Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :(

TELA

Hallo Zusammen,

in letzter Zeit werde ich immer wieder mit Werbung "zugemüllt" wenn ich den Internetbrowser egal ob Firefox, Internetexplorer etc. öffne. Ich hab schon ein wenig gegoogelt und bin jetzt auf diese Seite gestoßen und mir wie in einem Tread beschrieben wurde, den "OTL" Scanner runtergeladen. Habe jetzt den Anweisungen befolgt und folgendes hat sich jetzt nach dem Scan geöffnet:

Hab ich einen Virus?

Ich hoffe ihr könnt mir weiter helfen.. Vielen Dank im Voraus

OTL logfile created on: 13.05.2014 19:39:29 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\TT Lammers\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17041)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,97 Gb Total Physical Memory | 1,75 Gb Available Physical Memory | 44,14% Memory free
7,93 Gb Paging File | 5,28 Gb Available in Paging File | 66,60% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 232,79 Gb Total Space | 149,68 Gb Free Space | 64,30% Space Free | Partition Type: NTFS

Computer Name: TTLAMMERS-PC | User Name: TT Lammers | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\TT Lammers\Desktop\otl.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe (APN LLC.)
PRC - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (APN)
PRC - C:\Program Files (x86)\Iminent\WinkHandler.exe ()
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
PRC - C:\ProgramData\WPM\wprotectmanager.exe (Cherished Technololgy LIMITED)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\WinZipper\winzipersvc.exe (Taiwan Shui Mu Chih Ching Technology Limited.)
PRC - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe ()
PRC - C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE ()
PRC - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
MOD - C:\Program Files (x86)\Iminent\WinkHandler.exe ()
MOD - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe ()


