Windows wurde zur sichherheit gesperrt zahlen sie 50€

Zebrahead

ich habe genau das gleiche problem wie Annabe aber dort steht das ich einen eigenen threat eröffnen sollte
also hier nochmal kurz erklärt : wenn ich meinen pc starte (win7 64bit) und das passwort eingegeben hab komme ich auf den desktop
für ein paar minuten ist es dann so wie immer aber dann wird der hintergrund verdunkelt und ein fenster erscheint indem mir irgendwas vonwegen sie müssen sich ein vireprogramm herrunterladen zur sicherheit wurde windows gesperrt bezahlen sie 50€ usw.
ich hoffe ihr könnt mir helfen und ich fänd es super wenn ich all meine daten auf der platte behalten könnte oder wenigstens auf die daten auf der 2 partition
mfg Felix

hier ist dieser log den ich eben mit der OTL.exe im safemode mit netzwerktreibern(von dem ich das auch gerade schreibe)gemacht habe



OTL logfile created on: 27.12.2011 17:05:30 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Felix\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

7,98 Gb Total Physical Memory | 7,05 Gb Available Physical Memory | 88,37% Memory free
15,96 Gb Paging File | 15,08 Gb Available in Paging File | 94,48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 146,48 Gb Total Space | 9,86 Gb Free Space | 6,73% Space Free | Partition Type: NTFS
Drive D: | 552,15 Gb Total Space | 245,34 Gb Free Space | 44,43% Space Free | Partition Type: NTFS
Drive E: | 4,91 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive F: | 6,28 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive G: | 149,05 Gb Total Space | 0,16 Gb Free Space | 0,11% Space Free | Partition Type: NTFS

Computer Name: FELIX-PC | User Name: Felix | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011.12.27 17:03:00 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Felix\Desktop\OTL.exe
PRC - [2011.11.13 13:17:59 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe


========== Modules (No Company Name) ==========

MOD - [2011.12.27 16:37:33 | 000,139,264 | ---- | M] () -- C:\Users\Felix\AppData\Roaming\5064\components\AcroFF0648.dll
MOD - [2011.11.29 13:15:20 | 008,527,008 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
MOD - [2011.11.13 13:17:59 | 001,989,592 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2011.10.14 23:54:26 | 000,265,536 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll


========== Win32 Services (SafeList) ==========

SRV - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.12.09 14:01:23 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.11.23 17:59:05 | 000,075,136 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.10.15 09:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.10.14 23:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2011.10.06 01:24:34 | 000,077,520 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE -- (HssTrayService)
SRV - [2011.10.06 01:21:56 | 000,288,088 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe -- (hshld)
SRV - [2011.08.15 16:18:12 | 002,329,480 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.05.27 00:14:40 | 000,329,544 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2011.05.27 00:14:36 | 000,363,336 | ---- | M] (AnchorFree Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011.12.15 15:00:00 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.12.15 14:59:59 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.12.15 14:59:59 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.08.30 00:54:28 | 000,117,520 | ---- | M] (MotioninJoy) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MijXfilt.sys -- (MotioninJoyXFilter)
DRV:64bit: - [2011.08.02 16:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.07.26 18:49:12 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2011.07.08 00:21:28 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.28 22:36:54 | 000,056,832 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HssDrv.sys -- (HssDrv)
DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.10.26 10:08:08 | 000,406,632 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010.10.19 22:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:64bit: - [2010.08.19 19:24:34 | 000,074,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV - [2011.03.18 17:08:56 | 000,029,592 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\Windows\SysWOW64\speedfan.sys -- (speedfan)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.hotspotshield.com/g/?c=h
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 83 9D 6C 61 25 88 CC 01 [binary data]
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 203.232.208.116:8080

========== FireFox ==========

FF - prefs.js..network.proxy.http: "69.163.96.2"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.type: 0

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.96.0: C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3ED591BC-7CC7-495B-A526-B2431356EDC1}: C:\Program Files (x86)\Ad Muncher\FirefoxExtension_2.0 [2011.10.18 20:10:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.13 13:18:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey\Extensions\\{3ED591BC-7CC7-495B-A526-B2431356EDC1}: C:\Program Files (x86)\Ad Muncher\FirefoxExtension_2.0 [2011.10.18 20:10:34 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\Felix\AppData\Roaming\5064 [2011.12.22 17:22:58 | 000,000,000 | ---D | M]

