Folgende Fehlermeldung: Aus Sicherheitsgründen wurde ihr System blockiert! Bezahlen und Runterladen

rko4616 · 18.12.2011, 17:47

Hallo Liebe Helfer! Versuche mich kurz zu fassen!

Besitze 2 Accounts auf meinem PC: Acount A = Benutzer 1 (Administrator), Account B = Benutzer 2. Beide Accounts sind ohne Passworte gesichert, da ich meiner Familie bezüglich dieser Sache vertrauen kann. Betriebssystem: Windows 7. Ich steige meistens mit dem Benutzer 1 ein. Während dem Internetsurfen ist bei mir folgende Fehlermeldung aufgetaucht (im Anhang ersichtlich) --> Diese Fehlermeldung kommt jetzt immer wieder sobald ich in den Benutzer 1 einsteige.
Bei dem Benutzer 2 funktioniert noch alles normal. Danach habe ich mich bei dem Benutzer 2 angemeldet und die vorgeschlagenen Schritte befolgt, welche ihr den anderen Personen vorgeschlagen habt, welche das gleiche Problem hatten.

1. ESET installiert und ESET-Scan (für Modzilla) durchgeführt (obwohl ich den Virus über den Internetexplorer von Microsoft bekommen habe, passt das dann schon so?)
2. Malwarebites (antimalware) installiert und ordnungsgemäß Scan durchgeführt (bei Benutzer zwei natürlich)

Leider kommt auch nach dieser Vorgehensweise immer noch dieselbe Fehlermeldung bei dem Benutzer Nummer 2. Frage: Wie soll ich weiter vorgehen, um dieses Problem zu beheben? Soll ich den Scan im abgesicherten Modus nochmals machen? Soll bei Herauffahren des Windows-System Recovery mit F11 aktivieren?

Wäre über jegliche Hilfe sehr dankbar. Anbei noch das logfiles. log.txt habe ich unte dem jeweilig besprochenen Ordner gefunden. mbam-log-2011-12-18... hatte das Malware kurz nach dem Scan ausgespuckt. Falls noch Fragen bestehen, könnt ihr mich gerne kontaktieren.
Schöne Grüße

markusg · 18.12.2011, 18:14

hi
starte den pc neu in den abgesicherten modus mit netzwerk, bei pc start f8 drücken melde dich mit dem infiziertem konto an, dann folgendes:
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die
Textbox.

Code:

ATTFilter

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

rko4616 · 18.12.2011, 19:29

Hallo!
Erstmals vielen Dank für die Hilfe und sorry, dass ich erst so spät antworte. Habe folgende Version für die Analyse benutzt, so wie du es mir aufgetragen hast: OTL by Old Timer Version 3.2.31.0

Dein Link hat leider nicht funktioniert. Anbei die Extra Datei, die OTL-Datei kann ich leider nicht hochladen, da diese zu groß ist.

rko4616 · 18.12.2011, 19:29

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 12/18/2011 6:36:56 PM - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\René Kolar\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
4.00 Gb Total Physical Memory | 3.41 Gb Available Physical Memory | 85.24% Memory free
8.00 Gb Paging File | 7.42 Gb Available in Paging File | 92.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1366.17 Gb Total Space | 1304.13 Gb Free Space | 95.46% Space Free | Partition Type: NTFS
Drive D: | 30.00 Gb Total Space | 10.38 Gb Free Space | 34.59% Space Free | Partition Type: NTFS
 
Computer Name: RENEKOLAR-PC | User Name: René Kolar | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\René Kolar\Desktop\OTL.exe (OldTimer Tools)
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (OverwolfUpdaterService) -- C:\Program Files (x86)\Overwolf\\OverwolfUpdater.exe ()
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (WSWNDA3100) -- C:\Program Files (x86)\NETGEAR\WNDA3100v2\WifiSvc.exe ()
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (PSI_SVC_2) -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (RTL8192su) -- C:\Windows\SysNative\drivers\RTL8192su.sys (Realtek Semiconductor Corporation                           )
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (ATI Technologies, Inc.)
DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) -- C:\Windows\SysNative\drivers\AtiPcie64.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (amd_sata) -- C:\Windows\SysNative\drivers\amd_sata.sys (Advanced Micro Devices)
DRV:64bit: - (amd_xata) -- C:\Windows\SysNative\drivers\amd_xata.sys (Advanced Micro Devices)
DRV:64bit: - (BCMH43XX) -- C:\Windows\SysNative\drivers\bcmwlhigh664.sys (Broadcom Corporation)
DRV:64bit: - (NPF) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (SCMNdisP) -- C:\Windows\SysNative\drivers\SCMNdisP.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWinl.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050
IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWinl.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\4.8\pdfforgeToolbarIE.dll (Spigot, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316&ilc=12"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2319825&SearchSource=13"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: pdfforge@mybrowserbar.com:4.3
FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.3
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.3.0.7280
FF - prefs.js..keyword.URL: "hxxp://at.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=827316&p="
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/11/12 12:11:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/06/18 15:08:12 | 000,000,000 | ---D | M]
 
