| |  50 Euro Virus
 Auch meine Mutter hat sich mit ihrem Laptop den 50 Euro Virus eingefangen.
Ich hab bereits von anderen Hilfe Threads den ersten Schritt gemacht und dabei kam folgendes raus: (Extras.txt im Anhang da Text sonst zu lang)
OTL.text: Zitat:
OTL logfile created on: 20.03.2012 16:42:57 - Run 1
OTL by OldTimer - Version 3.2.39.1 Folder = C:\Users\Sabine\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,68 Gb Total Physical Memory | 3,15 Gb Available Physical Memory | 85,66% Memory free
7,35 Gb Paging File | 6,84 Gb Available in Paging File | 93,05% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 449,55 Gb Total Space | 393,88 Gb Free Space | 87,62% Space Free | Partition Type: NTFS
Computer Name: SABINES-PC | User Name: Sabine | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012.03.20 16:28:37 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Users\Sabine\Downloads\OTL.exe
========== Modules (No Company Name) ==========
========== Win32 Services (SafeList) ==========
SRV - [2011.12.05 08:12:41 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011.09.23 18:08:19 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.09.23 18:01:09 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.03.01 20:23:36 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.02.25 09:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2011.01.31 21:55:14 | 000,244,624 | ---- | M] (Acer Incorporated) [Auto | Stopped] -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe -- (Live Updater Service)
SRV - [2011.01.05 14:23:58 | 000,867,712 | ---- | M] (Acer Incorporated) [Auto | Stopped] -- C:\Programme\Packard Bell\Packard Bell Power Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2010.10.12 18:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010.09.30 02:06:46 | 000,169,408 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor9.0)
SRV - [2010.09.23 02:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.09.21 22:49:00 | 002,286,976 | ---- | M] (Microsoft Corp.) [Auto | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.08.11 02:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010.06.28 23:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010.05.04 20:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Stopped] -- c:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate) @c:\Program Files (x86)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.03 13:42:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2010.03.03 13:41:58 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.08 14:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2012.02.15 21:34:10 | 000,132,320 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.11.30 17:11:53 | 000,279,616 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.10.01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011.10.01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011.10.01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011.10.01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011.09.15 23:55:03 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.09.15 23:55:03 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.08.01 15:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2011.07.28 18:37:10 | 000,052,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.07.28 23:10:40 | 010,610,400 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.06.21 11:45:54 | 000,287,232 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010.06.08 03:36:18 | 000,406,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM)
DRV:64bit: - [2010.05.12 03:11:38 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010.03.19 02:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.03.04 03:51:40 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.02.27 01:32:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009.09.18 05:12:06 | 000,292,912 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.09.17 11:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.20 03:09:57 | 000,054,272 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\L1E62x64.sys -- (L1E) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.06 00:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009.05.06 00:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.myplaycity.com/
IE - HKLM\..\URLSearchHook: {8e41e543-e069-4197-8608-e8b4c2f75747} - C:\Program Files (x86)\wellgames\tbwell.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1166249
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.gametop.com/?utm_source=fishdom&utm_medium=start
IE - HKCU\..\URLSearchHook: {8e41e543-e069-4197-8608-e8b4c2f75747} - C:\Program Files (x86)\wellgames\tbwell.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1166249