========== Services (SafeList) ==========

SRV:64bit: - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)
SRV:64bit: - (hpsrv) -- C:\Windows\SysNative\hpservice.exe (Hewlett-Packard Company)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (APNMCP) -- C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe (APN LLC.)
SRV - (WinkHandler) -- C:\Program Files (x86)\Iminent\WinkHandler.exe ()
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (Wpm) -- C:\ProgramData\WPM\wprotectmanager.exe (Cherished Technololgy LIMITED)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (winzipersvc) -- C:\Program Files (x86)\WinZipper\winzipersvc.exe (Taiwan Shui Mu Chih Ching Technology Limited.)
SRV - (Guard.Mail.ru) -- C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe ()
SRV - (ICQ Service) -- C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE ()
SRV - (ACDaemon) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (hpdskflt) -- C:\Windows\SysNative\drivers\hpdskflt.sys (Hewlett-Packard Company)
DRV:64bit: - (Accelerometer) -- C:\Windows\SysNative\drivers\Accelerometer.sys (Hewlett-Packard Company)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (NETw5s64) -- C:\Windows\SysNative\drivers\NETw5s64.sys (Intel Corporation)
DRV:64bit: - (ATSwpWDF) -- C:\Windows\SysNative\drivers\ATSwpWDF.sys (AuthenTec, Inc.)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (WSDScan) -- C:\Windows\SysNative\drivers\WSDScan.sys (Microsoft Corporation)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (TPM) -- C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (AgereSoftModem) -- C:\Windows\SysNative\drivers\agrsm64.sys (LSI Corp)
DRV:64bit: - (netw5v64) -- C:\Windows\SysNative\drivers\netw5v64.sys (Intel Corporation)
DRV:64bit: - (e1yexpress) -- C:\Windows\SysNative\drivers\e1y60x64.sys (Intel Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (HpqKbFiltr) -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV:64bit: - (HBtnKey) -- C:\Windows\SysNative\drivers\CPQBttn64.sys (Hewlett-Packard Development Company, L.P.)
DRV:64bit: - (rismxdp) -- C:\Windows\SysNative\drivers\rixdpx64.sys (REDC)
DRV:64bit: - (RICOH SmartCard Reader) -- C:\Windows\SysNative\drivers\rismcx64.sys (RICOH Company, Ltd.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{460C3D19-B3D4-4964-A550-77D263B0CCCB}: "URL" = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EHw,,&q={searchTerms}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.claro-search.com/?affID=114506&tt=4812_5&babsrc=HP_clro&mntrId=7cbab5d900000000000000216a3bc6ad
IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT
IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms}
IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms}
IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTE0LPl7nfnBSc0ax5uDcscDZ4nZ2-hTHC4FiHP0Ir17U635wZtwgHiz3MJxyBGSw,,
IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = EA B4 E7 84 44 13 CD 01 [binary data]
IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms}
IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms}
IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms}
IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Ask Web Search"
FF - prefs.js..browser.search.selectedEngine: "Ask Web Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://home.tb.ask.com/index.jhtml?ptb=3647B52E-61F9-4842-811C-226D62F0ED52&n=780bd8c7&p2=^AYY^xdm070^YYA^de&si=flvrunner"
FF - prefs.js..extensions.enabledAddons: ext%40MediaViewV1alpha5026.net:1.1
FF - prefs.js..extensions.enabledAddons: ext%40MediaWatchV1home30.net:1.1
FF - prefs.js..extensions.enabledAddons: ext%40MediaBuzzV1mode146.net:1.1
FF - prefs.js..extensions.enabledAddons: 8hffxtbr%40Allin1Convert_8h.com:6.33.3.46645
FF - prefs.js..extensions.enabledAddons: ext%40RichMediaViewV1release866.net:1.1
FF - prefs.js..extensions.enabledAddons: 0c822a17-a68f-4066-9257-d229458d21ca%409c178d17-dc61-4aaf-b2da-1425ac7300ac.com:0.94.93
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:29.0.1
FF - prefs.js..extensions.toolbar.mindspark._8hMembers_.browser.search.defaultenginename.prev: "StartWeb"
FF - prefs.js..extensions.toolbar.mindspark._8hMembers_.browser.search.defaultenginename.savedPrev: "true"
FF - prefs.js..extensions.toolbar.mindspark._8hMembers_.browser.search.defaultenginename.tb: "Ask Web Search"
FF - prefs.js..extensions.toolbar.mindspark._8hMembers_.browser.search.selectedEngine.prev: "StartWeb"
FF - prefs.js..extensions.toolbar.mindspark._8hMembers_.browser.search.selectedEngine.savedPrev: "true"
FF - prefs.js..extensions.toolbar.mindspark._8hMembers_.browser.search.selectedEngine.tb: "Ask Web Search"
FF - prefs.js..browser.startup.homepage: "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTE0LPl7nfnBSc0ax5uDcscDZ4nZ2-hTHC4FiHP0Ir17U635wZtwgHiz3MJxyBGSw,,"
FF - prefs.js..browser.startup.homepage: "true"
FF - prefs.js..browser.startup.homepage: "hxxp://home.tb.ask.com/index.jhtml?ptb=3647B52E-61F9-4842-811C-226D62F0ED52&n=780bd8c7&p2=^AYY^xdm070^YYA^de&si=flvrunner"
