Hallo Freunde,
ich benutze Windows 7 und habe folgendes Problem:

Gestern hatte ich die Meldung "Windows wird in einer Minute heruntergefahren", was dann auch passierte. Er startete neu. Das System lief dann zwar wieder, aber irgendwie anders. Der Taskmanager ist verschwunden, kann ihn auch nicht mehr durch die Registry anstellen. Außerdem arbeitet der PC ohne Ende obwohl kein Programm geöffnet ist. Ständig das Ladezeichen neben der Maus. Mein Internet Explorer stürzt auch andauernd ab.(Nutze Firefox)
Windows sagte mir dann noch das ein Virus gefunden wurde namens Kelihos oder so. Hab bei google aber nix darüber gefunden und die Datei entfernt.

Was meint ihr? Würde mich über eine Antwort freuen.
LG

Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
beide posten.

OTL:OTL Logfile:

OTL logfile created on: 22.12.2010 14:46:04 - Run 1
OTL by OldTimer - Version 3.2.18.0     Folder = C:\Users\Tobi\Desktop
64bit- An unknown product  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,00 Gb Available Physical Memory | 18,00% Memory free
4,00 Gb Paging File | 1,00 Gb Available in Paging File | 14,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,80 Gb Total Space | 14,03 Gb Free Space | 12,55% Space Free | Partition Type: NTFS
Drive D: | 6,31 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: TOBIS-RECHNER | User Name: Tobi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Tobi\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Tobi\AppData\Roaming\56880\mscjm.exe (Microsoft)
PRC - C:\Users\Tobi\AppData\Roaming\56880\mscj.exe (Microsoft)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Spiele\NBA2k11\nba2k11.exe (2K Sports)
PRC - C:\Users\Tobi\AppData\Roaming\Bazay\kexeo.exe (G Data Software AG)
PRC - C:\Program Files (x86)\QIP 2010\qip.exe (QIP)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Cheat Engine\Cheat Engine.exe ()
PRC - C:\Program Files (x86)\Java\jre6\bin\jp2launcher.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files (x86)\ICQ Away Reader\ICQ Away Reader.exe (murb.com)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\RapidSolution\Scramby\ScrambyServer.exe (RapidSolution Software AG)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Tobi\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wkscli.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\normaliz.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (PnkBstrA) -- C:\Windows\SysNative\PnkBstrA.exe File not found
SRV:64bit: - (vvdsvc) -- C:\Windows\SysNative\nagasoft\vjocx.dll (NanJing Nagasoft Co, LTD.)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (Apple Mobile Device) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (vvdsvc) -- C:\Windows\SysWOW64\nagasoft\vjocx.dll (NanJing Nagasoft Co, LTD.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (SBSDWSCService) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (ScrambyServer) -- C:\Program Files (x86)\RapidSolution\Scramby\ScrambyServer.exe (RapidSolution Software AG)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (mdp2efc) -- C:\Windows\SysNative\drivers\mdp2efc.sys ()
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (cpuz134) -- C:\Windows\SysNative\drivers\cpuz134_x64.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (ScreamBAudioSvc) -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys (Screaming Bee LLC)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (xnacc) -- C:\Windows\SysNative\drivers\xnacc.sys (Microsoft Corporation)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (NuidFltr) -- C:\Windows\SysNative\drivers\nuidfltr.sys (Microsoft Corporation)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (VCSVADHWSer) Avnex Virtual Audio Device (WDM) -- C:\Windows\SysNative\drivers\vcsvad.sys (Avnex)
DRV:64bit: - (scramby_out) -- C:\Windows\SysNative\drivers\scramby_out.sys (RapidSolution Software AG)
DRV:64bit: - (scramby) -- C:\Windows\SysNative\drivers\scramby.sys (RapidSolution Software AG)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = QIP: ????? ? ?????????
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = QIP: ????? ? ?????????
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = QIP: ????? ? ?????????
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Ask.com Search Engine - Better Web Search
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B5 3B 2A AB 28 6E CA 01  [binary data]
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = QIP: ????? ? ?????????
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\..\URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\Tobi\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.yodl.de/href.php?hrefname=FF-splug_google&q="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.1.0014
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.5
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: eafo3fflauncher@ea.com:1.1
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.12.16 01:22:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.12.11 18:51:05 | 000,000,000 | ---D | M]
 