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "hxxp://home.myplaycity.com/"
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.12.23 02:11:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.19 21:51:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.02.07 19:35:35 | 000,000,000 | ---D | M]
[2011.11.30 22:35:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sabine\AppData\Roaming\mozilla\Extensions
[2012.03.06 20:31:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sabine\AppData\Roaming\mozilla\Firefox\Profiles\n7eg5clg.default\extensions
[2012.03.06 20:31:06 | 000,000,000 | ---D | M] (wellgames Community Toolbar) -- C:\Users\Sabine\AppData\Roaming\mozilla\Firefox\Profiles\n7eg5clg.default\extensions\{8e41e543-e069-4197-8608-e8b4c2f75747}
[2012.02.19 11:39:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
() (No name found) -- C:\USERS\SABINE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\N7EG5CLG.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.02.19 21:51:10 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.02.07 19:35:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.01.10 18:18:56 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.10 18:18:56 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.01.10 18:18:56 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.10 18:18:56 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.10 18:18:56 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.10 18:18:56 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (wellgames Toolbar) - {8e41e543-e069-4197-8608-e8b4c2f75747} - C:\Program Files (x86)\wellgames\tbwell.dll (Conduit Ltd.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (wellgames Toolbar) - {8e41e543-e069-4197-8608-e8b4c2f75747} - C:\Program Files (x86)\wellgames\tbwell.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Packard Bell\Packard Bell Power Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKCU..\Run: [MediaGet2] C:\Users\Sabine\AppData\Local\MediaGet2\mediaget.exe --minimized File not found
O4 - HKCU..\Run: [SkypePM] C:\Users\Sabine\AppData\Local\Skype\SkypePM.exe (Twain Working Group)
O4 - HKCU..\Run: [Spiele Post] C:\Program Files (x86)\OXXOGames\GPlayer\GameCenterNotifier.exe (Intenium)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{219D6159-1D1C-4B93-A9BA-A804EDB92342}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F90EAC65-8E9B-4323-B3FC-2570536AE517}: DhcpNameServer = 192.52.104.29
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{5ab91c61-1b98-11e1-b785-206a8a5c9710}\Shell - "" = AutoRun
O33 - MountPoints2\{5ab91c61-1b98-11e1-b785-206a8a5c9710}\Shell\AutoRun\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{5ab91c61-1b98-11e1-b785-206a8a5c9710}\Shell\configure\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{5ab91c61-1b98-11e1-b785-206a8a5c9710}\Shell\install\command - "" = F:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
CREATERESTOREPOINT
Error creating restore point.
========== Files/Folders - Created Within 30 Days ==========
[2012.03.18 13:35:38 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{A24A084F-7F36-4038-BC45-5359DE1D1906}
[2012.03.18 13:35:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{D8F0B8B0-0E86-4FEE-BA4F-4AB0E90F3B6E}
[2012.03.17 14:02:10 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{E93986BB-855D-46F6-A168-3CFE90FC5AB2}
[2012.03.17 14:01:59 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{F6394C7F-BF30-4B24-B671-2C865A51B9A5}
[2012.03.17 14:01:48 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{BC57B48D-C054-4553-9230-67FAAE278772}
[2012.03.16 11:31:38 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{0917A550-6A93-447A-A870-B59B77A61077}
[2012.03.16 11:31:27 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{E379E1FA-CF9E-44A6-BF86-4753AD37B95A}
[2012.03.16 08:06:16 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{A688A7D0-4549-415C-8C07-7CFCB91DF620}
[2012.03.16 08:06:04 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{5CC4FBFF-F824-4B1E-BA28-A7DF5E588A6E}
[2012.03.15 20:24:29 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{1C762587-748D-44A1-B429-A4E993F55902}
[2012.03.15 08:49:50 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{143F751A-116E-4572-AF06-79DC2773D10D}
[2012.03.15 08:49:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{9609F23A-1CB4-4D67-BF50-46BEFEF9ABCD}
[2012.03.14 19:02:33 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{553E8244-E096-4A42-B43C-39B13360AD17}
[2012.03.14 19:02:22 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{2D3ADB46-D59B-4280-B787-C5B60388017F}