[2011/02/07 21:58:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\René Kolar\AppData\Roaming\mozilla\Extensions
[2011/12/16 14:27:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\René Kolar\AppData\Roaming\mozilla\Firefox\Profiles\qc0dl4ro.default\extensions
[2011/12/06 13:46:11 | 000,000,000 | ---D | M] (Winload Community Toolbar) -- C:\Users\René Kolar\AppData\Roaming\mozilla\Firefox\Profiles\qc0dl4ro.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}
[2011/12/06 21:12:10 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\René Kolar\AppData\Roaming\mozilla\Firefox\Profiles\qc0dl4ro.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2011/03/01 20:58:49 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\René Kolar\AppData\Roaming\mozilla\Firefox\Profiles\qc0dl4ro.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/03/28 17:53:34 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\René Kolar\AppData\Roaming\mozilla\Firefox\Profiles\qc0dl4ro.default\extensions\engine@conduit.com
[2011/06/06 12:53:44 | 000,000,917 | ---- | M] () -- C:\Users\René Kolar\AppData\Roaming\Mozilla\Firefox\Profiles\qc0dl4ro.default\searchplugins\conduit.xml
[2011/12/09 12:15:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011/12/06 13:46:38 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
File not found (No name found) -- C:\USERS\RENÃ© KOLAR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QC0DL4RO.DEFAULT\EXTENSIONS\{40C3CC16-7269-4B32-9531-17F2950FB06F}
File not found (No name found) -- C:\USERS\RENÃ© KOLAR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QC0DL4RO.DEFAULT\EXTENSIONS\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
File not found (No name found) -- C:\USERS\RENÃ© KOLAR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QC0DL4RO.DEFAULT\EXTENSIONS\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}
File not found (No name found) -- C:\USERS\RENÃ© KOLAR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QC0DL4RO.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011/11/12 12:11:31 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/10/02 14:17:31 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/10/02 14:17:31 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/10/02 14:17:31 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011/10/02 14:17:31 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/10/02 14:17:31 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/10/02 14:17:31 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2009/06/10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWinl.dll (Conduit Ltd.)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\4.8\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\4.8\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Winload Toolbar) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - C:\Program Files (x86)\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [JAVA] C:\Windows\java.vbs ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [{65F76971-3345-11E0-9C46-806E6F6E6963}] C:\Users\René Kolar\AppData\Roaming\Microsoft\hostrun.exe (The Pidgin developer community)
O4 - HKCU..\Run: [NvCplDaemonTool] rundll32.exe  File not found
O4 - HKCU..\Run: [Overwolf] C:\Program Files (x86)\Overwolf\Overwolf.exe (Overwolf)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\René Kolar\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\René Kolar\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\René Kolar\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\René Kolar\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/5221-29898-17534-1/4 File not found
O9:64bit: - Extra 'Tools' menuitem : eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/5221-29898-17534-1/4 File not found
O9 - Extra Button: eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/5221-29898-17534-1/4 File not found
O9 - Extra 'Tools' menuitem : eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/5221-29898-17534-1/4 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1FC4AE18-1088-4A4E-A5C3-01A88EF86339}: DhcpNameServer = 10.0.0.138 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2E5D18CB-FE5E-4DB2-ABC0-DC88F471ECD1}: DhcpNameServer = 10.0.0.138 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8B837A18-DD06-4797-B407-ED239BCBD9C5}: DhcpNameServer = 10.0.0.138 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{968D1D2D-689F-407A-9952-71D7A2706EF2}: DhcpNameServer = 10.0.0.138 10.0.0.138
O18:64bit: - Protocol\Handler\cdo - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Overwolf\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKCU Winlogon: Shell - (C:\Users\René Kolar\AppData\Roaming\gog.exe) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/06/16 17:02:17 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/12/18 18:32:41 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\René Kolar\Desktop\OTL.exe
[2011/12/18 17:12:20 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{45315269-683A-48BB-8C25-F6AABDFDF7B9}
[2011/12/18 14:40:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2011/12/18 14:33:33 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Roaming\Malwarebytes
[2011/12/18 14:30:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/12/18 14:30:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/12/18 14:30:51 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011/12/18 14:30:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011/12/17 10:58:22 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{08F537C4-EC62-4DAE-B468-442B5B77C43E}
[2011/12/17 10:58:11 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{573294E2-E9A2-4806-B398-BEE27768A7B4}
[2011/12/16 14:24:27 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{C65BE5F4-13DB-46AC-B307-64ECD9B7C9CB}
[2011/12/16 14:24:14 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{2E1D89CD-30D8-42F2-9BF1-1BE97B6773D4}
[2011/12/15 13:52:08 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{6754492E-7905-4672-8109-88BF8A3844F0}
[2011/12/15 13:51:47 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{32FCA9C5-019B-409B-97F1-1DE670E0B641}
[2011/12/14 16:33:56 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{C42F5A0D-FB47-45D6-9AA5-FB172921E39F}
[2011/12/14 16:33:44 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{7465EDE8-075D-4220-A962-A5DDFF106F2B}
[2011/12/14 10:15:59 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{51757C86-FE81-4B11-9432-076B16C072DC}
[2011/12/13 16:26:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2011/12/13 16:26:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Overwolf
[2011/12/13 16:26:38 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011/12/13 13:13:35 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{B1048806-4818-402C-BC45-83696E546C20}
[2011/12/13 13:13:18 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{24A2594B-8059-49C7-A11C-E778D9C22939}
[2011/12/12 19:53:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Overwolf
[2011/12/12 16:41:46 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{2DCA8E93-38C2-4669-935F-40170A979669}
[2011/12/12 16:41:24 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{8B5891BD-9DCB-4027-A8AD-8C2AC709AEA0}
[2011/12/11 12:06:23 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{2AF3CCAD-4528-4817-9487-AE202000AEE6}
[2011/12/11 12:06:10 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{60917E3C-E06B-4B9B-816F-0C911960A59F}
[2011/12/10 13:04:18 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{DAA995DD-5A2F-4A40-9E4D-3FD3AFCA6960}
[2011/12/10 13:04:02 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{530E16A7-32C3-46BA-888F-6D153DCB9236}
[2011/12/09 12:15:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Application Updater
[2011/12/09 12:15:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Spigot
[2011/12/09 12:15:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\pdfforge Toolbar
[2011/12/09 12:13:20 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{2894BE44-CFC6-4782-BCE9-0095AB2D9C47}
[2011/12/09 12:13:05 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{E7B29CF7-BC1F-483F-8C32-808C23B155DE}
[2011/12/08 23:26:05 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{9545F748-48EE-498B-BACD-0C3ED92A079E}
[2011/12/08 23:25:55 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{564994C5-E93D-48D4-8C95-5DF0F4E1AA78}
[2011/12/08 17:16:17 | 000,000,000 | -H-D | C] -- C:\Users\René Kolar\Documents\Runes of Magic
[2011/12/08 17:11:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Overwolf
[2011/12/08 17:10:04 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\Overwolf
[2011/12/08 17:09:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Runes of Magic
[2011/12/08 17:00:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Runes of Magic
[2011/12/08 14:10:12 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Roaming\FOG Downloader
[2011/12/08 14:10:04 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\Runs of Magic
[2011/12/08 14:09:29 | 000,000,000 | ---D | C] -- C:\Runs of Magic
[2011/12/08 14:08:49 | 000,000,000 | ---D | C] -- C:\Program Files\Runs of Magic
[2011/12/08 11:25:27 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{21ED118B-5324-4E92-A648-1A54A306E59C}
[2011/12/08 11:24:57 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{2D42C6EA-BD12-4158-9404-D08ED62AE3CE}
[2011/12/07 14:59:15 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{81A035BB-CC78-470F-BF95-38BBC5A563F0}
[2011/12/07 14:59:00 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{CC416FAB-8844-47B3-8F0A-86C02C81EA4E}
[2011/12/06 13:46:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/12/06 13:41:43 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{F909FFBD-C0F4-4027-BF7A-07139E1E15D2}
[2011/12/06 13:41:27 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{7D621AF3-26D6-4521-96EA-FC016082800C}
[2011/12/05 14:10:55 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{F3BB84E3-E459-410D-BA85-8B1B91E748DF}
[2011/12/05 14:10:40 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{781A0613-3704-469E-904E-09D93FDFE60F}
[2011/12/04 11:23:56 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{2D8D4ADB-2608-4DF3-87CB-789D63FCBE14}
[2011/12/04 11:23:21 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{00AB2D7A-D4EF-4D04-9077-57A2D58D785D}
[2011/12/03 11:31:24 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{26C64812-39FD-421D-8196-89752F53BE19}
[2011/12/03 11:31:06 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{95E051D5-8FC8-4966-B977-DDD8085D7A94}
[2011/12/02 14:11:18 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{620AD673-3693-4826-AA77-597CF95D3911}
[2011/12/02 14:11:00 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{C961F65C-761E-4FBC-896F-48BFFBFF23DA}
[2011/12/01 21:38:18 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{5651E06B-5E26-4917-BA08-94FF106F360D}
[2011/12/01 21:38:07 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{A0B89B63-8040-4412-A3B7-AA0E41583896}
[2011/12/01 09:37:36 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{8239D3DD-3C9D-4A37-83B1-4E6F2BBBDE61}
[2011/12/01 09:37:11 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{EDE432C6-94BA-45AB-8FC7-88F4EC7E4B0E}
[2011/11/30 14:51:20 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{04BD8F9E-4803-4977-9208-F8D92B7DEEE5}
[2011/11/30 14:51:04 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{40656761-9BEB-4EAC-ADC7-EE0BF56818B2}
[2011/11/29 15:50:13 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{EA2419BF-2CF5-42E7-A82D-095DD1434957}
[2011/11/29 15:49:54 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{681A11D6-9200-4165-94EC-89DE4560FB7B}
[2011/11/28 14:26:06 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{D8A3321E-3A3D-40DE-B39F-7C9254631A4A}
[2011/11/28 14:25:46 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{78E179E9-8C2A-41C5-99F6-D0DAAA6F35E8}
[2011/11/27 19:30:00 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{5288780E-12D7-45D9-A6E4-E262B49FB7EB}
[2011/11/27 19:29:48 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{67474EF7-667A-4466-A37D-CDEBF8F07D0E}
