Weißer bildschirm - Bitte warten, während die Verbindung hergestellt wird

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
         

OTL logfile created on: 3/1/2012 12:33:45 AM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: d.M.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 92.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 53.20 Gb Total Space | 8.79 Gb Free Space | 16.51% Space Free | Partition Type: NTFS
Drive D: | 186.31 Gb Total Space | 70.13 Gb Free Space | 37.64% Space Free | Partition Type: NTFS
Drive E: | 58.59 Gb Total Space | 3.63 Gb Free Space | 6.20% Space Free | Partition Type: NTFS
Drive F: | 938.15 Mb Total Space | 480.64 Mb Free Space | 51.23% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet003
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand] --  -- (DAUpdaterSvc)
SRV - [2011/11/09 14:05:42 | 002,420,616 | ---- | M] (Check Point Software Technologies LTD) [Auto] -- C:\Programme\CheckPoint\ZoneAlarm\vsmon.exe -- (vsmon)
SRV - [2011/11/03 09:44:28 | 000,497,280 | ---- | M] (Check Point Software Technologies) [Auto] -- C:\Programme\CheckPoint\ZAForceField\IswSvc.exe -- (IswSvc)
SRV - [2011/10/23 08:06:29 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/10/23 08:06:26 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/03/16 03:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010/05/18 09:13:58 | 000,935,208 | ---- | M] (Nero AG) [Auto] -- C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009/12/17 10:37:52 | 000,067,360 | ---- | M] (NOS Microsystems Ltd.) [On_Demand] -- C:\Programme\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2009/03/02 08:06:16 | 000,068,136 | ---- | M] () [Auto] -- C:\Programme\Gigabyte\EasySaver\ESSVR.EXE -- (ES lite Service)
SRV - [2003/07/28 06:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | System] --  -- (SRTSPX)
DRV - File not found [File_System | System] --  -- (SRTSP)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand] --  -- (NAVEX15)
DRV - File not found [Kernel | On_Demand] --  -- (NAVENG)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | On_Demand] --  -- (cpuz130)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2012/02/29 17:46:22 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2011/12/20 02:39:28 | 000,100,368 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AtihdXP3.sys -- (AtiHDAudioService)
DRV - [2011/12/11 05:30:11 | 000,239,168 | ---- | M] (DT Soft Ltd) [Kernel | System] -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2011/12/05 22:42:18 | 007,490,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2011/11/09 14:01:38 | 000,525,840 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System] -- C:\WINDOWS\system32\vsdatant.sys -- (Vsdatant)
DRV - [2011/11/03 09:44:20 | 000,027,016 | ---- | M] (Check Point Software Technologies) [Kernel | Auto] -- C:\Programme\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)
DRV - [2011/10/23 08:06:31 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/10/23 08:06:31 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/10/04 12:05:56 | 000,281,760 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2010/10/04 12:05:54 | 000,025,888 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2010/03/30 10:05:38 | 000,004,096 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nocashio.sys -- (nocashio)
DRV - [2009/08/19 07:05:56 | 000,100,368 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2009/05/11 03:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/02/13 05:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009/01/20 05:53:06 | 005,027,840 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/10/30 08:14:20 | 000,117,888 | R--- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008/04/13 13:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2006/10/17 07:22:26 | 000,009,216 | R--- | M] (VIA Technologies, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\videX32.sys -- (videX32)
DRV - [2006/03/26 07:22:14 | 000,051,200 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2006/03/24 11:27:01 | 000,050,176 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sfsync04.sys -- (sfsync04) StarForce Protection Synchronization Driver (version 4.x)
DRV - [2006/03/13 04:38:23 | 000,006,656 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2005/11/03 09:40:07 | 000,063,488 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV - [2001/08/17 08:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)
DRV - [2001/08/17 07:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\irsir.sys -- (irsir)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddr&s={searchTerms}&f=4
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\ich_bi_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.co.uk/
IE - HKU\ich_bi_ON_C\..\URLSearchHook: {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\system32\dvmurl.dll (DeviceVM Inc.)
