hallo seid heute kommt ganze zeit so eine meldung


und noch was komisches bei den prozessen


ich hoffe ihr könnt mir helfen denn das komische verlangsamt mein pc danke

ootl:
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
poste beide.

sry für doppelpost
hier bitte
Extras.txt :OTL Logfile:

OTL Extras logfile created on: 23.08.2010 18:14:23 - Run 1
OTL by OldTimer - Version 3.2.10.0     Folder = C:\Users\User\Downloads
64bit- Home Premium Edition Service Pack 1, v.178 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.16562)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 65,00% Memory free
9,00 Gb Paging File | 7,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): c:\pagefile.sys 5000 10000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 226,38 Gb Total Space | 159,43 Gb Free Space | 70,43% Space Free | Partition Type: NTFS
Drive D: | 226,38 Gb Total Space | 66,61 Gb Free Space | 29,42% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: WORKOUT
Current User Name: SeLx
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-2492281337-2513460117-458281117-1005\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Minefield\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [runas] -- cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Directory [takeownership] -- cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe" = C:\Program Files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3 -- File not found
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20AB57C7-FED7-4394-8166-A409DEA20253}" = TubeBox!
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{34BDF3BF-AA61-42E7-8818-C16A304910FC}" = Emma Core
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CE0C5C8-3880-40DE-90F8-D1D69A50AEBE}_is1" = V3.0
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D482078-8D15-4FD3-B838-C7B49174650F}" = Opera 10.61
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{7FC7AD70-1DF3-4B84-9AA2-4FB680F45572}_is1" = Hex-Editor MX
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74DEFD-A224-49CC-AB80-4E88BC730125}" = LogMeIn Hamachi
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96BFADF-A159-4395-8E9C-A9E2F059A3BB}" = Camtasia Studio 7
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F7FC9307-374E-4017-8E9D-DE1154780480}" = System Requirements Lab for Intel
"Action Replay Code Manager_is1" = Action Replay Code Manager
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Akamai" = Akamai NetSession Interface
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.12 (Unicode)
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Doom 3v1.3.0" = Doom 3
"Google Chrome" = Google Chrome
"HDClone.Free.3.9.3.1031" = HDClone 3.9 Free Edition
"Inno Setup 5_is1" = Inno Setup Version 5.3.9
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 6.0.0
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live
"MessengerDiscovery_is1" = MessengerDiscovery 2.5.95
"Mijagi-MT2" = Mijagi-MT2
"Minefield (4.0b5pre)" = Minefield (4.0b5pre)
"Notepad++" = Notepad++
"OPERATION7" = OPERATION7
"PremiumSoft Navicat for MySQL_is1" = PremiumSoft Navicat 9.0 for MySQL
"RAR Password Cracker" = RAR Password Cracker 4.12
"RegRun Security Suite_is1" = RegRun Security Suite Standard
"SEMC OMSI Module" = SEMC OMSI Module
"TuneUp Utilities" = TuneUp Utilities
"UberIcon_is1" = UberIcon 1.0.4
"Update Service" = Update Service
"uTorrent" = µTorrent
"WinLiveSuite_Wave3" = Windows Live Essentials
"WolfTeam" = WolfTeam
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         

--- --- ---
und jetz otl.txt :OTL Logfile:

OTL logfile created on: 23.08.2010 18:14:22 - Run 1
OTL by OldTimer - Version 3.2.10.0     Folder = C:\Users\SeLx\Downloads
64bit- Home Premium Edition Service Pack 1, v.178 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.16562)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 65,00% Memory free
9,00 Gb Paging File | 7,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): c:\pagefile.sys 5000 10000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 226,38 Gb Total Space | 159,43 Gb Free Space | 70,43% Space Free | Partition Type: NTFS
Drive D: | 226,38 Gb Total Space | 66,61 Gb Free Space | 29,42% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: WORKOUT
Current User Name: SeLx
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\SeLx\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Opera\opera.exe (Opera Software)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\SeLx\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.16562_none_41ebc47a2bd240fc\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Akamai) -- c:\program files (x86)\common files\akamai\rswin_3745.dll ()
SRV - (TuneUp.Defrag) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (npggsvc) -- C:\Windows\SysWow64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (clr_optimization_v4.0.30319_64) -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (IAANTMON) Intel(R) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
SRV - (OMSI download service) -- C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (RegGuard) -- C:\Windows\SysWOW64\drivers\regguard.sys (Greatis Software)
DRV - (Partizan) -- C:\Windows\system32\drivers\Partizan.sys (Greatis Software)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (cpudrv64) -- C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys ()
DRV - (NPPTNT2) -- C:\Windows\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2492281337-2513460117-458281117-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
 
FF - HKLM\software\mozilla\Minefield 4.0b3pre\extensions\\Components: C:\Program Files (x86)\Minefield\components [2010.08.22 18:55:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Minefield 4.0b4pre\extensions\\Components: C:\Program Files (x86)\Minefield\components [2010.08.22 18:55:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Minefield 4.0b5pre\extensions\\Components: C:\Program Files (x86)\Minefield\components [2010.08.22 18:55:56 | 000,000,000 | ---D | M]
 