[2011/11/26 14:52:39 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{09A78F1D-1A41-42DB-95FE-17D85AB0C935}
[2011/11/26 14:52:27 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{00C5100D-4D03-4DC9-8FB7-BFE33B216A3A}
[2011/11/25 14:39:42 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{749422B2-39CA-4251-A183-5B3C02CCC6E5}
[2011/11/25 14:39:31 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{47ABBE4D-E2AC-4E5B-866A-3FDE55146244}
[2011/11/24 15:05:49 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{98B04916-AE9E-432F-A322-9F66B1335C85}
[2011/11/24 15:05:28 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{CAB0BC05-EEC5-4145-8657-E46BEBAB391B}
[2011/11/23 19:51:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoftTB
[2011/11/23 10:53:55 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{3C1B3894-D12E-4F49-BAAB-799BEF1D49A1}
[2011/11/23 10:53:40 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{4E081334-EBE4-4BF4-B421-0B76754358AF}
[2011/11/22 22:06:26 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{0EC9C46C-135C-4A2F-BB4D-58C085600A92}
[2011/11/22 22:06:15 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{92ADC15F-A2EB-4BB2-9C35-0FE1A68C5141}
[2011/11/22 10:05:23 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{7681501B-523D-45FD-A7E3-5B774D7E2975}
[2011/11/22 10:05:12 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{2A5EA940-6B83-4FCE-90C8-1B4C4C466BE6}
[2011/11/21 16:54:37 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{486DE080-134C-46EE-B4BC-D99259BE8060}
[2011/11/20 11:29:55 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{C92FF03D-3F5C-47E7-B139-F24EB5F865D2}
[2011/11/20 11:29:45 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{50F6F20A-2B49-4FA1-9004-0AF28FFA4C14}
[2011/11/19 10:37:04 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{96D5356B-30DA-4436-BC17-FF0CE8300E6F}
[2011/11/19 10:36:46 | 000,000,000 | ---D | C] -- C:\Users\René Kolar\AppData\Local\{BC18264D-0940-40CB-9C98-CD2855AFAAD3}
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011/12/18 18:32:42 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\René Kolar\Desktop\OTL.exe
[2011/12/18 18:28:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/12/18 18:28:39 | 3220,664,320 | -HS- | M] () -- C:\hiberfil.sys
[2011/12/18 17:11:49 | 000,010,096 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/18 17:11:49 | 000,010,096 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/18 17:08:22 | 001,500,294 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011/12/18 17:08:22 | 000,654,602 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011/12/18 17:08:22 | 000,616,484 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011/12/18 17:08:22 | 000,130,216 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011/12/18 17:08:22 | 000,106,606 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011/12/18 14:30:55 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/12/14 16:30:45 | 000,304,680 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011/12/10 13:30:22 | 500,998,971 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/12/08 17:09:54 | 000,001,943 | ---- | M] () -- C:\Users\René Kolar\Desktop\Runes of Magic.lnk
[2011/12/04 14:56:24 | 000,007,680 | ---- | M] () -- C:\Users\René Kolar\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/01 13:50:12 | 000,043,843 | ---- | M] () -- C:\Users\René Kolar\Desktop\296829_2447786309772_1105357867_32932759_105928996_n.jpg
[2011/11/23 19:51:06 | 000,001,299 | ---- | M] () -- C:\Users\René Kolar\Desktop\Free Audio CD Burner.lnk
[2011/11/23 19:51:06 | 000,001,243 | ---- | M] () -- C:\Users\René Kolar\Desktop\DVDVideoSoft Free Studio.lnk
[2011/11/23 19:51:05 | 000,001,402 | ---- | M] () -- C:\Users\René Kolar\Desktop\Free YouTube to MP3 Converter.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011/12/18 14:30:55 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/12/10 13:30:22 | 500,998,971 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011/12/08 17:09:55 | 000,001,943 | ---- | C] () -- C:\Users\René Kolar\Desktop\Runes of Magic.lnk
[2011/12/01 13:50:10 | 000,043,843 | ---- | C] () -- C:\Users\René Kolar\Desktop\296829_2447786309772_1105357867_32932759_105928996_n.jpg
[2011/11/23 19:51:06 | 000,001,299 | ---- | C] () -- C:\Users\René Kolar\Desktop\Free Audio CD Burner.lnk
[2011/08/24 16:46:16 | 000,007,680 | ---- | C] () -- C:\Users\René Kolar\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/11 20:04:22 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll
[2011/04/10 13:08:30 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011/02/17 23:08:17 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011/02/17 23:08:17 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2011/02/16 22:14:49 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2011/02/07 22:27:05 | 001,526,976 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010/12/03 19:16:47 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010/12/03 19:12:37 | 000,002,888 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2009/08/04 00:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\SysWow64\OGACheckControl.DLL
[2009/07/14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2011/02/07 22:52:40 | 000,000,000 | ---D | M] -- C:\Users\René Kolar\AppData\Roaming\Canneverbe Limited
[2011/11/23 19:51:35 | 000,000,000 | ---D | M] -- C:\Users\René Kolar\AppData\Roaming\DVDVideoSoft
[2011/03/01 20:58:48 | 000,000,000 | ---D | M] -- C:\Users\René Kolar\AppData\Roaming\DVDVideoSoftIEHelpers
[2011/12/08 17:15:38 | 000,000,000 | ---D | M] -- C:\Users\René Kolar\AppData\Roaming\FOG Downloader
[2011/02/07 23:16:44 | 000,000,000 | ---D | M] -- C:\Users\René Kolar\AppData\Roaming\IrfanView
[2011/09/14 15:41:17 | 000,000,000 | ---D | M] -- C:\Users\René Kolar\AppData\Roaming\Onihu
[2011/11/15 23:58:00 | 000,000,000 | ---D | M] -- C:\Users\René Kolar\AppData\Roaming\SoftGrid Client
[2011/02/07 22:28:00 | 000,000,000 | ---D | M] -- C:\Users\René Kolar\AppData\Roaming\TP
[2011/02/11 20:26:39 | 000,000,000 | ---D | M] -- C:\Users\René Kolar\AppData\Roaming\Windows Live Writer
[2011/09/14 15:45:42 | 000,000,000 | ---D | M] -- C:\Users\René Kolar\AppData\Roaming\Yrsyeg
[2011/12/17 17:26:07 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011/02/08 11:24:21 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2011/02/17 23:05:21 | 000,000,000 | ---D | M] -- C:\BrotherTemp
[2011/12/14 10:14:47 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2011/02/07 21:46:46 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011/05/18 20:49:55 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2011/12/08 14:09:03 | 000,000,000 | R--D | M] -- C:\Program Files
[2011/12/18 14:40:13 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2011/12/18 14:30:54 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011/02/07 21:46:46 | 000,000,000 | -HSD | M] -- C:\Recovery
[2011/12/08 14:09:29 | 000,000,000 | ---D | M] -- C:\Runs of Magic
[2011/12/17 19:47:35 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011/08/11 09:22:18 | 000,000,000 | ---D | M] -- C:\Team17
[2011/02/08 11:24:12 | 000,000,000 | R--D | M] -- C:\Users
[2011/12/18 18:24:26 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009/07/14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009/07/14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009/07/14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009/07/14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011/02/26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009/10/31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011/02/25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009/08/03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009/10/31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009/08/03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/10/31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009/08/03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011/02/26 07:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009/08/03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2010/11/20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2010/05/12 09:37:57 | 000,410,504 | ---- | M] (Intel Corporation) MD5=513DC087CFED7D2BB82F005385D3531F -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16592_none_0af87721a183cb70\iaStorV.sys
[2011/03/11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011/03/11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011/03/11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011/03/11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011/03/11 07:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009/07/14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
[2010/05/12 09:50:37 | 000,410,496 | ---- | M] (Intel Corporation) MD5=E353CF970C5D4D6A092911E15FB78C07 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20712_none_0bd89532ba6088d9\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009/07/14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010/11/20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010/11/20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010/11/20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010/11/20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009/07/14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2010/05/12 09:38:10 | 000,166,280 | ---- | M] (NVIDIA Corporation) MD5=0AF7B8136794E23E87BE138992880E64 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16592_none_95c1e7d0d8ba7548\nvstor.sys
[2009/07/14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011/03/11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011/03/11 07:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2010/05/12 09:50:49 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=CE76755AF933E728CEBA6C7A970838A4 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20712_none_96a205e1f19732b1\nvstor.sys
[2011/03/11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011/03/11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011/03/11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010/11/20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010/11/20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010/11/20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010/11/20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010/11/20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010/11/20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010/11/20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009/07/14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009/07/14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010/11/20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010/11/20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010/11/20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010/11/20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010/11/20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010/11/20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009/10/28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009/10/28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009/07/14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
[2011/12/18 18:39:54 | 001,835,008 | -HS- | M] () -- C:\Users\René Kolar\NTUSER.DAT
[2011/12/18 18:39:54 | 000,262,144 | -HS- | M] () -- C:\Users\René Kolar\ntuser.dat.LOG1
[2011/02/07 21:51:25 | 000,000,000 | -HS- | M] () -- C:\Users\René Kolar\ntuser.dat.LOG2
[2011/02/07 23:01:35 | 000,065,536 | -HS- | M] () -- C:\Users\René Kolar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2011/02/07 23:01:35 | 000,524,288 | -HS- | M] () -- C:\Users\René Kolar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2011/02/07 23:01:35 | 000,524,288 | -HS- | M] () -- C:\Users\René Kolar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2011/02/07 21:51:25 | 000,000,020 | -HS- | M] () -- C:\Users\René Kolar\ntuser.ini
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
<           >