[2009.11.12 22:52:45 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\mozilla\Extensions
[2010.12.22 13:57:28 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\mozilla\Firefox\Profiles\3mnowx1v.default\extensions
[2009.12.02 19:58:07 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Tobi\AppData\Roaming\mozilla\Firefox\Profiles\3mnowx1v.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.05.07 14:26:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tobi\AppData\Roaming\mozilla\Firefox\Profiles\3mnowx1v.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2009.12.08 14:59:23 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\mozilla\Firefox\Profiles\3mnowx1v.default\extensions\DTToolbar@toolbarnet.com
[2010.09.18 03:06:43 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\mozilla\Firefox\Profiles\3mnowx1v.default\extensions\eafo3fflauncher@ea.com
[2010.08.16 21:27:15 | 000,002,384 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\askcom.xml
[2009.12.31 13:21:47 | 000,002,080 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\bing.xml
[2009.12.08 14:59:12 | 000,002,055 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\daemon-search.xml
[2010.12.16 14:18:09 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-1.xml
[2010.09.09 21:21:30 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-10.xml
[2010.11.14 09:14:54 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-11.xml
[2010.12.11 18:51:18 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-12.xml
[2010.03.06 15:28:20 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-2.xml
[2010.03.24 16:58:52 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-3.xml
[2010.04.02 20:01:23 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-4.xml
[2010.04.28 20:27:27 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-5.xml
[2010.06.25 02:12:43 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-6.xml
[2010.07.21 19:12:23 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-7.xml
[2010.07.25 15:49:36 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-8.xml
[2010.08.17 18:06:51 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-9.xml
[2008.03.31 09:52:00 | 000,000,168 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin.gif
[2008.03.31 09:52:00 | 000,000,618 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin.src
[2010.02.12 21:45:05 | 000,000,955 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin.xml
[2009.12.31 13:21:47 | 000,002,058 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\qipsearch.xml
[2010.12.22 13:57:28 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2009.12.24 00:06:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.11.14 09:14:44 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2009.12.23 23:23:25 | 000,001,779 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\clipfish.xml
[2009.12.23 23:23:25 | 000,001,013 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\conrad.xml
[2009.12.23 23:23:25 | 000,002,487 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\discount24.xml
[2010.11.14 09:14:44 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.11.14 09:14:44 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2009.12.23 23:23:25 | 000,001,047 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\musicload.xml
[2009.12.23 23:23:25 | 000,002,120 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\myvideo.xml
[2009.12.23 23:23:25 | 000,002,023 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\otto.xml
[2009.12.23 23:23:25 | 000,000,758 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\quelle.xml
[2009.12.23 23:23:25 | 000,001,329 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\telefonbuch-de.xml
[2010.11.14 09:14:44 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.11.14 09:14:44 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-de.xml
[2009.12.23 23:23:25 | 000,005,375 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\yodl.xml
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Programme\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\Tobi\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3 - HKLM\..\Toolbar: (no name) - {081230F8-EA50-42A9-983C-D22ABC2EED3B} - No CLSID value found.
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKU\S-1-5-21-737334471-58013836-1855596642-1000\..\Toolbar\WebBrowser: (no name) - {081230F8-EA50-42A9-983C-D22ABC2EED3B} - No CLSID value found.
O3:64bit: - HKU\S-1-5-21-737334471-58013836-1855596642-1000\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3 - HKU\S-1-5-21-737334471-58013836-1855596642-1000\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: [nonep] C:\Users\Tobi\AppData\Local\Temp\tmpe80abe5f\aport.exe File not found
O4 - HKLM..\Run: [POEngine]  File not found
O4 - HKLM..\Run: [SmartIndex] C:\Windows\Temp\_ex-08.exe File not found
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [{4674891F-0755-3CF7-C5D1-FD5E03489693}] C:\Users\Tobi\AppData\Roaming\Bazay\kexeo.exe (G Data Software AG)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [mscj] c:\users\tobi\appdata\roaming\56880\mscj.exe (Microsoft)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [mscj.exe] C:\Users\Tobi\AppData\Roaming\56880\mscj.exe (Microsoft)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [mscjm] c:\users\tobi\appdata\roaming\56880\mscjm.exe (Microsoft)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [mscjm.exe] C:\Users\Tobi\AppData\Roaming\56880\mscjm.exe (Microsoft)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [rasCommonhid] C:\Users\Tobi\AppData\Local\Sysobjnet\rasCommonhid.DLL ()
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8:64bit: - Extra context menu item: &FreeRIP Search - C:\Program Files (x86)\FreeRIP3\toolband.dll ()
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Tobi\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: &FreeRIP Search - C:\Program Files (x86)\FreeRIP3\toolband.dll ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Tobi\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPLive.exe ()
O9 - Extra 'Tools' menuitem : PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPLive.exe ()
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe File not found
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} Vexcast.com - Stream Yourself - All Stream (VodClient Control Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.09.10 22:33:59 | 000,000,000 | R--D | M] - D:\AutoRun -- [ UDF ]
O32 - AutoRun File - [2010.09.10 22:34:03 | 000,439,056 | R--- | M] (Electronic Arts) - D:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2010.09.10 22:34:02 | 007,864,832 | R--- | M] () - D:\autorun.dat -- [ UDF ]
O32 - AutoRun File - [2010.09.10 22:33:38 | 000,000,141 | R--- | M] () - D:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{23383851-e402-11de-8fe8-001fd0917f43}\Shell - "" = AutoRun
O33 - MountPoints2\{23383851-e402-11de-8fe8-001fd0917f43}\Shell\AutoRun\command - "" = F:\Autorun.exe -- File not found
O33 - MountPoints2\{dc0af11d-cfcc-11de-826a-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{dc0af11d-cfcc-11de-826a-806e6f6e6963}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2010.09.10 22:34:03 | 000,439,056 | R--- | M] (Electronic Arts)
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\AUTOSTARTER.EXE -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: dxdishta - (C:\Windows\system32\pbsvtend.dll) - C:\Windows\SysWOW64\pbsvtend.dll ()
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpFolder: C:^Users^Tobi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CurseClientStartup.ccip - C:\Users\Tobi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip - File not found
MsConfig:64bit - StartUpFolder: C:^Users^Tobi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: avgnt - hkey= - key= - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe File not found
MsConfig:64bit - StartUpReg: DAEMON Tools Lite - hkey= - key= - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
MsConfig:64bit - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MsConfig:64bit - StartUpReg: ICQ - hkey= - key= - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
MsConfig:64bit - StartUpReg: Infium - hkey= - key= - C:\Program Files (x86)\QIP 2010\qip.exe (QIP)
MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe File not found
MsConfig:64bit - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: RayV - hkey= - key= - C:\Program Files (x86)\RayV\RayV\RayV.exe (RayV)
MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Spiele\Steam\Steam.exe (Valve Corporation)
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
MsConfig:64bit - State: "startup" - Reg Error: Key error.
MsConfig:64bit - State: "services" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32:64bit: VIDC.XFR1 - xfcodec64.dll ()
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\SysWow64\lhacm.acm (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.22 14:43:22 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Tobi\Desktop\OTL.exe
[2010.12.22 02:00:49 | 000,112,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe
[2010.12.22 01:59:27 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2010.12.22 01:59:26 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2010.12.22 01:59:26 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2010.12.22 01:59:26 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2010.12.22 01:59:26 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2010.12.22 01:59:26 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2010.12.22 01:59:26 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2010.12.22 01:59:26 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2010.12.22 01:59:26 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2010.12.22 01:59:26 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2010.12.22 01:59:26 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2010.12.22 01:59:26 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2010.12.22 01:59:26 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2010.12.22 01:59:26 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2010.12.22 01:55:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2010.12.22 01:55:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2010.12.22 01:51:52 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2010.12.22 01:28:47 | 000,000,000 | ---D | C] -- C:\Users\Tobi\AppData\Local\Sysobjnet
[2010.12.22 01:28:40 | 000,000,000 | ---D | C] -- C:\Users\Tobi\AppData\Roaming\56880
[2010.12.22 00:18:25 | 064,818,688 | ---- | C] (2K Sports) -- C:\Users\Tobi\Desktop\nba2k11.exe
[2010.12.17 16:03:17 | 000,000,000 | ---D | C] -- C:\Users\Tobi\AppData\Local\AOL
[2010.12.17 16:03:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ7.2
[2010.12.16 19:54:28 | 000,000,000 | ---D | C] -- C:\Users\Tobi\Desktop\cod1
[2010.12.11 15:57:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2010.12.09 09:09:40 | 000,000,000 | ---D | C] -- C:\Users\Tobi\Desktop\Studium
[2010.12.03 20:25:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Deep Silver
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.22 14:43:38 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Tobi\Desktop\OTL.exe
[2010.12.22 13:43:47 | 000,048,128 | -H-- | M] () -- C:\Windows\SysWow64\pbsvtend.dll
[2010.12.22 13:38:15 | 001,527,098 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.12.22 13:38:15 | 000,664,396 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.12.22 13:38:15 | 000,624,578 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.12.22 13:38:15 | 000,134,564 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.12.22 13:38:15 | 000,110,216 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.12.22 13:36:58 | 000,020,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.12.22 13:36:58 | 000,020,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.12.22 13:31:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.12.22 13:31:43 | 1609,424,896 | -HS- | M] () -- C:\hiberfil.sys
[2010.12.22 01:56:06 | 000,001,214 | ---- | M] () -- C:\Users\Tobi\Desktop\Spybot - Search & Destroy.lnk
[2010.12.22 01:52:03 | 000,385,024 | ---- | M] () -- C:\Users\Tobi\AppData\Local\zdglyt.exe
[2010.12.22 01:45:09 | 000,048,640 | -H-- | M] () -- C:\Windows\pbsvtend.dll
[2010.12.22 01:37:06 | 000,000,034 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini
[2010.12.21 21:36:22 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\World of Warcraft.lnk
[2010.12.21 04:16:27 | 000,008,639 | ---- | M] () -- C:\Users\Tobi\Desktop\Raclette.odt
[2010.12.21 03:46:09 | 000,138,272 | ---- | M] () -- C:\Windows\SysNative\drivers\mdp2efc.sys
[2010.12.20 08:32:18 | 000,008,380 | ---- | M] () -- C:\Users\Tobi\Desktop\Projekt.ods
[2010.12.09 20:35:48 | 000,232,326 | ---- | M] () -- C:\Users\Tobi\Desktop\CIMG0251.JPG
[2010.12.09 20:35:48 | 000,002,140 | ---- | M] () -- C:\Users\Tobi\.recently-used.xbel
[2010.12.03 20:29:28 | 000,002,137 | ---- | M] () -- C:\Users\Public\Desktop\Geheimakte Tunguska.lnk
[2010.12.03 20:29:21 | 000,310,984 | ---- | M] () -- C:\Windows\SysNative\drivers\atksgt.sys
[2010.11.30 21:12:11 | 000,013,149 | ---- | M] () -- C:\Users\Tobi\Desktop\BUch.odt
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.12.22 01:56:06 | 000,001,214 | ---- | C] () -- C:\Users\Tobi\Desktop\Spybot - Search & Destroy.lnk
[2010.12.22 01:52:03 | 000,385,024 | ---- | C] () -- C:\Users\Tobi\AppData\Local\zdglyt.exe
[2010.12.22 01:45:09 | 000,048,640 | -H-- | C] () -- C:\Windows\pbsvtend.dll
[2010.12.22 01:41:12 | 000,048,128 | -H-- | C] () -- C:\Windows\SysWow64\pbsvtend.dll
[2010.12.21 04:14:58 | 000,008,639 | ---- | C] () -- C:\Users\Tobi\Desktop\Raclette.odt
[2010.12.21 03:46:09 | 000,138,272 | ---- | C] () -- C:\Windows\SysNative\drivers\mdp2efc.sys
[2010.12.10 23:20:32 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\World of Warcraft.lnk
[2010.12.09 20:35:48 | 000,232,326 | ---- | C] () -- C:\Users\Tobi\Desktop\CIMG0251.JPG
[2010.12.09 20:35:48 | 000,002,140 | ---- | C] () -- C:\Users\Tobi\.recently-used.xbel
[2010.12.03 20:29:28 | 000,002,137 | ---- | C] () -- C:\Users\Public\Desktop\Geheimakte Tunguska.lnk
[2010.11.30 20:40:28 | 000,013,149 | ---- | C] () -- C:\Users\Tobi\Desktop\BUch.odt
[2010.11.21 00:28:45 | 000,000,073 | ---- | C] () -- C:\Windows\cdplayer.ini
[2010.11.20 23:44:22 | 000,001,302 | ---- | C] () -- C:\ProgramData\ss.ini
[2010.11.20 23:44:09 | 000,000,034 | ---- | C] () -- C:\Users\Tobi\AppData\Roaming\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini
[2010.11.20 23:43:57 | 000,000,033 | ---- | C] () -- C:\ProgramData\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini
[2010.11.15 02:41:32 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2010.10.14 01:36:44 | 000,179,263 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2010.08.10 16:18:12 | 000,001,793 | ---- | C] () -- C:\Windows\TSearch.INI
[2010.07.26 17:27:51 | 000,003,584 | ---- | C] () -- C:\Users\Tobi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.02.17 22:51:00 | 000,000,000 | ---- | C] () -- C:\Windows\Editor.INI
[2010.01.18 09:37:31 | 001,970,176 | ---- | C] () -- C:\Windows\SysWow64\d3dx9.dll
[2009.12.18 03:45:48 | 000,000,092 | ---- | C] () -- C:\Users\Tobi\AppData\Local\fusioncache.dat
[2009.11.19 18:58:26 | 000,290,816 | ---- | C] () -- C:\Windows\SysWow64\decdll.dll
[2009.11.16 00:25:36 | 001,526,730 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2007.02.22 16:17:50 | 000,000,071 | ---- | C] () -- C:\Windows\pn.ini
[2007.02.22 16:17:50 | 000,000,051 | ---- | C] () -- C:\Windows\pr.ini
[2002.08.13 16:04:12 | 000,217,088 | R--- | C] () -- C:\Users\Tobi\AppData\Roaming\MafiaSetup.exe
 
