Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Bundestrojaner (https://www.trojaner-board.de/124204-bundestrojaner.html)

Shizznut 17.09.2012 12:35
Bundestrojaner
 
Hallo zusammen,
habe mir vor kurzem nen Bundestrojaner eingefangen. Ich habe dann eine Systemwiederherstellung gestartet, Scans mit Hijackthis, Spybot und Panda, durchgeführt. Letztere zwei haben n paar Spywareeinträge gefunden und behoben.
Malwarebytes hat 3 Trojaner gefunden und auch behoben. Leider weiß ich nicht mehr welche das waren.
Da mein Sytem zwar wieder normal läuft aber länger zu starten braucht, es anscheinend keine Rootkits/-scanner für 64 bit Systeme gibt, Panda keine Startzeitprüfung hat, startete ich erneut einen Scan mit Malwarebytes und fand einen Security.Hijack.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe (Security.Hijack)

Diemal habe ich nach Anleitung Logfiles von Malwarebytes, Hijackthis, Panda GP und Otl ertellt.

Würde mich sehr freuen, wenn mir jemand dazu was sagen könnte.

Es geht um den Rechner meiner Mutter und die bekommt langsam ne Krise, da sie nicht versteht warum trotz Schutz und behobenen Scans immer noch Malware da ist.
Im Voraus besten Dank

P.S. Das ist der infizierte (?) Registrierungsschlüssel: Debugger "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe".
Weiß nicht, ich nutze TuneUp 2012 auch, aber habe den Eintrag nicht. Bringt es was den Wert einfach zu löschen/zu ändern?
Wäre echt dankbar über Tipps/Erfahrungen/Lösungsätze.

cosinus 17.09.2012 13:52
Zitat:
Weiß nicht, ich nutze TuneUp 2012 auch, aber habe den Eintrag nicht. Bringt es was den Wert einfach zu löschen/zu ändern?
Wäre echt dankbar über Tipps/Erfahrungen/Lösungsätze.
TuneUp ist das reinste Schlangenöl, würde ich niemals installieren - und obendrein ist dieses Tool in den Händen von Laien brandgefährlich!

Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset




Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

Shizznut 17.09.2012 17:34
Hi Cosinus,
danke für die rasche Antwort. :daumenhoc
Hier erstmal das Log von Malwarebytes. Ältere finde ich leider nicht mehr (Ccleaner).
Eset läuft gerade - folgt.

Code:
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.17.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** [Administrator]

17.09.2012 15:31:24
Malwarebytes.txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 444546
Laufzeit: 1 Stunde(n), 59 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe (Security.Hijack) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Hi Cosinus,
danke für die rasche Antwort. :daumenhoc
Hier erstmal das Log von Malwarebytes. Ältere finde ich leider nicht mehr (Ccleaner).
Eset läuft gerade - folgt.

Code:
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.17.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** [Administrator]

17.09.2012 15:31:24
Malwarebytes.txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 444546
Laufzeit: 1 Stunde(n), 59 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe (Security.Hijack) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Hier noch ESET:
Code:
C:\Users\Rina\Downloads\SoftonicDownloader_fuer_g-force.exe        Win32/SoftonicDownloader application
C:\Users\Rina\Downloads\Unlocker1.9.1-x64.exe        Win32/Adware.ADON application
Danke nochmal für deine Bemühungen.

cosinus 18.09.2012 11:15
Dass der CCleaner Logs von Malwarebytes löscht höre ich zum ersten Mal!

Schau mal nach ob die Logs noch hier zu sehen sind in Form von Textdateien. Damit du die Ordner auch siehst das hier VORHER umsetzen!! => http://www.trojaner-board.de/59624-a...-sichtbar.html

Hauptlogs nach Scans (Quick, Full oder Flash):
  • XP:
    C:\Dokumente und Einstellungen\(USER)\Anwendungsdaten\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-yyyy-mm-dd.txt

  • Vista, Windows 7, 2008:
    C:\Users\(USER)\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-yyyy-mm-dd.txt