[2011.09.25 18:20:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Extensions
[2011.12.24 23:35:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\qzuavcdc.default\extensions
[2011.10.18 16:58:08 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\qzuavcdc.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.10.25 12:45:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.10.25 12:45:07 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.10.11 13:49:29 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
[2011.10.18 20:11:13 | 000,000,000 | ---D | M] (afurladvisor) -- C:\Program Files (x86)\mozilla firefox\extensions\afurladvisor@anchorfree.com
[2011.12.22 17:22:58 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\FELIX\APPDATA\ROAMING\5064
() (No name found) -- C:\USERS\FELIX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QZUAVCDC.DEFAULT\EXTENSIONS\ICH@MALTEGOETZ.DE.XPI
[2011.11.13 13:17:59 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.10.01 18:04:31 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.01 18:04:31 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.10.01 18:04:31 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.01 18:04:31 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.06.21 19:12:32 | 000,001,847 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\privatesearch.xml
[2011.10.01 18:04:31 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.01 18:04:31 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll (AnchorFree Inc.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Windows.old\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [RoccatKone+] C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.EXE (ROCCAT GmbH)
O4 - HKCU..\Run: [EADM] D:\Origin\Origin.exe (Electronic Arts)
O4 - HKCU..\Run: [GAINWARD] C:\Program Files (x86)\EXPERTool\TBPanel.exe (Gainward Co.)
O4 - HKCU..\Run: [opera.exe] C:\Users\Felix\AppData\Roaming\Opera\Opera\opera.exe ()
O4 - HKCU..\Run: [RDReminder] File not found
O4 - HKCU..\Run: [Steam] D:\Steam\steam.exe (Valve Corporation)
O4 - HKCU..\Run: [Userinit] C:\Users\Felix\AppData\Roaming\appconf32.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Felix\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Felix\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Windows.old\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Windows.old\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D9A8B4AB-A3EE-46F7-8395-DCB8137BBDCA}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Windows.old\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.09.17 10:35:09 | 000,000,000 | ---D | M] - D:\Autorun -- [ NTFS ]
O32 - AutoRun File - [2009.09.17 09:31:38 | 010,810,880 | R--- | M] () - D:\autorun.dat -- [ NTFS ]
O32 - AutoRun File - [2009.07.29 09:55:00 | 000,419,088 | ---- | M] (Electronic Arts) - D:\AutoRun.exe -- [ NTFS ]
O32 - AutoRun File - [2009.09.17 10:35:05 | 000,000,157 | ---- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2011.10.06 16:01:16 | 000,000,044 | R--- | M] () - E:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2011.10.06 04:40:42 | 000,000,115 | R--- | M] () - F:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{56ad6e20-e790-11e0-bec6-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{56ad6e20-e790-11e0-bec6-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Setup.exe -- [2011.10.06 16:01:18 | 000,355,920 | R--- | M] (Valve Corporation)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.12.27 17:02:58 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Felix\Desktop\OTL.exe
[2011.12.27 16:39:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
[2011.12.27 16:39:28 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011.12.25 22:09:25 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\Avira
[2011.12.25 22:09:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011.12.25 22:09:09 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2011.12.25 22:09:09 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2011.12.25 22:09:09 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2011.12.25 22:09:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2011.12.25 22:09:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2011.12.25 21:48:34 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\Opera
[2011.12.24 19:37:42 | 000,000,000 | ---D | C] -- C:\ProgramData\ROCCAT
[2011.12.24 19:37:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT
[2011.12.24 19:37:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ROCCAT
[2011.12.24 19:37:02 | 000,000,000 | ---D | C] -- C:\Users\Felix\Desktop\ROCCAT_Kone[+]_DRV1.49_FW1.45
[2011.12.23 20:04:43 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2011.12.23 11:49:52 | 000,033,856 | -H-- | C] (LogMeIn, Inc.) -- C:\Windows\SysNative\hamachi.sys
[2011.12.23 11:49:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2011.12.23 11:49:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi
[2011.12.22 17:23:12 | 000,351,184 | ---- | C] (Adobe Systems, Incorporated) -- C:\Users\Felix\AppData\Roaming\AcroIEHelpe068.dll
[2011.12.22 17:22:41 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\5064
[2011.12.21 19:11:11 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\5063
[2011.12.20 16:04:43 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\5062
[2011.12.19 16:32:34 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\5061
[2011.12.18 21:57:54 | 000,000,000 | ---D | C] -- C:\Users\Felix\Desktop\Msuik
[2011.12.16 14:54:35 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\5060
[2011.12.14 21:38:25 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\5059
[2011.12.14 21:35:29 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2011.12.14 21:35:26 | 000,702,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2011.12.14 21:35:26 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011.12.14 21:35:25 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011.12.14 21:35:25 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2011.12.14 21:35:25 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2011.12.14 21:35:25 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2011.12.14 21:35:25 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011.12.14 21:35:13 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2011.12.14 21:35:13 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2011.12.13 15:10:57 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\5058