========== LOP Check ==========
 
[2010.12.06 11:42:31 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\2K Sports
[2010.10.07 18:12:48 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\2K Sports
[2010.12.22 01:36:46 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\56880
[2010.06.09 14:46:42 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Audacity
[2010.03.11 19:23:39 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Avnex
[2010.08.24 01:13:52 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Bazay
[2009.11.27 16:07:49 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Canneverbe_Limited
[2009.12.08 15:48:32 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\DAEMON Tools Lite
[2010.05.20 16:35:42 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.07.27 01:18:42 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\FreeVideoConverter
[2010.03.11 19:15:51 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\GetRightToGo
[2010.12.09 20:35:48 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\gtk-2.0
[2010.12.19 23:09:08 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\ICQ
[2010.03.20 01:30:22 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Leadertech
[2009.12.23 23:20:13 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\McLoad
[2009.12.23 23:28:23 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\OCS
[2009.11.18 20:18:57 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\OpenOffice.org
[2009.12.23 23:28:26 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Opera
[2009.11.24 00:39:02 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\PPLive
[2010.06.15 22:41:21 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\QIP
[2010.06.16 03:37:18 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\RayV
[2010.03.11 19:28:31 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Screaming Bee
[2009.11.19 21:44:43 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Sony
[2010.05.07 04:20:10 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\temp
[2010.02.18 01:54:45 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\TS3Client
[2009.12.18 03:52:22 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Turbine
[2010.01.02 21:16:44 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Ubisoft
[2010.12.22 14:41:41 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Zota
[2010.10.13 12:09:42 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.10.07 18:12:48 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\2K Sports
[2010.12.22 01:36:46 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\56880
[2010.03.16 00:07:48 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Adobe
[2009.11.18 20:53:59 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Apple Computer
[2010.06.09 14:46:42 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Audacity
[2010.03.11 19:23:39 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Avnex
[2010.08.24 01:13:52 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Bazay
[2009.11.27 16:07:49 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Canneverbe_Limited
[2009.12.08 15:48:32 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\DAEMON Tools Lite
[2010.07.14 19:05:43 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\DivX
[2010.05.20 16:35:42 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.07.27 01:18:42 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\FreeVideoConverter
[2010.03.11 19:15:51 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\GetRightToGo
[2010.12.09 20:35:48 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\gtk-2.0
[2010.02.23 23:12:33 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Hamachi
[2010.12.19 23:09:08 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\ICQ
[2009.11.12 21:58:31 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Identities
[2010.03.20 01:30:22 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Leadertech
[2009.11.12 23:06:19 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Macromedia
[2009.12.23 23:20:13 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\McLoad
[2009.07.14 19:18:34 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Media Center Programs
[2010.11.20 05:24:50 | 000,000,000 | --SD | M] -- C:\Users\Tobi\AppData\Roaming\Microsoft
[2010.05.08 15:54:37 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\mIRC
[2009.11.12 22:52:45 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Mozilla
[2010.07.23 14:12:47 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Mozilla-Cache
[2009.11.27 12:06:21 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Nero
[2009.12.23 23:28:23 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\OCS
[2009.11.18 20:18:57 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\OpenOffice.org
[2009.12.23 23:28:26 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Opera
[2009.11.24 00:39:02 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\PPLive
[2010.06.15 22:41:21 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\QIP
[2010.06.16 03:37:18 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\RayV
[2010.03.11 19:28:31 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Screaming Bee
[2009.12.10 00:31:17 | 000,000,000 | RH-D | M] -- C:\Users\Tobi\AppData\Roaming\SecuROM
[2010.12.14 01:28:31 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Skype
[2010.12.14 00:04:08 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\skypePM
[2009.11.19 21:44:43 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Sony
[2010.11.19 23:32:48 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\teamspeak2
[2010.05.07 04:20:10 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\temp
[2010.02.18 01:54:45 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\TS3Client
[2009.12.18 03:52:22 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Turbine
[2010.01.02 21:16:44 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Ubisoft
[2010.01.25 01:41:39 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\vlc
[2009.11.13 01:11:11 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\WinRAR
[2010.12.22 14:41:41 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Zota
 
< %APPDATA%\*.exe /s >
[2002.08.13 16:04:12 | 000,217,088 | R--- | M] () -- C:\Users\Tobi\AppData\Roaming\MafiaSetup.exe
[2010.12.22 01:28:42 | 000,139,264 | ---- | M] (Microsoft) -- C:\Users\Tobi\AppData\Roaming\56880\mscj.exe
[2010.12.22 01:28:44 | 000,010,240 | ---- | M] (Microsoft) -- C:\Users\Tobi\AppData\Roaming\56880\mscjm.exe
[2010.12.22 01:28:47 | 000,089,883 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\56880\pdmn2.exe
[2010.08.24 01:13:52 | 000,115,751 | ---- | M] (G Data Software AG) -- C:\Users\Tobi\AppData\Roaming\Bazay\kexeo.exe
[2010.09.23 12:03:13 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Tobi\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.12.09 09:02:05 | 002,790,864 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Tobi\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2010.08.24 17:20:09 | 000,348,160 | ---- | M] (Octoshape ApS) -- C:\Users\Tobi\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe
[2009.12.23 23:20:13 | 000,196,610 | ---- | M] (ThinkLABs-ltd.) -- C:\Users\Tobi\AppData\Roaming\McLoad\Uninstall-Mcload.exe
[2009.12.23 23:28:23 | 000,106,496 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\OCS\SM\SearchAnonymizer.exe
[2009.12.23 23:28:23 | 000,040,960 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe
[2009.11.24 00:39:02 | 009,730,472 | ---- | M] (Synacast Corp.) -- C:\Users\Tobi\AppData\Roaming\PPLive\Update\Update.exe
 
< %SYSTEMDRIVE%\*.exe >
[2007.11.07 07:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2010.07.26 03:15:18 | 000,004,608 | ---- | M] () MD5=55BB95F9595F24E8FBC771815BE4ED34 -- C:\Users\Tobi\AppData\Local\Xenocode\ApplianceCaches\GameCamXPress.exe_v4322CD3A\Native\STUBEXE\@SYSTEM@\explorer.exe
[2009.08.03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2009.08.03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.07.27 21:40:29 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=7AC326D5850CE4144E2EFB73586AB7B7 -- C:\Windows\SysWOW64\winlogon.exe
[2009.07.27 21:40:29 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=7AC326D5850CE4144E2EFB73586AB7B7 -- C:\Windows\SysWOW64\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.07.14 02:15:13 | 000,346,112 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\dxtmsft.dll
[2009.07.14 02:15:13 | 000,215,552 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\dxtrans.dll
[2009.07.14 02:15:50 | 001,386,496 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\msvbvm60.dll

< End of report >
         

--- --- ---
ExtrasOTL Logfile:

OTL Extras logfile created on: 22.12.2010 14:46:04 - Run 1
OTL by OldTimer - Version 3.2.18.0     Folder = C:\Users\Tobi\Desktop
64bit- An unknown product  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,00 Gb Available Physical Memory | 18,00% Memory free
4,00 Gb Paging File | 1,00 Gb Available in Paging File | 14,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,80 Gb Total Space | 14,03 Gb Free Space | 12,55% Space Free | Partition Type: NTFS
Drive D: | 6,31 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: TOBIS-RECHNER | User Name: Tobi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{21185083-5C3F-45E1-A52F-1279E0724967}" = iTunes
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{963BFE7E-C350-4346-B43C-B02358306A45}" = Apple Mobile Device Support
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}" = Bonjour
"{F0A36649-873E-4832-A5F1-BF5DF8600BDB}" = Windows Live Family Safety
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.55
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{17424F35-8B77-4ADF-BC63-BF9B81418539}" = Apple Application Support
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FDA5A37-B22D-43FF-B582-B8964050DC13}" = Microsoft Games for Windows - LIVE Redistributable
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 17
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{3B416FDA-CB3E-4514-9616-763E5B0D1140}" = Geheimakte Tunguska
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{501451DE-5808-4599-B544-8BD0915B6B24}_is1" = FreeRIP v3.5
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{69082C8E-38F6-445A-8617-C19008DD5392}" = Scramby
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{70B7A167-0B88-445D-A3EA-97C73AA88CAC}" = Windows Live Toolbar
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{7B63B2922B174135AFC0E1377DD81EC2}" = 
"{81DD0597-29EB-4FA0-8223-4F41362B2E72}" = NBA 2K11
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86A4C6D9-29EE-4719-AFA1-BA3341862B83}" = Microsoft Games for Windows - LIVE
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C1A80F67-656F-4DF3-A6C4-DE18A47477C5}_is1" = ICQ Away Reader 1.4
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E17141A6-211D-5854-61D9-69827A430D82}" = EA Download Manager UI
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Anstoss 2007 Userfile_is1" = Userfile 06/07 V2.00
"ArtMoney SE_is1" = ArtMoney SE v7.32.1
"Audacity_is1" = Audacity 1.2.6
"AV Voice Changer Software DIAMOND 7.0" = AV Voice Changer Software DIAMOND 7.0
"AV Voice Changer Software GOLD 7.0" = AV Voice Changer Software GOLD 7.0
"Cheat Engine 5.5_is1" = Cheat Engine 5.5
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"EA Download Manager" = EA Download Manager
"EAX Unified" = EAX Unified
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free Video Converter_is1" = Free Video Converter V 2.9
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8
"Game Cam XPress" = Game Cam XPress 2.5.0
"GameSpy Arcade" = GameSpy Arcade
"JDownloader" = JDownloader
"McLoad Preinstaller" = McLoad Preinstaller
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"mIRC" = mIRC
"Monster Stimme 1" = Monster Stimme 1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"PPLive" = PPLive 1.9
"PunkBusterSvc" = PunkBuster Services
"RayV" = RayV
"SopCast" = SopCast 3.2.9
"StarCraft II" = StarCraft II
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.3
"WinGimp-2.0_is1" = GIMP 2.6.7
"WinLiveSuite_Wave3" = Windows Live Essentials
"World of Warcraft" = World of Warcraft
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"090215de958f1060" = Curse Client
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"QIP 2005" = QIP 2005 8095
"QIP 2010" = QIP 2010 10.6.9.3598
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         