IE - HKU\ich_bi_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Facemoods Search"
FF - prefs.js..browser.search.selectedEngine: "Wikipedia (en)"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.60
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:3.7.0.6
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.11
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Programme\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Programme\CheckPoint\ZAForceField\TrustChecker [2011/11/18 07:17:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Programme\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/02/17 14:54:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/02/23 10:13:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012/01/11 08:57:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2010/01/03 07:06:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins [2012/01/11 08:57:34 | 000,000,000 | ---D | M]
 
[2010/01/03 07:06:02 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\mozilla\Extensions
[2010/01/03 07:06:02 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/02/17 14:40:07 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\mozilla\Firefox\Profiles\gqdf0s32.default\extensions
[2011/09/22 15:09:56 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\mozilla\Firefox\Profiles\gqdf0s32.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2011/03/28 07:28:16 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\mozilla\Firefox\Profiles\gqdf0s32.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/01/11 01:44:55 | 000,000,000 | ---D | M] (Zynga Community Toolbar) -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\mozilla\Firefox\Profiles\gqdf0s32.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2010/01/14 21:52:25 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\mozilla\Firefox\Profiles\gqdf0s32.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2012/02/17 14:40:07 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\mozilla\Firefox\Profiles\gqdf0s32.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/10/27 18:48:14 | 000,001,431 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\bulbapedia-en.xml
[2011/06/22 17:31:10 | 000,002,658 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\dsencyclopdie-fr.xml
[2012/01/11 09:14:50 | 000,001,831 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\leo-deu-eng.xml
[2010/11/27 16:53:11 | 000,001,748 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\leo-deu-fra.xml
[2010/04/18 13:29:21 | 000,002,581 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\pokwiki-de.xml
[2011/11/20 05:23:25 | 000,002,262 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\the-vault-en.xml
[2011/06/01 20:52:10 | 000,002,272 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\uncyclopedia-de.xml
[2011/06/01 20:51:15 | 000,002,283 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\uncyclopedia-en.xml
[2011/10/21 08:00:33 | 000,002,006 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\urban-dictionary.xml
[2010/11/27 16:50:48 | 000,001,348 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\wikipdia-fr.xml
[2011/12/24 05:52:24 | 000,001,328 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\wikipedia-de.xml
[2010/01/04 15:55:15 | 000,001,340 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\wikipedia-en.xml
[2010/01/03 08:26:56 | 000,001,201 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\winamp-search.xml
[2011/11/17 10:37:00 | 000,002,611 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\wookieepedia-en.xml
[2010/01/13 22:00:34 | 000,001,720 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Mozilla\Firefox\Profiles\gqdf0s32.default\searchplugins\youtube-video-search.xml
[2011/12/04 14:33:00 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
File not found (No name found) -- 
[2012/02/17 14:54:17 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAMME\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2012/02/23 10:13:42 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2010/08/16 07:46:49 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2009/12/21 00:47:02 | 000,063,488 | ---- | M] (Nullsoft) -- C:\Programme\mozilla firefox\plugins\npwachk.dll
[2011/12/26 15:22:05 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2011/03/28 08:26:12 | 000,002,046 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\fcmdSrchddr.xml
[2011/12/26 15:22:04 | 000,002,040 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\twitter.xml
 
O1 HOSTS File: ([2004/08/04 07:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKU\ich_bi_ON_C\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [ISW]  File not found
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [VX2bt1oYNKCLnkO] C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\h6s5ruij653.exe (Cutting Edge Software Inc.)
O4 - HKLM..\Run: [ZoneAlarm] C:\Programme\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O4 - HKU\ich_bi_ON_C..\Run: [VX2bt1oYNKCLnkO] C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\h6s5ruij653.exe (Cutting Edge Software Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\ich_bi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\ich_bi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\ich_bi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\ich_bi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Winamp Search - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1262355567546 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.33.99.70 80.120.17.70
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\h6s5ruij653.exe) - C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\h6s5ruij653.exe (Cutting Edge Software Inc.)