[2011.12.12 17:06:29 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\5056
[2011.12.10 17:15:20 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\5055
[2011.12.09 20:02:21 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\5054
[2011.12.06 17:16:00 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\UAs
[2011.12.06 13:22:09 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\5053
[2011.12.06 13:21:13 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\xmldm
[2011.12.06 13:20:44 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\kock
[2011.11.29 13:15:19 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2011.11.28 17:37:47 | 000,000,000 | ---D | C] -- C:\Users\Felix\Desktop\Neuer Ordner
[1 C:\Users\Felix\AppData\Roaming\*.tmp files -> C:\Users\Felix\AppData\Roaming\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.12.27 17:03:00 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Felix\Desktop\OTL.exe
[2011.12.27 17:02:40 | 001,612,484 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.12.27 17:02:40 | 000,696,620 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.12.27 17:02:40 | 000,651,938 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.12.27 17:02:40 | 000,147,916 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.12.27 17:02:40 | 000,120,870 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.12.27 16:58:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.27 16:58:18 | 2132,721,663 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.27 16:54:13 | 000,009,633 | ---- | M] () -- C:\Users\Felix\Desktop\hijackthislog
[2011.12.27 16:44:14 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.27 16:44:14 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.27 16:39:28 | 000,002,975 | ---- | M] () -- C:\Users\Felix\Desktop\HiJackThis.lnk
[2011.12.26 10:52:40 | 000,000,036 | ---- | M] () -- C:\Users\Felix\AppData\Roaming\blckdom.res
[2011.12.25 22:09:14 | 000,002,066 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2011.12.25 16:23:27 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2011.12.25 16:23:27 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.12.25 15:11:35 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2011.12.23 23:54:18 | 000,000,109 | ---- | M] () -- C:\Users\Felix\Desktop\Let's Read - Das Märchen der traurigen Traurigkeit.URL
[2011.12.23 20:12:58 | 000,000,884 | ---- | M] () -- C:\Users\Felix\Desktop\3D Vision-Fotoanzeige.lnk
[2011.12.22 19:10:30 | 000,000,201 | ---- | M] () -- C:\Users\Felix\Desktop\LIMBO.url
[2011.12.22 17:23:12 | 000,351,184 | ---- | M] (Adobe Systems, Incorporated) -- C:\Users\Felix\AppData\Roaming\AcroIEHelpe068.dll
[2011.12.21 19:29:00 | 000,000,292 | ---- | M] () -- C:\Windows\tasks\DLL-files.com Fixer_UPDATES.job
[2011.12.15 18:05:53 | 000,274,464 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.12.15 15:00:00 | 000,027,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2011.12.15 14:59:59 | 000,130,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2011.12.15 14:59:59 | 000,097,312 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2011.12.13 22:03:44 | 002,279,951 | ---- | M] () -- C:\Users\Felix\Desktop\IOGraphica - 7.5 hours (from 14-27 to 22-03).png
[2011.12.12 22:04:59 | 000,614,893 | ---- | M] () -- C:\Users\Felix\Desktop\IOGraphica - 14.2 minutes (from 21-50 to 22-04).png
[2011.12.09 19:19:33 | 000,032,159 | ---- | M] () -- C:\Users\Felix\Desktop\polizei.jpg
[2011.12.04 19:09:49 | 000,000,201 | ---- | M] () -- C:\Users\Felix\Desktop\Call of Duty Modern Warfare 3.url
[2011.12.04 19:09:49 | 000,000,201 | ---- | M] () -- C:\Users\Felix\Desktop\Call of Duty Modern Warfare 3 - Multiplayer.url
[2011.12.04 19:09:49 | 000,000,201 | ---- | M] () -- C:\Users\Felix\Desktop\Call of Duty Modern Warfare 3 - Dedicated Server.url
[2011.11.29 13:15:20 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[1 C:\Users\Felix\AppData\Roaming\*.tmp files -> C:\Users\Felix\AppData\Roaming\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.12.27 16:54:13 | 000,009,633 | ---- | C] () -- C:\Users\Felix\Desktop\hijackthislog
[2011.12.27 16:39:28 | 000,002,975 | ---- | C] () -- C:\Users\Felix\Desktop\HiJackThis.lnk
[2011.12.25 22:09:14 | 000,002,066 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2011.12.23 23:54:18 | 000,000,109 | ---- | C] () -- C:\Users\Felix\Desktop\Let's Read - Das Märchen der traurigen Traurigkeit.URL
[2011.12.23 20:12:58 | 000,000,884 | ---- | C] () -- C:\Users\Felix\Desktop\3D Vision-Fotoanzeige.lnk
[2011.12.22 19:09:26 | 000,000,201 | ---- | C] () -- C:\Users\Felix\Desktop\LIMBO.url
[2011.12.13 22:03:42 | 002,279,951 | ---- | C] () -- C:\Users\Felix\Desktop\IOGraphica - 7.5 hours (from 14-27 to 22-03).png
[2011.12.12 22:04:58 | 000,614,893 | ---- | C] () -- C:\Users\Felix\Desktop\IOGraphica - 14.2 minutes (from 21-50 to 22-04).png
[2011.12.09 19:19:32 | 000,032,159 | ---- | C] () -- C:\Users\Felix\Desktop\polizei.jpg
[2011.12.06 13:21:21 | 000,000,036 | ---- | C] () -- C:\Users\Felix\AppData\Roaming\blckdom.res
[2011.12.04 19:09:49 | 000,000,201 | ---- | C] () -- C:\Users\Felix\Desktop\Call of Duty Modern Warfare 3.url
[2011.12.04 19:09:49 | 000,000,201 | ---- | C] () -- C:\Users\Felix\Desktop\Call of Duty Modern Warfare 3 - Multiplayer.url
[2011.12.04 19:09:49 | 000,000,201 | ---- | C] () -- C:\Users\Felix\Desktop\Call of Duty Modern Warfare 3 - Dedicated Server.url
[2011.10.14 23:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.10.12 16:40:43 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2011.10.10 16:42:36 | 001,588,762 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.10.01 01:03:57 | 000,280,904 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.10.01 01:03:55 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.09.25 18:50:40 | 000,007,605 | ---- | C] () -- C:\Users\Felix\AppData\Local\Resmon.ResmonCfg
[2011.09.25 18:02:20 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2011.06.02 08:17:24 | 000,007,764 | ---- | C] () -- C:\Windows\cadx2.ini
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2008.12.09 16:23:13 | 000,051,536 | RHS- | C] () -- C:\Users\Felix\AppData\Roaming\appconf32.exe