[2010.08.23 06:44:24 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\mozilla\Extensions
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - No CLSID value found.
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DelayedDesktopSwitchTimeout = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\S-1-5-21-2492281337-2513460117-458281117-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O13 - gopher Prefix: missing
O16 - DPF: {C212D449-8B3C-41F2-BD9A-047BD770550F} hxxp://www.fiaa.eu/OPLauncher.cab (Perparer Class)
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab (SysInfo Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 213.20.173.11 193.189.244.205
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWow64\userinit.exe File not found
O20 - HKLM Winlogon: UIHost - (logonui.exe) -  File not found
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {F552DDE6-2090-4bf4-B924-6141E87789A5} - C:\PROGRA~2\Greatis\RegRunSuite\RRShell.dll (Greatis Software, LLC)
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2010.08.23 05:40:07 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010.08.23 05:40:07 | 000,000,000 | RHSD | M] - D:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (DfSDKBt) -  File not found
O34 - HKLM BootExecute: (Partizanautocheck turegopt) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^maComfort.lnk - C:\PROGRA~2\maComfort\maComfort.exe - ()
MsConfig:64bit - StartUpFolder: C:^Users^Maikk's^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Settings.ini - C:\Users\Maikk's\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Settings.ini - File not found
MsConfig:64bit - StartUpReg: BitTorrent DNA - hkey= - key= - C:\Program Files (x86)\DNA\btdna.exe File not found
MsConfig:64bit - StartUpReg: CyberGhost VPN - hkey= - key= - C:\Program Files\S.A.D\CyberGhost VPN\Cyberghost.exe File not found
MsConfig:64bit - StartUpReg: Java JRE - hkey= - key= - C:\Users\Maikk's\AppData\Roaming\Java\javaq.exe File not found
MsConfig:64bit - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
MsConfig:64bit - StartUpReg: Microsoft Default Manager - hkey= - key= - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe File not found
MsConfig:64bit - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files (x86)\Windows Live\Messenger\MsnMsgr.Exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: Rainlendar2 - hkey= - key= - C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe File not found
MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig:64bit - StartUpReg: Sony Ericsson PC Companion - hkey= - key= - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson Mobile Communications AB)
MsConfig:64bit - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe File not found
MsConfig:64bit - StartUpReg: Windows Live Communications Platform - hkey= - key= - C:\Users\Maikk's\AppData\Roaming\Windows Media Player\msvc.exe File not found
MsConfig:64bit - State: "bootini" - Reg Error: Key error.
MsConfig:64bit - State: "startup" - Reg Error: Key error.
MsConfig:64bit - State: "services" - Reg Error: Key error.
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: Hamachi2Svc - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.ac3acm - C:\Windows\SysWow64\ac3acm.acm (fccHandler)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\SysWow64\lameACM.acm (www)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\divx.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\SysWow64\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.23 18:05:14 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.08.23 18:05:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010.08.23 08:10:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.08.23 07:52:47 | 000,039,424 | ---- | C] (NirSoft) -- C:\Windows\zipinst.exe
[2010.08.23 07:52:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Finderbar 1.5
[2010.08.23 07:05:25 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Malwarebytes
[2010.08.23 06:47:48 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Macromedia
[2010.08.23 06:47:48 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Adobe
[2010.08.23 06:47:44 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Opera
[2010.08.23 06:47:44 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Opera
[2010.08.23 06:47:35 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\TuneUp Software
[2010.08.23 06:44:18 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Mozilla
[2010.08.23 06:44:18 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Mozilla
[2010.08.23 06:39:09 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Reshacker
[2010.08.23 06:37:32 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Musik
[2010.08.23 06:37:21 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Hompage etc
[2010.08.23 06:36:58 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Urlaub Hamburg 2010
[2010.08.23 06:36:44 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Designs etc
[2010.08.23 06:36:27 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Handy etc
[2010.08.23 06:35:16 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Searches
[2010.08.23 06:35:07 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Identities
[2010.08.23 06:35:05 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Contacts
[2010.08.23 06:34:50 | 000,000,000 | ---D | C] -- C:\Users\SeLx\Documents\RegRun2
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Vorlagen
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\AppData\Local\Verlauf
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\AppData\Local\Temporary Internet Files
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Startmenü
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\SendTo
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Recent
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Netzwerkumgebung
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Lokale Einstellungen
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Documents\Eigene Videos
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Documents\Eigene Musik
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Eigene Dateien
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Documents\Eigene Bilder
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Druckumgebung
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Cookies
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\AppData\Local\Anwendungsdaten
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Anwendungsdaten
[2010.08.23 06:34:45 | 000,000,000 | --SD | C] -- C:\Users\SeLx\AppData\Roaming\Microsoft
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Videos
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Saved Games
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Pictures
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Music
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Links
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Favorites
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Downloads
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Documents
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop
[2010.08.23 06:34:45 | 000,000,000 | -H-D | C] -- C:\Users\SeLx\AppData
[2010.08.23 06:34:45 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Temp
[2010.08.23 06:34:45 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Microsoft
[2010.08.23 06:34:45 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Media Center Programs
[2010.08.23 05:45:22 | 000,000,000 | ---D | C] -- C:\Windows\RestoreSafeDeleted
[2010.08.23 05:40:39 | 000,024,416 | ---- | C] (Greatis Software) -- C:\Windows\SysWow64\drivers\regguard.sys
[2010.08.23 05:40:07 | 000,000,000 | RHSD | C] -- C:\desktop.ini
[2010.08.23 05:40:07 | 000,000,000 | RHSD | C] -- C:\comment.htt
[2010.08.23 05:40:07 | 000,000,000 | RHSD | C] -- C:\autorun.inf
[2010.08.23 05:39:29 | 000,035,816 | ---- | C] (Greatis Software) -- C:\Windows\SysWow64\drivers\Partizan.sys
[2010.08.23 05:39:28 | 000,037,600 | ---- | C] (Greatis Software) -- C:\Windows\SysWow64\Partizan.exe
[2010.08.23 05:38:26 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\regruninfo
[2010.08.23 05:38:25 | 001,385,240 | ---- | C] (Greatis Software) -- C:\Windows\RunGuard.exe
[2010.08.23 05:37:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Greatis
[2010.08.23 03:16:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Microsoft Shared
[2010.08.23 01:52:41 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE
[2010.08.22 04:10:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hex-Editor MX
[2010.08.21 00:41:23 | 000,000,000 | ---D | C] -- C:\Fiaa
[2010.08.19 17:25:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QS
[2010.08.19 02:24:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RAR Password Cracker
[2010.08.18 15:06:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Jens Lorek
[2010.08.18 01:20:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2010.08.18 00:59:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Notepad++
[2010.08.18 00:26:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\maComfort
[2010.08.17 23:06:48 | 002,791,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer_edit_w7sba.exe
[2010.08.17 23:06:48 | 002,791,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer_backup_w7sba.exe
[2010.08.17 23:06:48 | 000,000,000 | ---D | C] -- C:\Windows\w7sba
[2010.08.17 22:58:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\UberIcon
[2010.08.17 22:57:07 | 002,870,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer_edit_w7upfc.exe
[2010.08.17 22:57:07 | 000,000,000 | ---D | C] -- C:\Windows\w7upfc
[2010.08.17 22:57:06 | 002,870,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer_backup_w7upfc.exe
[2010.08.17 20:43:07 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat
[2010.08.16 16:15:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Datel
[2010.08.16 16:04:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Opera
[2010.08.16 00:08:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HDClone 3.9 Free Edition
[2010.08.16 00:05:04 | 000,197,632 | ---- | C] (Intel(R) Corporation) -- C:\Windows\SysWow64\ir32_32.dll
[2010.08.16 00:05:04 | 000,082,944 | ---- | C] (Radius Inc.) -- C:\Windows\SysWow64\iccvid.dll
[2010.08.16 00:04:34 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2010.08.02 02:10:55 | 000,000,000 | ---D | C] -- C:\Intel
[2010.08.01 23:10:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Famount-MT2
[2010.08.01 18:28:52 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2010.08.01 16:22:35 | 000,000,000 | ---D | C] -- C:\AeriaGames
[2010.08.01 01:01:08 | 000,000,000 | ---D | C] -- C:\xampp
[2010.07.31 19:36:33 | 000,000,000 | ---D | C] -- C:\Serverfiles_by_Profizocker94_v2
[2010.07.26 20:50:04 | 000,000,000 | ---D | C] -- C:\mt2
[2010.07.26 13:26:28 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Hochzeit 2010 selcuk&serap
[2010.07.25 14:14:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MT2ExpMod
[2010.05.30 18:50:06 | 000,413,696 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkinpa.dll
[2010.05.30 18:50:06 | 000,397,312 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkiesc.dll
[2010.05.30 18:50:05 | 000,991,232 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkusb1.dll
[2010.05.30 18:50:05 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkpmui.dll
[2010.05.30 18:50:04 | 001,224,704 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkserv.dll
[2010.05.30 18:50:04 | 000,585,728 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbklmpm.dll
[2010.05.30 18:50:04 | 000,163,840 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkprox.dll
[2010.05.30 18:50:04 | 000,094,208 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkpplc.dll
[2010.05.30 18:50:03 | 000,696,320 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkhbn3.dll
[2010.05.30 18:50:03 | 000,684,032 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkcomc.dll
[2010.05.30 18:50:03 | 000,421,888 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkcomm.dll
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.23 18:15:06 | 001,048,576 | -HS- | M] () -- C:\Users\SeLx\NTUSER.DAT
[2010.08.23 17:51:42 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.23 17:51:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.23 17:51:16 | 3092,930,560 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.23 17:27:06 | 002,030,943 | -H-- | M] () -- C:\Users\SeLx\AppData\Local\IconCache.db
[2010.08.23 07:52:47 | 000,039,424 | ---- | M] (NirSoft) -- C:\Windows\zipinst.exe
[2010.08.23 07:12:19 | 000,524,288 | -HS- | M] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010.08.23 07:12:19 | 000,524,288 | -HS- | M] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010.08.23 07:12:19 | 000,065,536 | -HS- | M] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010.08.23 06:35:27 | 000,064,160 | ---- | M] () -- C:\Users\SeLx\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.08.23 06:34:46 | 000,000,020 | -HS- | M] () -- C:\Users\SeLx\ntuser.ini
[2010.08.23 06:18:01 | 000,024,416 | ---- | M] (Greatis Software) -- C:\Windows\SysWow64\drivers\regguard.sys
[2010.08.23 06:01:18 | 000,000,170 | ---- | M] () -- C:\Windows\SysWow64\Partizan.RRI
[2010.08.23 05:56:50 | 000,000,002 | RHS- | M] () -- C:\Windows\winstart.bat
[2010.08.23 05:56:50 | 000,000,002 | RHS- | M] () -- C:\Windows\SysWow64\CONFIG.NT
[2010.08.23 05:56:50 | 000,000,002 | RHS- | M] () -- C:\Windows\SysWow64\AUTOEXEC.NT
[2010.08.23 05:39:29 | 000,037,600 | ---- | M] (Greatis Software) -- C:\Windows\SysWow64\Partizan.exe
[2010.08.23 05:39:29 | 000,035,816 | ---- | M] (Greatis Software) -- C:\Windows\SysWow64\drivers\Partizan.sys
[2010.08.16 13:10:26 | 001,385,240 | ---- | M] (Greatis Software) -- C:\Windows\RunGuard.exe
[2010.08.16 13:10:18 | 000,020,248 | ---- | M] () -- C:\Windows\WinBait.org
[2010.08.16 13:10:18 | 000,020,248 | ---- | M] () -- C:\Windows\WinBait.exe
[2010.08.12 21:20:06 | 000,021,312 | ---- | M] (TuneUp Software) -- C:\Windows\SysWow64\authuitu.dll
[2010.08.12 21:19:54 | 000,030,016 | ---- | M] (TuneUp Software) -- C:\Windows\SysWow64\uxtuneup.dll
[2010.08.01 18:29:42 | 000,000,056 | -H-- | M] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.07.29 08:02:56 | 000,197,632 | ---- | M] (Intel(R) Corporation) -- C:\Windows\SysWow64\ir32_32.dll
[2010.07.29 08:02:07 | 000,082,944 | ---- | M] (Radius Inc.) -- C:\Windows\SysWow64\iccvid.dll
 
========== Files Created - No Company Name ==========
 
[2010.08.23 06:34:46 | 000,524,288 | -HS- | C] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010.08.23 06:34:46 | 000,524,288 | -HS- | C] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010.08.23 06:34:46 | 000,262,144 | -HS- | C] () -- C:\Users\SeLx\ntuser.dat.LOG1
[2010.08.23 06:34:46 | 000,065,536 | -HS- | C] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010.08.23 06:34:46 | 000,000,020 | -HS- | C] () -- C:\Users\SeLx\ntuser.ini
[2010.08.23 06:34:46 | 000,000,000 | -HS- | C] () -- C:\Users\SeLx\ntuser.dat.LOG2
[2010.08.23 06:34:45 | 001,048,576 | -HS- | C] () -- C:\Users\SeLx\NTUSER.DAT
[2010.08.23 05:56:50 | 000,000,002 | RHS- | C] () -- C:\Windows\winstart.bat
[2010.08.23 05:56:50 | 000,000,002 | RHS- | C] () -- C:\Windows\SysWow64\CONFIG.NT
[2010.08.23 05:45:22 | 000,000,170 | ---- | C] () -- C:\Windows\SysWow64\Partizan.RRI
[2010.08.23 05:39:58 | 000,000,002 | RHS- | C] () -- C:\Windows\SysWow64\AUTOEXEC.NT
[2010.08.23 05:38:26 | 000,057,556 | ---- | C] () -- C:\Windows\guard.bmp
[2010.08.23 05:38:25 | 000,020,248 | ---- | C] () -- C:\Windows\WinBait.org
[2010.08.23 05:38:24 | 000,020,248 | ---- | C] () -- C:\Windows\WinBait.exe
[2010.08.01 18:29:42 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.07.24 13:50:47 | 000,040,960 | ---- | C] () -- C:\Windows\SysWow64\php_mysql.dll
[2010.07.24 13:50:46 | 002,359,296 | ---- | C] () -- C:\Windows\SysWow64\libmysql.dll
[2010.07.24 13:50:46 | 000,166,912 | ---- | C] () -- C:\Windows\SysWow64\libmcrypt.dll
[2010.07.24 13:50:46 | 000,165,643 | ---- | C] () -- C:\Windows\SysWow64\libmhash.dll
[2010.07.24 13:50:46 | 000,051,008 | ---- | C] () -- C:\Windows\php.ini
[2010.07.19 19:34:40 | 001,589,248 | ---- | C] () -- C:\Windows\SysWow64\libmysql_d.dll
[2010.07.04 15:53:39 | 000,000,025 | ---- | C] () -- C:\Windows\libem.INI
[2010.06.08 19:07:37 | 000,014,848 | ---- | C] () -- C:\Windows\SysWow64\BASSMOD.dll
[2010.06.03 14:16:44 | 000,165,376 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2010.06.03 14:16:43 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2010.06.03 14:16:31 | 000,881,664 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010.06.03 14:16:31 | 000,205,824 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2010.06.03 14:16:29 | 000,000,547 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll.manifest
[2010.06.03 14:16:28 | 000,108,032 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2010.05.30 18:50:06 | 000,274,432 | ---- | C] () -- C:\Windows\SysWow64\LXBKinst.dll
[2010.05.30 18:50:05 | 000,413,696 | ---- | C] () -- C:\Windows\SysWow64\lxbkutil.dll
[2010.05.11 22:38:25 | 000,307,200 | ---- | C] () -- C:\Windows\SysWow64\AscSQLite.dll
[2010.02.11 00:05:42 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll
[2010.02.11 00:05:42 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
 