[2012.03.14 16:57:39 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{FD85B5AB-43E9-464C-9D10-299D2E09C90E}
[2012.03.14 16:57:17 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{7F767065-00A8-4E4F-995E-C98F6DD14109}
[2012.03.14 06:57:09 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{A4415DB8-6A4B-4D43-B4CF-CE186C7DD565}
[2012.03.14 06:56:57 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{1B2BFF7A-8DAF-4980-9C94-DB09CA9B608F}
[2012.03.13 20:05:53 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{9C8CC26B-CA56-4727-B8C2-2B1B39B57254}
[2012.03.13 15:30:42 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{2D464311-945A-4560-B036-46DE2BC92CC4}
[2012.03.12 19:31:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{DE8CEFF6-4EF6-42F8-BF21-746E887D0C55}
[2012.03.12 19:31:15 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{6F45BBD0-A782-4A78-83D6-48EC3DB52175}
[2012.03.12 15:15:20 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{2CA14D8F-A274-4F04-BB79-6F411D1B0813}
[2012.03.12 15:15:09 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{3018A7CA-0173-4F55-8658-8A411CA24CA9}
[2012.03.12 14:53:14 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{F28BDFEB-C857-4D5B-AFA9-EF35F85A5842}
[2012.03.11 21:59:52 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{31617FD0-B829-492E-AFA3-D56A14B571BA}
[2012.03.11 21:59:40 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{92BB6859-8C15-4704-889B-30AA98E57876}
[2012.03.11 20:16:36 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{93A6582E-B216-41DD-A20B-CFF30168F306}
[2012.03.11 20:16:25 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{15631D26-B3EC-4498-9514-20FAEAAE6A07}
[2012.03.11 16:36:18 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{28113B01-BF86-4C7C-AB5F-BBE3BE3E2CB8}
[2012.03.11 15:43:14 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{C847C594-34FD-4EBF-B34F-C42C4A37177F}
[2012.03.11 15:43:04 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{92C55CB2-41A0-4B2E-8078-F17DF27D6260}
[2012.03.11 13:09:56 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{C4CD0359-84DA-486D-8AE4-52D24AE10647}
[2012.03.11 13:09:34 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{3B16297F-55FA-4AEF-9742-510D8FADD111}
[2012.03.10 14:23:20 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{42122E33-AAB0-442F-8F6A-F8D416C672D5}
[2012.03.10 14:23:08 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{8FB1B450-AC60-44BC-BAAD-10F5B2445584}
[2012.03.10 10:28:38 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{3A6E61FB-75C6-4CC3-99F5-D9B7E42F3DA1}
[2012.03.10 10:28:22 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{AB432319-BCA6-4CE4-8BEB-D33EC868B94E}
[2012.03.09 16:16:39 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{C603B0A8-4256-4937-AE09-EA3B7705C491}
[2012.03.09 16:16:28 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{824CE93F-4E05-41BD-B249-3896B33E476C}
[2012.03.08 19:13:49 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{F4F6A5D1-976B-4C21-9FFD-32FF6F7C7EB0}
[2012.03.08 19:13:27 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{31B0D8E1-B620-4CEF-9D9B-A36809B61D7B}
[2012.03.07 21:42:28 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{0F3BD3CE-FD06-4AA8-907C-81BB1297425F}
[2012.03.07 21:42:17 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{FE232830-2871-4836-93CD-2BDE5C506223}
[2012.03.07 21:35:50 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{7140B93A-A4D5-4606-8833-93F009372F9D}
[2012.03.07 21:35:38 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{AB2A1B12-710E-45DE-A78E-ADEA09ACF631}
[2012.03.07 15:44:52 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{4B54DD53-E790-46C2-BB07-3146BD41AAC2}
[2012.03.07 15:44:41 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{261ED810-9427-400E-9922-9942EBB05215}
[2012.03.06 20:22:24 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{4C7FFBA7-B46C-422A-8AA8-CCDDD2838113}
[2012.03.06 20:22:02 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{4E8B0126-75C1-4D11-97FB-BD80A1B8AF81}
[2012.03.06 12:09:25 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{3DFBA7F5-6531-408C-ABD8-736AA8671ECD}
[2012.03.06 12:09:03 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{A3FDFEB3-F86C-4F11-A38E-BB9547EBC5F2}
[2012.03.05 20:24:07 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{3A8703DF-FFC3-4A60-A919-D6F974888A6E}
[2012.03.05 20:23:45 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{851131B6-A984-4EBD-BFAC-E4DE6A40E50F}
[2012.03.05 17:24:41 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{9A91B6DE-7B44-4310-88DC-5D13143356E4}