< End of report >

--- --- ---

rko4616 · 18.12.2011, 19:31

Nochmals vielen Dank für deine Hilfe. Falls du noch Fragen hast bzw. Aufforderung, kannst du dich gerne melden.
Oje, habe aber folgendes vergessen: auf die Datei OTL auf dem Desktop habe ich es nicht als Administrator ausgeführt, sondern einen normalen Doppelklick gemacht. Ich hoffe, es funktioniert auch so, sonst scanne ich es einfach nochmals "mit Administrator" ausführen.
Sorry, dass ich so "dumm" bin, aber bin halt sehr nervös, da ich den PC für die Schule unbedingt brauche.

markusg · 18.12.2011, 19:41

hi

achtung!

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

ATTFilter

:OTL
O4 - HKCU..\Run: [{65F76971-3345-11E0-9C46-806E6F6E6963}] C:\Users\René Kolar\AppData\Roaming\Microsoft\hostrun.exe (The Pidgin developer community)
:Files
C:\Users\René Kolar\AppData\Roaming\Microsoft\hostrun.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

öffne computer, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
folge dem link, und lade das archiv im upload channel hoch
http://www.trojaner-board.de/54791-a...ner-board.html

rko4616 · 18.12.2011, 20:09

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{65F76971-3345-11E0-9C46-806E6F6E6963} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65F76971-3345-11E0-9C46-806E6F6E6963}\ not found.
C:\Users\René Kolar\AppData\Roaming\Microsoft\hostrun.exe moved successfully.
========== FILES ==========
File\Folder C:\Users\René Kolar\AppData\Roaming\Microsoft\hostrun.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 56502 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Michael
->Flash cache emptied: 57316 bytes

User: Public

User: René Kolar
->Flash cache emptied: 70946 bytes

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Michael
->Temp folder emptied: 5445194 bytes
->Temporary Internet Files folder emptied: 1347661 bytes
->Java cache emptied: 51299 bytes
->FireFox cache emptied: 57734412 bytes
->Flash cache emptied: 0 bytes

User: Public

User: René Kolar
->Temp folder emptied: 73090388 bytes
->Temporary Internet Files folder emptied: 443207896 bytes
->Java cache emptied: 218333 bytes
->FireFox cache emptied: 1082190657 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 4 bytes
%systemroot% .tmp files removed: 1708414 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 269396 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50501 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 749 bytes
RecycleBin emptied: 5441332 bytes

Total Files Cleaned = 1,593.00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 12182011_200036

Files\Folders moved on Reboot...
C:\Users\René Kolar\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

rko4616 · 18.12.2011, 20:40

Juhu, mein Account funktioniert wieder dank dir. Echt vielen Dank, bin froh, dass das so schnell und gut geklappt hat.

Muss ich jetzt noch weitere Punkte beachten oder war's das? Wenn ja, kannst du mir gerne Bescheid geben ...

Hätt nur noch ne kleine Frage. Wieso konnte mir so etwas passieren, ich habe ja ein Antivirus programm = Avira und laut Experten sollte dies ein sehr gutes Antivirus programm sein.

Soll ich noch zusätzliche Antiviren-Programme installieren? Kennst du ein besseres? Was würde mir noch für einen guten, kostenlosen Schutz fehlen?
Wäre über eine Antwort dankbar. Vielen Dank nochmals für die Reparatur^^

markusg · 18.12.2011, 20:42

ein av programm heißt noch lange nicht das der pc sicher ist, gebe dir dann noch tipps.

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
Tool

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Hinweis:
Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

rko4616 · 19.12.2011, 23:27

Combofix Logfile:

Code:

ATTFilter

ComboFix 11-12-19.01 - René Kolar 19.12.2011  21:21:07.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.43.1031.18.4095.2552 [GMT 1:00]
ausgeführt von:: c:\users\RenÚ Kolar\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\René Kolar\AppData\Roaming\Adobe\plugs\mmc212.exe
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\wpcap.dll
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_NPF
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-11-19 bis 2011-12-19  ))))))))))))))))))))))))))))))
.
.
2011-12-19 20:44 . 2011-12-19 20:44	69000	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{D9077C04-EBAA-46D1-9260-3000801C1280}\offreg.dll
2011-12-19 16:10 . 2011-12-19 16:10	--------	d-----w-	c:\users\René Kolar\AppData\Local\{B7A162B2-A2DD-4951-9666-5C071E169E9E}
2011-12-19 16:10 . 2011-12-19 16:10	--------	d-----w-	c:\users\René Kolar\AppData\Local\{2EB9B943-2771-482F-8237-4F5D443B018E}
2011-12-18 19:07 . 2011-12-18 19:08	--------	d-----w-	c:\users\René Kolar\AppData\Local\{7C21C7FF-202B-4788-A669-528E480E11C1}
2011-12-18 19:07 . 2011-12-18 19:07	--------	d-----w-	c:\users\René Kolar\AppData\Local\{4E8D7DDA-7996-4E01-90F3-B41C03EA9D2D}
2011-12-18 19:00 . 2011-12-18 19:14	--------	d-----w-	C:\_OTL
2011-12-18 18:54 . 2011-12-18 18:55	--------	d-----w-	c:\users\René Kolar\GILD2
2011-12-18 18:20 . 2011-12-18 18:47	--------	d-----w-	c:\users\René Kolar\GILD1
2011-12-18 17:47 . 2011-12-18 19:08	--------	d-----w-	c:\users\René Kolar\GILD geschickt
2011-12-18 16:12 . 2011-12-18 16:12	--------	d-----w-	c:\users\René Kolar\AppData\Local\{45315269-683A-48BB-8C25-F6AABDFDF7B9}
2011-12-18 15:18 . 2011-12-18 15:18	--------	d-----w-	c:\users\Michael\AppData\Roaming\Malwarebytes
2011-12-18 13:40 . 2011-12-18 13:40	--------	d-----w-	c:\program files (x86)\ESET
2011-12-18 13:33 . 2011-12-18 13:33	--------	d-----w-	c:\users\René Kolar\AppData\Roaming\Malwarebytes
2011-12-18 13:30 . 2011-12-18 13:30	--------	d-----w-	c:\programdata\Malwarebytes
2011-12-18 13:30 . 2011-12-18 13:30	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2011-12-18 13:30 . 2011-08-31 16:00	25416	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-12-18 13:20 . 2011-12-18 13:20	--------	d-----w-	c:\users\Michael\AppData\Local\SoftGrid Client
2011-12-18 13:20 . 2011-12-18 16:03	--------	d-----w-	c:\users\Michael\AppData\Roaming\SoftGrid Client
2011-12-17 09:58 . 2011-12-17 09:58	--------	d-----w-	c:\users\René Kolar\AppData\Local\{08F537C4-EC62-4DAE-B468-442B5B77C43E}
2011-12-17 09:58 . 2011-12-17 09:58	--------	d-----w-	c:\users\René Kolar\AppData\Local\{573294E2-E9A2-4806-B398-BEE27768A7B4}
2011-12-16 13:27 . 2011-11-21 11:40	8822856	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{D9077C04-EBAA-46D1-9260-3000801C1280}\mpengine.dll
2011-12-16 13:24 . 2011-12-16 13:24	--------	d-----w-	c:\users\René Kolar\AppData\Local\{C65BE5F4-13DB-46AC-B307-64ECD9B7C9CB}
2011-12-16 13:24 . 2011-12-16 13:24	--------	d-----w-	c:\users\René Kolar\AppData\Local\{2E1D89CD-30D8-42F2-9BF1-1BE97B6773D4}
2011-12-15 12:52 . 2011-12-15 12:52	--------	d-----w-	c:\users\René Kolar\AppData\Local\{6754492E-7905-4672-8109-88BF8A3844F0}
2011-12-15 12:51 . 2011-12-15 12:52	--------	d-----w-	c:\users\René Kolar\AppData\Local\{32FCA9C5-019B-409B-97F1-1DE670E0B641}
2011-12-14 15:33 . 2011-12-14 15:34	--------	d-----w-	c:\users\René Kolar\AppData\Local\{C42F5A0D-FB47-45D6-9AA5-FB172921E39F}
2011-12-14 15:33 . 2011-12-14 15:33	--------	d-----w-	c:\users\René Kolar\AppData\Local\{7465EDE8-075D-4220-A962-A5DDFF106F2B}
2011-12-14 09:25 . 2011-11-24 04:52	3145216	----a-w-	c:\windows\system32\win32k.sys
2011-12-14 09:25 . 2011-10-15 06:31	723456	----a-w-	c:\windows\system32\EncDec.dll
2011-12-14 09:25 . 2011-10-15 05:38	534528	----a-w-	c:\windows\SysWow64\EncDec.dll
2011-12-14 09:25 . 2011-11-05 05:32	2048	----a-w-	c:\windows\system32\tzres.dll
2011-12-14 09:25 . 2011-11-05 04:26	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2011-12-14 09:15 . 2011-12-14 09:15	--------	d-----w-	c:\users\René Kolar\AppData\Local\{51757C86-FE81-4B11-9432-076B16C072DC}
2011-12-13 15:26 . 2011-12-13 15:26	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2011-12-13 15:26 . 2011-12-13 15:26	--------	d-----w-	c:\program files (x86)\Common Files\Overwolf
2011-12-13 12:13 . 2011-12-13 12:13	--------	d-----w-	c:\users\René Kolar\AppData\Local\{B1048806-4818-402C-BC45-83696E546C20}
2011-12-13 12:13 . 2011-12-13 12:13	--------	d-----w-	c:\users\René Kolar\AppData\Local\{24A2594B-8059-49C7-A11C-E778D9C22939}
2011-12-12 18:53 . 2011-12-12 18:53	--------	d-----w-	c:\programdata\Overwolf
2011-12-12 15:41 . 2011-12-12 15:42	--------	d-----w-	c:\users\René Kolar\AppData\Local\{2DCA8E93-38C2-4669-935F-40170A979669}
2011-12-12 15:41 . 2011-12-12 15:41	--------	d-----w-	c:\users\René Kolar\AppData\Local\{8B5891BD-9DCB-4027-A8AD-8C2AC709AEA0}
2011-12-11 20:05 . 2011-12-11 20:05	421200	----a-w-	c:\windows\SysWow64\msvcp100.dll
2011-12-11 20:05 . 2011-12-11 20:05	768848	----a-w-	c:\windows\SysWow64\msvcr100.dll
2011-12-11 11:06 . 2011-12-11 11:06	--------	d-----w-	c:\users\René Kolar\AppData\Local\{2AF3CCAD-4528-4817-9487-AE202000AEE6}
2011-12-11 11:06 . 2011-12-11 11:06	--------	d-----w-	c:\users\René Kolar\AppData\Local\{60917E3C-E06B-4B9B-816F-0C911960A59F}