========== LOP Check ==========
 
[2010.05.10 17:43:53 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\TuneUp Software
[2010.08.23 06:33:51 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\DNA
[2010.07.30 12:47:28 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\MessengerDiscovery 2
[2010.06.17 23:04:37 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\Rainmeter
[2010.05.30 18:29:45 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\Sony
[2010.05.09 21:00:02 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\TuneUp Software
[2010.08.23 06:47:44 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Opera
[2010.08.23 06:47:35 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\TuneUp Software
[2010.07.17 18:12:23 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.08.23 06:47:48 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Adobe
[2010.08.23 06:35:07 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Identities
[2010.08.23 06:47:48 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Macromedia
[2010.08.23 07:05:25 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Malwarebytes
[2009.07.14 20:18:18 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Media Center Programs
[2010.08.23 07:17:22 | 000,000,000 | --SD | M] -- C:\Users\SeLx\AppData\Roaming\Microsoft
[2010.08.23 06:44:24 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Mozilla
[2010.08.23 06:47:44 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Opera
[2010.08.23 06:47:35 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\TuneUp Software
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_707e24689a830c30\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.16562_none_1800f942d57aa321\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_f8a21b209c42bf2b\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.16562_none_3b26342138539843\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2009.08.06 00:00:00 | 000,028,787 | ---- | M] () MD5=9517DD94BABFCCDBA18772AB41AF4A57 -- C:\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll
 
< MD5 for: IASTOR.SYS  >
[2009.06.04 18:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009.06.04 18:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysWow64\DriverStore\FileRepository\iaahci.inf_amd64_neutral_7fb62b08f6b7117a\iaStor.sys
[2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010.06.04 12:05:32 | 000,410,496 | ---- | M] (Intel Corporation) MD5=E82C8DB2D63C4F6A6A25A766C305D767 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_c9199d57075f47a9\iaStorV.sys
[2010.06.04 12:05:32 | 000,410,496 | ---- | M] (Intel Corporation) MD5=E82C8DB2D63C4F6A6A25A766C305D767 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.16562_none_0cff5e7f9e91c436\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.06.04 10:40:05 | 000,693,760 | ---- | M] (Microsoft Corporation) MD5=4870CCE9A0FB95D464C4720652702CDB -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.16562_none_5ba5c34a4ec3b1fe\netlogon.dll
[2010.06.04 09:53:16 | 000,564,736 | ---- | M] (Microsoft Corporation) MD5=8D62A9C16461EC11A96B177422274904 -- C:\Windows\SysWOW64\netlogon.dll
[2010.06.04 09:53:16 | 000,564,736 | ---- | M] (Microsoft Corporation) MD5=8D62A9C16461EC11A96B177422274904 -- C:\Windows\SysWOW64\netlogon.dll
[2010.06.04 09:53:16 | 000,564,736 | ---- | M] (Microsoft Corporation) MD5=8D62A9C16461EC11A96B177422274904 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.16562_none_65fa6d9c832473f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2010.06.04 12:05:43 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=BD1AE842E5F68477FF636856FCF1527A -- C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_c09ee40f078b4594\nvstor.sys
[2010.06.04 12:05:43 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=BD1AE842E5F68477FF636856FCF1527A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.16562_none_97c8cf2ed5c86e0e\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010.06.04 10:40:37 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=5B0B04D5646CD824AB46074E167F4F38 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.16562_none_95fbee62efe538b9\scecli.dll
[2010.06.04 09:53:38 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=CC272ABCBF23CC53F751292D3BF61D77 -- C:\Windows\SysWOW64\scecli.dll
[2010.06.04 09:53:38 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=CC272ABCBF23CC53F751292D3BF61D77 -- C:\Windows\SysWOW64\scecli.dll
[2010.06.04 09:53:38 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=CC272ABCBF23CC53F751292D3BF61D77 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.16562_none_a05098b52445fab4\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.06.04 10:41:05 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=6B179C1FB800F953757CC5F5ED42DF94 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.16562_none_2b267848842648d9\user32.dll
[2010.06.04 09:43:42 | 000,828,416 | ---- | M] (Microsoft Corporation) MD5=8BE2DDDAFE3778FF1E5C8B5802055587 -- C:\Windows\SysWOW64\user32.dll
[2010.06.04 09:43:42 | 000,828,416 | ---- | M] (Microsoft Corporation) MD5=8BE2DDDAFE3778FF1E5C8B5802055587 -- C:\Windows\SysWOW64\user32.dll
[2010.06.04 09:43:42 | 000,828,416 | ---- | M] (Microsoft Corporation) MD5=8BE2DDDAFE3778FF1E5C8B5802055587 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.16562_none_357b229ab8870ad4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.06.04 09:51:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=A1C9C01C02AF6A2C81CAC34CD5E65F9B -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.16562_none_ddf82a99301c507c\userinit.exe
[2010.06.04 10:38:08 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=FEC03AB7D1B2DB3909CB931B2D2B7C7E -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.16562_none_3a16c61ce879c1b2\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.06.04 10:38:12 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=7B8ADC7DBE1B90D4F514D5C2DAA43A02 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.16562_none_cdb10d1debbb459c\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
< End of report >
         

--- --- ---

hier bitte
Extras.txt :OTL Logfile:

OTL Extras logfile created on: 23.08.2010 18:14:23 - Run 1
OTL by OldTimer - Version 3.2.10.0     Folder = C:\Users\User\Downloads
64bit- Home Premium Edition Service Pack 1, v.178 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.16562)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 65,00% Memory free
9,00 Gb Paging File | 7,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): c:\pagefile.sys 5000 10000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 226,38 Gb Total Space | 159,43 Gb Free Space | 70,43% Space Free | Partition Type: NTFS
Drive D: | 226,38 Gb Total Space | 66,61 Gb Free Space | 29,42% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: WORKOUT
Current User Name: SeLx
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-2492281337-2513460117-458281117-1005\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Minefield\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [runas] -- cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Directory [takeownership] -- cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe" = C:\Program Files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3 -- File not found
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20AB57C7-FED7-4394-8166-A409DEA20253}" = TubeBox!
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{34BDF3BF-AA61-42E7-8818-C16A304910FC}" = Emma Core
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CE0C5C8-3880-40DE-90F8-D1D69A50AEBE}_is1" = V3.0
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D482078-8D15-4FD3-B838-C7B49174650F}" = Opera 10.61
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{7FC7AD70-1DF3-4B84-9AA2-4FB680F45572}_is1" = Hex-Editor MX
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74DEFD-A224-49CC-AB80-4E88BC730125}" = LogMeIn Hamachi
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96BFADF-A159-4395-8E9C-A9E2F059A3BB}" = Camtasia Studio 7
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F7FC9307-374E-4017-8E9D-DE1154780480}" = System Requirements Lab for Intel
"Action Replay Code Manager_is1" = Action Replay Code Manager
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Akamai" = Akamai NetSession Interface
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.12 (Unicode)
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Doom 3v1.3.0" = Doom 3
"Google Chrome" = Google Chrome
"HDClone.Free.3.9.3.1031" = HDClone 3.9 Free Edition
"Inno Setup 5_is1" = Inno Setup Version 5.3.9
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 6.0.0
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live
"MessengerDiscovery_is1" = MessengerDiscovery 2.5.95
"Mijagi-MT2" = Mijagi-MT2
"Minefield (4.0b5pre)" = Minefield (4.0b5pre)
"Notepad++" = Notepad++
"OPERATION7" = OPERATION7
"PremiumSoft Navicat for MySQL_is1" = PremiumSoft Navicat 9.0 for MySQL
"RAR Password Cracker" = RAR Password Cracker 4.12
"RegRun Security Suite_is1" = RegRun Security Suite Standard
"SEMC OMSI Module" = SEMC OMSI Module
"TuneUp Utilities" = TuneUp Utilities
"UberIcon_is1" = UberIcon 1.0.4
"Update Service" = Update Service
"uTorrent" = µTorrent
"WinLiveSuite_Wave3" = Windows Live Essentials
"WolfTeam" = WolfTeam
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         

--- --- ---
und jetz otl.txt :OTL Logfile:

OTL logfile created on: 23.08.2010 18:14:22 - Run 1
OTL by OldTimer - Version 3.2.10.0     Folder = C:\Users\SeLx\Downloads
64bit- Home Premium Edition Service Pack 1, v.178 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.16562)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 65,00% Memory free
9,00 Gb Paging File | 7,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): c:\pagefile.sys 5000 10000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 226,38 Gb Total Space | 159,43 Gb Free Space | 70,43% Space Free | Partition Type: NTFS
Drive D: | 226,38 Gb Total Space | 66,61 Gb Free Space | 29,42% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: WORKOUT
Current User Name: SeLx
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\SeLx\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Opera\opera.exe (Opera Software)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\SeLx\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.16562_none_41ebc47a2bd240fc\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Akamai) -- c:\program files (x86)\common files\akamai\rswin_3745.dll ()
SRV - (TuneUp.Defrag) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (npggsvc) -- C:\Windows\SysWow64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (clr_optimization_v4.0.30319_64) -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (IAANTMON) Intel(R) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
SRV - (OMSI download service) -- C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (RegGuard) -- C:\Windows\SysWOW64\drivers\regguard.sys (Greatis Software)
DRV - (Partizan) -- C:\Windows\system32\drivers\Partizan.sys (Greatis Software)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (cpudrv64) -- C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys ()
DRV - (NPPTNT2) -- C:\Windows\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2492281337-2513460117-458281117-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
 
FF - HKLM\software\mozilla\Minefield 4.0b3pre\extensions\\Components: C:\Program Files (x86)\Minefield\components [2010.08.22 18:55:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Minefield 4.0b4pre\extensions\\Components: C:\Program Files (x86)\Minefield\components [2010.08.22 18:55:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Minefield 4.0b5pre\extensions\\Components: C:\Program Files (x86)\Minefield\components [2010.08.22 18:55:56 | 000,000,000 | ---D | M]
 