Shizznut 19.09.2012 10:31
Hi,
du ich finde leider keine ältere Logs mehr.
Hast recht: Ccleaner hat selbst mit Ccenhancer keinen Punkt von Malwarebytes.
Es liegt wohl daran, dass ich wg. des fehlenden Echtzeitschutzes in der Free Version von Malwarebytes diese dann wieder deinstalliert habe. Zurückblickend bisschen voreilig. Hätte mir wenigstens die Log-Dateien speichern sollen.

cosinus 19.09.2012 16:02
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)

Shizznut 19.09.2012 17:18
Hi,
hier die Adwcleaner-Log
Code:
# AdwCleaner v2.002 - Datei am 09/19/2012 um 18:07:56 erstellt
# Aktualisiert am 16/09/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer :
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Rina\Downloads\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gefunden : C:\ProgramData\Partner

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{28A88B70-D874-4f73-BBBA-9B2B222FB7D6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\kt_bho_dll.dll
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\kt_bho.KettleBho
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\kt_bho.KettleBho.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{86676E13-D6D8-4652-9FCF-F2047F1FB000}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v15.0 (de)

Profilname : default
Datei : C:\Users\Rina\AppData\Roaming\Mozilla\Firefox\Profiles\x7v2uwab.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Rina\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [1841 octets] - [19/09/2012 18:07:56]

########## EOF - C:\AdwCleaner[R1].txt - [1901 octets] ##########
Zitat:
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren
Hi Cosinus.
Ok, 3 Browser sind toolbar-,start- und suchmaschinen-frei.
Warum ist aber immer noch
Code:
Schlüssel Gefunden : HKCU\Software\Softonic
vorhanden?
Ich muss wahrscheinlich auch die Anwendung löschen/schreddern, nicht nur die Installationsdatei.
Aber wg ESET: Unlocker hatte ich direkt von chip.de runter geladen. Virustotal gibt auch nur 2/49 als Fund aus. Wem darf/muss/soll man vertrauen?
Wegen Ccleaner: mit Ccenhancer gibt es Bei Ccleaner doch zwei Punkte von Malwarebytes, welche man löschen kann. Habe ausversehen auf meinem Rechner nachgeschaut. Da hier kein Malwarebytes installiert ist, kann Ccleaner auch nichts anzeigen.
Wegen des Security.Hijacks von Malwarebytes: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe
Wie gesagt, das war der Registrierungseintrag: C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
Dazu: TUAutoReactivator64.exe ist 'n Bestandteil von TuneUp (Programm Deaktivator), der das jeweilige Programm nicht dauernd laufen läßt, sonder nach Bedarf aktiviert und deaktiviert.
Habe heute aus Interesse bei 'nem Kumpel, der auch TuneUp nutz, auch mit Malwarebytes scannen lassen und da gab's den Security.Hijack auch, nur mit HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe
Jo, was machen? Neu aufsetzen? Festplatte ausbauen, mbr löschen, alles löschen...? Neu kaufen? 320 Sata III is net so teuer...
Kann man jemals nach so oder so ähnlichen Situationen sicher sein?
Meine Mutter würde halt gerne wieder wichtige Dinge über ihren Rechner machen, und obwohl ich das Standard-Programm (Benutzernamen-, Passwortänderungen) durchgeführt habe, kann ich ihr gerade nicht raten solche Sachen auszuführen.
Ok, ich sehe es schon kommen. Neu aufsetzten. Kann ich dann den älteren Sicherungsimages noch trauen?
Fragen über Fragen...

cosinus 20.09.2012 09:55
Wieso neu aufsetzen, verzettel dich nicht und denk an 1000 Sachen gleichzeitig. Immer schön Schritt für Schritt!