[2012.03.05 17:24:29 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{976C1832-C017-4F92-B724-4BBF8AD02411}
[2012.03.05 12:03:28 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{43AB67D2-C77B-47E5-A104-6F5BF5CDE738}
[2012.03.05 12:03:05 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{28A78807-1D73-4426-8D55-FF31F0C37E6E}
[2012.03.04 21:55:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{7C1DC16F-88FC-42B0-B41A-EA19FA636C7A}
[2012.03.04 21:55:03 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{76B0C383-A857-4C0B-92A1-906B6C60D0FE}
[2012.03.04 17:05:30 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{C745660F-9061-4CD1-B6ED-B74591CCF21E}
[2012.03.04 17:05:19 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{D9DDDD85-7667-437E-995B-6D1575B4D7F9}
[2012.03.03 17:47:29 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{2964DFDE-FEF7-41E6-B2CA-DAC3B1C305D0}
[2012.03.03 17:47:17 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{FE1F21B5-84D5-4AB7-B16F-B418C5391EAC}
[2012.03.02 21:53:41 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{38BAE088-6AD1-433B-90BB-E9B80966E4DE}
[2012.03.02 21:53:30 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{BB08E832-A340-4924-ACC2-4A306831C4DF}
[2012.03.02 18:30:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Roaming\SmashFrenzy4
[2012.03.02 18:30:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Roaming\MB4
[2012.03.02 18:30:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Roaming\DreamDale
[2012.03.02 18:29:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPlayCity.com
[2012.03.02 18:29:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MyPlayCity.com
[2012.03.01 21:24:41 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{2A4C9549-EE1E-42A9-8052-447EF25C9D4D}
[2012.03.01 21:24:30 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{E05E2DCD-D314-4BCC-9BB0-4EDBDB36AA21}
[2012.03.01 10:50:34 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{B638FC33-3C44-401D-81E4-BC7E162714F1}
[2012.02.29 21:25:37 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{BB374174-E0BE-476D-962D-DB8680851FFA}
[2012.02.29 21:25:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{33AC204A-BC87-408B-B44C-783A8627CED5}
[2012.02.29 17:22:56 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{E3FE57F9-58BA-4C79-AB80-5F94D01AEAB5}
[2012.02.27 20:27:00 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{9B9C528B-27AD-444F-AA6B-E6FF193691EC}
[2012.02.27 20:26:49 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{D06B6E10-BF75-4B72-93C1-70E91806AEB5}
[2012.02.27 20:20:40 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{17FB4AB6-B777-4EEF-9153-963DF82DD315}
[2012.02.27 20:20:28 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{849845FC-2A6A-48B8-B7D6-8CC594FEB9BF}
[2012.02.27 14:20:21 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{0EC3E341-652D-4287-AB4C-6274FD0EDBB0}
[2012.02.27 14:20:10 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{F664F2EA-0742-4333-B202-0D46D4926A33}
[2012.02.26 14:29:53 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{1978C224-C6C6-4FF7-BD69-E6E1B14E709C}
[2012.02.26 14:29:41 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{CD465A9B-9BBC-4D39-9268-563711A67D4F}
[2012.02.25 18:54:06 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{E6A11BC7-BBCA-4091-83DB-01750F35F9CC}
[2012.02.25 18:53:55 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{B64929AE-6740-4E77-A65C-26C354C955B0}
[2012.02.25 16:00:18 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{35B93C9E-812A-4251-BAD2-77249EA5D84A}
[2012.02.25 16:00:07 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{97168718-8D18-4813-8C8A-93DD9B6A9C4B}
[2012.02.24 14:47:34 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{F75CE227-62BE-47FA-9EB9-8EADB72FF594}
[2012.02.24 14:47:12 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{011EB575-0211-47DD-86B5-6B6B2735EB17}
[2012.02.23 20:09:04 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{E61936FE-A34A-4FAD-A53F-0DABB4BB15A9}
[2012.02.23 20:08:53 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{77B9CC62-9528-4FE6-AB80-C7DA2604F890}
[2012.02.23 14:27:03 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{C581B792-25AF-4B1E-913D-93A10EFC849E}
[2012.02.22 15:02:52 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{F9D7A600-E88F-457E-B942-E1E3C5243CEF}
[2012.02.22 07:33:04 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{0884DC60-1DA4-43E7-91AB-C41E0F7E522E}
[2012.02.21 17:23:01 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{AB70DBA6-58BE-401C-A041-7857FF77F86A}
[2012.02.21 17:22:38 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{5DD7C5F5-62CE-4893-8BCD-D843B558B5B9}