[2010.08.23 06:44:24 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\mozilla\Extensions
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - No CLSID value found.
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DelayedDesktopSwitchTimeout = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\S-1-5-21-2492281337-2513460117-458281117-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O13 - gopher Prefix: missing
O16 - DPF: {C212D449-8B3C-41F2-BD9A-047BD770550F} hxxp://www.fiaa.eu/OPLauncher.cab (Perparer Class)
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab (SysInfo Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 213.20.173.11 193.189.244.205
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWow64\userinit.exe File not found
O20 - HKLM Winlogon: UIHost - (logonui.exe) -  File not found
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {F552DDE6-2090-4bf4-B924-6141E87789A5} - C:\PROGRA~2\Greatis\RegRunSuite\RRShell.dll (Greatis Software, LLC)
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2010.08.23 05:40:07 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010.08.23 05:40:07 | 000,000,000 | RHSD | M] - D:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (DfSDKBt) -  File not found
O34 - HKLM BootExecute: (Partizanautocheck turegopt) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^maComfort.lnk - C:\PROGRA~2\maComfort\maComfort.exe - ()
MsConfig:64bit - StartUpFolder: C:^Users^Maikk's^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Settings.ini - C:\Users\Maikk's\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Settings.ini - File not found
MsConfig:64bit - StartUpReg: BitTorrent DNA - hkey= - key= - C:\Program Files (x86)\DNA\btdna.exe File not found
MsConfig:64bit - StartUpReg: CyberGhost VPN - hkey= - key= - C:\Program Files\S.A.D\CyberGhost VPN\Cyberghost.exe File not found
MsConfig:64bit - StartUpReg: Java JRE - hkey= - key= - C:\Users\Maikk's\AppData\Roaming\Java\javaq.exe File not found
MsConfig:64bit - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
MsConfig:64bit - StartUpReg: Microsoft Default Manager - hkey= - key= - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe File not found
MsConfig:64bit - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files (x86)\Windows Live\Messenger\MsnMsgr.Exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: Rainlendar2 - hkey= - key= - C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe File not found
MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig:64bit - StartUpReg: Sony Ericsson PC Companion - hkey= - key= - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson Mobile Communications AB)
MsConfig:64bit - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe File not found
MsConfig:64bit - StartUpReg: Windows Live Communications Platform - hkey= - key= - C:\Users\Maikk's\AppData\Roaming\Windows Media Player\msvc.exe File not found
MsConfig:64bit - State: "bootini" - Reg Error: Key error.
MsConfig:64bit - State: "startup" - Reg Error: Key error.
MsConfig:64bit - State: "services" - Reg Error: Key error.
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: Hamachi2Svc - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.ac3acm - C:\Windows\SysWow64\ac3acm.acm (fccHandler)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\SysWow64\lameACM.acm (www)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\divx.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\SysWow64\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.23 18:05:14 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.08.23 18:05:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010.08.23 08:10:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.08.23 07:52:47 | 000,039,424 | ---- | C] (NirSoft) -- C:\Windows\zipinst.exe
[2010.08.23 07:52:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Finderbar 1.5
[2010.08.23 07:05:25 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Malwarebytes
[2010.08.23 06:47:48 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Macromedia
[2010.08.23 06:47:48 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Adobe
[2010.08.23 06:47:44 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Opera
[2010.08.23 06:47:44 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Opera
[2010.08.23 06:47:35 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\TuneUp Software
[2010.08.23 06:44:18 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Mozilla
[2010.08.23 06:44:18 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Mozilla
[2010.08.23 06:39:09 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Reshacker
[2010.08.23 06:37:32 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Musik
[2010.08.23 06:37:21 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Hompage etc
[2010.08.23 06:36:58 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Urlaub Hamburg 2010
[2010.08.23 06:36:44 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Designs etc
[2010.08.23 06:36:27 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Handy etc
[2010.08.23 06:35:16 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Searches
[2010.08.23 06:35:07 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Identities
[2010.08.23 06:35:05 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Contacts
[2010.08.23 06:34:50 | 000,000,000 | ---D | C] -- C:\Users\SeLx\Documents\RegRun2
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Vorlagen
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\AppData\Local\Verlauf
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\AppData\Local\Temporary Internet Files
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Startmenü
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\SendTo
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Recent
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Netzwerkumgebung
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Lokale Einstellungen
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Documents\Eigene Videos
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Documents\Eigene Musik
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Eigene Dateien
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Documents\Eigene Bilder
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Druckumgebung
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Cookies
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\AppData\Local\Anwendungsdaten
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Anwendungsdaten
[2010.08.23 06:34:45 | 000,000,000 | --SD | C] -- C:\Users\SeLx\AppData\Roaming\Microsoft
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Videos
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Saved Games
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Pictures
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Music
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Links
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Favorites
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Downloads
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Documents
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop
[2010.08.23 06:34:45 | 000,000,000 | -H-D | C] -- C:\Users\SeLx\AppData
[2010.08.23 06:34:45 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Temp
[2010.08.23 06:34:45 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Microsoft
[2010.08.23 06:34:45 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Media Center Programs
[2010.08.23 05:45:22 | 000,000,000 | ---D | C] -- C:\Windows\RestoreSafeDeleted
[2010.08.23 05:40:39 | 000,024,416 | ---- | C] (Greatis Software) -- C:\Windows\SysWow64\drivers\regguard.sys
[2010.08.23 05:40:07 | 000,000,000 | RHSD | C] -- C:\desktop.ini
[2010.08.23 05:40:07 | 000,000,000 | RHSD | C] -- C:\comment.htt
[2010.08.23 05:40:07 | 000,000,000 | RHSD | C] -- C:\autorun.inf
[2010.08.23 05:39:29 | 000,035,816 | ---- | C] (Greatis Software) -- C:\Windows\SysWow64\drivers\Partizan.sys
[2010.08.23 05:39:28 | 000,037,600 | ---- | C] (Greatis Software) -- C:\Windows\SysWow64\Partizan.exe
[2010.08.23 05:38:26 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\regruninfo
[2010.08.23 05:38:25 | 001,385,240 | ---- | C] (Greatis Software) -- C:\Windows\RunGuard.exe
[2010.08.23 05:37:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Greatis
[2010.08.23 03:16:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Microsoft Shared
[2010.08.23 01:52:41 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE
[2010.08.22 04:10:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hex-Editor MX
[2010.08.21 00:41:23 | 000,000,000 | ---D | C] -- C:\Fiaa
[2010.08.19 17:25:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QS
[2010.08.19 02:24:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RAR Password Cracker
[2010.08.18 15:06:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Jens Lorek
[2010.08.18 01:20:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2010.08.18 00:59:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Notepad++
[2010.08.18 00:26:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\maComfort
[2010.08.17 23:06:48 | 002,791,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer_edit_w7sba.exe
[2010.08.17 23:06:48 | 002,791,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer_backup_w7sba.exe
[2010.08.17 23:06:48 | 000,000,000 | ---D | C] -- C:\Windows\w7sba
[2010.08.17 22:58:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\UberIcon
[2010.08.17 22:57:07 | 002,870,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer_edit_w7upfc.exe
[2010.08.17 22:57:07 | 000,000,000 | ---D | C] -- C:\Windows\w7upfc
[2010.08.17 22:57:06 | 002,870,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer_backup_w7upfc.exe
[2010.08.17 20:43:07 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat
[2010.08.16 16:15:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Datel
[2010.08.16 16:04:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Opera
[2010.08.16 00:08:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HDClone 3.9 Free Edition
[2010.08.16 00:05:04 | 000,197,632 | ---- | C] (Intel(R) Corporation) -- C:\Windows\SysWow64\ir32_32.dll
[2010.08.16 00:05:04 | 000,082,944 | ---- | C] (Radius Inc.) -- C:\Windows\SysWow64\iccvid.dll
[2010.08.16 00:04:34 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2010.08.02 02:10:55 | 000,000,000 | ---D | C] -- C:\Intel
[2010.08.01 23:10:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Famount-MT2
[2010.08.01 18:28:52 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2010.08.01 16:22:35 | 000,000,000 | ---D | C] -- C:\AeriaGames
[2010.08.01 01:01:08 | 000,000,000 | ---D | C] -- C:\xampp
[2010.07.31 19:36:33 | 000,000,000 | ---D | C] -- C:\Serverfiles_by_Profizocker94_v2
[2010.07.26 20:50:04 | 000,000,000 | ---D | C] -- C:\mt2
[2010.07.26 13:26:28 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Hochzeit 2010 selcuk&serap
[2010.07.25 14:14:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MT2ExpMod
[2010.05.30 18:50:06 | 000,413,696 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkinpa.dll
[2010.05.30 18:50:06 | 000,397,312 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkiesc.dll
[2010.05.30 18:50:05 | 000,991,232 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkusb1.dll
[2010.05.30 18:50:05 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkpmui.dll
[2010.05.30 18:50:04 | 001,224,704 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkserv.dll
[2010.05.30 18:50:04 | 000,585,728 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbklmpm.dll
[2010.05.30 18:50:04 | 000,163,840 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkprox.dll
[2010.05.30 18:50:04 | 000,094,208 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkpplc.dll
[2010.05.30 18:50:03 | 000,696,320 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkhbn3.dll
[2010.05.30 18:50:03 | 000,684,032 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkcomc.dll
[2010.05.30 18:50:03 | 000,421,888 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkcomm.dll
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.23 18:15:06 | 001,048,576 | -HS- | M] () -- C:\Users\SeLx\NTUSER.DAT
[2010.08.23 17:51:42 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.23 17:51:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.23 17:51:16 | 3092,930,560 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.23 17:27:06 | 002,030,943 | -H-- | M] () -- C:\Users\SeLx\AppData\Local\IconCache.db
[2010.08.23 07:52:47 | 000,039,424 | ---- | M] (NirSoft) -- C:\Windows\zipinst.exe
[2010.08.23 07:12:19 | 000,524,288 | -HS- | M] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010.08.23 07:12:19 | 000,524,288 | -HS- | M] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010.08.23 07:12:19 | 000,065,536 | -HS- | M] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010.08.23 06:35:27 | 000,064,160 | ---- | M] () -- C:\Users\SeLx\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.08.23 06:34:46 | 000,000,020 | -HS- | M] () -- C:\Users\SeLx\ntuser.ini
[2010.08.23 06:18:01 | 000,024,416 | ---- | M] (Greatis Software) -- C:\Windows\SysWow64\drivers\regguard.sys
[2010.08.23 06:01:18 | 000,000,170 | ---- | M] () -- C:\Windows\SysWow64\Partizan.RRI
[2010.08.23 05:56:50 | 000,000,002 | RHS- | M] () -- C:\Windows\winstart.bat
[2010.08.23 05:56:50 | 000,000,002 | RHS- | M] () -- C:\Windows\SysWow64\CONFIG.NT
[2010.08.23 05:56:50 | 000,000,002 | RHS- | M] () -- C:\Windows\SysWow64\AUTOEXEC.NT
[2010.08.23 05:39:29 | 000,037,600 | ---- | M] (Greatis Software) -- C:\Windows\SysWow64\Partizan.exe
[2010.08.23 05:39:29 | 000,035,816 | ---- | M] (Greatis Software) -- C:\Windows\SysWow64\drivers\Partizan.sys
[2010.08.16 13:10:26 | 001,385,240 | ---- | M] (Greatis Software) -- C:\Windows\RunGuard.exe
[2010.08.16 13:10:18 | 000,020,248 | ---- | M] () -- C:\Windows\WinBait.org
[2010.08.16 13:10:18 | 000,020,248 | ---- | M] () -- C:\Windows\WinBait.exe
[2010.08.12 21:20:06 | 000,021,312 | ---- | M] (TuneUp Software) -- C:\Windows\SysWow64\authuitu.dll
[2010.08.12 21:19:54 | 000,030,016 | ---- | M] (TuneUp Software) -- C:\Windows\SysWow64\uxtuneup.dll
[2010.08.01 18:29:42 | 000,000,056 | -H-- | M] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.07.29 08:02:56 | 000,197,632 | ---- | M] (Intel(R) Corporation) -- C:\Windows\SysWow64\ir32_32.dll
[2010.07.29 08:02:07 | 000,082,944 | ---- | M] (Radius Inc.) -- C:\Windows\SysWow64\iccvid.dll
 