2011-12-10 12:04 . 2011-12-10 12:04	--------	d-----w-	c:\users\René Kolar\AppData\Local\{DAA995DD-5A2F-4A40-9E4D-3FD3AFCA6960}
2011-12-10 12:04 . 2011-12-10 12:04	--------	d-----w-	c:\users\René Kolar\AppData\Local\{530E16A7-32C3-46BA-888F-6D153DCB9236}
2011-12-09 11:15 . 2011-12-18 13:46	--------	d-----w-	c:\program files (x86)\Application Updater
2011-12-09 11:15 . 2011-12-09 11:15	--------	d-----w-	c:\program files (x86)\pdfforge Toolbar
2011-12-09 11:15 . 2011-12-09 11:15	--------	d-----w-	c:\program files (x86)\Common Files\Spigot
2011-12-09 11:13 . 2011-12-09 11:13	--------	d-----w-	c:\users\René Kolar\AppData\Local\{2894BE44-CFC6-4782-BCE9-0095AB2D9C47}
2011-12-09 11:13 . 2011-12-09 11:13	--------	d-----w-	c:\users\René Kolar\AppData\Local\{E7B29CF7-BC1F-483F-8C32-808C23B155DE}
2011-12-08 22:26 . 2011-12-08 22:26	--------	d-----w-	c:\users\René Kolar\AppData\Local\{9545F748-48EE-498B-BACD-0C3ED92A079E}
2011-12-08 22:25 . 2011-12-08 22:26	--------	d-----w-	c:\users\René Kolar\AppData\Local\{564994C5-E93D-48D4-8C95-5DF0F4E1AA78}
2011-12-08 16:11 . 2011-12-13 15:26	--------	d-----w-	c:\program files (x86)\Overwolf
2011-12-08 16:10 . 2011-12-19 16:10	--------	d-----w-	c:\users\René Kolar\AppData\Local\Overwolf
2011-12-08 16:00 . 2011-12-13 12:47	--------	d-----w-	c:\program files (x86)\Runes of Magic
2011-12-08 13:10 . 2011-12-08 16:15	--------	d-----w-	c:\users\René Kolar\AppData\Roaming\FOG Downloader
2011-12-08 13:10 . 2011-12-08 13:10	--------	d-----w-	c:\users\René Kolar\Runs of Magic
2011-12-08 13:09 . 2011-12-08 13:09	--------	d-----w-	C:\Runs of Magic
2011-12-08 13:08 . 2011-12-08 13:08	--------	d-----w-	c:\program files\Runs of Magic
2011-12-08 10:25 . 2011-12-08 10:25	--------	d-----w-	c:\users\René Kolar\AppData\Local\{21ED118B-5324-4E92-A648-1A54A306E59C}
2011-12-08 10:24 . 2011-12-08 10:25	--------	d-----w-	c:\users\René Kolar\AppData\Local\{2D42C6EA-BD12-4158-9404-D08ED62AE3CE}
2011-12-07 13:59 . 2011-12-07 13:59	--------	d-----w-	c:\users\René Kolar\AppData\Local\{81A035BB-CC78-470F-BF95-38BBC5A563F0}
2011-12-07 13:59 . 2011-12-07 13:59	--------	d-----w-	c:\users\René Kolar\AppData\Local\{CC416FAB-8844-47B3-8F0A-86C02C81EA4E}
2011-12-06 12:41 . 2011-12-06 12:41	--------	d-----w-	c:\users\René Kolar\AppData\Local\{F909FFBD-C0F4-4027-BF7A-07139E1E15D2}
2011-12-06 12:41 . 2011-12-06 12:41	--------	d-----w-	c:\users\René Kolar\AppData\Local\{7D621AF3-26D6-4521-96EA-FC016082800C}
2011-12-05 13:10 . 2011-12-05 13:11	--------	d-----w-	c:\users\René Kolar\AppData\Local\{F3BB84E3-E459-410D-BA85-8B1B91E748DF}
2011-12-05 13:10 . 2011-12-05 13:10	--------	d-----w-	c:\users\René Kolar\AppData\Local\{781A0613-3704-469E-904E-09D93FDFE60F}
2011-12-04 10:23 . 2011-12-04 10:24	--------	d-----w-	c:\users\René Kolar\AppData\Local\{2D8D4ADB-2608-4DF3-87CB-789D63FCBE14}
2011-12-04 10:23 . 2011-12-04 10:23	--------	d-----w-	c:\users\René Kolar\AppData\Local\{00AB2D7A-D4EF-4D04-9077-57A2D58D785D}
2011-12-03 10:31 . 2011-12-03 10:31	--------	d-----w-	c:\users\René Kolar\AppData\Local\{26C64812-39FD-421D-8196-89752F53BE19}
2011-12-03 10:31 . 2011-12-03 10:31	--------	d-----w-	c:\users\René Kolar\AppData\Local\{95E051D5-8FC8-4966-B977-DDD8085D7A94}
2011-12-02 13:11 . 2011-12-02 13:11	--------	d-----w-	c:\users\René Kolar\AppData\Local\{620AD673-3693-4826-AA77-597CF95D3911}
2011-12-02 13:11 . 2011-12-02 13:11	--------	d-----w-	c:\users\René Kolar\AppData\Local\{C961F65C-761E-4FBC-896F-48BFFBFF23DA}
2011-12-01 20:38 . 2011-12-01 20:38	--------	d-----w-	c:\users\René Kolar\AppData\Local\{5651E06B-5E26-4917-BA08-94FF106F360D}
2011-12-01 20:38 . 2011-12-01 20:38	--------	d-----w-	c:\users\René Kolar\AppData\Local\{A0B89B63-8040-4412-A3B7-AA0E41583896}
2011-12-01 08:37 . 2011-12-01 08:37	--------	d-----w-	c:\users\René Kolar\AppData\Local\{8239D3DD-3C9D-4A37-83B1-4E6F2BBBDE61}
2011-12-01 08:37 . 2011-12-01 08:37	--------	d-----w-	c:\users\René Kolar\AppData\Local\{EDE432C6-94BA-45AB-8FC7-88F4EC7E4B0E}
2011-11-30 13:51 . 2011-11-30 13:51	--------	d-----w-	c:\users\René Kolar\AppData\Local\{04BD8F9E-4803-4977-9208-F8D92B7DEEE5}
2011-11-30 13:51 . 2011-11-30 13:51	--------	d-----w-	c:\users\René Kolar\AppData\Local\{40656761-9BEB-4EAC-ADC7-EE0BF56818B2}
2011-11-29 14:50 . 2011-11-29 14:50	--------	d-----w-	c:\users\René Kolar\AppData\Local\{EA2419BF-2CF5-42E7-A82D-095DD1434957}
2011-11-29 14:49 . 2011-11-29 14:50	--------	d-----w-	c:\users\René Kolar\AppData\Local\{681A11D6-9200-4165-94EC-89DE4560FB7B}
2011-11-28 13:26 . 2011-11-28 13:26	--------	d-----w-	c:\users\René Kolar\AppData\Local\{D8A3321E-3A3D-40DE-B39F-7C9254631A4A}
2011-11-28 13:25 . 2011-11-28 13:26	--------	d-----w-	c:\users\René Kolar\AppData\Local\{78E179E9-8C2A-41C5-99F6-D0DAAA6F35E8}
2011-11-27 18:30 . 2011-11-27 18:30	--------	d-----w-	c:\users\René Kolar\AppData\Local\{5288780E-12D7-45D9-A6E4-E262B49FB7EB}
2011-11-27 18:29 . 2011-11-27 18:29	--------	d-----w-	c:\users\René Kolar\AppData\Local\{67474EF7-667A-4466-A37D-CDEBF8F07D0E}
2011-11-26 13:52 . 2011-11-26 13:52	--------	d-----w-	c:\users\René Kolar\AppData\Local\{09A78F1D-1A41-42DB-95FE-17D85AB0C935}
2011-11-26 13:52 . 2011-11-26 13:52	--------	d-----w-	c:\users\René Kolar\AppData\Local\{00C5100D-4D03-4DC9-8FB7-BFE33B216A3A}
2011-11-25 13:39 . 2011-11-25 13:39	--------	d-----w-	c:\users\René Kolar\AppData\Local\{749422B2-39CA-4251-A183-5B3C02CCC6E5}