O20 - HKLM Winlogon: UserInit - (C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\h6s5ruij653.exe) - C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\h6s5ruij653.exe (Cutting Edge Software Inc.)
O20 - HKU\ich_bi_ON_C Winlogon: Shell - (C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\h6s5ruij653.exe) - C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\h6s5ruij653.exe (Cutting Edge Software Inc.)
O20 - HKU\ich_bi_ON_C Winlogon: UserInit - (C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\h6s5ruij653.exe) - C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\h6s5ruij653.exe (Cutting Edge Software Inc.)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/01/01 08:14:52 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{045e9414-35f1-11e0-9bdc-00196670d913}\Shell - "" = AutoRun
O33 - MountPoints2\{045e9414-35f1-11e0-9bdc-00196670d913}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{045e9414-35f1-11e0-9bdc-00196670d913}\Shell\AutoRun\command - "" = J:\FalloutLauncher.exe
O33 - MountPoints2\{1aedfb54-5aca-11e0-9c3e-00196670d913}\Shell - "" = AutoRun
O33 - MountPoints2\{1aedfb54-5aca-11e0-9c3e-00196670d913}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1aedfb54-5aca-11e0-9c3e-00196670d913}\Shell\AutoRun\command - "" = L:\Autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {5ueDxYLo-I543-1otK-kGTs-C9Y55G4HYphK} - 
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^BDARemote.lnk - C:\Programme\USB TV\EM28XX\BDARemote.exe - ()
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^HP Digital Imaging Monitor.lnk - C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe - (Hewlett-Packard Development Company, L.P.)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^ich bi^Startmenü^Programme^Autostart^DesktopVideoPlayer.LNK -  - File not found
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: DAEMON Tools Lite - hkey= - key= - C:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
MsConfig - StartUpReg: HP Software Update - hkey= - key= - C:\Programme\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Development Company, L.P.)
MsConfig - StartUpReg: MSMSGS - hkey= - key= - C:\Programme\Messenger\msmsgs.exe (Microsoft Corporation)
MsConfig - StartUpReg: PHIME2002A - hkey= - key= -  File not found
MsConfig - StartUpReg: RTHDCPL - hkey= - key= - C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: StartCCC - hkey= - key= - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
MsConfig - StartUpReg: Steam - hkey= - key= -  File not found
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: VeohPlugin - hkey= - key= - C:\Programme\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
MsConfig - StartUpReg: WinampAgent - hkey= - key= - C:\Programme\Winamp\winampa.exe (Nullsoft)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/02/29 17:10:59 | 000,308,224 | ---- | C] (Cutting Edge Software Inc.) -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\h6s5ruij653.exe
[2012/02/23 16:50:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ATI
[2012/02/23 16:46:03 | 000,000,000 | ---D | C] -- C:\Programme\AMD APP
[2012/02/23 16:45:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Catalyst Control Center
[2012/02/23 16:44:14 | 000,100,368 | ---- | C] (Advanced Micro Devices) -- C:\WINDOWS\System32\drivers\AtihdXP3.sys
[2012/02/23 16:43:23 | 000,956,160 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\WINDOWS\System32\ativvamv.dll
[2012/02/23 16:43:22 | 000,159,744 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\atiapfxx.exe
[2012/02/23 16:42:55 | 000,000,000 | ---D | C] -- C:\Programme\ATI
[2012/02/23 16:41:12 | 000,000,000 | ---D | C] -- C:\AMD
[2012/02/23 16:18:29 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Futuremark Shared
[2012/02/23 16:15:59 | 000,000,000 | ---D | C] -- C:\Programme\Futuremark
[2012/02/23 16:15:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Futuremark
[2012/02/23 15:32:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ich bi\Lokale Einstellungen\Anwendungsdaten\AquaMark3
[2012/02/23 15:32:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ich bi\Eigene Dateien\AquaMark3
[2012/02/23 15:31:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\AquaMark3
[2012/02/23 15:31:27 | 000,000,000 | ---D | C] -- C:\Programme\AquaMark3
[2012/02/23 14:21:30 | 000,139,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpwd.sys
[2012/02/23 14:21:29 | 000,105,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mup.sys
[2012/02/23 14:20:31 | 000,010,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndistapi.sys
[2012/02/23 13:50:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ich bi\Desktop\pics3
[2012/02/17 14:56:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\DDMSettings
[2012/02/02 02:52:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Dragon Age Origins
[2012/02/02 02:47:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ich bi\Eigene Dateien\BioWare