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Löschen.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Sx].txt. (x=fortlaufende Nummer)

Shizznut 22.09.2012 17:15
Ok, Schritt für Schritt.
Hier die Adwcleaner-Log.
Und, kann man schon was sagen? Sind die gelöschten Schlüssel alles bösartige BHOs gewesen?
Code:
# AdwCleaner v2.002 - Datei am 09/22/2012 um 18:02:10 erstellt
# Aktualisiert am 16/09/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer :
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Rina\Downloads\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\ProgramData\Partner

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{28A88B70-D874-4f73-BBBA-9B2B222FB7D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\kt_bho_dll.dll
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\kt_bho.KettleBho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\kt_bho.KettleBho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{86676E13-D6D8-4652-9FCF-F2047F1FB000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

Wiederhergestellt : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\\ Mozilla Firefox v15.0 (de)

Profilname : default
Datei : C:\Users\Rina\AppData\Roaming\Mozilla\Firefox\Profiles\x7v2uwab.default\prefs.js

C:\Users\Rina\AppData\Roaming\Mozilla\Firefox\Profiles\x7v2uwab.default\user.js ... Gelöscht !

[OK] Die Datei ist sauber.

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Rina\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [1966 octets] - [19/09/2012 18:07:56]
AdwCleaner[R2].txt - [2026 octets] - [19/09/2012 18:10:53]
AdwCleaner[S1].txt - [2518 octets] - [22/09/2012 18:02:10]

########## EOF - C:\AdwCleaner[S1].txt - [2578 octets] ##########

cosinus 22.09.2012 20:07
Hätte da mal zwei Fragen bevor es weiter geht (wir sind noch nicht fertig!)

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Shizznut 23.09.2012 12:17
Hi,
Zu 1) Meinst du mit uneingeschränkt: Windows im normalen Modus starten, ohne F8 oder CD? Ja, startet normal nur halt langsamer.
Zu 2) Alle Programme sind da, keine leeren Ordner. Wie gesagt, ist halt meiner Mutters Rechner - weiß auch nicht was da alles drauf war.
Komisch ist nur, dass OpenOffice auf einmal 'ne Registrierung wollte und nach Abrechen dieser, startete OpenOffice auch nicht. Hab's deinstalliert und die aktuelle Version wieder drauf gemacht.

cosinus 23.09.2012 17:41
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Shizznut 23.09.2012 19:15
Code:
OTL logfile created on: 23.09.2012 20:33:25 - Run 4
OTL by OldTimer - Version 3.2.61.5    Folder = C:\Users\Rina\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,77 Gb Available Physical Memory | 69,24% Memory free
10,00 Gb Paging File | 8,74 Gb Available in Paging File | 87,47% Paging File free
Paging file location(s): c:\pagefile.sys 6142 6142 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 278,56 Gb Total Space | 211,05 Gb Free Space | 75,77% Space Free | Partition Type: NTFS
 
Computer Name: ASUS | User Name: Rina | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Rina\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Windows\SysWOW64\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe ()
PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()
PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe ()
MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()
MOD - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV:64bit: - (AFBAgent) -- C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (Stereo Service) -- C:\Windows\SysWOW64\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (Point64) -- C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (dc3d) -- C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys (Nokia)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia)
DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (UnlockerDriver5) -- C:\Program Files\Unlocker\UnlockerDriver5.sys ()
DRV:64bit: - (SPUVCbv) -- C:\Windows\SysNative\drivers\SPUVCBv_x64.sys (Digital Camera)
DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronic Corp.)
DRV:64bit: - (AmUStor) -- C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( )
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ATK64AMD.sys (ASUS)
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (SLEE_17_DRIVER) -- C:\Windows\SleeN1764.sys (Softwareentwicklung Remus - ArchiCrypt - )
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
IE - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.de/
IE - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000\..\SearchScopes\{6358B70C-BB3E-4389-BFD6-4802993AFFD5}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://de.msn.com/?rd=1&ucc=DE&dcc=DE&opt=0"
FF - prefs.js..extensions.enabledAddons: netvideohunter@netvideohunter.com:1.9.1
FF - prefs.js..extensions.enabledAddons: wrc@avast.com:7.0.1466
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.09.18 08:34:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.31 17:10:41 | 000,000,000 | ---D | M]
 