--- --- ---

OTL:OTL Logfile:

OTL logfile created on: 22.12.2010 14:46:04 - Run 1
OTL by OldTimer - Version 3.2.18.0     Folder = C:\Users\Tobi\Desktop
64bit- An unknown product  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,00 Gb Available Physical Memory | 18,00% Memory free
4,00 Gb Paging File | 1,00 Gb Available in Paging File | 14,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,80 Gb Total Space | 14,03 Gb Free Space | 12,55% Space Free | Partition Type: NTFS
Drive D: | 6,31 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: TOBIS-RECHNER | User Name: Tobi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Tobi\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Tobi\AppData\Roaming\56880\mscjm.exe (Microsoft)
PRC - C:\Users\Tobi\AppData\Roaming\56880\mscj.exe (Microsoft)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Spiele\NBA2k11\nba2k11.exe (2K Sports)
PRC - C:\Users\Tobi\AppData\Roaming\Bazay\kexeo.exe (G Data Software AG)
PRC - C:\Program Files (x86)\QIP 2010\qip.exe (QIP)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Cheat Engine\Cheat Engine.exe ()
PRC - C:\Program Files (x86)\Java\jre6\bin\jp2launcher.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files (x86)\ICQ Away Reader\ICQ Away Reader.exe (murb.com)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\RapidSolution\Scramby\ScrambyServer.exe (RapidSolution Software AG)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Tobi\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wkscli.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\normaliz.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (PnkBstrA) -- C:\Windows\SysNative\PnkBstrA.exe File not found
SRV:64bit: - (vvdsvc) -- C:\Windows\SysNative\nagasoft\vjocx.dll (NanJing Nagasoft Co, LTD.)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (Apple Mobile Device) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (vvdsvc) -- C:\Windows\SysWOW64\nagasoft\vjocx.dll (NanJing Nagasoft Co, LTD.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (SBSDWSCService) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (ScrambyServer) -- C:\Program Files (x86)\RapidSolution\Scramby\ScrambyServer.exe (RapidSolution Software AG)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (mdp2efc) -- C:\Windows\SysNative\drivers\mdp2efc.sys ()
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (cpuz134) -- C:\Windows\SysNative\drivers\cpuz134_x64.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (ScreamBAudioSvc) -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys (Screaming Bee LLC)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (xnacc) -- C:\Windows\SysNative\drivers\xnacc.sys (Microsoft Corporation)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (NuidFltr) -- C:\Windows\SysNative\drivers\nuidfltr.sys (Microsoft Corporation)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (VCSVADHWSer) Avnex Virtual Audio Device (WDM) -- C:\Windows\SysNative\drivers\vcsvad.sys (Avnex)
DRV:64bit: - (scramby_out) -- C:\Windows\SysNative\drivers\scramby_out.sys (RapidSolution Software AG)
DRV:64bit: - (scramby) -- C:\Windows\SysNative\drivers\scramby.sys (RapidSolution Software AG)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = QIP: ????? ? ?????????
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = QIP: ????? ? ?????????
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = QIP: ????? ? ?????????
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Ask.com Search Engine - Better Web Search
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B5 3B 2A AB 28 6E CA 01  [binary data]
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = QIP: ????? ? ?????????
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\..\URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\Tobi\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.yodl.de/href.php?hrefname=FF-splug_google&q="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.1.0014
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.5
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: eafo3fflauncher@ea.com:1.1
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.12.16 01:22:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.12.11 18:51:05 | 000,000,000 | ---D | M]
 
