnk
[2011.11.18 16:02:18 | 004,024,320 | ---- | M] () -- C:\Users\Entilsa\Desktop\fw_Speedport_W501V_v_28.04.38.image
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.12.17 16:20:27 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.12.17 16:19:07 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.12.01 20:38:55 | 000,280,904 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2011.12.01 20:16:32 | 000,000,642 | ---- | C] () -- C:\Users\Public\Desktop\Battlefield 3.lnk
[2011.12.01 20:15:46 | 000,280,904 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.12.01 20:15:46 | 000,280,904 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2011.12.01 20:15:44 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.12.01 19:38:20 | 000,000,983 | ---- | C] () -- C:\Users\Public\Desktop\Origin.lnk
[2011.11.29 22:02:02 | 000,001,954 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
[2011.11.28 15:20:33 | 000,437,301 | ---- | C] () -- C:\Users\Entilsa\Desktop\Vokabeltrainer_2.2.zip
[2011.11.22 07:23:04 | 000,000,728 | ---- | C] () -- C:\Users\Public\Desktop\Star Wars - The Old Republic.lnk
[2011.11.19 13:35:30 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_bcmwlhigh664_01009.Wdf
[2011.11.19 13:34:28 | 000,001,029 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Play Wireless USB Adapter Utility.lnk
[2011.11.18 16:05:03 | 004,024,320 | ---- | C] () -- C:\Users\Entilsa\Desktop\fw_Speedport_W501V_v_28.04.38.image
[2011.10.15 00:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.04.06 13:05:14 | 000,000,095 | ---- | C] () -- C:\Users\Entilsa\AppData\Local\fusioncache.dat
[2011.03.12 20:02:48 | 001,621,372 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.03.09 13:25:00 | 000,176,128 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.03.09 13:25:00 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011.02.25 21:27:46 | 000,000,001 | ---- | C] () -- C:\Windows\SysWow64\SI.bin
[2009.09.16 08:20:14 | 000,001,801 | ---- | C] () -- C:\Windows\WRcfg.ini
[2009.08.19 07:15:08 | 000,000,388 | ---- | C] () -- C:\Windows\WRMCcfg.ini
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2007.11.07 04:19:28 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll
[2007.01.26 00:04:12 | 000,138,752 | ---- | C] () -- C:\Windows\SysWow64\mase32.dll
[2007.01.26 00:04:12 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\ma32.dll
[2003.10.06 09:21:31 | 000,000,000 | -H-- | C] () -- C:\ProgramData\sdpsenv.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 913 bytes -> C:\Users\Entilsa\Documents\Bewerte die Fotos deiner Feunde auf Facebook.eml:OECustomProperty
@Alternate Data Stream - 160 bytes -> C:\ProgramData\sdpsenv.dat:naughtypirates

< End of report >

hi

achtung!

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKCU..\Run: [firefox.exe] C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\firefox.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
:Files
C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\firefox.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden
öffne computer, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
folge dem link, und lade das archiv im upload channel hoch
http://www.trojaner-board.de/54791-a...ner-board.html

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\firefox.exe deleted successfully.
C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\firefox.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
========== FILES ==========
File\Folder C:\Users\Entilsa\AppData\Roaming\Mozilla\Firefox\firefox.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 56504 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Entilsa
->Flash cache emptied: 858 bytes

User: Public

User: UpdatusUser
->Flash cache emptied: 56504 bytes

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Entilsa
->Temp folder emptied: 2890439 bytes
->Temporary Internet Files folder emptied: 5034875 bytes
->Java cache emptied: 1668976 bytes
->FireFox cache emptied: 42837123 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 356352 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 591412 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67899 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 51,00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 12172011_174847

Files\Folders moved on Reboot...
C:\Users\Entilsa\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

Files\Folders moved on Reboot...
File\Folder C:\Users\Entilsa\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...

bis jetzt klappt es wieder.. danke danke vielen dank

wo ist der rest, nicht schon ab der hälfte aufhören zu lesen.
ich warte auf den upload