[2012.02.21 09:40:11 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{E21D3EF5-E867-4456-A4AF-5CDBC801F132}
[2012.02.21 09:40:00 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{FDBD744E-3BC4-4DD7-9273-6EF99FFA39DB}
[2012.02.20 15:55:41 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{8ED16D76-7E3B-4E5D-BF5A-DB58C44E36B8}
[2012.02.20 08:38:41 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{F96C6A2B-E7CD-4BAB-8CE2-F62C81657A63}
[2012.02.20 08:38:30 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{515B5319-AE2D-4AD8-8E05-539228E10F70}
========== Files - Modified Within 30 Days ==========
[2012.03.20 16:26:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.20 16:26:07 | 2960,470,016 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.20 16:11:31 | 000,024,432 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.20 16:11:31 | 000,024,432 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.20 09:02:39 | 000,003,408 | ---- | M] () -- C:\bootsqm.dat
[2012.03.17 14:04:32 | 001,500,018 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.03.17 14:04:32 | 000,654,610 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.03.17 14:04:32 | 000,616,452 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.03.17 14:04:32 | 000,130,192 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.03.17 14:04:32 | 000,106,574 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.03.15 08:47:48 | 000,420,560 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.03.12 21:00:44 | 000,001,161 | ---- | M] () -- C:\Users\Sabine\Desktop\Fishdom.lnk
[2012.03.04 17:08:26 | 000,002,194 | ---- | M] () -- C:\Users\Sabine\Desktop\Smash Frenzy 4.lnk
[2012.03.04 17:08:26 | 000,002,105 | ---- | M] () -- C:\Users\Sabine\Desktop\Play Online Games.lnk
[2012.03.04 17:08:26 | 000,002,070 | ---- | M] () -- C:\Users\Sabine\Desktop\MyPlayCity Games.lnk
========== Files Created - No Company Name ==========
[2012.03.20 09:02:39 | 000,003,408 | ---- | C] () -- C:\bootsqm.dat
[2012.03.12 21:00:44 | 000,001,161 | ---- | C] () -- C:\Users\Sabine\Desktop\Fishdom.lnk
[2012.03.02 18:29:38 | 000,002,194 | ---- | C] () -- C:\Users\Sabine\Desktop\Smash Frenzy 4.lnk
[2012.03.02 18:29:38 | 000,002,105 | ---- | C] () -- C:\Users\Sabine\Desktop\Play Online Games.lnk
[2012.03.02 18:29:38 | 000,002,070 | ---- | C] () -- C:\Users\Sabine\Desktop\MyPlayCity Games.lnk
[2011.12.29 12:15:33 | 000,000,080 | ---- | C] () -- C:\Windows\wiso.ini
[2011.12.25 13:40:19 | 000,000,010 | ---- | C] () -- C:\Windows\popcinfo.dat
[2011.12.02 08:05:41 | 000,000,076 | ---- | C] () -- C:\Windows\HCINST.INI
[2011.12.02 07:46:28 | 001,526,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.09.23 12:43:30 | 000,000,267 | ---- | C] () -- C:\Windows\LaunApp.ini
[2011.09.23 12:41:48 | 000,870,560 | ---- | C] () -- C:\Windows\SysWow64\igkrng575.bin
[2011.09.23 12:41:48 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll
[2011.09.23 12:41:48 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll
[2011.09.23 12:41:48 | 000,127,868 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin
[2011.09.23 12:41:48 | 000,104,796 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin
[2011.09.23 12:41:10 | 000,001,361 | ---- | C] () -- C:\Windows\WPatchProgress.ini
[2011.04.06 20:49:06 | 000,000,325 | ---- | C] () -- C:\Windows\Prelaunch.ini
[2011.04.06 20:49:06 | 000,000,271 | ---- | C] () -- C:\Windows\WisPriority.ini
[2011.04.06 20:49:06 | 000,000,168 | ---- | C] () -- C:\Windows\WisLangCode.ini
========== LOP Check ==========
[2011.11.30 17:12:59 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\DAEMON Tools Lite
[2012.03.04 17:12:50 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\DreamDale
[2011.12.02 07:54:27 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\EasternGraphics
[2012.03.02 18:31:03 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\MB4
[2011.12.31 15:51:46 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\Playrix Entertainment
[2012.03.02 18:30:26 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\SmashFrenzy4
[2012.01.24 14:55:32 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\SNS
[2011.12.27 19:18:53 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\SoftGrid Client
[2011.12.02 07:47:19 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\TP
[2011.12.02 10:07:06 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\Windows Live Writer
[2012.02.16 09:08:40 | 000,032,612 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*. >
[2011.11.30 22:26:22 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.09.23 03:32:09 | 000,000,000 | ---D | M] -- C:\BOOK