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/02/29 17:46:22 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) -- C:\WINDOWS\gdrv.sys
[2012/02/29 17:46:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/02/29 17:10:58 | 000,308,224 | ---- | M] (Cutting Edge Software Inc.) -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\h6s5ruij653.exe
[2012/02/27 08:32:03 | 000,001,066 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Desktop\MinecraftSP.lnk
[2012/02/27 08:29:45 | 000,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/02/25 11:03:19 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/02/23 16:45:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Catalyst Control Center
[2012/02/23 16:36:07 | 000,000,157 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Desktop\ati treiber.url
[2012/02/23 16:19:34 | 000,001,657 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\3DMark06.lnk
[2012/02/23 16:19:21 | 000,444,952 | ---- | M] (Creative Labs) -- C:\WINDOWS\System32\wrap_oal.dll
[2012/02/23 16:19:21 | 000,109,080 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\WINDOWS\System32\OpenAL32.dll
[2012/02/23 16:15:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Futuremark
[2012/02/23 15:31:50 | 000,000,657 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\AquaMark3.lnk
[2012/02/23 15:31:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\AquaMark3
[2012/02/23 15:15:34 | 000,322,728 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/02/23 14:44:54 | 000,449,222 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012/02/23 14:44:54 | 000,432,914 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/02/23 14:44:54 | 000,080,530 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012/02/23 14:44:54 | 000,067,870 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/02/23 14:38:10 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/02/23 04:33:45 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/02/23 02:02:12 | 002,815,971 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Desktop\DE_MTGM11_Rulebook_LR_Web.pdf
[2012/02/17 14:54:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\DivX Plus
[2012/02/14 03:53:33 | 000,116,094 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Desktop\nticket.pdf
[2012/02/02 11:47:39 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012/02/02 02:52:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Dragon Age Origins
[2012/02/01 17:32:29 | 000,000,211 | ---- | M] () -- C:\Dokumente und Einstellungen\ich bi\Desktop\Dragon Age Origins - Ultimate Edition.url
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/02/23 16:43:23 | 000,219,080 | ---- | C] () -- C:\WINDOWS\System32\atiapfxx.blb
[2012/02/23 16:35:44 | 000,000,157 | ---- | C] () -- C:\Dokumente und Einstellungen\ich bi\Desktop\ati treiber.url
[2012/02/23 16:19:34 | 000,001,657 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\3DMark06.lnk
[2012/02/23 15:31:50 | 000,000,657 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\AquaMark3.lnk
[2012/02/23 14:26:39 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2012/02/23 14:20:30 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/02/23 14:20:30 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\dllcache\iacenc.dll
[2012/02/23 02:02:12 | 002,815,971 | ---- | C] () -- C:\Dokumente und Einstellungen\ich bi\Desktop\DE_MTGM11_Rulebook_LR_Web.pdf
[2012/02/14 03:53:33 | 000,116,094 | ---- | C] () -- C:\Dokumente und Einstellungen\ich bi\Desktop\nticket.pdf
[2012/02/01 17:32:29 | 000,000,211 | ---- | C] () -- C:\Dokumente und Einstellungen\ich bi\Desktop\Dragon Age Origins - Ultimate Edition.url
[2012/01/27 02:37:34 | 000,000,163 | ---- | C] () -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\default.rss
[2012/01/27 02:36:13 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2011/12/08 15:53:59 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2011/12/05 16:04:00 | 000,059,904 | ---- | C] () -- C:\WINDOWS\System32\OpenVideo.dll
[2011/12/05 16:03:52 | 000,054,784 | ---- | C] () -- C:\WINDOWS\System32\OVDecode.dll
[2011/10/22 11:46:27 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2011/10/22 11:46:24 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2011/10/22 11:46:21 | 000,650,752 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2011/10/22 11:46:21 | 000,243,200 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2011/10/22 11:46:18 | 000,074,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2011/01/22 08:32:38 | 000,017,408 | ---- | C] () -- C:\Dokumente und Einstellungen\ich bi\Lokale Einstellungen\Anwendungsdaten\WebpageIcons.db
[2010/10/24 14:46:45 | 000,000,025 | ---- | C] () -- C:\WINDOWS\popcinfot.dat
[2010/10/24 14:46:45 | 000,000,000 | ---- | C] () -- C:\WINDOWS\popcreg.dat
[2010/10/15 13:57:02 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2010/10/15 13:57:02 | 000,608,507 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2010/10/15 13:57:02 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2010/10/04 12:05:56 | 000,281,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2010/10/04 12:05:54 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2010/08/15 17:31:55 | 000,000,005 | ---- | C] () -- C:\WINDOWS\treeskp.sys