[2009.11.12 22:52:45 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\mozilla\Extensions
[2010.12.22 13:57:28 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\mozilla\Firefox\Profiles\3mnowx1v.default\extensions
[2009.12.02 19:58:07 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Tobi\AppData\Roaming\mozilla\Firefox\Profiles\3mnowx1v.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.05.07 14:26:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tobi\AppData\Roaming\mozilla\Firefox\Profiles\3mnowx1v.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2009.12.08 14:59:23 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\mozilla\Firefox\Profiles\3mnowx1v.default\extensions\DTToolbar@toolbarnet.com
[2010.09.18 03:06:43 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\mozilla\Firefox\Profiles\3mnowx1v.default\extensions\eafo3fflauncher@ea.com
[2010.08.16 21:27:15 | 000,002,384 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\askcom.xml
[2009.12.31 13:21:47 | 000,002,080 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\bing.xml
[2009.12.08 14:59:12 | 000,002,055 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\daemon-search.xml
[2010.12.16 14:18:09 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-1.xml
[2010.09.09 21:21:30 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-10.xml
[2010.11.14 09:14:54 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-11.xml
[2010.12.11 18:51:18 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-12.xml
[2010.03.06 15:28:20 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-2.xml
[2010.03.24 16:58:52 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-3.xml
[2010.04.02 20:01:23 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-4.xml
[2010.04.28 20:27:27 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-5.xml
[2010.06.25 02:12:43 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-6.xml
[2010.07.21 19:12:23 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-7.xml
[2010.07.25 15:49:36 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-8.xml
[2010.08.17 18:06:51 | 000,000,950 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin-9.xml
[2008.03.31 09:52:00 | 000,000,168 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin.gif
[2008.03.31 09:52:00 | 000,000,618 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin.src
[2010.02.12 21:45:05 | 000,000,955 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\icqplugin.xml
[2009.12.31 13:21:47 | 000,002,058 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\Mozilla\FireFox\Profiles\3mnowx1v.default\searchplugins\qipsearch.xml
[2010.12.22 13:57:28 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2009.12.24 00:06:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.11.14 09:14:44 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2009.12.23 23:23:25 | 000,001,779 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\clipfish.xml
[2009.12.23 23:23:25 | 000,001,013 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\conrad.xml
[2009.12.23 23:23:25 | 000,002,487 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\discount24.xml
[2010.11.14 09:14:44 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.11.14 09:14:44 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2009.12.23 23:23:25 | 000,001,047 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\musicload.xml
[2009.12.23 23:23:25 | 000,002,120 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\myvideo.xml
[2009.12.23 23:23:25 | 000,002,023 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\otto.xml
[2009.12.23 23:23:25 | 000,000,758 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\quelle.xml
[2009.12.23 23:23:25 | 000,001,329 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\telefonbuch-de.xml
[2010.11.14 09:14:44 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.11.14 09:14:44 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-de.xml
[2009.12.23 23:23:25 | 000,005,375 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\yodl.xml
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Programme\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\Tobi\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3 - HKLM\..\Toolbar: (no name) - {081230F8-EA50-42A9-983C-D22ABC2EED3B} - No CLSID value found.
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKU\S-1-5-21-737334471-58013836-1855596642-1000\..\Toolbar\WebBrowser: (no name) - {081230F8-EA50-42A9-983C-D22ABC2EED3B} - No CLSID value found.
O3:64bit: - HKU\S-1-5-21-737334471-58013836-1855596642-1000\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3 - HKU\S-1-5-21-737334471-58013836-1855596642-1000\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: [nonep] C:\Users\Tobi\AppData\Local\Temp\tmpe80abe5f\aport.exe File not found
O4 - HKLM..\Run: [POEngine]  File not found
O4 - HKLM..\Run: [SmartIndex] C:\Windows\Temp\_ex-08.exe File not found
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [{4674891F-0755-3CF7-C5D1-FD5E03489693}] C:\Users\Tobi\AppData\Roaming\Bazay\kexeo.exe (G Data Software AG)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [mscj] c:\users\tobi\appdata\roaming\56880\mscj.exe (Microsoft)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [mscj.exe] C:\Users\Tobi\AppData\Roaming\56880\mscj.exe (Microsoft)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [mscjm] c:\users\tobi\appdata\roaming\56880\mscjm.exe (Microsoft)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [mscjm.exe] C:\Users\Tobi\AppData\Roaming\56880\mscjm.exe (Microsoft)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [rasCommonhid] C:\Users\Tobi\AppData\Local\Sysobjnet\rasCommonhid.DLL ()
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8:64bit: - Extra context menu item: &FreeRIP Search - C:\Program Files (x86)\FreeRIP3\toolband.dll ()
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Tobi\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: &FreeRIP Search - C:\Program Files (x86)\FreeRIP3\toolband.dll ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Tobi\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPLive.exe ()
O9 - Extra 'Tools' menuitem : PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPLive.exe ()
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe File not found
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} Vexcast.com - Stream Yourself - All Stream (VodClient Control Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.09.10 22:33:59 | 000,000,000 | R--D | M] - D:\AutoRun -- [ UDF ]
O32 - AutoRun File - [2010.09.10 22:34:03 | 000,439,056 | R--- | M] (Electronic Arts) - D:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2010.09.10 22:34:02 | 007,864,832 | R--- | M] () - D:\autorun.dat -- [ UDF ]
O32 - AutoRun File - [2010.09.10 22:33:38 | 000,000,141 | R--- | M] () - D:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{23383851-e402-11de-8fe8-001fd0917f43}\Shell - "" = AutoRun
O33 - MountPoints2\{23383851-e402-11de-8fe8-001fd0917f43}\Shell\AutoRun\command - "" = F:\Autorun.exe -- File not found
O33 - MountPoints2\{dc0af11d-cfcc-11de-826a-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{dc0af11d-cfcc-11de-826a-806e6f6e6963}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2010.09.10 22:34:03 | 000,439,056 | R--- | M] (Electronic Arts)
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\AUTOSTARTER.EXE -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: dxdishta - (C:\Windows\system32\pbsvtend.dll) - C:\Windows\SysWOW64\pbsvtend.dll ()
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpFolder: C:^Users^Tobi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CurseClientStartup.ccip - C:\Users\Tobi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip - File not found
MsConfig:64bit - StartUpFolder: C:^Users^Tobi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: avgnt - hkey= - key= - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe File not found
MsConfig:64bit - StartUpReg: DAEMON Tools Lite - hkey= - key= - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
MsConfig:64bit - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MsConfig:64bit - StartUpReg: ICQ - hkey= - key= - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
MsConfig:64bit - StartUpReg: Infium - hkey= - key= - C:\Program Files (x86)\QIP 2010\qip.exe (QIP)
MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe File not found
MsConfig:64bit - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: RayV - hkey= - key= - C:\Program Files (x86)\RayV\RayV\RayV.exe (RayV)
MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Spiele\Steam\Steam.exe (Valve Corporation)
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
MsConfig:64bit - State: "startup" - Reg Error: Key error.
MsConfig:64bit - State: "services" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32:64bit: VIDC.XFR1 - xfcodec64.dll ()
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\SysWow64\lhacm.acm (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.22 14:43:22 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Tobi\Desktop\OTL.exe
[2010.12.22 02:00:49 | 000,112,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe
[2010.12.22 01:59:27 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2010.12.22 01:59:26 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2010.12.22 01:59:26 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2010.12.22 01:59:26 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2010.12.22 01:59:26 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2010.12.22 01:59:26 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2010.12.22 01:59:26 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2010.12.22 01:59:26 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2010.12.22 01:59:26 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2010.12.22 01:59:26 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2010.12.22 01:59:26 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2010.12.22 01:59:26 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2010.12.22 01:59:26 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2010.12.22 01:59:26 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2010.12.22 01:55:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2010.12.22 01:55:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2010.12.22 01:51:52 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2010.12.22 01:28:47 | 000,000,000 | ---D | C] -- C:\Users\Tobi\AppData\Local\Sysobjnet
[2010.12.22 01:28:40 | 000,000,000 | ---D | C] -- C:\Users\Tobi\AppData\Roaming\56880
[2010.12.22 00:18:25 | 064,818,688 | ---- | C] (2K Sports) -- C:\Users\Tobi\Desktop\nba2k11.exe
[2010.12.17 16:03:17 | 000,000,000 | ---D | C] -- C:\Users\Tobi\AppData\Local\AOL
[2010.12.17 16:03:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ7.2
[2010.12.16 19:54:28 | 000,000,000 | ---D | C] -- C:\Users\Tobi\Desktop\cod1
[2010.12.11 15:57:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2010.12.09 09:09:40 | 000,000,000 | ---D | C] -- C:\Users\Tobi\Desktop\Studium
[2010.12.03 20:25:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Deep Silver
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.22 14:43:38 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Tobi\Desktop\OTL.exe
[2010.12.22 13:43:47 | 000,048,128 | -H-- | M] () -- C:\Windows\SysWow64\pbsvtend.dll
[2010.12.22 13:38:15 | 001,527,098 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.12.22 13:38:15 | 000,664,396 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.12.22 13:38:15 | 000,624,578 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.12.22 13:38:15 | 000,134,564 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.12.22 13:38:15 | 000,110,216 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.12.22 13:36:58 | 000,020,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.12.22 13:36:58 | 000,020,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.12.22 13:31:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.12.22 13:31:43 | 1609,424,896 | -HS- | M] () -- C:\hiberfil.sys
[2010.12.22 01:56:06 | 000,001,214 | ---- | M] () -- C:\Users\Tobi\Desktop\Spybot - Search & Destroy.lnk
[2010.12.22 01:52:03 | 000,385,024 | ---- | M] () -- C:\Users\Tobi\AppData\Local\zdglyt.exe
[2010.12.22 01:45:09 | 000,048,640 | -H-- | M] () -- C:\Windows\pbsvtend.dll
[2010.12.22 01:37:06 | 000,000,034 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini
[2010.12.21 21:36:22 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\World of Warcraft.lnk
[2010.12.21 04:16:27 | 000,008,639 | ---- | M] () -- C:\Users\Tobi\Desktop\Raclette.odt
[2010.12.21 03:46:09 | 000,138,272 | ---- | M] () -- C:\Windows\SysNative\drivers\mdp2efc.sys
[2010.12.20 08:32:18 | 000,008,380 | ---- | M] () -- C:\Users\Tobi\Desktop\Projekt.ods
[2010.12.09 20:35:48 | 000,232,326 | ---- | M] () -- C:\Users\Tobi\Desktop\CIMG0251.JPG
[2010.12.09 20:35:48 | 000,002,140 | ---- | M] () -- C:\Users\Tobi\.recently-used.xbel
[2010.12.03 20:29:28 | 000,002,137 | ---- | M] () -- C:\Users\Public\Desktop\Geheimakte Tunguska.lnk
[2010.12.03 20:29:21 | 000,310,984 | ---- | M] () -- C:\Windows\SysNative\drivers\atksgt.sys
[2010.11.30 21:12:11 | 000,013,149 | ---- | M] () -- C:\Users\Tobi\Desktop\BUch.odt
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.12.22 01:56:06 | 000,001,214 | ---- | C] () -- C:\Users\Tobi\Desktop\Spybot - Search & Destroy.lnk
[2010.12.22 01:52:03 | 000,385,024 | ---- | C] () -- C:\Users\Tobi\AppData\Local\zdglyt.exe
[2010.12.22 01:45:09 | 000,048,640 | -H-- | C] () -- C:\Windows\pbsvtend.dll
[2010.12.22 01:41:12 | 000,048,128 | -H-- | C] () -- C:\Windows\SysWow64\pbsvtend.dll
[2010.12.21 04:14:58 | 000,008,639 | ---- | C] () -- C:\Users\Tobi\Desktop\Raclette.odt
[2010.12.21 03:46:09 | 000,138,272 | ---- | C] () -- C:\Windows\SysNative\drivers\mdp2efc.sys
[2010.12.10 23:20:32 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\World of Warcraft.lnk
[2010.12.09 20:35:48 | 000,232,326 | ---- | C] () -- C:\Users\Tobi\Desktop\CIMG0251.JPG
[2010.12.09 20:35:48 | 000,002,140 | ---- | C] () -- C:\Users\Tobi\.recently-used.xbel
[2010.12.03 20:29:28 | 000,002,137 | ---- | C] () -- C:\Users\Public\Desktop\Geheimakte Tunguska.lnk
[2010.11.30 20:40:28 | 000,013,149 | ---- | C] () -- C:\Users\Tobi\Desktop\BUch.odt
[2010.11.21 00:28:45 | 000,000,073 | ---- | C] () -- C:\Windows\cdplayer.ini
[2010.11.20 23:44:22 | 000,001,302 | ---- | C] () -- C:\ProgramData\ss.ini
[2010.11.20 23:44:09 | 000,000,034 | ---- | C] () -- C:\Users\Tobi\AppData\Roaming\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini
[2010.11.20 23:43:57 | 000,000,033 | ---- | C] () -- C:\ProgramData\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini
[2010.11.15 02:41:32 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2010.10.14 01:36:44 | 000,179,263 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2010.08.10 16:18:12 | 000,001,793 | ---- | C] () -- C:\Windows\TSearch.INI
[2010.07.26 17:27:51 | 000,003,584 | ---- | C] () -- C:\Users\Tobi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.02.17 22:51:00 | 000,000,000 | ---- | C] () -- C:\Windows\Editor.INI
[2010.01.18 09:37:31 | 001,970,176 | ---- | C] () -- C:\Windows\SysWow64\d3dx9.dll
[2009.12.18 03:45:48 | 000,000,092 | ---- | C] () -- C:\Users\Tobi\AppData\Local\fusioncache.dat
[2009.11.19 18:58:26 | 000,290,816 | ---- | C] () -- C:\Windows\SysWow64\decdll.dll
[2009.11.16 00:25:36 | 001,526,730 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2007.02.22 16:17:50 | 000,000,071 | ---- | C] () -- C:\Windows\pn.ini
[2007.02.22 16:17:50 | 000,000,051 | ---- | C] () -- C:\Windows\pr.ini
[2002.08.13 16:04:12 | 000,217,088 | R--- | C] () -- C:\Users\Tobi\AppData\Roaming\MafiaSetup.exe
 