FF - prefs.js..keyword.URL: "hxxp://search.tb.ask.com/search/GGmain.jhtml?st=kwd&ptb=3647B52E-61F9-4842-811C-226D62F0ED52&n=780bd8c7&ind=2014042311&p2=^AYY^xdm070^YYA^de&si=flvrunner&searchfor="
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.55.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.55.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@lightspark.github.com/Lightspark;version=1: C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\xz123@ya456.com: C:\Program Files (x86)\BetterSurf\ff
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\12x3q4@3244516.com: C:\Program Files (x86)\Better-Surf\ff
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@bettersurfplus.com: C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ff
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@WebexpEnhancedV1alpha483.net: C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\ff [2013.12.21 18:30:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@flashenhancer.com: C:\Program Files (x86)\AmiExt\flashEnhancer\ff [2014.01.24 23:06:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@MediaPlayerV1alpha62.net: C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha62\ff [2014.01.29 19:36:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@MediaViewerV1alpha1336.net: C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1336\ff [2014.02.24 18:12:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@MediaViewV1alpha1029.net: C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha1029\ff [2014.03.01 21:35:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@MediaViewV1alpha5026.net: C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha5026\ff [2014.03.16 17:17:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@MediaWatchV1home30.net: C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home30\ff [2014.03.23 14:36:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@MediaBuzzV1mode146.net: C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode146\ff [2014.04.27 11:43:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@RichMediaViewV1release866.net: C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release866\ff [2014.05.13 19:22:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2014.03.15 18:42:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\Extensions
[2014.05.13 19:38:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\Firefox\Profiles\5c32r3dn.default\extensions
[2014.05.02 18:29:51 | 000,000,000 | ---D | M] ("MediaPlayerEnhance") -- C:\Users\TT Lammers\AppData\Roaming\mozilla\Firefox\Profiles\5c32r3dn.default\extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com
[2014.05.08 21:37:31 | 000,000,000 | ---D | M] (Allin1Convert) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\Firefox\Profiles\5c32r3dn.default\extensions\8hffxtbr@Allin1Convert_8h.com
[2014.05.11 18:25:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\Firefox\Profiles\5c32r3dn.default\extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com\extensionData
[2014.05.02 18:29:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\Firefox\Profiles\5c32r3dn.default\extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com\extensionData\plugins
[2014.05.11 18:25:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\Firefox\Profiles\5c32r3dn.default\extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com\extensionData\userCode
[2014.03.26 23:09:42 | 000,555,989 | ---- | M] () (No name found) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\extensions\toolbar_ORJ-V7C@apn.ask.com.xpi
[2014.05.02 13:43:47 | 000,957,880 | ---- | M] () (No name found) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2014.03.22 14:34:02 | 000,001,003 | ---- | M] () -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\searchplugins\11-suche.xml
[2014.04.23 11:08:38 | 000,009,608 | ---- | M] () -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\searchplugins\ask-web-search.xml
[2014.03.22 14:34:02 | 000,002,353 | ---- | M] () -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\searchplugins\englische-ergebnisse.xml
[2014.03.22 14:34:02 | 000,002,822 | ---- | M] () -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\searchplugins\gmx-suche.xml
[2014.03.22 14:34:02 | 000,002,432 | ---- | M] () -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\searchplugins\lastminute.xml
[2014.03.22 14:34:02 | 000,005,637 | ---- | M] () -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\searchplugins\webde-suche.xml
[2014.03.29 23:49:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2014.05.10 18:35:30 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2014.04.27 11:43:19 | 000,000,000 | ---D | M] (Media Buzz) -- C:\PROGRAM FILES (X86)\MEDIABUZZV1\MEDIABUZZV1MODE146\FF
[2014.03.16 17:17:47 | 000,000,000 | ---D | M] (Media View) -- C:\PROGRAM FILES (X86)\MEDIAVIEWV1\MEDIAVIEWV1ALPHA5026\FF
[2014.03.23 14:36:05 | 000,000,000 | ---D | M] (Media Watch) -- C:\PROGRAM FILES (X86)\MEDIAWATCHV1\MEDIAWATCHV1HOME30\FF
[2014.05.13 19:22:43 | 000,000,000 | ---D | M] (Rich Media View) -- C:\PROGRAM FILES (X86)\RICHMEDIAVIEWV1\RICHMEDIAVIEWV1RELEASE866\FF