[2010/08/15 17:31:55 | 000,000,005 | ---- | C] () -- C:\WINDOWS\sbacknt.bin
[2010/05/29 16:44:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Editor.INI
[2010/03/30 10:05:38 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\drivers\nocashio.sys
[2010/03/14 18:43:39 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/03/05 09:11:35 | 000,000,330 | ---- | C] () -- C:\WINDOWS\doom3.ini
[2010/02/25 10:12:18 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/02/24 11:39:28 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2010/02/24 11:39:24 | 000,000,157 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini
[2010/02/24 11:38:57 | 000,000,808 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini
[2010/02/24 11:34:49 | 000,143,554 | ---- | C] () -- C:\WINDOWS\hpwins06.dat
[2010/02/24 11:34:48 | 000,001,301 | ---- | C] () -- C:\WINDOWS\hpwmdl06.dat
[2010/01/22 23:49:28 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini
[2010/01/21 15:29:31 | 000,024,064 | ---- | C] () -- C:\Dokumente und Einstellungen\ich bi\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/01 09:47:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/01/01 09:03:17 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2010/01/01 09:01:02 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\vuins32.dll
[2010/01/01 08:58:37 | 000,004,599 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2010/01/01 08:58:35 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2010/01/01 08:48:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2010/01/01 08:39:17 | 003,107,788 | R--- | C] () -- C:\WINDOWS\System32\ativvaxx.dat
[2010/01/01 08:16:50 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/01/01 08:11:15 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/01/01 08:01:51 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/01/01 07:58:41 | 000,322,728 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/08/29 03:15:21 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\atibrtmon.exe
[2008/10/28 10:40:48 | 000,173,552 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2004/08/04 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 07:00:00 | 000,449,222 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004/08/04 07:00:00 | 000,432,914 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/04 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 07:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004/08/04 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 07:00:00 | 000,080,530 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004/08/04 07:00:00 | 000,067,870 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/04 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 07:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004/08/04 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 07:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 07:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003/02/20 11:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/05/28 13:55:42 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002/05/28 13:54:40 | 000,004,605 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/07/06 21:00:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
 
========== LOP Check ==========
 
[2012/02/27 16:30:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\.minecraft
[2011/11/18 07:17:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\CheckPoint
[2012/01/27 02:32:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\DAEMON Tools Lite
[2012/02/17 14:56:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\DDMSettings
[2011/03/30 06:59:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\facemoods.com
[2010/08/30 14:37:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\FFSJ
[2010/11/04 20:37:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\fltk.org
[2012/01/05 11:41:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\My Battle for Middle-earth Files
[2010/01/24 14:06:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\OpenOffice.org
[2010/01/01 08:26:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\SpeedProject
[2010/01/03 07:06:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\Thunderbird
[2010/10/04 17:26:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ich bi\Anwendungsdaten\vghd
[2011/03/17 17:19:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Atrise
[2012/02/02 03:01:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BioWare
[2011/11/18 07:15:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2011/02/11 09:52:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2011/10/22 06:11:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Fallout3
[2010/10/24 15:54:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PopCap Games