========== LOP Check ==========

[2011.11.27 19:50:58 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\.minecraft
[2011.09.25 18:40:54 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\4A Games
[2011.12.06 13:22:09 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\5053
[2011.12.09 20:02:21 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\5054
[2011.12.10 17:15:20 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\5055
[2011.12.12 17:06:29 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\5056
[2011.12.13 15:10:57 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\5058
[2011.12.14 21:38:25 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\5059
[2011.12.16 14:54:35 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\5060
[2011.12.19 16:32:35 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\5061
[2011.12.20 16:04:43 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\5062
[2011.12.21 19:11:11 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\5063
[2011.12.22 17:22:58 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\5064
[2011.10.18 20:10:34 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Ad Muncher
[2011.11.07 20:18:17 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Azureus
[2011.09.25 18:13:43 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\dll-files.com
[2011.10.18 16:58:12 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\DVDVideoSoft
[2011.10.18 16:58:08 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.12.06 13:20:44 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\kock
[2011.11.06 18:48:16 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\MotioninJoy
[2011.12.25 21:48:34 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Opera
[2011.10.23 19:23:46 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Origin
[2011.10.13 18:44:33 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\The Creative Assembly
[2011.12.25 21:53:51 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\UAs
[2011.11.07 19:23:16 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Ubisoft
[2011.11.08 17:19:35 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Voxatron
[2011.12.26 00:46:42 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\xmldm
[2011.11.26 19:29:00 | 000,000,272 | ---- | M] () -- C:\Windows\Tasks\DLL-files.com Fixer_MONTHLY.job
[2011.12.21 19:29:00 | 000,000,292 | ---- | M] () -- C:\Windows\Tasks\DLL-files.com Fixer_UPDATES.job
[2009.07.14 06:08:49 | 000,027,342 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 1056 bytes -> C:\ProgramData\TEMP:966F7784