========== Chrome ==========

CHR - default_search_provider: ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =
CHR - homepage: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTE0LPl7nfnBSc0ax5uDcscDZ4nZ2-hTHC4FiHP0Ir17U635wZtwgHiz3MJxyBGTA,,
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\bopakagnckmlgajfccecajhnimjiiedh\3.8.141.12_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.4_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgbealecnakbhfoeeipcnoboempfkbjd\2.1_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\eagngmbbjpiegdiojneaoolbllnappjo\1.1_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe\1.2.1_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\8.3_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\hggpkhijoeadmdfmlbdepfbngmhaldci\4.2.6.9_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnghlghflihkfiopikcjmaiajgbieegb\1.1_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.34_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lamhhbmgfmocmpeljkaablpohealeplo\1.1_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.7.0.2_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\crossrider
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\mglkejdgkcfeeecbbancdeeidmfpjkco\1.1_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\nchpfiddbhbdnagofhkjlaiaejmkdcla\2.0_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkmdmgjelehbgmopdfpjadcnihhpneop\1.1_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\obohmgehnpafmnikhnbehbefaheahaho\1.1_0\
CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkndmigholgfjlniaohblojbhgjbkakn\1.2.0_0\

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (media enhance) - {11111111-1111-1111-1111-110411411150} - C:\Program Files (x86)\media enhance\media enhance-bho64.dll (freeven)
O2:64bit: - BHO: (ValueApps) - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Programme\Conduit\ValueApps\IE\ValueAppsLoader.dll (Conduit Ltd.)
O2:64bit: - BHO: (IMinent WebBooster (BHO)) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\Minibar.InternetExplorer.BHOx64.dll File not found
O2 - BHO: (no name) - {112BA211-334C-4A90-90EC-2AD1CDAB287C} - No CLSID value found.
O2 - BHO: (flash-Enhancer) - {5A60B6BB-FA81-4EFA-AB9C-A820E2143736} - C:\Program Files (x86)\AmiExt\flashEnhancer\ie\flashEnhancer.dll ()
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No CLSID value found.
O2 - BHO: (ValueApps) - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Program Files (x86)\Conduit\ValueApps\IE\ValueAppsLoader.dll File not found
O2 - BHO: (no name) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {1FAFD711-ABF9-4F6A-8130-5166C7371427} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [ApnTBMon] C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (APN)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Guard.Mail.ru.gui] C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe ()
O4 - HKLM..\Run: [Iminent] C:\Program Files (x86)\Iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C" File not found
O4 - HKLM..\Run: [IminentMessenger] C:\Program Files (x86)\Iminent\Iminent.Messengers.exe File not found
O4 - HKLM..\Run: [mobilegeni daemon] C:\Program Files (x86)\Mobogenie\DaemonProcess.exe File not found
O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-169882981-2974695269-2748925970-1001..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKU\S-1-5-21-169882981-2974695269-2748925970-1001..\Run: [HP Photosmart 5520 series (NET)] C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O4 - HKU\S-1-5-21-169882981-2974695269-2748925970-1001..\Run: [lollipop_10271122] lollipop_10271122 File not found
O4 - HKU\S-1-5-21-169882981-2974695269-2748925970-1001..\Run: [NextLive] C:\Users\TT Lammers\AppData\Roaming\newnext.me\nengine.dll (NewNextDotMe)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\Smart Print 2.0\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\Smart Print 2.0\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0511CC15-6296-4FDF-A167-F94D1E800332}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{26969bd7-5590-11e2-86ff-00247e5b77a2}\Shell - "" = AutoRun
O33 - MountPoints2\{26969bd7-5590-11e2-86ff-00247e5b77a2}\Shell\AutoRun\command - "" = E:\Startme.exe
O33 - MountPoints2\{430916fa-809c-11e1-8051-00247e5b77a2}\Shell - "" = AutoRun
O33 - MountPoints2\{430916fa-809c-11e1-8051-00247e5b77a2}\Shell\AutoRun\command - "" = E:\Startme.exe
O33 - MountPoints2\{4e7c47c4-f87d-11e2-9b2f-00247e5b77a2}\Shell - "" = AutoRun
O33 - MountPoints2\{4e7c47c4-f87d-11e2-9b2f-00247e5b77a2}\Shell\AutoRun\command - "" = E:\iLinker.exe
O33 - MountPoints2\{90792bbe-5d80-11e2-8a77-00247e5b77a2}\Shell - "" = AutoRun
O33 - MountPoints2\{90792bbe-5d80-11e2-8a77-00247e5b77a2}\Shell\AutoRun\command - "" = E:\Startme.exe
O33 - MountPoints2\{90792bcd-5d80-11e2-8a77-00247e5b77a2}\Shell - "" = AutoRun