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2012/02/23 16:41:12 | 000,000,000 | ---D | M] -- C:\AMD
[2012/02/23 16:46:05 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2010/01/01 08:22:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2011/12/08 14:14:27 | 000,000,000 | ---D | M] -- C:\Intel
[2012/02/23 16:46:03 | 000,000,000 | R--D | M] -- C:\Programme
[2010/01/01 08:26:51 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2010/01/01 08:19:47 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010/02/24 11:39:27 | 000,000,000 | ---D | M] -- C:\TEMP
[2012/02/23 16:49:43 | 000,000,000 | ---D | M] -- C:\WINDOWS
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2004/08/04 07:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2010/10/04 14:13:25 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2010/10/04 14:13:25 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004/08/04 07:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2010/10/04 14:13:25 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2010/10/04 14:13:25 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0023\DriverFiles\i386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0025\DriverFiles\i386\atapi.sys
[2004/08/04 07:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 07:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008/04/13 21:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 21:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004/08/04 07:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2004/08/04 07:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2008/04/13 21:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
[2008/04/13 21:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
 
< MD5 for: NETLOGON.DLL  >
[2008/04/13 21:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 21:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/04 07:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2009/02/06 13:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009/02/06 13:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008/04/13 21:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 21:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004/08/04 07:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2004/08/04 07:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2008/04/13 21:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008/04/13 21:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008/04/13 21:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 21:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004/08/04 07:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004/08/04 07:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/13 21:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 21:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004/08/04 07:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004/08/04 07:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2010/01/01 08:57:42 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2010/01/01 08:57:42 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2010/01/01 08:57:42 | 000,458,752 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\system32\*.dll /lockedfiles >
[2011/03/03 01:54:43 | 000,149,504 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dnsapi.dll
[2011/12/18 08:43:24 | 011,082,240 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ieframe.dll
[2011/12/17 14:43:23 | 002,000,384 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iertutil.dll
[2008/04/13 21:22:18 | 000,280,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\mstask.dll
[2008/04/13 21:22:20 | 000,067,072 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ntdsapi.dll
[2011/01/21 09:44:10 | 008,503,296 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shell32.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
< End of report >
         

:OTL
O4 - HKLM..\Run: [0ZL5KpKbdq59PFw] C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\jj65sirug4.exe (StompSoft, Inc.)
O4 - HKU\Administrator_ON_C..\Run: [{8DC71E28-6C3A-2F70-7B2F-EA555A281F12}] C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Noasa\ybsyuk.exe ()
O4 - HKU\Administrator_ON_C..\Run: [0ZL5KpKbdq59PFw] C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\jj65sirug4.exe (StompSoft, Inc.)
O20 - HKLM Winlogon: Shell - (C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\jj65sirug4.exe) - C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\jj65sirug4.exe (StompSoft, Inc.)
O20 - HKU\Administrator_ON_C Winlogon: Shell - (C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\jj65sirug4.exe) - C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\jj65sirug4.exe (StompSoft, Inc.)
[2012/02/20 15:38:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Seupy
:Files
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\jj65sirug4.exe
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Noasa
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]