========== Files Created - No Company Name ==========
 
[2010.08.23 06:34:46 | 000,524,288 | -HS- | C] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010.08.23 06:34:46 | 000,524,288 | -HS- | C] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010.08.23 06:34:46 | 000,262,144 | -HS- | C] () -- C:\Users\SeLx\ntuser.dat.LOG1
[2010.08.23 06:34:46 | 000,065,536 | -HS- | C] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010.08.23 06:34:46 | 000,000,020 | -HS- | C] () -- C:\Users\SeLx\ntuser.ini
[2010.08.23 06:34:46 | 000,000,000 | -HS- | C] () -- C:\Users\SeLx\ntuser.dat.LOG2
[2010.08.23 06:34:45 | 001,048,576 | -HS- | C] () -- C:\Users\SeLx\NTUSER.DAT
[2010.08.23 05:56:50 | 000,000,002 | RHS- | C] () -- C:\Windows\winstart.bat
[2010.08.23 05:56:50 | 000,000,002 | RHS- | C] () -- C:\Windows\SysWow64\CONFIG.NT
[2010.08.23 05:45:22 | 000,000,170 | ---- | C] () -- C:\Windows\SysWow64\Partizan.RRI
[2010.08.23 05:39:58 | 000,000,002 | RHS- | C] () -- C:\Windows\SysWow64\AUTOEXEC.NT
[2010.08.23 05:38:26 | 000,057,556 | ---- | C] () -- C:\Windows\guard.bmp
[2010.08.23 05:38:25 | 000,020,248 | ---- | C] () -- C:\Windows\WinBait.org
[2010.08.23 05:38:24 | 000,020,248 | ---- | C] () -- C:\Windows\WinBait.exe
[2010.08.01 18:29:42 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.07.24 13:50:47 | 000,040,960 | ---- | C] () -- C:\Windows\SysWow64\php_mysql.dll
[2010.07.24 13:50:46 | 002,359,296 | ---- | C] () -- C:\Windows\SysWow64\libmysql.dll
[2010.07.24 13:50:46 | 000,166,912 | ---- | C] () -- C:\Windows\SysWow64\libmcrypt.dll
[2010.07.24 13:50:46 | 000,165,643 | ---- | C] () -- C:\Windows\SysWow64\libmhash.dll
[2010.07.24 13:50:46 | 000,051,008 | ---- | C] () -- C:\Windows\php.ini
[2010.07.19 19:34:40 | 001,589,248 | ---- | C] () -- C:\Windows\SysWow64\libmysql_d.dll
[2010.07.04 15:53:39 | 000,000,025 | ---- | C] () -- C:\Windows\libem.INI
[2010.06.08 19:07:37 | 000,014,848 | ---- | C] () -- C:\Windows\SysWow64\BASSMOD.dll
[2010.06.03 14:16:44 | 000,165,376 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2010.06.03 14:16:43 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2010.06.03 14:16:31 | 000,881,664 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010.06.03 14:16:31 | 000,205,824 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2010.06.03 14:16:29 | 000,000,547 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll.manifest
[2010.06.03 14:16:28 | 000,108,032 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2010.05.30 18:50:06 | 000,274,432 | ---- | C] () -- C:\Windows\SysWow64\LXBKinst.dll
[2010.05.30 18:50:05 | 000,413,696 | ---- | C] () -- C:\Windows\SysWow64\lxbkutil.dll
[2010.05.11 22:38:25 | 000,307,200 | ---- | C] () -- C:\Windows\SysWow64\AscSQLite.dll
[2010.02.11 00:05:42 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll
[2010.02.11 00:05:42 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
 
========== LOP Check ==========
 
[2010.05.10 17:43:53 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\TuneUp Software
[2010.08.23 06:33:51 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\DNA
[2010.07.30 12:47:28 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\MessengerDiscovery 2
[2010.06.17 23:04:37 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\Rainmeter
[2010.05.30 18:29:45 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\Sony
[2010.05.09 21:00:02 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\TuneUp Software
[2010.08.23 06:47:44 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Opera
[2010.08.23 06:47:35 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\TuneUp Software
[2010.07.17 18:12:23 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.08.23 06:47:48 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Adobe
[2010.08.23 06:35:07 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Identities
[2010.08.23 06:47:48 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Macromedia
[2010.08.23 07:05:25 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Malwarebytes
[2009.07.14 20:18:18 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Media Center Programs
[2010.08.23 07:17:22 | 000,000,000 | --SD | M] -- C:\Users\SeLx\AppData\Roaming\Microsoft
[2010.08.23 06:44:24 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Mozilla
[2010.08.23 06:47:44 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Opera
[2010.08.23 06:47:35 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\TuneUp Software
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_707e24689a830c30\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.16562_none_1800f942d57aa321\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_f8a21b209c42bf2b\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.16562_none_3b26342138539843\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2009.08.06 00:00:00 | 000,028,787 | ---- | M] () MD5=9517DD94BABFCCDBA18772AB41AF4A57 -- C:\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll
 
< MD5 for: IASTOR.SYS  >
[2009.06.04 18:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009.06.04 18:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysWow64\DriverStore\FileRepository\iaahci.inf_amd64_neutral_7fb62b08f6b7117a\iaStor.sys
[2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010.06.04 12:05:32 | 000,410,496 | ---- | M] (Intel Corporation) MD5=E82C8DB2D63C4F6A6A25A766C305D767 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_c9199d57075f47a9\iaStorV.sys
[2010.06.04 12:05:32 | 000,410,496 | ---- | M] (Intel Corporation) MD5=E82C8DB2D63C4F6A6A25A766C305D767 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.16562_none_0cff5e7f9e91c436\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.06.04 10:40:05 | 000,693,760 | ---- | M] (Microsoft Corporation) MD5=4870CCE9A0FB95D464C4720652702CDB -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.16562_none_5ba5c34a4ec3b1fe\netlogon.dll
[2010.06.04 09:53:16 | 000,564,736 | ---- | M] (Microsoft Corporation) MD5=8D62A9C16461EC11A96B177422274904 -- C:\Windows\SysWOW64\netlogon.dll
[2010.06.04 09:53:16 | 000,564,736 | ---- | M] (Microsoft Corporation) MD5=8D62A9C16461EC11A96B177422274904 -- C:\Windows\SysWOW64\netlogon.dll
[2010.06.04 09:53:16 | 000,564,736 | ---- | M] (Microsoft Corporation) MD5=8D62A9C16461EC11A96B177422274904 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.16562_none_65fa6d9c832473f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2010.06.04 12:05:43 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=BD1AE842E5F68477FF636856FCF1527A -- C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_c09ee40f078b4594\nvstor.sys
[2010.06.04 12:05:43 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=BD1AE842E5F68477FF636856FCF1527A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.16562_none_97c8cf2ed5c86e0e\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010.06.04 10:40:37 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=5B0B04D5646CD824AB46074E167F4F38 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.16562_none_95fbee62efe538b9\scecli.dll
[2010.06.04 09:53:38 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=CC272ABCBF23CC53F751292D3BF61D77 -- C:\Windows\SysWOW64\scecli.dll
[2010.06.04 09:53:38 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=CC272ABCBF23CC53F751292D3BF61D77 -- C:\Windows\SysWOW64\scecli.dll
[2010.06.04 09:53:38 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=CC272ABCBF23CC53F751292D3BF61D77 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.16562_none_a05098b52445fab4\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.06.04 10:41:05 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=6B179C1FB800F953757CC5F5ED42DF94 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.16562_none_2b267848842648d9\user32.dll
[2010.06.04 09:43:42 | 000,828,416 | ---- | M] (Microsoft Corporation) MD5=8BE2DDDAFE3778FF1E5C8B5802055587 -- C:\Windows\SysWOW64\user32.dll
[2010.06.04 09:43:42 | 000,828,416 | ---- | M] (Microsoft Corporation) MD5=8BE2DDDAFE3778FF1E5C8B5802055587 -- C:\Windows\SysWOW64\user32.dll
[2010.06.04 09:43:42 | 000,828,416 | ---- | M] (Microsoft Corporation) MD5=8BE2DDDAFE3778FF1E5C8B5802055587 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.16562_none_357b229ab8870ad4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.06.04 09:51:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=A1C9C01C02AF6A2C81CAC34CD5E65F9B -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.16562_none_ddf82a99301c507c\userinit.exe
[2010.06.04 10:38:08 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=FEC03AB7D1B2DB3909CB931B2D2B7C7E -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.16562_none_3a16c61ce879c1b2\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.06.04 10:38:12 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=7B8ADC7DBE1B90D4F514D5C2DAA43A02 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.16562_none_cdb10d1debbb459c\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
< End of report >
         

--- --- ---

du hast Malwarebytes genutzt? schau unter logdateien, scan logs posten.

und frisst meinen ganzen ram
hab noch was bemerkt und das wär das Malwarebytes anti malware blockt immer ne andere ip
logdatei :
10:23:23 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf QUARANTINE
10:23:24 SeLx ERROR Quarantine failed: UtilityReadFile failed with error code 3
10:33:57 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
11:03:36 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
11:13:39 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
11:23:41 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
11:33:42 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
11:43:44 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
12:03:48 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
12:23:52 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
12:43:53 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
12:53:55 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
13:03:57 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
13:13:59 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
13:24:01 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
14:07:42 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
15:44:16 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
16:24:29 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
17:24:38 SeLx DETECTION C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE Trojan.Delf DENY
17:54:24 SeLx ERROR UtilityReadFile failed with error code 2
17:54:24 SeLx MESSAGE Protection stopped

scan log :
Malwarebytes' Anti-Malware 1.46
Malwarebytes

Datenbank Version: 4466

Windows 6.1.7601 Service Pack 1, v.178
Internet Explorer 8.0.7601.16562

23.08.2010 18:37:53
mbam-log-2010-08-23 (18-37-53).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 150112
Laufzeit: 5 Minute(n), 57 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