[2011.12.24 22:41:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rina\AppData\Roaming\mozilla\Extensions
[2012.09.19 15:56:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rina\AppData\Roaming\mozilla\Firefox\Profiles\x7v2uwab.default\extensions
[2011.12.24 22:43:04 | 000,000,000 | ---D | M] ("NetVideoHunter") -- C:\Users\Rina\AppData\Roaming\mozilla\Firefox\Profiles\x7v2uwab.default\extensions\netvideohunter@netvideohunter.com
[2012.08.09 07:27:27 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Rina\AppData\Roaming\mozilla\firefox\profiles\x7v2uwab.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.08.31 17:35:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.09.18 08:34:36 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2012.08.25 04:00:05 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.08.25 04:49:52 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.25 04:49:52 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.08.25 04:49:52 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.08.25 04:49:52 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.08.25 04:49:52 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.08.25 04:49:52 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/ig/redirectdomain?brand=ASUT&bmod=ASUT
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/ig/redirectdomain?brand=ASUT&bmod=ASUT
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Java Deployment Toolkit 7.0.70.10 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: avast! WebRep = C:\Users\Rina\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1466_0\
 
O1 HOSTS File: ([2012.08.31 14:21:29 | 000,444,231 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 127.0.0.1        www.123fporn.info
O1 - Hosts: 15256 more lines...
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000\..\Toolbar\WebBrowser: (no name) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - No CLSID value found.
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Rina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Plugin Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4CFD4E55-A208-481B-8D1A-C74644E8D949}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O27:64bit: - HKLM IFEO\ccleaner64.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\dplaunch.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\firefox.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\qs.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\skype.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\uninst.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\ccleaner64.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\dplaunch.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\firefox.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\qs.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\skype.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\uninst.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
 