[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.11.30 22:24:45 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.12.02 08:14:25 | 000,000,000 | ---D | M] -- C:\EasternGraphics
[2011.11.30 22:27:35 | 000,000,000 | ---D | M] -- C:\elements
[2011.09.23 02:57:04 | 000,000,000 | ---D | M] -- C:\Intel
[2011.11.30 17:13:37 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2011.11.30 22:25:49 | 000,000,000 | -H-D | M] -- C:\OEM
[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.02.07 19:32:03 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.03.02 18:29:26 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012.02.07 19:35:50 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011.11.30 22:24:45 | 000,000,000 | -HSD | M] -- C:\Programme
[2012.03.19 08:56:58 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012.03.20 16:08:58 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.03.17 14:17:16 | 000,000,000 | R--D | M] -- C:\Users
[2012.03.19 09:44:20 | 000,000,000 | ---D | M] -- C:\Windows
< %PROGRAMFILES%\*.exe >
< %LOCALAPPDATA%\*.exe >
< %systemroot%\*. /mp /s >
< MD5 for: AGP440.SYS >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
< MD5 for: ATAPI.SYS >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
< MD5 for: CNGAUDIT.DLL >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
< MD5 for: EXPLORER.EXE >
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.21 04:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010.11.21 04:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
< MD5 for: IASTOR.SYS >
[2010.03.04 04:33:26 | 000,435,736 | ---- | M] (Intel Corporation) MD5=26541A068572F650A2FA490726FE81BE -- C:\OEM\Preload\Autorun\DRV\AHCI\F6\f6flpy-x86\iaStor.sys
[2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\OEM\Preload\Autorun\DRV\AHCI\F6\f6flpy-x64\iaStor.sys
[2010.03.04 03:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\Windows\SysNative\drivers\iaStor.sys
[2010.03.04 03:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_78ebae21a80aa2b4\iaStor.sys
< MD5 for: IASTORV.SYS >
[2010.11.21 04:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.21 04:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
< MD5 for: NETLOGON.DLL >
[2010.11.21 04:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.21 04:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.21 04:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.21 04:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
< MD5 for: NVSTOR.SYS >
[2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.21 04:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.21 04:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
< MD5 for: SCECLI.DLL >
[2010.11.21 04:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.21 04:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.21 04:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.21 04:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
< MD5 for: USER32.DLL >
[2010.11.21 04:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.21 04:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010.11.21 04:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.21 04:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
< MD5 for: USERINIT.EXE >
[2010.11.21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010.11.21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
< MD5 for: WINLOGON.EXE >
[2010.11.21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
< MD5 for: WS2IFSL.SYS >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
< %systemroot%\system32\drivers\*.sys /lockedfiles >
< %systemroot%\System32\config\*.sav >
< %systemroot%\system32\*.dll /lockedfiles >
< %USERPROFILE%\*.* >
[2011.12.01 15:21:33 | 000,000,335 | ---- | M] () -- C:\Users\Sabine\Benutzerdaten.txt
[2012.03.20 16:44:56 | 001,835,008 | -HS- | M] () -- C:\Users\Sabine\NTUSER.DAT
[2012.03.20 16:44:56 | 000,262,144 | -HS- | M] () -- C:\Users\Sabine\ntuser.dat.LOG1
[2011.11.30 22:25:05 | 000,000,000 | -HS- | M] () -- C:\Users\Sabine\ntuser.dat.LOG2
[2011.11.30 18:03:43 | 000,065,536 | -HS- | M] () -- C:\Users\Sabine\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2011.11.30 18:03:43 | 000,524,288 | -HS- | M] () -- C:\Users\Sabine\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2011.11.30 18:03:43 | 000,524,288 | -HS- | M] () -- C:\Users\Sabine\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010.11.21 03:50:53 | 000,000,020 | -HS- | M] () -- C:\Users\Sabine\ntuser.ini
< %USERPROFILE%\Local Settings\Temp\*.exe >
< %USERPROFILE%\Local Settings\Temp\*.dll >
< %USERPROFILE%\Application Data\*.exe >
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
< End of report >
|
|
22.03.2012, 14:46
Don't bring me down
) 
Linear-Darstellung