O33 - MountPoints2\{90792bcd-5d80-11e2-8a77-00247e5b77a2}\Shell\AutoRun\command - "" = E:\Startme.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2014.05.13 19:38:16 | 000,000,000 | ---D | C] -- C:\ProgramData\AskPartnerNetwork
[2014.05.13 19:38:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AskPartnerNetwork
[2014.05.13 19:36:58 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\TT Lammers\Desktop\otl.exe
[2014.05.13 19:36:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Oracle
[2014.05.13 19:36:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2014.05.13 19:35:41 | 000,264,616 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2014.05.13 19:35:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2014.05.13 19:35:16 | 000,175,528 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2014.05.13 19:35:16 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2014.05.13 19:35:16 | 000,096,168 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2014.05.13 19:35:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2014.05.13 19:22:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RichMediaViewV1
[2014.05.11 18:28:24 | 000,000,000 | ---D | C] -- C:\Users\xxxx\Desktop\2014-05-11 - Info
[2014.05.10 20:38:58 | 000,000,000 | --SD | C] -- C:\Users\xxxx\Documents\Eigene Datenquellen
[2014.05.10 20:18:28 | 000,000,000 | ---D | C] -- C:\Users\xxxx\Desktop\2014-05-10 - Info2
[2014.05.10 20:18:28 | 000,000,000 | ---D | C] -- C:\Users\xxxx\Desktop\2014-05-10 - Info1
[2014.05.06 21:10:28 | 000,000,000 | --SD | C] -- C:\Windows\SysNative\CompatTel
[2014.05.06 17:58:54 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll
[2014.05.06 17:58:54 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll
[2014.05.04 14:01:31 | 000,000,000 | -HSD | C] -- C:\Users\xxxx\AppData\Local\EmieUserList
[2014.05.04 14:01:31 | 000,000,000 | -HSD | C] -- C:\Users\xxxx\AppData\Local\EmieSiteList
[2014.05.03 18:57:55 | 000,000,000 | ---D | C] -- C:\Users\xxxx\Desktop\EDV
[2014.05.03 12:02:52 | 000,574,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2014.05.03 12:02:52 | 000,440,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2014.05.03 12:02:47 | 000,548,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2014.05.03 12:02:41 | 000,586,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2014.05.03 12:02:40 | 000,038,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2014.05.03 12:02:40 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2014.05.03 12:02:40 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
[2014.05.03 12:02:37 | 000,752,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
[2014.05.03 12:02:37 | 000,453,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2014.05.03 12:02:37 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2014.05.03 12:02:36 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2014.05.03 12:02:36 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2014.05.03 12:02:35 | 000,628,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2014.05.03 12:02:30 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2014.05.03 12:02:30 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2014.05.03 12:02:30 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2014.05.03 12:02:30 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2014.05.03 12:02:30 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2014.05.03 12:02:29 | 000,032,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2014.05.03 12:02:23 | 000,940,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2014.05.03 12:02:23 | 000,846,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2014.05.03 12:02:23 | 000,704,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2014.05.03 12:02:23 | 000,592,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
[2014.05.03 12:02:23 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
[2014.05.03 12:02:23 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2014.05.03 12:02:23 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
[2014.05.03 12:02:18 | 002,043,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2014.05.03 12:02:18 | 001,967,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2014.05.03 12:02:09 | 005,784,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2014.04.27 11:43:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MediaBuzzV1
[2014.04.19 12:25:34 | 000,000,000 | ---D | C] -- C:\Users\xxxx\Desktop\Prüfungen
[2014.04.15 19:55:41 | 000,000,000 | ---D | C] -- C:\Users\xxxx\Documents\BewerbungsMaster
[2014.04.15 19:55:41 | 000,000,000 | ---D | C] -- C:\Users\xxxx\AppData\Local\BewerbungsMaster
[2014.04.15 19:55:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BewerbungsMaster
[2014.04.15 19:54:58 | 000,000,000 | ---D | C] -- C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BewerbungsMaster
[2014.04.15 19:54:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BEWERBUNGSMASTER
[2014.04.15 19:54:49 | 000,335,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\Setup1.exe
[2014.04.15 19:54:46 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE
[2014.04.15 19:17:30 | 000,692,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2014.04.15 19:17:30 | 000,070,832 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[1 C:\Users\xxxx\Desktop\*.tmp files -> C:\Users\xxxx\Desktop\*.tmp -> ]
[1 C:\Users\xxxx\AppData\Local\*.tmp files -> C:\Users\xxxx\AppData\Local\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2014.05.13 19:37:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\xxxx\Desktop\otl.exe
[2014.05.13 19:35:08 | 000,264,616 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2014.05.13 19:35:08 | 000,175,528 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2014.05.13 19:35:08 | 000,096,168 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2014.05.13 19:35:06 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2014.05.13 19:33:50 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014.05.13 19:33:49 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014.05.13 19:32:43 | 001,620,684 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014.05.13 19:32:43 | 000,699,682 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2014.05.13 19:32:43 | 000,654,480 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014.05.13 19:32:43 | 000,149,790 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2014.05.13 19:32:43 | 000,122,352 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014.05.13 19:25:54 | 000,000,376 | ---- | M] () -- C:\Windows\tasks\AmiUpdXp.job
[2014.05.13 19:25:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014.05.13 19:25:37 | 3193,122,816 | -HS- | M] () -- C:\hiberfil.sys
[2014.05.13 19:25:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014.05.13 19:22:48 | 000,000,306 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2014.05.05 17:20:39 | 005,710,941 | ---- | M] () -- C:\Users\xxxx\Desktop\Sara Bareilles - Brave.mp3
[2014.05.03 15:32:27 | 004,369,702 | ---- | M] () -- C:\Users\xxxx\Desktop\Alle Farben - She Moves (Far Away) feat. Graham Candy (Street Video).mp3
[2014.04.29 14:24:11 | 000,742,872 | ---- | M] () -- C:\Users\xxxx\Documents\Scan0002.jpg
[2014.04.28 22:16:48 | 000,692,400 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2014.04.28 22:16:48 | 000,070,832 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2014.04.24 22:32:25 | 000,000,583 | ---- | M] () -- C:\Users\xxxx\Desktop\Buchungsuebersicht.lnk
[2014.04.22 19:11:07 | 400,341,788 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2014.04.15 19:54:49 | 000,335,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\Setup1.exe
[2014.04.15 19:54:47 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE
[2014.04.14 04:24:46 | 000,465,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll
[2014.04.14 04:19:37 | 000,424,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll
[1 C:\Users\xxxx\Desktop\*.tmp files -> C:\Users\xxxx\Desktop\*.tmp -> ]
[1 C:\Users\xxxx AppData\Local\*.tmp files -> C:\Users\xxxx\AppData\Local\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014.05.05 17:20:35 | 005,710,941 | ---- | C] () -- C:\Users\xxxx\Desktop\Sara Bareilles - Brave.mp3
[2014.05.03 15:32:27 | 004,369,702 | ---- | C] () -- C:\Users\xxxx\Desktop\Alle Farben - She Moves (Far Away) feat. Graham Candy (Street Video).mp3
[2014.04.29 14:23:53 | 000,742,872 | ---- | C] () -- C:\Users\xxxx\Documents\Scan0002.jpg
[2014.04.15 19:17:31 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014.03.16 21:56:19 | 000,000,160 | ---- | C] () -- C:\Users\xxxx\AppData\Roaming\aps.uninstall.scan.results
[2014.03.03 12:36:30 | 001,594,964 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2014.02.23 15:31:22 | 000,002,108 | ---- | C] () -- C:\Users\xxxx\AppData\Local\recently-used.xbel
[2014.01.29 19:36:10 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2013.12.18 21:32:53 | 000,000,041 | ---- | C] () -- C:\Users\xxxx\AppData\Roaming\WB.CFG
[2013.06.17 19:16:57 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2013.05.06 20:19:50 | 001,917,400 | ---- | C] () -- C:\Users\xxxx\DSC_0374.jpg
[2013.04.22 19:33:39 | 000,586,713 | ---- | C] () -- C:\Users\xxxx\DSCF1662.jpg
[2013.04.22 19:33:37 | 000,085,248 | ---- | C] () -- C:\Users\xxxx Lammers\554181_430948913619731_1182929366_n.jpg
[2013.04.22 19:33:18 | 001,480,278 | ---- | C] () -- C:\Users\xxxx\DSC_0041.jpg
[2013.04.22 19:33:06 | 000,985,147 | ---- | C] () -- C:\Users\xxxx\DSC_0046.jpg
[2013.04.22 19:33:03 | 000,190,871 | ---- | C] () -- C:\Users\xxxxs\DSC_0064.jpg
[2013.04.22 19:32:53 | 000,792,607 | ---- | C] () -- C:\Users\xxxx\DSCF1488.jpg
[2013.04.22 19:32:44 | 000,700,924 | ---- | C] () -- C:\Users\xxxx\DSCF1358.jpg