========== LOP Check ==========
 
[2010.12.06 11:42:31 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\2K Sports
[2010.10.07 18:12:48 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\2K Sports
[2010.12.22 01:36:46 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\56880
[2010.06.09 14:46:42 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Audacity
[2010.03.11 19:23:39 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Avnex
[2010.08.24 01:13:52 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Bazay
[2009.11.27 16:07:49 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Canneverbe_Limited
[2009.12.08 15:48:32 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\DAEMON Tools Lite
[2010.05.20 16:35:42 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.07.27 01:18:42 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\FreeVideoConverter
[2010.03.11 19:15:51 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\GetRightToGo
[2010.12.09 20:35:48 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\gtk-2.0
[2010.12.19 23:09:08 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\ICQ
[2010.03.20 01:30:22 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Leadertech
[2009.12.23 23:20:13 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\McLoad
[2009.12.23 23:28:23 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\OCS
[2009.11.18 20:18:57 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\OpenOffice.org
[2009.12.23 23:28:26 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Opera
[2009.11.24 00:39:02 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\PPLive
[2010.06.15 22:41:21 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\QIP
[2010.06.16 03:37:18 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\RayV
[2010.03.11 19:28:31 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Screaming Bee
[2009.11.19 21:44:43 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Sony
[2010.05.07 04:20:10 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\temp
[2010.02.18 01:54:45 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\TS3Client
[2009.12.18 03:52:22 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Turbine
[2010.01.02 21:16:44 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Ubisoft
[2010.12.22 14:41:41 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Zota
[2010.10.13 12:09:42 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.10.07 18:12:48 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\2K Sports
[2010.12.22 01:36:46 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\56880
[2010.03.16 00:07:48 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Adobe
[2009.11.18 20:53:59 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Apple Computer
[2010.06.09 14:46:42 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Audacity
[2010.03.11 19:23:39 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Avnex
[2010.08.24 01:13:52 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Bazay
[2009.11.27 16:07:49 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Canneverbe_Limited
[2009.12.08 15:48:32 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\DAEMON Tools Lite
[2010.07.14 19:05:43 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\DivX
[2010.05.20 16:35:42 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.07.27 01:18:42 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\FreeVideoConverter
[2010.03.11 19:15:51 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\GetRightToGo
[2010.12.09 20:35:48 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\gtk-2.0
[2010.02.23 23:12:33 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Hamachi
[2010.12.19 23:09:08 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\ICQ
[2009.11.12 21:58:31 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Identities
[2010.03.20 01:30:22 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Leadertech
[2009.11.12 23:06:19 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Macromedia
[2009.12.23 23:20:13 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\McLoad
[2009.07.14 19:18:34 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Media Center Programs
[2010.11.20 05:24:50 | 000,000,000 | --SD | M] -- C:\Users\Tobi\AppData\Roaming\Microsoft
[2010.05.08 15:54:37 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\mIRC
[2009.11.12 22:52:45 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Mozilla
[2010.07.23 14:12:47 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Mozilla-Cache
[2009.11.27 12:06:21 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Nero
[2009.12.23 23:28:23 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\OCS
[2009.11.18 20:18:57 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\OpenOffice.org
[2009.12.23 23:28:26 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Opera
[2009.11.24 00:39:02 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\PPLive
[2010.06.15 22:41:21 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\QIP
[2010.06.16 03:37:18 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\RayV
[2010.03.11 19:28:31 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Screaming Bee
[2009.12.10 00:31:17 | 000,000,000 | RH-D | M] -- C:\Users\Tobi\AppData\Roaming\SecuROM
[2010.12.14 01:28:31 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Skype
[2010.12.14 00:04:08 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\skypePM
[2009.11.19 21:44:43 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Sony
[2010.11.19 23:32:48 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\teamspeak2
[2010.05.07 04:20:10 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\temp
[2010.02.18 01:54:45 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\TS3Client
[2009.12.18 03:52:22 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Turbine
[2010.01.02 21:16:44 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Ubisoft
[2010.01.25 01:41:39 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\vlc
[2009.11.13 01:11:11 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\WinRAR
[2010.12.22 14:41:41 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Zota
 
< %APPDATA%\*.exe /s >
[2002.08.13 16:04:12 | 000,217,088 | R--- | M] () -- C:\Users\Tobi\AppData\Roaming\MafiaSetup.exe
[2010.12.22 01:28:42 | 000,139,264 | ---- | M] (Microsoft) -- C:\Users\Tobi\AppData\Roaming\56880\mscj.exe
[2010.12.22 01:28:44 | 000,010,240 | ---- | M] (Microsoft) -- C:\Users\Tobi\AppData\Roaming\56880\mscjm.exe
[2010.12.22 01:28:47 | 000,089,883 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\56880\pdmn2.exe
[2010.08.24 01:13:52 | 000,115,751 | ---- | M] (G Data Software AG) -- C:\Users\Tobi\AppData\Roaming\Bazay\kexeo.exe
[2010.09.23 12:03:13 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Tobi\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.12.09 09:02:05 | 002,790,864 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Tobi\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2010.08.24 17:20:09 | 000,348,160 | ---- | M] (Octoshape ApS) -- C:\Users\Tobi\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe
[2009.12.23 23:20:13 | 000,196,610 | ---- | M] (ThinkLABs-ltd.) -- C:\Users\Tobi\AppData\Roaming\McLoad\Uninstall-Mcload.exe
[2009.12.23 23:28:23 | 000,106,496 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\OCS\SM\SearchAnonymizer.exe
[2009.12.23 23:28:23 | 000,040,960 | ---- | M] () -- C:\Users\Tobi\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe
[2009.11.24 00:39:02 | 009,730,472 | ---- | M] (Synacast Corp.) -- C:\Users\Tobi\AppData\Roaming\PPLive\Update\Update.exe
 
< %SYSTEMDRIVE%\*.exe >
[2007.11.07 07:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2010.07.26 03:15:18 | 000,004,608 | ---- | M] () MD5=55BB95F9595F24E8FBC771815BE4ED34 -- C:\Users\Tobi\AppData\Local\Xenocode\ApplianceCaches\GameCamXPress.exe_v4322CD3A\Native\STUBEXE\@SYSTEM@\explorer.exe
[2009.08.03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2009.08.03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.07.27 21:40:29 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=7AC326D5850CE4144E2EFB73586AB7B7 -- C:\Windows\SysWOW64\winlogon.exe
[2009.07.27 21:40:29 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=7AC326D5850CE4144E2EFB73586AB7B7 -- C:\Windows\SysWOW64\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.07.14 02:15:13 | 000,346,112 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\dxtmsft.dll
[2009.07.14 02:15:13 | 000,215,552 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\dxtrans.dll
[2009.07.14 02:15:50 | 001,386,496 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\msvbvm60.dll

< End of report >
         

--- --- ---

ExtrasOTL Logfile:

OTL Extras logfile created on: 22.12.2010 14:46:04 - Run 1
OTL by OldTimer - Version 3.2.18.0     Folder = C:\Users\Tobi\Desktop
64bit- An unknown product  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,00 Gb Available Physical Memory | 18,00% Memory free
4,00 Gb Paging File | 1,00 Gb Available in Paging File | 14,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,80 Gb Total Space | 14,03 Gb Free Space | 12,55% Space Free | Partition Type: NTFS
Drive D: | 6,31 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: TOBIS-RECHNER | User Name: Tobi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{21185083-5C3F-45E1-A52F-1279E0724967}" = iTunes
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{963BFE7E-C350-4346-B43C-B02358306A45}" = Apple Mobile Device Support
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}" = Bonjour
"{F0A36649-873E-4832-A5F1-BF5DF8600BDB}" = Windows Live Family Safety
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.55
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{17424F35-8B77-4ADF-BC63-BF9B81418539}" = Apple Application Support
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FDA5A37-B22D-43FF-B582-B8964050DC13}" = Microsoft Games for Windows - LIVE Redistributable
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 17
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{3B416FDA-CB3E-4514-9616-763E5B0D1140}" = Geheimakte Tunguska
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{501451DE-5808-4599-B544-8BD0915B6B24}_is1" = FreeRIP v3.5
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{69082C8E-38F6-445A-8617-C19008DD5392}" = Scramby
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{70B7A167-0B88-445D-A3EA-97C73AA88CAC}" = Windows Live Toolbar
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{7B63B2922B174135AFC0E1377DD81EC2}" = 
"{81DD0597-29EB-4FA0-8223-4F41362B2E72}" = NBA 2K11
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86A4C6D9-29EE-4719-AFA1-BA3341862B83}" = Microsoft Games for Windows - LIVE
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C1A80F67-656F-4DF3-A6C4-DE18A47477C5}_is1" = ICQ Away Reader 1.4
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E17141A6-211D-5854-61D9-69827A430D82}" = EA Download Manager UI
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Anstoss 2007 Userfile_is1" = Userfile 06/07 V2.00
"ArtMoney SE_is1" = ArtMoney SE v7.32.1
"Audacity_is1" = Audacity 1.2.6
"AV Voice Changer Software DIAMOND 7.0" = AV Voice Changer Software DIAMOND 7.0
"AV Voice Changer Software GOLD 7.0" = AV Voice Changer Software GOLD 7.0
"Cheat Engine 5.5_is1" = Cheat Engine 5.5
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"EA Download Manager" = EA Download Manager
"EAX Unified" = EAX Unified
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free Video Converter_is1" = Free Video Converter V 2.9
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8
"Game Cam XPress" = Game Cam XPress 2.5.0
"GameSpy Arcade" = GameSpy Arcade
"JDownloader" = JDownloader
"McLoad Preinstaller" = McLoad Preinstaller
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"mIRC" = mIRC
"Monster Stimme 1" = Monster Stimme 1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"PPLive" = PPLive 1.9
"PunkBusterSvc" = PunkBuster Services
"RayV" = RayV
"SopCast" = SopCast 3.2.9
"StarCraft II" = StarCraft II
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.3
"WinGimp-2.0_is1" = GIMP 2.6.7
"WinLiveSuite_Wave3" = Windows Live Essentials
"World of Warcraft" = World of Warcraft
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-737334471-58013836-1855596642-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"090215de958f1060" = Curse Client
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"QIP 2005" = QIP 2005 8095
"QIP 2010" = QIP 2010 10.6.9.3598
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         