2011-11-25 13:39 . 2011-11-25 13:39	--------	d-----w-	c:\users\René Kolar\AppData\Local\{47ABBE4D-E2AC-4E5B-866A-3FDE55146244}
2011-11-24 14:05 . 2011-11-24 14:06	--------	d-----w-	c:\users\René Kolar\AppData\Local\{98B04916-AE9E-432F-A322-9F66B1335C85}
2011-11-24 14:05 . 2011-11-24 14:05	--------	d-----w-	c:\users\René Kolar\AppData\Local\{CAB0BC05-EEC5-4145-8657-E46BEBAB391B}
2011-11-23 18:51 . 2011-11-23 18:51	--------	d-----w-	c:\program files (x86)\DVDVideoSoftTB
2011-11-23 09:53 . 2011-11-23 09:54	--------	d-----w-	c:\users\René Kolar\AppData\Local\{3C1B3894-D12E-4F49-BAAB-799BEF1D49A1}
2011-11-23 09:53 . 2011-11-23 09:53	--------	d-----w-	c:\users\René Kolar\AppData\Local\{4E081334-EBE4-4BF4-B421-0B76754358AF}
2011-11-22 21:06 . 2011-11-22 21:06	--------	d-----w-	c:\users\René Kolar\AppData\Local\{0EC9C46C-135C-4A2F-BB4D-58C085600A92}
2011-11-22 21:06 . 2011-11-22 21:06	--------	d-----w-	c:\users\René Kolar\AppData\Local\{92ADC15F-A2EB-4BB2-9C35-0FE1A68C5141}
2011-11-22 09:05 . 2011-11-22 09:05	--------	d-----w-	c:\users\René Kolar\AppData\Local\{7681501B-523D-45FD-A7E3-5B774D7E2975}
2011-11-22 09:05 . 2011-11-22 09:05	--------	d-----w-	c:\users\René Kolar\AppData\Local\{2A5EA940-6B83-4FCE-90C8-1B4C4C466BE6}
2011-11-21 15:54 . 2011-11-21 15:54	--------	d-----w-	c:\users\René Kolar\AppData\Local\{486DE080-134C-46EE-B4BC-D99259BE8060}
2011-11-20 10:29 . 2011-11-20 10:30	--------	d-----w-	c:\users\René Kolar\AppData\Local\{C92FF03D-3F5C-47E7-B139-F24EB5F865D2}
2011-11-20 10:29 . 2011-11-20 10:29	--------	d-----w-	c:\users\René Kolar\AppData\Local\{50F6F20A-2B49-4FA1-9004-0AF28FFA4C14}
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-08 22:19 . 2011-06-22 18:23	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-09-29 16:29 . 2011-11-09 08:57	1923952	----a-w-	c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{40c3cc16-7269-4b32-9531-17f2950fb06f}"= "c:\program files (x86)\Winload\prxtbWinl.dll" [2011-01-17 175912]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files (x86)\DVDVideoSoftTB\prxtbDVDV.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{40c3cc16-7269-4b32-9531-17f2950fb06f}]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54	175912	----a-w-	c:\program files (x86)\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{40c3cc16-7269-4b32-9531-17f2950fb06f}]
2011-01-17 14:54	175912	----a-w-	c:\program files (x86)\Winload\prxtbWinl.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2011-05-09 08:49	176936	----a-w-	c:\program files (x86)\DVDVideoSoftTB\prxtbDVDV.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{40c3cc16-7269-4b32-9531-17f2950fb06f}"= "c:\program files (x86)\Winload\prxtbWinl.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files (x86)\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files (x86)\DVDVideoSoftTB\prxtbDVDV.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{40c3cc16-7269-4b32-9531-17f2950fb06f}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 17351304]
"Overwolf"="c:\program files (x86)\Overwolf\Overwolf.exe" [2011-12-11 38632]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-10-14 98304]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"BrMfcWnd"="c:\program files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-26 1159168]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-07-19 421736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 WSWNDA3100;WSWNDA3100;c:\program files (x86)\NETGEAR\WNDA3100v2\WifiSvc.exe [2009-11-04 278528]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 OverwolfUpdaterService;Overwolf Updater Service;c:\program files (x86)\Overwolf\\OverwolfUpdater.exe [2011-12-11 16616]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [x]
S0 SCMNdisP;General NDIS Protocol Driver;c:\windows\system32\DRIVERS\scmndisp.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-28 136360]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 BCMH43XX;Treiber für Broadcom 802.11-USB-Netzwerkadapter;c:\windows\system32\DRIVERS\bcmwlhigh664.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JAVA"="c:\windows\java.vbs" [2010-11-17 83]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-10-22 11490408]
"combofix"="c:\combofix\CF3454.3XE" [2010-11-20 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube Download - c:\users\René Kolar\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\René Kolar\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/5221-29898-17534-1/4
TCP: DhcpNameServer = 10.0.0.138 10.0.0.138
FF - ProfilePath - c:\users\René Kolar\AppData\Roaming\Mozilla\Firefox\Profiles\qc0dl4ro.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2319825&SearchSource=13
FF - prefs.js: keyword.URL - hxxp://at.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p=
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-NvCplDaemonTool - (no file)
SafeBoot-BsScanner
WebBrowser-{40C3CC16-7269-4B32-9531-17F2950FB06F} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-12-19  22:05:58 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-12-19 21:05
.
Vor Suchlauf: 9 Verzeichnis(se), 1.400.400.568.320 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 1.401.840.951.296 Bytes frei
.
- - End Of File - - 771195F9FECEA992D7721BAC0FF1EA41