[2013.04.22 19:32:27 | 001,380,193 | ---- | C] () -- C:\Users\xxxx\IMG_0723.jpg
[2013.04.22 19:32:15 | 000,923,506 | ---- | C] () -- C:\Users\xxxx\IMG_3529.jpg
[2013.04.22 19:32:03 | 000,901,347 | ---- | C] () -- C:\Users\xxxx\DSC_0070.jpg
[2013.04.22 19:31:51 | 000,951,420 | ---- | C] () -- C:\Users\xxxx\DSC00190.jpg
[2013.04.22 19:31:47 | 000,189,649 | ---- | C] () -- C:\Users\xxxx\IMG_0682.jpg
[2013.04.22 19:31:34 | 000,817,616 | ---- | C] () -- C:\Users\xxxx\IMG_6395.jpg
[2013.04.22 19:31:33 | 000,050,312 | ---- | C] () -- C:\Users\xxxxs\Bild254.jpg
[2013.04.22 19:31:32 | 000,021,587 | ---- | C] () -- C:\Users\TT xxxx\DSC_0215_20130406195310175-1.jpg
[2013.04.22 19:31:29 | 000,165,176 | ---- | C] () -- C:\Users\TT xxxx\DSC_0215_20130406195310175.jpg
[2013.04.22 19:31:26 | 000,253,405 | ---- | C] () -- C:\Users\TT xxxx\DSC01645_20130410210245927.jpg
[2013.0422 19:31:20 | 000,392,629 | ---- | C] () -- C:\Users\TT xxxx\IMG_1187_20130410210735964.jpg
[2013.04.22 19:31:07 | 001,028,722 | ---- | C] () -- C:\Users\TT xxxx\IMG_0612_20130410211153208.jpg
[2013.04.22 19:31:04 | 000,163,035 | ---- | C] () -- C:\Users\TT xxxx\DSC_0262_20130417202117709.jpg
[2013.04.22 19:31:02 | 000,178,987 | ---- | C] () -- C:\Users\TT xxxx\DSC_0265_20130417202143729.jpg
[2013.04.22 19:30:59 | 000,160,705 | ---- | C] () -- C:\Users\TT xxxx\DSC_0261_20130417202229975.jpg
[2013.04.22 19:30:57 | 000,056,887 | ---- | C] () -- C:\Users\TT xxxx\DSC_0262_20130417202117709_20130417202421992.jpg
[2013.04.22 19:30:55 | 000,189,098 | ---- | C] () -- C:\Users\TT xxxx\DSC_0290_20130418195748969.jpg
[2013.04.22 19:30:53 | 000,051,167 | ---- | C] () -- C:\Users\TT xxxx\248496_191171744264117_5348576_n_20130418202401632.jpg
[2013.04.22 19:30:51 | 000,151,695 | ---- | C] () -- C:\Users\TT xxxx\DSC01652_20130418213654875.jpg
[2013.04.22 19:30:48 | 000,117,433 | ---- | C] () -- C:\Users\xx xxxx\IMG-20130421-WA0067_20130421230557220.jpg
[2013.04.22 19:30:46 | 000,145,093 | ---- | C] () -- C:\Users\xx xxxx\IMG-20130421-WA0035_20130421230856459.jpg
[2013.04.22 19:30:38 | 000,556,094 | ---- | C] () -- C:\Users\TT Lammers\IMG-20130421-WA0029_20130421231015747.jpg
[2013.04.22 19:30:37 | 000,109,465 | ---- | C] () -- C:\Users\TT Lammers\IMG-20130421-WA0019_20130421231618558.jpg
[2013.04.22 19:30:35 | 000,110,253 | ---- | C] () -- C:\Users\TT Lammers\IMG-20130421-WA0018_20130421231705949.jpg
[2013.01.19 19:12:41 | 000,797,539 | ---- | C] () -- C:\Users\TT Lammers\DSC_0095.jpg
[2013.01.19 19:12:29 | 000,703,556 | ---- | C] () -- C:\Users\TT Lammers\DSC_0096.jpg
[2013.01.19 19:12:18 | 000,803,703 | ---- | C] () -- C:\Users\TT Lammers\DSC_0097.jpg
[2013.01.19 19:12:06 | 000,773,686 | ---- | C] () -- C:\Users\TT Lammers\DSC_0098.jpg
[2013.01.19 19:11:55 | 000,802,374 | ---- | C] () -- C:\Users\TT Lammers\DSC_0099.jpg
[2013.01.19 19:11:45 | 000,768,366 | ---- | C] () -- C:\Users\TT Lammers\DSC_0100.jpg
[2013.01.19 19:11:34 | 000,810,485 | ---- | C] () -- C:\Users\TT Lammers\DSC_0101.jpg
[2013.01.19 19:11:23 | 000,807,414 | ---- | C] () -- C:\Users\TT Lammers\DSC_0102.jpg
[2013.01.19 19:11:14 | 000,709,272 | ---- | C] () -- C:\Users\TT Lammers\DSC_0103.jpg
[2013.01.19 19:11:02 | 000,762,727 | ---- | C] () -- C:\Users\TT Lammers\DSC_0104.jpg
[2013.01.19 19:10:43 | 000,856,648 | ---- | C] () -- C:\Users\TT Lammers\DSC_0105.jpg
[2013.01.19 19:10:29 | 000,857,996 | ---- | C] () -- C:\Users\TT Lammers\DSC_0106.jpg
[2013.01.19 19:10:18 | 000,873,588 | ---- | C] () -- C:\Users\TT Lammers\DSC_0107.jpg
[2013.01.19 19:10:01 | 000,851,378 | ---- | C] () -- C:\Users\TT Lammers\DSC_0108.jpg
[2013.01.19 19:09:47 | 000,868,921 | ---- | C] () -- C:\Users\TT Lammers\DSC_0109.jpg
[2013.01.19 19:09:35 | 000,866,634 | ---- | C] () -- C:\Users\TT Lammers\DSC_0110.jpg
[2013.01.19 19:09:13 | 000,860,071 | ---- | C] () -- C:\Users\TT Lammers\DSC_0111.jpg
[2013.01.19 19:09:00 | 000,828,584 | ---- | C] () -- C:\Users\TT Lammers\DSC_0112.jpg
[2013.01.19 19:08:48 | 000,849,543 | ---- | C] () -- C:\Users\TT Lammers\DSC_0113.jpg
[2013.01.19 19:08:28 | 000,878,321 | ---- | C] () -- C:\Users\TT Lammers\DSC_0114.jpg
[2013.01.19 19:08:17 | 000,848,261 | ---- | C] () -- C:\Users\TT Lammers\DSC_0115.jpg
[2013.01.19 19:08:07 | 000,836,748 | ---- | C] () -- C:\Users\TT Lammers\DSC_0116.jpg
[2013.01.19 19:07:52 | 000,849,893 | ---- | C] () -- C:\Users\TT Lammers\DSC_0117.jpg
[2013.01.19 19:07:39 | 000,824,595 | ---- | C] () -- C:\Users\TT Lammers\DSC_0118.jpg
[2013.01.19 19:07:25 | 000,823,322 | ---- | C] () -- C:\Users\TT Lammers\DSC_0119.jpg
[2012.10.18 17:04:37 | 000,000,032 | ---- | C] () -- C:\Users\TT Lammers\.simfy
[2012.08.26 18:22:17 | 000,003,584 | ---- | C] () -- C:\Users\TT Lammers\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.04.23 16:07:53 | 000,019,088 | ---- | C] () -- C:\Users\TT Lammers\AppData\Roaming\UserTile.png