--- --- ---

deinstaliere spybot, es stört die reinigung, starte dann neu.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
PRC - C:\Users\Tobi\AppData\Roaming\56880\mscjm.exe (Microsoft)
PRC - C:\Users\Tobi\AppData\Roaming\56880\mscj.exe (Microsoft)
PRC - C:\Users\Tobi\AppData\Roaming\Bazay\kexeo.exe (G Data Software AG)
SRV:64bit: - (PnkBstrA) -- C:\Windows\SysNative\PnkBstrA.exe File not found
SRV:64bit: - (vvdsvc) -- C:\Windows\SysNative\nagasoft\vjocx.dll (NanJing Nagasoft Co, LTD.)
IE - HKU\S-1-5-21-737334471-58013836-1855596642-1000\..\URLSearchHook: - Reg Error: Key error. File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {081230F8-EA50-42A9-983C-D22ABC2EED3B} - No CLSID value found.
O3 - HKU\S-1-5-21-737334471-58013836-1855596642-1000\..\Toolbar\WebBrowser: (no name) - {081230F8-EA50-42A9-983C-D22ABC2EED3B} - No CLSID value found
O4 - HKLM..\Run: [nonep] C:\Users\Tobi\AppData\Local\Temp\tmpe80abe5f\aport.exe File not found
O4 - HKLM..\Run: [POEngine] File not found
O4 - HKLM..\Run: [SmartIndex] C:\Windows\Temp\_ex-08.exe File not found
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [mscj] c:\users\tobi\appdata\roaming\56880\mscj.exe (Microsoft)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [mscj.exe] C:\Users\Tobi\AppData\Roaming\56880\mscj.exe (Microsoft)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [mscjm] c:\users\tobi\appdata\roaming\56880\mscjm.exe (Microsoft)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [mscjm.exe] C:\Users\Tobi\AppData\Roaming\56880\mscjm.exe (Microsoft)
O4 - HKU\S-1-5-21-737334471-58013836-1855596642-1000..\Run: [rasCommonhid] C:\Users\Tobi\AppData\Local\Sysobjnet\rasCommonhid.DLL ()
O36 - AppCertDlls: dxdishta - (C:\Windows\system32\pbsvtend.dll) - C:\Windows\SysWOW64\pbsvtend.dll ()
[2010.12.22 01:28:47 | 000,000,000 | ---D | C] -- C:\Users\Tobi\AppData\Local\Sysobjnet
[2010.12.22 01:28:40 | 000,000,000 | ---D | C] -- C:\Users\Tobi\AppData\Roaming\56880
[2010.12.22 13:43:47 | 000,048,128 | -H-- | M] () -- C:\Windows\SysWow64\pbsvtend.dll
[2010.12.22 01:52:03 | 000,385,024 | ---- | M] () -- C:\Users\Tobi\AppData\Local\zdglyt.exe
[2010.12.22 01:45:09 | 000,048,640 | -H-- | M] () -- C:\Windows\pbsvtend.dll
[2010.08.24 01:13:52 | 000,000,000 | ---D | M] -- C:\Users\Tobi\AppData\Roaming\Bazay
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort posten.


öffne mein computer, c: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
lade das archiv in unserem upload channel hoch.
http://www.trojaner-board.de/54791-a...ner-board.html

All processes killed
========== OTL ==========
No active process named mscjm.exe was found!
No active process named mscj.exe was found!
No active process named kexeo.exe was found!
Service PnkBstrA stopped successfully!
Service PnkBstrA deleted successfully!
File C:\Windows\SysNative\PnkBstrA.exe File not found not found.
Service vvdsvc stopped successfully!
Service vvdsvc deleted successfully!
C:\Windows\SysNative\nagasoft\vjocx.dll moved successfully.
Registry key HKEY_USERS\S-1-5-21-737334471-58013836-1855596642-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{081230F8-EA50-42A9-983C-D22ABC2EED3B} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{081230F8-EA50-42A9-983C-D22ABC2EED3B}\ not found.
Registry value HKEY_USERS\S-1-5-21-737334471-58013836-1855596642-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{081230F8-EA50-42A9-983C-D22ABC2EED3B} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{081230F8-EA50-42A9-983C-D22ABC2EED3B}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\nonep deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\POEngine deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SmartIndex deleted successfully.
Registry value HKEY_USERS\S-1-5-21-737334471-58013836-1855596642-1000\Software\Microsoft\Windows\CurrentVersion\Run\\mscj deleted successfully.
c:\users\tobi\appdata\roaming\56880\mscj.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-737334471-58013836-1855596642-1000\Software\Microsoft\Windows\CurrentVersion\Run\\mscj.exe deleted successfully.
File C:\Users\Tobi\AppData\Roaming\56880\mscj.exe not found.
Registry value HKEY_USERS\S-1-5-21-737334471-58013836-1855596642-1000\Software\Microsoft\Windows\CurrentVersion\Run\\mscjm deleted successfully.
c:\users\tobi\appdata\roaming\56880\mscjm.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-737334471-58013836-1855596642-1000\Software\Microsoft\Windows\CurrentVersion\Run\\mscjm.exe deleted successfully.
File C:\Users\Tobi\AppData\Roaming\56880\mscjm.exe not found.
Registry value HKEY_USERS\S-1-5-21-737334471-58013836-1855596642-1000\Software\Microsoft\Windows\CurrentVersion\Run\\rasCommonhid deleted successfully.
C:\Users\Tobi\AppData\Local\Sysobjnet\rasCommonhid.DLL moved successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\dxdishta:C:\Windows\system32\pbsvtend.dll deleted successfully.
C:\Windows\SysWOW64\pbsvtend.dll moved successfully.
C:\Users\Tobi\AppData\Local\Sysobjnet folder moved successfully.
C:\Users\Tobi\AppData\Roaming\56880 folder moved successfully.
File C:\Windows\SysWow64\pbsvtend.dll not found.
C:\Users\Tobi\AppData\Local\zdglyt.exe moved successfully.
C:\Windows\pbsvtend.dll moved successfully.
C:\Users\Tobi\AppData\Roaming\Bazay folder moved successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 41620 bytes

User: All Users

User: Default
->Flash cache emptied: 56504 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Lukas

User: Public

User: Tobi
->Flash cache emptied: 4036049 bytes

Total Flash Files Cleaned = 4,00 mb


[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 213287 bytes
->Temporary Internet Files folder emptied: 67486 bytes
->Java cache emptied: 10680337 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Lukas

User: Public

User: Tobi
->Temp folder emptied: 21370601 bytes
->Temporary Internet Files folder emptied: 84209771 bytes
->Java cache emptied: 67138054 bytes
->FireFox cache emptied: 66769591 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 4 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 531650 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 5219851 bytes

Total Files Cleaned = 244,00 mb


OTL by OldTimer - Version 3.2.18.0 log created on 12222010_211805

Files\Folders moved on Reboot...
File\Folder C:\Users\Tobi\AppData\Local\Temp\fla457.tmp not found!
File\Folder C:\Users\Tobi\AppData\Local\Temp\fla607B.tmp not found!
File\Folder C:\Users\Tobi\AppData\Local\Temp\fla60AB.tmp not found!
File\Folder C:\Users\Tobi\AppData\Local\Temp\flaC0E.tmp not found!
File\Folder C:\Users\Tobi\AppData\Local\Temp\flaCA33.tmp not found!
File\Folder C:\Users\Tobi\AppData\Local\Temp\flaF082.tmp not found!
C:\Users\Tobi\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Users\Tobi\AppData\Local\Temp\~DF0B1AE9ED40F05A59.TMP not found!
File\Folder C:\Users\Tobi\AppData\Local\Temp\~DF1C53255E3D5324AB.TMP not found!
File\Folder C:\Users\Tobi\AppData\Local\Temp\~DF5B3B36234769C74D.TMP not found!
File\Folder C:\Users\Tobi\AppData\Local\Temp\~DF5CC942D039E61F76.TMP not found!
File\Folder C:\Users\Tobi\AppData\Local\Temp\~DF880F43FC704C3776.TMP not found!
File\Folder C:\Users\Tobi\AppData\Local\Temp\~DFC1643FCAEC178590.TMP not found!
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\SuggestedSites.dat moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VV5MQCJO\index2[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S3QHHQML\ff2[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S3QHHQML\glamthumbs_com[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QZP8VYD1\adshow[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QZP8VYD1\carolporn_com[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QZP8VYD1\rt_ad7[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QZP8VYD1\sidebar[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PRJ3NY6A\ads[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H7TH07JZ\nudedumbteens_com[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H7TH07JZ\piclist[2].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FOQDLA1M\adshow[2].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FOQDLA1M\ff2[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FOQDLA1M\pornwithgirls_com[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BE2ZPA4U\adshow[3].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BE2ZPA4U\bigbosstube_com[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BE2ZPA4U\thongdreams_com[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ACWCOKH4\adshow[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ACWCOKH4\nudedumbteens_com[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ACWCOKH4\personalporntube_com[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4OMWW31X\adshow[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4OMWW31X\babeslips_com[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4OMWW31X\index[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4OMWW31X\milfporntube_net[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4OMWW31X\teen-home-video_com[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4OMWW31X\teenageselfpics_com[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0O3PDGOW\adshow[2].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0O3PDGOW\falula_com[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0O3PDGOW\girlfriendi_com[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0O3PDGOW\idealsexy_net[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0O3PDGOW\piclist[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0O3PDGOW\piclist[2].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0O3PDGOW\PPN_atthepark_pv_video-1[1].flv moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0O3PDGOW\signin[1].htm moved successfully.
C:\Users\Tobi\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