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.ac3filter - C:\Windows\SysWow64\ac3filter.acm ()
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.23 13:04:09 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4.1
[2012.09.23 08:46:00 | 000,000,000 | ---D | C] -- C:\Users\Rina\AppData\Roaming\iWin
[2012.09.23 08:46:00 | 000,000,000 | ---D | C] -- C:\ProgramData\iWin
[2012.09.23 08:41:41 | 000,000,000 | ---D | C] -- C:\Users\Rina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jewel Quest Mysteries - Das Orakel von Ur
[2012.09.23 08:41:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Jewel Quest Mysteries - Das Orakel von Ur
[2012.09.23 08:41:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Jewel Quest Mysteries - Das Orakel von Ur
[2012.09.19 15:51:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.09.18 08:35:03 | 000,025,232 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2012.09.18 08:35:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2012.09.18 08:35:02 | 000,359,464 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2012.09.18 08:34:58 | 000,054,072 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2012.09.18 08:34:57 | 000,059,728 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2012.09.18 08:34:55 | 000,969,200 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2012.09.18 08:34:50 | 000,285,328 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2012.09.18 08:34:50 | 000,071,600 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2012.09.18 08:34:27 | 000,041,224 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.09.18 08:34:26 | 000,227,648 | ---- | C] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2012.09.18 08:34:15 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2012.09.18 08:34:15 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012.09.17 15:47:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.09.17 13:59:32 | 000,000,000 | ---D | C] -- C:\Users\Rina\Documents\Logfiles
[2012.09.17 12:41:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.09.17 12:41:24 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.09.17 12:41:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.09.17 12:17:57 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%
[2012.09.17 12:06:41 | 000,016,200 | ---- | C] (McAfee, Inc.) -- C:\Windows\stinger.sys
[2012.09.17 12:03:01 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.09.17 11:08:20 | 000,000,000 | ---D | C] -- C:\Users\Rina\AppData\Roaming\WinRAR
[2012.09.17 11:08:20 | 000,000,000 | ---D | C] -- C:\Users\Rina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.09.17 11:08:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.09.17 11:07:53 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012.09.17 11:02:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.09.11 19:44:32 | 000,000,000 | ---D | C] -- C:\Users\Rina\AppData\Roaming\Mad Head Games
[2012.09.11 11:02:01 | 000,000,000 | ---D | C] -- C:\Users\Rina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rite of Passage - Die perfekte Show Sammleredition
[2012.09.11 11:02:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rite of Passage - Die perfekte Show Sammleredition
[2012.09.11 11:02:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rite of Passage - Die perfekte Show Sammleredition
[2012.09.09 16:38:25 | 000,000,000 | ---D | C] -- C:\Users\Rina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Royal Detective - Herr der Statuen Sammleredition
[2012.09.09 16:38:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Royal Detective - Herr der Statuen Sammleredition
[2012.09.09 16:38:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Royal Detective - Herr der Statuen Sammleredition
[2012.09.02 13:26:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Software
[2012.09.01 17:50:25 | 000,000,000 | ---D | C] -- C:\Windows\FltMgr
[2012.09.01 17:45:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Backup
[2012.09.01 17:44:50 | 000,839,488 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysNative\PavSHook64.dll
[2012.09.01 17:44:50 | 000,546,624 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysWow64\PavSHookWow.dll
[2012.09.01 17:44:50 | 000,114,496 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysNative\PavLspHook64.dll
[2012.09.01 17:44:50 | 000,087,872 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysWow64\PavLspHookWow.dll
[2012.09.01 17:44:50 | 000,025,344 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysNative\sysHelper64.dll
[2012.09.01 17:44:50 | 000,025,344 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysWow64\sysHelper32.dll
[2012.09.01 17:44:49 | 000,216,648 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysNative\drivers\n64i1644.sys
[2012.09.01 17:44:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Security
[2012.09.01 17:44:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Panda Security
[2012.08.31 17:41:09 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.08.31 17:17:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012.08.31 16:21:47 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2012.08.31 16:21:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.08.31 16:21:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012.08.31 15:39:41 | 000,000,000 | ---D | C] -- C:\Users\Rina\AppData\Roaming\Malwarebytes
[2012.08.31 15:39:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.31 15:18:34 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.08.31 12:48:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2012.08.31 12:42:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton
[2012.08.31 12:42:51 | 000,000,000 | ---D | C] -- C:\Users\Rina\AppData\Local\NPE
[2012.08.31 12:24:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012.08.31 12:24:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2012.08.31 12:24:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2012.08.30 11:54:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ewige Reise - Das neue Atlantis Sammleredition
[2012.08.30 11:54:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ewige Reise - Das neue Atlantis Sammleredition
[2012.08.25 20:35:03 | 000,000,000 | ---D | C] -- C:\Users\Rina\AppData\Roaming\DailyMagic