========== ZeroAccess Check ==========

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.07.26 04:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.07.26 03:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2014.04.01 20:45:43 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\337
[2014.04.01 20:52:54 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\337 Wallpaper
[2012.12.02 15:32:16 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Babylon
[2013.08.05 21:06:13 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Dealply
[2013.08.15 18:46:25 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Desk 365
[2013.08.05 21:04:44 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\eIntaller
[2012.04.17 19:14:39 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\GetRightToGo
[2012.12.17 22:44:27 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\ICQ
[2012.09.28 18:25:47 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\ICQ Search
[2014.03.15 18:42:33 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\IminentToolbar
[2014.05.13 19:26:12 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\newnext.me
[2014.04.01 20:50:47 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Omiga Plus
[2014.02.21 19:50:46 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Opera Software
[2012.12.23 16:59:36 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\PerformerSoft
[2012.10.18 17:04:36 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Simfy
[2013.01.13 17:34:47 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Sony
[2012.12.02 15:32:55 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\UltraMixer
[2014.01.24 23:02:28 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\ValueApps
[2012.04.17 19:14:58 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Webcammax
[2012.04.19 21:49:51 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Windows SideBar
[2014.01.26 22:52:58 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\WinZipper

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2013.11.21 16:11:17 | 105,514,518 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\꒳曬Ḽ˜
[2013.11.21 16:11:17 | 105,514,518 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\꒳曬Ḽ˜
[2013.11.20 18:29:31 | 105,361,780 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\㎡花Ḽ–
[2013.11.20 18:29:31 | 105,361,780 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\㎡花Ḽ–
[2013.11.12 21:01:02 | 103,974,937 | ---- | M] ()(C:\Windows\SysWow64\???�) -- C:\Windows\SysWow64\麨Ḽ�
[2013.11.12 21:01:02 | 103,974,937 | ---- | C] ()(C:\Windows\SysWow64\???�) -- C:\Windows\SysWow64\麨Ḽ�
[2013.11.02 12:33:50 | 104,569,497 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\後쓺Ḽ‰
[2013.11.02 12:33:50 | 104,569,497 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\後쓺Ḽ‰
[2013.10.29 19:14:44 | 103,932,228 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\୓㭅Ḽ’
[2013.10.29 19:14:44 | 103,932,228 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\୓㭅Ḽ’

< End of report >