VirusTotal - Free Online Virus, Malware and URL Scanner
prüfe dort
C:\USERS\MAIKK'S\APPDATA\ROAMING\LSASS.EXE
poste das ergebniss

den benutzer hab ich gelöscht wegem dem virus, der virus frisst meinen ganzen ram..
trozdem is er noch da.. komisch
der is jetz im system32 und virustotal findet das nich..hm.. und er findet noch ein paar dateien nich ich lösch mal..
die dateien sind:
ipremove.dll, lsasrv.dll, lsass.exe, lsm.exe, lsmproxy.dll die dateien findet er nich ich mach nen wiederherstellungs punkt und lösche die..
löschen geht nich da die im system offen is man..

was für ne meldung wird angezeigt wenn du das mit vt hochladen willst aus windows
LSASS.EXE

lsass.exe hab ich im system 32 gescannt aber da is nix schlimmes, aber ich glaub die datei nich die echte is iwo im temp drinne weil ich glaub der benutzer wurde nich richtig gelöscht kann das möglich sein ?

wenn du mit dem benutzer angemeldet bist kannst du ihn nicht löschen.
1.
nutze ccleaner:
http://www.trojaner-board.de/51464-a...-ccleaner.html
dateen + registry bereinigen
2. deaktiviere die systemwiederherstellung:
Systemwiederherstellung deaktivieren unter Vista - Windows Tipps Tricks Computer PC Hilfe
warte 5 min, schalte sie wieder ein.
3. nutze drweb cureit:
http://www.trojaner-board.de/59299-a...eb-cureit.html
vorher alle laufenden programme auch avira guard aus, internetverbindung trennen, bitte das programm im normal modus nutzen, den schnell scan abbrechen und gleich zum vollständigen über gehen, log hier hochladen
File-Upload.net
un link posten.

ich hab nen neuen benutzer erstellt und bin da rein und hab den dann gelöscht
und hier der link hxxp://www.file-upload.net/download-2769624/CureIt.log.html

hmm kannst du bitte mal ne neue otl.txt posten?

OTL Logfile:

OTL logfile created on: 24.08.2010 17:02:40 - Run 2
OTL by OldTimer - Version 3.2.10.0     Folder = C:\Users\SeLx\Downloads
64bit- Home Premium Edition Service Pack 1, v.178 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.16562)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 67,00% Memory free
9,00 Gb Paging File | 7,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): c:\pagefile.sys 5000 10000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 226,38 Gb Total Space | 182,75 Gb Free Space | 80,73% Space Free | Partition Type: NTFS
Drive D: | 226,38 Gb Total Space | 66,61 Gb Free Space | 29,42% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: WORKOUT
Current User Name: SeLx
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\SeLx\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Opera\opera.exe (Opera Software)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\SeLx\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.16562_none_41ebc47a2bd240fc\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (npggsvc) -- C:\Windows\SysNative\GameMon.des File not found
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV:64bit: - (!SASCORE) -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
SRV:64bit: - (MsMpSvc) -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
SRV - (TuneUp.Defrag) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (npggsvc) -- C:\Windows\SysWow64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (clr_optimization_v4.0.30319_64) -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (IAANTMON) Intel(R) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
SRV - (OMSI download service) -- C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (RegGuard) -- C:\Windows\SysNative\Drivers\regguard.sys File not found
DRV:64bit: - (NPPTNT2) -- C:\Windows\SysNative\npptNT2.sys File not found
DRV:64bit: - (ATP) -- C:\Windows\SysNative\DRIVERS\cmdatp.sys File not found
DRV:64bit: - (ActionReplayDS) -- C:\Windows\SysNative\drivers\ActionReplayDS_x64.sys (Thesycon GmbH, Germany)
DRV:64bit: - (vmm) -- C:\Windows\SysNative\Treiber\VMM.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (seehcri) -- C:\Windows\SysNative\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
DRV:64bit: - (taphss) -- C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc)
DRV:64bit: - (JMCR) -- C:\Windows\SysNative\drivers\jmcr.sys (JMicron Technology Corp.)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (vpcusb) -- C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation)
DRV:64bit: - (vpcbus) -- C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (AgereSoftModem) -- C:\Windows\SysNative\drivers\agrsm64.sys (LSI Corp)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (s1029unic) Sony Ericsson Device 1029 USB Ethernet Emulation (WDM) -- C:\Windows\SysNative\drivers\s1029unic.sys (MCCI Corporation)
DRV:64bit: - (s1029mgmt) Sony Ericsson Device 1029 USB WMC Device Management Drivers (WDM) -- C:\Windows\SysNative\drivers\s1029mgmt.sys (MCCI Corporation)
DRV:64bit: - (s1029obex) -- C:\Windows\SysNative\drivers\s1029obex.sys (MCCI Corporation)
DRV:64bit: - (s1029mdm) -- C:\Windows\SysNative\drivers\s1029mdm.sys (MCCI Corporation)
DRV:64bit: - (s1029nd5) Sony Ericsson Device 1029 USB Ethernet Emulation (NDIS) -- C:\Windows\SysNative\drivers\s1029nd5.sys (MCCI Corporation)
DRV:64bit: - (s1029mdfl) -- C:\Windows\SysNative\drivers\s1029mdfl.sys (MCCI Corporation)
DRV:64bit: - (s1029bus) Sony Ericsson Device 1029 driver (WDM) -- C:\Windows\SysNative\drivers\s1029bus.sys (MCCI Corporation)
DRV:64bit: - (ggsemc) -- C:\Windows\SysNative\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV:64bit: - (ggflt) -- C:\Windows\SysNative\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV:64bit: - (VPCNetS2) -- C:\Windows\SysNative\drivers\VMNetSrv.sys (Microsoft Corporation)
DRV - (RegGuard) -- C:\Windows\SysWOW64\drivers\regguard.sys (Greatis Software)
DRV - (Partizan) -- C:\Windows\system32\drivers\Partizan.sys (Greatis Software)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (cpudrv64) -- C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys ()
DRV - (NPPTNT2) -- C:\Windows\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2492281337-2513460117-458281117-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
 
FF - HKLM\software\mozilla\Minefield 4.0b3pre\extensions\\Components: C:\Program Files (x86)\Minefield\components [2010.08.22 18:55:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Minefield 4.0b4pre\extensions\\Components: C:\Program Files (x86)\Minefield\components [2010.08.22 18:55:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Minefield 4.0b5pre\extensions\\Components: C:\Program Files (x86)\Minefield\components [2010.08.22 18:55:56 | 000,000,000 | ---D | M]
 
[2010.08.23 06:44:24 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\mozilla\Extensions
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (no name) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - No CLSID value found.
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [MSSE] C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DelayedDesktopSwitchTimeout = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\S-1-5-21-2492281337-2513460117-458281117-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2492281337-2513460117-458281117-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKU\S-1-5-21-2492281337-2513460117-458281117-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKU\S-1-5-21-2492281337-2513460117-458281117-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKU\S-1-5-21-2492281337-2513460117-458281117-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKU\S-1-5-21-2492281337-2513460117-458281117-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab (Reg Error: Key error.)
O16 - DPF: {C212D449-8B3C-41F2-BD9A-047BD770550F} hxxp://www.fiaa.eu/OPLauncher.cab (Perparer Class)
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab (SysInfo Class)
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWow64\userinit.exe File not found
O20 - HKLM Winlogon: UIHost - (logonui.exe) -  File not found
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {F552DDE6-2090-4bf4-B924-6141E87789A5} - C:\PROGRA~2\Greatis\RegRunSuite\RRShell.dll (Greatis Software, LLC)
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2010.08.23 05:40:07 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010.08.23 05:40:07 | 000,000,000 | RHSD | M] - D:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (DfSDKBt) -  File not found
O34 - HKLM BootExecute: (Partizanautocheck turegopt) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^maComfort.lnk - C:\PROGRA~2\maComfort\maComfort.exe - File not found
MsConfig:64bit - StartUpFolder: C:^Users^Maikk's^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Settings.ini - C:\Users\Maikk's\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Settings.ini - File not found
MsConfig:64bit - StartUpReg: BitTorrent DNA - hkey= - key= - C:\Program Files (x86)\DNA\btdna.exe File not found
MsConfig:64bit - StartUpReg: CyberGhost VPN - hkey= - key= - C:\Program Files\S.A.D\CyberGhost VPN\Cyberghost.exe File not found
MsConfig:64bit - StartUpReg: Java JRE - hkey= - key= - C:\Users\Maikk's\AppData\Roaming\Java\javaq.exe File not found
MsConfig:64bit - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
MsConfig:64bit - StartUpReg: Microsoft Default Manager - hkey= - key= - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe File not found
MsConfig:64bit - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files (x86)\Windows Live\Messenger\MsnMsgr.Exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: Rainlendar2 - hkey= - key= - C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe File not found
MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig:64bit - StartUpReg: Sony Ericsson PC Companion - hkey= - key= - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson Mobile Communications AB)
MsConfig:64bit - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe File not found
MsConfig:64bit - StartUpReg: Windows Live Communications Platform - hkey= - key= - C:\Users\Maikk's\AppData\Roaming\Windows Media Player\msvc.exe File not found
MsConfig:64bit - State: "bootini" - Reg Error: Key error.
MsConfig:64bit - State: "startup" - Reg Error: Key error.
MsConfig:64bit - State: "services" - Reg Error: Key error.
 