[2012.08.25 20:35:03 | 000,000,000 | ---D | C] -- C:\ProgramData\DailyMagic
[2012.08.25 20:33:19 | 000,000,000 | ---D | C] -- C:\Users\Rina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dark Dimensions - Das Wachsmuseum Sammleredition
[2012.08.25 20:33:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dark Dimensions - Das Wachsmuseum Sammleredition
[2012.08.25 20:33:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Dark Dimensions - Das Wachsmuseum Sammleredition
[2012.08.25 20:26:54 | 000,000,000 | ---D | C] -- C:\Users\Rina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nightmares from the Deep - Die Schaedelinsel
[2012.08.25 20:26:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nightmares from the Deep - Die Schaedelinsel
[2012.08.25 20:26:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nightmares from the Deep - Die Schaedelinsel
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.23 20:40:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.23 20:39:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.23 20:33:09 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.23 20:33:09 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.23 20:26:20 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.23 20:25:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.23 17:13:04 | 000,001,980 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini
[2012.09.23 17:11:43 | 000,298,360 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.09.23 13:04:56 | 000,001,251 | ---- | M] () -- C:\Users\Rina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
[2012.09.23 12:26:43 | 000,001,028 | ---- | M] () -- C:\Users\Rina\Desktop\Logfiles - Verknüpfung.lnk
[2012.09.21 10:16:44 | 001,529,502 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.09.21 10:16:44 | 000,665,812 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.09.21 10:16:44 | 000,627,654 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.09.21 10:16:44 | 000,133,992 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.09.21 10:16:44 | 000,110,374 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.09.20 13:19:22 | 000,007,627 | ---- | M] () -- C:\Users\Rina\AppData\Local\Resmon.ResmonCfg
[2012.09.18 12:01:15 | 000,001,527 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini
[2012.09.18 08:34:50 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.09.17 18:13:33 | 000,000,000 | ---- | M] () -- C:\Windows\PAVSHRB.INI
[2012.09.17 15:30:20 | 000,284,700 | ---- | M] () -- C:\Windows\SysNative\drivers\APPFCONT.DAT.bck
[2012.09.17 15:30:20 | 000,284,700 | ---- | M] () -- C:\Windows\SysNative\drivers\APPFCONT.DAT
[2012.09.17 15:30:20 | 000,001,132 | ---- | M] () -- C:\Windows\SysNative\drivers\APPFLTR.CFG.bck
[2012.09.17 15:30:20 | 000,001,132 | ---- | M] () -- C:\Windows\SysNative\drivers\APPFLTR.CFG
[2012.09.17 15:30:20 | 000,000,252 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\IdsFlt.cfg.bck
[2012.09.17 15:30:20 | 000,000,068 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\NetFlt.cfg.bck
[2012.09.17 15:30:20 | 000,000,068 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\NetFlt.cfg
[2012.09.17 15:30:20 | 000,000,056 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\WnmFlt.cfg.bck
[2012.09.17 15:30:20 | 000,000,056 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\WnmFlt.cfg
[2012.09.17 15:30:20 | 000,000,056 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\DsaFlt.cfg.bck
[2012.09.17 15:30:19 | 000,303,044 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\DsaFlt.rls.bck
[2012.09.17 15:28:17 | 000,000,064 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\NetAR.wlt.bck
[2012.09.17 15:28:17 | 000,000,064 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\NetAR.wlt
[2012.09.17 14:32:36 | 000,008,627 | ---- | M] () -- C:\Windows\SysWow64\PAV_FOG.OPC
[2012.09.17 12:41:25 | 000,001,125 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.09.17 12:11:59 | 000,016,200 | ---- | M] (McAfee, Inc.) -- C:\Windows\stinger.sys
[2012.09.17 11:02:41 | 000,000,834 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.09.07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.31 16:21:47 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.08.31 14:21:29 | 000,444,231 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.08.31 12:59:24 | 000,001,139 | ---- | M] () -- C:\Users\Rina\Desktop\TeamViewer.exe.lnk
[2012.08.31 12:24:23 | 000,001,264 | ---- | M] () -- C:\Users\Rina\Desktop\Spybot - Search & Destroy.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.23 17:11:27 | 000,298,360 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.09.23 13:04:56 | 000,001,251 | ---- | C] () -- C:\Users\Rina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
[2012.09.23 12:26:43 | 000,001,028 | ---- | C] () -- C:\Users\Rina\Desktop\Logfiles - Verknüpfung.lnk
[2012.09.18 08:34:50 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt
[2012.09.17 18:13:33 | 000,000,000 | ---- | C] () -- C:\Windows\PAVSHRB.INI
[2012.09.17 12:41:25 | 000,001,125 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.09.01 17:54:38 | 000,008,627 | ---- | C] () -- C:\Windows\SysWow64\PAV_FOG.OPC
[2012.09.01 17:46:13 | 000,284,700 | ---- | C] () -- C:\Windows\SysNative\drivers\APPFCONT.DAT.bck
[2012.09.01 17:46:13 | 000,284,700 | ---- | C] () -- C:\Windows\SysNative\drivers\APPFCONT.DAT
[2012.09.01 17:46:13 | 000,001,132 | ---- | C] () -- C:\Windows\SysNative\drivers\APPFLTR.CFG.bck
[2012.09.01 17:46:13 | 000,001,132 | ---- | C] () -- C:\Windows\SysNative\drivers\APPFLTR.CFG
[2012.08.31 17:10:48 | 000,001,158 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.08.31 16:21:47 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.08.31 13:30:38 | 000,007,627 | ---- | C] () -- C:\Users\Rina\AppData\Local\Resmon.ResmonCfg
[2012.08.31 12:59:24 | 000,001,139 | ---- | C] () -- C:\Users\Rina\Desktop\TeamViewer.exe.lnk
[2012.08.31 12:24:23 | 000,001,264 | ---- | C] () -- C:\Users\Rina\Desktop\Spybot - Search & Destroy.lnk
[2011.09.23 07:14:23 | 001,526,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.09.10 13:59:55 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2010.09.11 22:39:26 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== LOP Check ==========
 