Registry entries deleted on Reboot...




was hab ich eigentlich gemacht bis jetzt?^^ blick da nicht so durch...aber vielen Dank für eure Hilfe!

du hast einige trojaner entfernt, wo ist der upload um den ich gebeten hab?

soeben passiert!

hi,
1. machst du onlinebanking /einkäufe?ja

2. mal ne kurze anmerkung zu deinem surfverhalten, ich konnte da nen kleinen einblick gewinnen.
keine angst, keine passwörter oder so und das wird kein vortrag über moral sondern nur fakten.
die seiten die du so besuchst bringen sehr häufig malware mit sich, auch streaming seiten wie kino.to
lass lieber die finger davon und du lebst wesendlich sicherer.

1. ja
2. :-)

hi, dann sollten wir uns ans daten sichern und neu aufsetzen machen, ich zeige dir dann wie du den pc richtig absicherst.
rufe bitte außerdem sicherheitshalber die bank an und lasse onlinebanking sperren.

ist das jetzt so schlimm?

hab schon ma passwörter geändert...

aber hoffenldihc nicht von dem infizierten pc.
und na klar ists schlimm, oder muss erst das konto leer geräumt werden?

am besten mach ich den einfach platt, oder?

das war doch das was ich gesagt hab :-)
sichere erst daten und dann gehts hiermit weiter:
- formatieren, nicht die schnelle formatierung wählen!
dann windows aufspielen, dann treiber!
windows update:
Microsoft Windows Update
hier instalierst du so lange updates, bis es keine neuen mehr gibt.
unter einstellungen, wähle windows updates automatisch instalieren.

du solltest nur noch als eingeschrenkter nutzer arbeiten , das admin konto ist nur für instalationen gedacht.
klicke start, tippe unter suchen (ausführen) systemsteuerung. wähle dort Benutzerkonten hinzufügen/entfernen.
wähle "neues konto erstellen"
Wähle standard benutzer.

die konten sollten mit einem passwort geschützt werden.
dazu auf konto endern klicken und passwörter vergeben.
die folgenden konfigurationen als administrator durchführen
die uac sollte auf maximum stehen.
klicke auf start, ausführen (suchen) tippe
uac
enter
nachfrage bestätigen, regler auf höchste stufe.
so ist es schwiriger heimlich etwas auf dem pc zu instalieren.

dep für alle prozesse:
Datenausführungsverhinderung (DEP)
• "Datenausführungsverhinderung für alle Programme und Dienste mit Ausnahme der ausgewählten einschalten:".
wenn es zu problemen kommen sollte, kann man die betroffenen prozesse aus der Überwachung entfernen.

SEHOP aktivieren:
Aktivieren von SEHOP (Structured Exception Handling Overwrite Protection) in Windows-Betriebssystemen
klicke auf "Feature automatisch aktivieren"
und folge den anweisungen

avira genauestens nach anleitung instalieren:
http://www.trojaner-board.de/54192-a...tellungen.html
achte darauf, das der auftrag im planer wirklich über lokale laufwerke läuft, sonst werden scan einstellungen nicht gültig.
unter avira, konfiguration, guard, autostart, haken raus lassen.

als browser solltest du den opera nutzen, er ist sicherer und schneller.
wenn er dir nicht gefällt passe ich meine anleitung für den ff an.
Opera Webbrowser | Schneller & sicherer | Die neuen Internet-Browser kostenlos herunterladen
mit diesem tool lässt sich ein werbeblocker laden
mit diesem tool lässt sich ein werbeblocker laden
Opera URLFilter Downloader ? OperaWiki
dies sollte 1x pro woche durchgeführt werden.
zusätzlich kannst du das auch manuell erledigen, falls mal etwas nicht geblockt wird:
Computerbase - Werbung blockieren
auch diese tutorial seite mal ansehen.
Opera Tutorial- Übersicht
hier besonders die abschnitte sicherheit (kookies) und passwort durchlesen


um das surfen sicherer zu machen, würde ich Sandboxie empfehlen.
Download:
Drop.io
(als pdf)
und ein vidio zum besseren verständniss:
hier noch ein paar zusatzeinstellungen, nicht verunsichern lassen, wenn du das programm instaliert hast, werden sie klar.
den direkten datei zugriff bitte auf opera beschrenken,
bei
Internetzugriff:
opera.exe
öffne dann sandboxie, dann oben im menü auf sandbox klickem, wähle deine sandbox aus und klicke dann auf sandboxeinstellung.
dort auf anwendung, webbrowser, andere dort auf direkten zugriff auf opera bookmarks erlauben. dann auf hinzufügen und ok.
somit kannst du deine lesezeichen auch in der sandbox dauerhaft abspeichern.

wenn du mit dem programm gut auskommst, ist ne lizenz zu empfehlen.
1. es gibt dann noch ein paar mehr funktionen.
2. kommt nach nem monat die anzeige, dass das programm freeware ist, die verschwindet erst nach ner zeit, find ich n bissel nerfig.
3. ist die lizenz lebenslang gültig, kostenpunkt rund 30 €, und du kannst sie auf allen pcs in deinem haushalt einsetzen.

autorun deaktivieren:
über diesen weg werden sehr häufig schaddateien verbreitet, schalte die funktion also ab.
Tipparchiv - Autorun/Autoplay gezielt für Laufwerkstypen oder -buchstaben abschalten - WinTotal.de
usb sticks, festplatten etc, sollte man mit panda vaccine impfen:
ANTIMALWARE: Panda USB Vaccine - Download FREE - PANDA SECURITY
so holt man sich keine infektionen ins haus, wenn man mal die festplatte etc verleit.
hake an:
run panda usb vaccine automatically when computer boots
automatically vaccine any new insert usb key
enable ntfs file suport

Updates sind für dein system genauso wichtig, wie ein antivirenscanner. Sehr häufig gelangen schädlinge nur aufs system, weil der user veraltete software nutzt.
instaliere die folgenden update checker.
Secunia:
http://www.trojaner-board.de/83959-s...ector-psi.html
und file hippo update checker:
FileHippo.com Update Checker - FileHippo.com
das file Hippo Symbol wird im infobereich neben der uhr auftauchen, mache bitte nen rechtsklick darauf, wähle settings, results, setze einen haken bei "hide beta updates" klicke ok.
dann doppelklicke file hippo, eine Internetseite wird geöffnet, auf der dier die aktuellsten updates gezeigt werden, diese downloaden und instalieren.

Beide programme sollten im autostart bleiben, und sobald eines der programme updates anzeigt sollten diese umgehend instaliert werden.


achtung:
bei einigen programmen werden englische setups angeboten. das sollte man ersehen können, die setupdateien sollten ein .en oder .us enthalten. wenn dem so ist, sollte man beim hersteller schauen, dort gibts die deutschen setups zu laden.
Falls du die hersteller seite nicht kennst, google wird bestimmt behilflich sein :-)

regelmäßige Backups des systems sind sehr wichtig, du weist nie, ob deine festplatte mal kaputt geht.
Paragon Backup & Recovery Free Edition - Das Produkt
außerdem kannst du, bei neuerlichem malware befall das system zurücksetzen.
Das Backup sollte möglichst auf eine externe festplatte etc emacht werden, nicht auf die selbe, wo sich die zu sichernden daten befinden.
Von sehr wichtigen Daten könnte man noch eine zusätzliche Sicherung auf dvds/cds erstellen, dazu könnte man auch wiederbeschreibbare verwenden (rws) falls die sammlung mal erneuert werden soll.



allgemeines.
- verzichte auf tuning programme, sie bringen nichts.
- keine illegalen downloads.
90 % bringen malware mit sich!
- keine streaming seiten wie kino.to sie verbreiten malware.
- wenn möglich, instalationen immer benutzerdefiniert ausführen, dann kannst du unnötiges zeug abwählen.
- programme patches etc immer nur vom hersteller direkt laden.
online banking:

ich würde zu online banking mit chipcard raten, dazu benötigst du, ein lesegerät, lasse dich von deiner bank beraten, es sollte aber mindestens ein klasse2 lesegerät sein, besser sogar ein klasse3 leser, das sind die besten für den privat kunden.
Kartenlesegerät ? Wikipedia

instaliere jetzt die von dir benötigten programme.
endere alle passwörter.
danach, bitte nur noch im standard nutzer konto einloggen, und dort in der sandbox surfen, mit klick auf "sandboxed web browser".
wenn du diese anleitung genauestens abarbeitest, dann bist du in zukunft besser geschützt.