SafeBootMin:64bit: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: MsMpSvc - C:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: MsMpSvc - C:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: Hamachi2Svc - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.ac3acm - C:\Windows\SysWow64\ac3acm.acm (fccHandler)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\SysWow64\lameACM.acm (hxxp://www.mp3dev.org/)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\divx.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\SysWow64\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.24 16:44:58 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Diagnostics
[2010.08.24 01:56:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QS
[2010.08.24 01:56:50 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\TeamViewer
[2010.08.24 01:53:03 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Google
[2010.08.24 00:07:05 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\VirtualStore
[2010.08.23 23:32:54 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Apps
[2010.08.23 23:01:09 | 000,000,000 | ---D | C] -- C:\Users\SeLx\Desktop\TubeBox!
[2010.08.23 23:00:54 | 000,000,000 | ---D | C] -- C:\Users\SeLx\Documents\TubeBox!
[2010.08.23 23:00:51 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\TubeBox
[2010.08.23 22:09:24 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\LogMeIn Hamachi
[2010.08.23 21:36:41 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Winamp
[2010.08.23 21:29:13 | 000,000,000 | ---D | C] -- C:\Users\SeLx\DoctorWeb
[2010.08.23 21:16:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CCleaner
[2010.08.23 20:49:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Messenger Plus!
[2010.08.23 20:49:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony Ericsson
[2010.08.23 18:19:49 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\skypePM
[2010.08.23 18:18:58 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Skype
[2010.08.23 18:18:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2010.08.23 18:18:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2010.08.23 18:17:35 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Avira
[2010.08.23 18:05:14 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.08.23 18:05:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010.08.23 08:10:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.08.23 07:52:47 | 000,039,424 | ---- | C] (NirSoft) -- C:\Windows\zipinst.exe
[2010.08.23 07:05:25 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Malwarebytes
[2010.08.23 06:47:48 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Macromedia
[2010.08.23 06:47:48 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Adobe
[2010.08.23 06:47:44 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Opera
[2010.08.23 06:47:44 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Opera
[2010.08.23 06:47:35 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\TuneUp Software
[2010.08.23 06:44:18 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Mozilla
[2010.08.23 06:44:18 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Mozilla
[2010.08.23 06:39:09 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Reshacker
[2010.08.23 06:37:32 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Musik
[2010.08.23 06:37:21 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Hompage etc
[2010.08.23 06:36:58 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Urlaub Hamburg 2010
[2010.08.23 06:36:44 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Designs etc
[2010.08.23 06:36:27 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Handy etc
[2010.08.23 06:35:16 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Searches
[2010.08.23 06:35:07 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Identities
[2010.08.23 06:35:05 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Contacts
[2010.08.23 06:34:50 | 000,000,000 | ---D | C] -- C:\Users\SeLx\Documents\RegRun2
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Vorlagen
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\AppData\Local\Verlauf
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\AppData\Local\Temporary Internet Files
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Startmenü
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\SendTo
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Recent
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Netzwerkumgebung
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Lokale Einstellungen
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Documents\Eigene Videos
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Documents\Eigene Musik
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Eigene Dateien
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Documents\Eigene Bilder
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Druckumgebung
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Cookies
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\AppData\Local\Anwendungsdaten
[2010.08.23 06:34:46 | 000,000,000 | -HSD | C] -- C:\Users\SeLx\Anwendungsdaten
[2010.08.23 06:34:45 | 000,000,000 | --SD | C] -- C:\Users\SeLx\AppData\Roaming\Microsoft
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Videos
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Saved Games
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Pictures
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Music
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Links
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Favorites
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Downloads
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Documents
[2010.08.23 06:34:45 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop
[2010.08.23 06:34:45 | 000,000,000 | -H-D | C] -- C:\Users\SeLx\AppData
[2010.08.23 06:34:45 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Temp
[2010.08.23 06:34:45 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Local\Microsoft
[2010.08.23 06:34:45 | 000,000,000 | ---D | C] -- C:\Users\SeLx\AppData\Roaming\Media Center Programs
[2010.08.23 05:45:22 | 000,000,000 | ---D | C] -- C:\Windows\RestoreSafeDeleted
[2010.08.23 05:40:39 | 000,024,416 | ---- | C] (Greatis Software) -- C:\Windows\SysWow64\drivers\regguard.sys
[2010.08.23 05:40:07 | 000,000,000 | RHSD | C] -- C:\desktop.ini
[2010.08.23 05:40:07 | 000,000,000 | RHSD | C] -- C:\comment.htt
[2010.08.23 05:40:07 | 000,000,000 | RHSD | C] -- C:\autorun.inf
[2010.08.23 05:39:29 | 000,035,816 | ---- | C] (Greatis Software) -- C:\Windows\SysWow64\drivers\Partizan.sys
[2010.08.23 05:39:28 | 000,037,600 | ---- | C] (Greatis Software) -- C:\Windows\SysWow64\Partizan.exe
[2010.08.23 05:38:26 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\regruninfo
[2010.08.23 05:38:25 | 001,385,240 | ---- | C] (Greatis Software) -- C:\Windows\RunGuard.exe
[2010.08.23 05:37:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Greatis
[2010.08.23 03:16:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Microsoft Shared
[2010.08.23 01:52:41 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE
[2010.08.23 01:52:39 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware
[2010.08.22 21:41:19 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2010.08.22 04:10:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hex-Editor MX
[2010.08.21 00:41:23 | 000,000,000 | ---D | C] -- C:\Fiaa
[2010.08.18 15:06:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Jens Lorek
[2010.08.18 01:20:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2010.08.18 00:59:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Notepad++
[2010.08.17 23:06:48 | 002,791,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer_edit_w7sba.exe
[2010.08.17 23:06:48 | 002,791,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer_backup_w7sba.exe
[2010.08.17 23:06:48 | 000,000,000 | ---D | C] -- C:\Windows\w7sba
[2010.08.17 22:57:07 | 002,870,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer_edit_w7upfc.exe
[2010.08.17 22:57:07 | 000,000,000 | ---D | C] -- C:\Windows\w7upfc
[2010.08.17 22:57:06 | 002,870,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer_backup_w7upfc.exe
[2010.08.17 20:43:07 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat
[2010.08.17 20:43:06 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Wat
[2010.08.16 16:15:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Datel
[2010.08.16 16:04:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Opera
[2010.08.16 00:08:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HDClone 3.9 Free Edition
[2010.08.16 00:05:04 | 000,197,632 | ---- | C] (Intel(R) Corporation) -- C:\Windows\SysWow64\ir32_32.dll
[2010.08.16 00:05:04 | 000,082,944 | ---- | C] (Radius Inc.) -- C:\Windows\SysWow64\iccvid.dll
[2010.08.16 00:04:34 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2010.08.16 00:04:34 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2010.08.02 02:10:55 | 000,000,000 | ---D | C] -- C:\Intel
[2010.08.01 23:10:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Famount-MT2
[2010.08.01 18:28:52 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2010.08.01 16:22:35 | 000,000,000 | ---D | C] -- C:\AeriaGames
[2010.08.01 01:01:08 | 000,000,000 | ---D | C] -- C:\xampp
[2010.07.31 19:36:33 | 000,000,000 | ---D | C] -- C:\Serverfiles_by_Profizocker94_v2
[2010.07.27 17:47:07 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Treiber
[2010.07.27 17:47:04 | 000,000,000 | ---D | C] -- C:\Programme\Virtual pc
[2010.07.26 20:50:04 | 000,000,000 | ---D | C] -- C:\mt2
[2010.07.26 13:26:28 | 000,000,000 | R--D | C] -- C:\Users\SeLx\Desktop\Hochzeit 2010 selcuk&serap
[2010.05.30 18:50:06 | 000,413,696 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkinpa.dll
[2010.05.30 18:50:06 | 000,397,312 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkiesc.dll
[2010.05.30 18:50:05 | 000,991,232 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkusb1.dll
[2010.05.30 18:50:05 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkpmui.dll
[2010.05.30 18:50:04 | 001,224,704 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkserv.dll
[2010.05.30 18:50:04 | 000,585,728 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbklmpm.dll
[2010.05.30 18:50:04 | 000,163,840 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkprox.dll
[2010.05.30 18:50:04 | 000,094,208 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkpplc.dll
[2010.05.30 18:50:03 | 000,696,320 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkhbn3.dll
[2010.05.30 18:50:03 | 000,684,032 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkcomc.dll
[2010.05.30 18:50:03 | 000,421,888 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbkcomm.dll
[7 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.24 17:08:57 | 001,048,576 | -HS- | M] () -- C:\Users\SeLx\NTUSER.DAT
[2010.08.24 16:47:39 | 000,013,440 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.08.24 16:47:39 | 000,013,440 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.08.24 16:45:44 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.08.24 16:45:44 | 000,655,842 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.08.24 16:45:44 | 000,616,682 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.08.24 16:45:44 | 000,130,722 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.08.24 16:45:44 | 000,107,062 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.08.24 16:40:11 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.24 16:40:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.24 16:40:02 | 3092,930,560 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.24 03:53:40 | 001,986,709 | -H-- | M] () -- C:\Users\SeLx\AppData\Local\IconCache.db
[2010.08.24 01:56:20 | 002,920,016 | ---- | M] () -- C:\Users\SeLx\Desktop\TeamViewer_Setup.exe
[2010.08.23 23:16:12 | 001,108,480 | ---- | M] () -- C:\Users\SeLx\Desktop\Windows_Live_Messenger.exe
[2010.08.23 07:52:47 | 000,039,424 | ---- | M] (NirSoft) -- C:\Windows\zipinst.exe
[2010.08.23 07:12:19 | 000,524,288 | -HS- | M] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010.08.23 07:12:19 | 000,524,288 | -HS- | M] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010.08.23 07:12:19 | 000,065,536 | -HS- | M] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010.08.23 06:35:27 | 000,064,160 | ---- | M] () -- C:\Users\SeLx\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.08.23 06:34:46 | 000,000,020 | -HS- | M] () -- C:\Users\SeLx\ntuser.ini
[2010.08.23 06:18:01 | 000,024,416 | ---- | M] (Greatis Software) -- C:\Windows\SysWow64\drivers\regguard.sys
[2010.08.23 06:01:18 | 000,000,170 | ---- | M] () -- C:\Windows\SysWow64\Partizan.RRI
[2010.08.23 05:56:50 | 000,000,002 | RHS- | M] () -- C:\Windows\winstart.bat
[2010.08.23 05:56:50 | 000,000,002 | RHS- | M] () -- C:\Windows\SysWow64\CONFIG.NT
[2010.08.23 05:56:50 | 000,000,002 | RHS- | M] () -- C:\Windows\SysWow64\AUTOEXEC.NT
[2010.08.23 05:39:29 | 000,037,600 | ---- | M] (Greatis Software) -- C:\Windows\SysWow64\Partizan.exe
[2010.08.23 05:39:29 | 000,035,816 | ---- | M] (Greatis Software) -- C:\Windows\SysWow64\drivers\Partizan.sys
[2010.08.22 18:02:20 | 000,291,720 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2010.08.16 17:48:08 | 000,051,600 | ---- | M] (Thesycon GmbH, Germany) -- C:\Windows\SysNative\drivers\ActionReplayDS_x64.sys
[2010.08.16 13:10:26 | 001,385,240 | ---- | M] (Greatis Software) -- C:\Windows\RunGuard.exe
[2010.08.16 13:10:18 | 000,020,248 | ---- | M] () -- C:\Windows\WinBait.org
[2010.08.16 13:10:18 | 000,020,248 | ---- | M] () -- C:\Windows\WinBait.exe
[2010.08.12 21:25:58 | 000,034,624 | ---- | M] (TuneUp Software) -- C:\Windows\SysNative\TURegOpt.exe
[2010.08.12 21:20:12 | 000,025,920 | ---- | M] (TuneUp Software) -- C:\Windows\SysNative\authuitu.dll
[2010.08.12 21:20:06 | 000,021,312 | ---- | M] (TuneUp Software) -- C:\Windows\SysWow64\authuitu.dll
[2010.08.12 21:20:02 | 000,036,160 | ---- | M] (TuneUp Software) -- C:\Windows\SysNative\uxtuneup.dll
[2010.08.12 21:19:54 | 000,030,016 | ---- | M] (TuneUp Software) -- C:\Windows\SysWow64\uxtuneup.dll
[2010.08.02 14:23:38 | 000,015,180 | ---- | M] () -- C:\Windows\SysNative\results.xml
[2010.08.01 18:29:42 | 000,000,056 | -H-- | M] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.07.29 08:02:56 | 000,197,632 | ---- | M] (Intel(R) Corporation) -- C:\Windows\SysWow64\ir32_32.dll
[2010.07.29 08:02:07 | 000,082,944 | ---- | M] (Radius Inc.) -- C:\Windows\SysWow64\iccvid.dll
[7 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.08.24 01:56:19 | 002,920,016 | ---- | C] () -- C:\Users\SeLx\Desktop\TeamViewer_Setup.exe
[2010.08.23 23:16:08 | 001,108,480 | ---- | C] () -- C:\Users\SeLx\Desktop\Windows_Live_Messenger.exe
[2010.08.23 06:34:46 | 000,524,288 | -HS- | C] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010.08.23 06:34:46 | 000,524,288 | -HS- | C] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010.08.23 06:34:46 | 000,262,144 | -HS- | C] () -- C:\Users\SeLx\ntuser.dat.LOG1
[2010.08.23 06:34:46 | 000,065,536 | -HS- | C] () -- C:\Users\SeLx\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010.08.23 06:34:46 | 000,000,020 | -HS- | C] () -- C:\Users\SeLx\ntuser.ini
[2010.08.23 06:34:46 | 000,000,000 | -HS- | C] () -- C:\Users\SeLx\ntuser.dat.LOG2
[2010.08.23 06:34:45 | 001,048,576 | -HS- | C] () -- C:\Users\SeLx\NTUSER.DAT
[2010.08.23 05:56:50 | 000,000,002 | RHS- | C] () -- C:\Windows\winstart.bat
[2010.08.23 05:56:50 | 000,000,002 | RHS- | C] () -- C:\Windows\SysWow64\CONFIG.NT
[2010.08.23 05:45:22 | 000,000,170 | ---- | C] () -- C:\Windows\SysWow64\Partizan.RRI
[2010.08.23 05:39:58 | 000,000,002 | RHS- | C] () -- C:\Windows\SysWow64\AUTOEXEC.NT
[2010.08.23 05:38:26 | 000,057,556 | ---- | C] () -- C:\Windows\guard.bmp
[2010.08.23 05:38:25 | 000,020,248 | ---- | C] () -- C:\Windows\WinBait.org
[2010.08.23 05:38:24 | 000,020,248 | ---- | C] () -- C:\Windows\WinBait.exe
[2010.08.01 18:29:42 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.07.24 13:50:47 | 000,040,960 | ---- | C] () -- C:\Windows\SysWow64\php_mysql.dll
[2010.07.24 13:50:46 | 002,359,296 | ---- | C] () -- C:\Windows\SysWow64\libmysql.dll
[2010.07.24 13:50:46 | 000,166,912 | ---- | C] () -- C:\Windows\SysWow64\libmcrypt.dll
[2010.07.24 13:50:46 | 000,165,643 | ---- | C] () -- C:\Windows\SysWow64\libmhash.dll
[2010.07.24 13:50:46 | 000,051,008 | ---- | C] () -- C:\Windows\php.ini
[2010.07.19 19:34:40 | 001,589,248 | ---- | C] () -- C:\Windows\SysWow64\libmysql_d.dll
[2010.07.04 15:53:39 | 000,000,025 | ---- | C] () -- C:\Windows\libem.INI
[2010.06.08 19:07:37 | 000,014,848 | ---- | C] () -- C:\Windows\SysWow64\BASSMOD.dll
[2010.06.03 14:16:44 | 000,165,376 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2010.06.03 14:16:43 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2010.06.03 14:16:31 | 000,881,664 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010.06.03 14:16:31 | 000,205,824 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2010.06.03 14:16:29 | 000,000,547 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll.manifest
[2010.06.03 14:16:28 | 000,108,032 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2010.05.30 18:50:06 | 000,274,432 | ---- | C] () -- C:\Windows\SysWow64\LXBKinst.dll
[2010.05.30 18:50:05 | 000,413,696 | ---- | C] () -- C:\Windows\SysWow64\lxbkutil.dll
[2010.05.11 22:38:25 | 000,307,200 | ---- | C] () -- C:\Windows\SysWow64\AscSQLite.dll
[2010.02.11 00:05:42 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll
[2010.02.11 00:05:42 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
 