--- --- ---

markusg · 20.12.2011, 11:27

sieht gut aus.
lade den CCleaner standard:
CCleaner Download - CCleaner 3.13.1600
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

rko4616 · 20.12.2011, 23:05

notwendig Acrobat.com Adobe Systems Incorporated 12.10.2010 1,61MB 1.6.65
notwendig Adobe AIR Adobe Systems Inc. 01.12.2010 2.5.1.17730
notwendig Adobe Flash Player 10 Plugin Adobe Systems Incorporated 29.06.2011 6,00MB 10.3.181.34
notwendig Adobe Flash Player 11 ActiveX 64-bit Adobe Systems Incorporated 07.11.2011 6,00MB 11.0.1.152
notwendig Adobe Reader X (10.1.0) - Deutsch Adobe Systems Incorporated 17.06.2011 165,4MB 10.1.0
notwendig Adobe Shockwave Player 11.5 Adobe Systems, Inc. 07.02.2011 11.5.9.615
unbekannt Apple Application Support Apple Inc. 26.07.2011 51,0MB 1.5.2
unbekannt Apple Mobile Device Support Apple Inc. 26.07.2011 22,7MB 3.4.1.2
unbekannt Apple Software Update Apple Inc. 26.07.2011 2,38MB 2.1.3.127
unbekannt ATI Catalyst Install Manager ATI Technologies, Inc. 02.12.2010 22,4MB 3.0.804.0
notwendig Avira AntiVir Personal - Free Antivirus Avira GmbH 13.10.2011 69,3MB 10.2.0.704
notwendig bet-at-home.com Poker 26.10.2011
unbekannt Bonjour Apple Inc. 26.07.2011 1,58MB 3.0.0.2
notwendig Brother MFL-Pro Suite DCP-135C Brother Industries, Ltd. 16.02.2011 1.0.2.0
notwendig CCleaner Piriform 19.12.2011 3.13
notwendig CDBurnerXP CDBurnerXP 06.02.2011 11,1MB 4.3.8.2474
unbekannt Conduit Engine Conduit Ltd. 15.06.2011
unbekannt Control ActiveX de Windows Live Mesh para conexiones remotas Microsoft Corporation 26.10.2010 5,57MB 15.4.5722.2
notwendig Controlo ActiveX do Windows Live Mesh para Ligações Remotas Microsoft Corporation 26.10.2010 5,58MB 15.4.5722.2
notwendig Contrôle ActiveX Windows Live Mesh pour connexions à distance Microsoft Corporation 26.10.2010 5,57MB 15.4.5722.2
notwendig DVDVideoSoftTB Toolbar DVDVideoSoftTB 22.11.2011
notwendig ESET Online Scanner v3 17.12.2011
unbekannt Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych Microsoft Corporation 26.10.2010 5,57MB 15.4.5722.2
notwendig Free Audio CD Burner version 1.4.7 DVDVideoSoft Limited. 28.03.2011 10,7MB
notwendig Free Studio version 5.1.1 DVDVideoSoft Limited. 16.07.2011 329MB
notwendig Free YouTube to MP3 Converter version 3.10.13.1123 DVDVideoSoft Ltd. 22.11.2011 87,6MB
unnötig Google Chrome Google Inc. 19.12.2011 16.0.912.63
notwendig IrfanView (remove only) Irfan Skiljan 06.02.2011 1,50MB 4.28
notwendig iTunes Apple Inc. 26.07.2011 142,8MB 10.4.0.80
notwendig Java(TM) 6 Update 22 Oracle 01.12.2010 97,1MB 6.0.220
notwendig Java(TM) 6 Update 22 (64-bit) Oracle 01.12.2010 90,7MB 6.0.220
unbekannt Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave Microsoft Corporation 26.10.2010 5,57MB 15.4.5722.2
unnötig LEGO Universe LEGO Software 06.09.2011
notwendig Malwarebytes' Anti-Malware Version 1.51.2.1300 Malwarebytes Corporation 17.12.2011 13,8MB 1.51.2.1300
notwendig Medion Home Cinema CyberLink Corp. 08.11.2010 0,94MB 6.0.0000
notwendig Microsoft .NET Framework 4 Client Profile Microsoft Corporation 06.07.2010 38,8MB 4.0.30319
notwendig Microsoft Office 2010 Microsoft Corporation 06.07.2010 6,31MB 14.0.4763.1000
notwendig Microsoft Office Klick-und-Los 2010 Microsoft Corporation 06.02.2011 14.0.4763.1000
notwendig Microsoft Office Starter 2010 - Deutsch Microsoft Corporation 06.02.2011 14.0.4763.1000
notwendig Microsoft Office XP Professional mit FrontPage Microsoft Corporation 15.02.2011 468MB 10.0.2701.0
notwendig Microsoft Silverlight Microsoft Corporation 11.10.2011 160,0MB 4.0.60831.0
notwendig Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 26.10.2010 1,70MB 3.1.0000
notwendig Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 Microsoft Corporation 06.07.2010 0,25MB 8.0.50727.4053
notwendig Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 11.04.2011 0,25MB 8.0.50727.4053
notwendig Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 13.06.2011 0,29MB 8.0.61001
notwendig Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 10.04.2011 0,69MB 8.0.61000
notwendig Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 Microsoft Corporation 25.05.2011 0,57MB 8.0.51011
notwendig Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 Microsoft Corporation 07.02.2011 0,21MB 9.0.30729.4148
notwendig Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 Microsoft Corporation 25.05.2011 0,77MB 9.0.30729.5570
notwendig Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Corporation 25.05.2011 0,58MB 9.0.30729.5570
notwendig Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 02.12.2010 0,77MB 9.0.30729
notwendig Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 13.06.2011 0,77MB 9.0.30729.6161
notwendig Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 02.12.2010 0,58MB 9.0.30729
notwendig Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 06.02.2011 0,58MB 9.0.30729.4148
notwendig Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 13.06.2011 0,59MB 9.0.30729.6161
notwendig Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 Microsoft Corporation 25.05.2011 13,7MB 10.0.30319
notwendig Mozilla Firefox 8.0 (x86 de) Mozilla 11.11.2011 36,2MB 8.0
unbekannt MSXML 4.0 SP2 (KB973688) Microsoft Corporation 06.07.2010 1,34MB 4.20.9876.0
notwendig NETGEAR WNDA3100v2 wireless USB 2.0 adapter NETGEAR 10.04.2011 1.0.0.133
unbekannt Overwolf Overwolf 12.12.2011 58,1MB 0.27.166
notwendig PDFCreator Frank Heindörfer, Philip Chinery 01.03.2011 1.2.0
unbekannt pdfforge Toolbar v4.8 Spigot, Inc. 08.12.2011 8,36MB 4.8
unbekannt PlayReady PC Runtime amd64 Microsoft Corporation 06.02.2011 2,06MB 1.3.0
unbekannt QuickTime Apple Inc. 06.02.2011 73,7MB 7.69.80.9
unbekannt Realtek High Definition Audio Driver Realtek Semiconductor Corp. 01.12.2010 6.0.1.6225
unbekannt Renesas Electronics USB 3.0 Host Controller Driver Renesas Electronics Corporation 14.12.2010 1,01MB 2.0.30.0
notwendig Runes of Magic Frogster Online Gaming GmbH 07.12.2011 4.0.5.2467
notwendig Skype Click to Call Skype Technologies S.A. 05.12.2011 12,6MB 5.6.8442
notwendig Skype™ 5.5 Skype Technologies S.A. 05.12.2011 17,0MB 5.5.124
notwendig Spelling Dictionaries Support For Adobe Reader 9 Adobe Systems Incorporated 08.11.2010 64,7MB 9.0.0
unbekannt Uninstall 1.0.0.1 28.03.2011 10,9MB
unbekannt Uzak Bağlantılar İçin Windows Live Mesh ActiveX Denetimi Microsoft Corporation 26.10.2010 5,57MB 15.4.5722.2
notwendig VLC media player 1.1.7 VideoLAN 06.02.2011 1.1.7
notwendig Win2day Poker 26.10.2011
notwendig Windows Live Essentials Microsoft Corporation 27.10.2010 15.4.3538.0513
unbekannt Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen Microsoft Corporation 26.10.2010 5,57MB 15.4.5722.2
unbekannt Windows Live Mesh ActiveX Control for Remote Connections Microsoft Corporation 26.10.2010 5,38MB 15.4.5722.2
unbekannt Windows Live Mesh ActiveX control for remote connections Microsoft Corporation 26.10.2010 5,58MB 15.4.5722.2
unbekannt Windows Live Mesh ActiveX-objekt til fjernforbindelser Microsoft Corporation 26.10.2010 5,57MB 15.4.5722.2
unbekannt Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz Microsoft Corporation 26.10.2010 5,58MB 15.4.5722.2
unbekannt Windows Media Encoder 9 Series 08.11.2010
unnötig Winload Toolbar Winload 15.06.2011 6.3.3.3
notwendig WinRAR 4.01 (32-Bit) win.rar GmbH 16.09.2011 4.01.0
notwendig Worms World Party 10.08.2011
unbekannt Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις Microsoft Corporation 26.10.2010 5,38MB 15.4.5722.2

rko4616 · 20.12.2011, 23:07

Habe dies nach bestem Willen ausgefüllt! Die Windows Office Programme habe ich alle als Notwendig markiert. Auch die Starterpakete von XP, welche bei diesem PC dabei waren. Andernfalls kann ich die Office XP-Dateien, welche ich von anderen Schulkollegen bekomme nicht öffnen. LG

markusg · 21.12.2011, 11:58

deinstaliere:
Adobe Flash Player 10
Conduit Engine
Control ActiveX
DVDVideoSoftTB ist ein sicherheitsrisiko und sollte weg
Formant
Java beide
Download der kostenlosen Java-Software
downloade java jre instalire es

deinstaliere
Kontrolnik
LEGO Universe
Overwolf
pdfforge Toolbar
Uzak Bağlantılar
Windows Live alle falls nicht benötigt
Winload Toolbar
Στοιχείο
klicke im CCleaner analysieren, dann bereinigen

rko4616 · 21.12.2011, 18:53

Hallo! Hab diese Vorgänge alle erfolgreich durchgeführt! Danke für deine Info's. Gibt es sonst noch was zu tun für mich bzw. wie ich meinen PC besser schützen kann?

Folgende Fehlermeldung: Aus Sicherheitsgründen wurde ihr System blockiert! Bezahlen und Runterladen

Log-Analyse und Auswertung: Folgende Fehlermeldung: Aus Sicherheitsgründen wurde ihr System blockiert! Bezahlen und Runterladen