========== LOP Check ==========
 
[2010.05.10 17:43:53 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\TuneUp Software
[2010.08.23 21:13:21 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\DNA
[2010.07.30 12:47:28 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\MessengerDiscovery 2
[2010.06.17 23:04:37 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\Rainmeter
[2010.05.30 18:29:45 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\Sony
[2010.05.09 21:00:02 | 000,000,000 | ---D | M] -- C:\Users\Olga\AppData\Roaming\TuneUp Software
[2010.08.23 06:47:44 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Opera
[2010.08.24 01:59:01 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\TeamViewer
[2010.08.23 23:00:51 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\TubeBox
[2010.08.23 06:47:35 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\TuneUp Software
[2010.07.17 18:12:23 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.08.23 06:47:48 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Adobe
[2010.08.23 18:17:35 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Avira
[2010.08.23 06:35:07 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Identities
[2010.08.23 06:47:48 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Macromedia
[2010.08.23 07:05:25 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Malwarebytes
[2009.07.14 20:18:18 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Media Center Programs
[2010.08.24 00:05:33 | 000,000,000 | --SD | M] -- C:\Users\SeLx\AppData\Roaming\Microsoft
[2010.08.23 06:44:24 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Mozilla
[2010.08.23 06:47:44 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Opera
[2010.08.24 17:07:50 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Skype
[2010.08.24 16:48:34 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\skypePM
[2010.08.24 01:59:01 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\TeamViewer
[2010.08.23 23:00:51 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\TubeBox
[2010.08.23 06:47:35 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\TuneUp Software
[2010.08.23 22:07:09 | 000,000,000 | ---D | M] -- C:\Users\SeLx\AppData\Roaming\Winamp
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_707e24689a830c30\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.16562_none_1800f942d57aa321\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_f8a21b209c42bf2b\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.16562_none_3b26342138539843\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2009.08.06 00:00:00 | 000,028,787 | ---- | M] () MD5=9517DD94BABFCCDBA18772AB41AF4A57 -- C:\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll
 
< MD5 for: IASTOR.SYS  >
[2009.06.04 18:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009.06.04 18:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysWow64\DriverStore\FileRepository\iaahci.inf_amd64_neutral_7fb62b08f6b7117a\iaStor.sys
[2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010.06.04 12:05:32 | 000,410,496 | ---- | M] (Intel Corporation) MD5=E82C8DB2D63C4F6A6A25A766C305D767 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_c9199d57075f47a9\iaStorV.sys
[2010.06.04 12:05:32 | 000,410,496 | ---- | M] (Intel Corporation) MD5=E82C8DB2D63C4F6A6A25A766C305D767 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.16562_none_0cff5e7f9e91c436\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.06.04 10:40:05 | 000,693,760 | ---- | M] (Microsoft Corporation) MD5=4870CCE9A0FB95D464C4720652702CDB -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.16562_none_5ba5c34a4ec3b1fe\netlogon.dll
[2010.06.04 09:53:16 | 000,564,736 | ---- | M] (Microsoft Corporation) MD5=8D62A9C16461EC11A96B177422274904 -- C:\Windows\SysWOW64\netlogon.dll
[2010.06.04 09:53:16 | 000,564,736 | ---- | M] (Microsoft Corporation) MD5=8D62A9C16461EC11A96B177422274904 -- C:\Windows\SysWOW64\netlogon.dll
[2010.06.04 09:53:16 | 000,564,736 | ---- | M] (Microsoft Corporation) MD5=8D62A9C16461EC11A96B177422274904 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.16562_none_65fa6d9c832473f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2010.06.04 12:05:43 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=BD1AE842E5F68477FF636856FCF1527A -- C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_c09ee40f078b4594\nvstor.sys
[2010.06.04 12:05:43 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=BD1AE842E5F68477FF636856FCF1527A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.16562_none_97c8cf2ed5c86e0e\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010.06.04 10:40:37 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=5B0B04D5646CD824AB46074E167F4F38 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.16562_none_95fbee62efe538b9\scecli.dll
[2010.06.04 09:53:38 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=CC272ABCBF23CC53F751292D3BF61D77 -- C:\Windows\SysWOW64\scecli.dll
[2010.06.04 09:53:38 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=CC272ABCBF23CC53F751292D3BF61D77 -- C:\Windows\SysWOW64\scecli.dll
[2010.06.04 09:53:38 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=CC272ABCBF23CC53F751292D3BF61D77 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.16562_none_a05098b52445fab4\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.06.04 10:41:05 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=6B179C1FB800F953757CC5F5ED42DF94 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.16562_none_2b267848842648d9\user32.dll
[2010.06.04 09:43:42 | 000,828,416 | ---- | M] (Microsoft Corporation) MD5=8BE2DDDAFE3778FF1E5C8B5802055587 -- C:\Windows\SysWOW64\user32.dll
[2010.06.04 09:43:42 | 000,828,416 | ---- | M] (Microsoft Corporation) MD5=8BE2DDDAFE3778FF1E5C8B5802055587 -- C:\Windows\SysWOW64\user32.dll
[2010.06.04 09:43:42 | 000,828,416 | ---- | M] (Microsoft Corporation) MD5=8BE2DDDAFE3778FF1E5C8B5802055587 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.16562_none_357b229ab8870ad4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.06.04 09:51:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=A1C9C01C02AF6A2C81CAC34CD5E65F9B -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.16562_none_ddf82a99301c507c\userinit.exe
[2010.06.04 10:38:08 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=FEC03AB7D1B2DB3909CB931B2D2B7C7E -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.16562_none_3a16c61ce879c1b2\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.06.04 10:38:12 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=7B8ADC7DBE1B90D4F514D5C2DAA43A02 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.16562_none_cdb10d1debbb459c\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
< End of report >
         

--- --- ---

• Starte bitte die OTL.exe.
Vista-User mit Rechtsklick "als Administrator starten"
• Kopiere nun das Folgende in die Textbox.

:OTL
[2010.08.23 05:56:50 | 000,000,002 | RHS- | M] () -- C:\Windows\winstart.bat
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument dieses posten