[2012.06.10 08:49:32 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\4 Friends Games
[2012.07.15 16:47:05 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Alawar
[2011.11.08 21:28:47 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Alawar Entertainment
[2011.11.15 19:14:20 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Alawar Stargaze
[2012.02.24 19:54:48 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\AlawarEntertainment
[2011.09.11 11:15:45 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Anarchy
[2012.08.06 15:59:27 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Artifex Mundi
[2011.09.09 18:31:33 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Asus WebStorage
[2012.07.22 08:05:36 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\AtlanticJourney
[2011.11.02 13:26:54 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Awem
[2012.06.03 16:45:02 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\bigwig_media
[2012.04.29 08:48:32 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Blue Tea Games
[2011.11.09 20:34:43 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Boolat Games
[2012.06.05 16:53:00 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Boomzap
[2012.06.01 18:35:51 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Casual Box
[2012.04.09 09:21:16 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\casualArts
[2011.12.02 20:38:38 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\CatmoonGames
[2012.05.15 17:10:28 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\cerasus.media
[2012.07.15 16:36:04 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Chayowo Games
[2011.10.08 09:04:21 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Crown
[2011.10.29 09:42:26 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Daedalic Entertainment
[2012.08.25 20:35:03 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\DailyMagic
[2012.06.05 18:46:40 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Dark Blue Games
[2011.12.04 14:46:16 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\DarkParablesBriarRose_BFG
[2012.01.24 19:45:31 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\DieselPuppet
[2012.05.01 08:52:50 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Dreamsdwell Stories
[2012.04.10 19:29:44 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\EleFun Games
[2012.03.18 09:19:37 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Elephant Games
[2012.06.06 19:03:45 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\ERS Game Studios
[2011.11.13 11:59:06 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Fenomen Games
[2012.02.02 19:41:38 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\GameInvest
[2012.02.12 18:46:46 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\GameMill Entertainment
[2011.12.08 21:56:07 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\GO Games
[2012.02.21 18:33:51 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\GoBoingo
[2012.06.11 18:53:09 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Gogii
[2012.03.25 08:29:57 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\HitPoint Studios
[2012.09.23 08:46:00 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\iWin
[2011.12.31 10:32:48 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\JaiboGames
[2012.06.02 09:24:07 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Joybits
[2011.09.18 12:57:37 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Lazy Turtle Games
[2012.09.11 19:44:32 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Mad Head Games
[2012.01.31 20:29:54 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\MagicIndie
[2011.09.16 18:40:56 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\margrave3_full
[2011.11.06 20:46:59 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Mariaglorum
[2012.01.13 20:32:53 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\MediaArt
[2012.05.03 16:22:42 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\MumboJumbo
[2011.10.02 10:32:04 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\OpenOffice.org
[2012.04.22 16:26:41 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Orneon
[2011.09.18 17:09:17 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\PlayFirst
[2012.05.20 07:49:09 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Playrix Entertainment
[2012.05.18 19:18:00 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\quickclick
[2011.10.03 10:41:54 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Skunk Studios
[2011.09.23 19:26:35 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\SoftGrid Client
[2012.09.20 12:41:04 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\SoundSpectrum
[2012.03.04 08:52:58 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Specialbit
[2011.09.30 19:06:05 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\SpinTop Games
[2012.08.31 13:06:24 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Steganos
[2012.01.25 18:48:15 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Striped Arts
[2012.09.17 16:50:42 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\TeamViewer
[2011.11.27 15:48:39 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\TFS2
[2011.09.23 07:15:35 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\TP
[2011.10.29 16:30:11 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\TuneUp Software
[2012.01.06 17:24:49 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\URSE Games
[2011.10.03 07:12:48 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\VampireSagaHL
[2012.05.13 07:16:55 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Vast Studios
[2012.05.13 08:39:51 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Vogat Interactive
[2012.08.06 15:30:49 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.06.10 08:49:32 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\4 Friends Games
[2011.09.10 08:27:19 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Adobe
[2012.07.15 16:47:05 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Alawar
[2011.11.08 21:28:47 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Alawar Entertainment
[2011.11.15 19:14:20 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Alawar Stargaze
[2012.02.24 19:54:48 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\AlawarEntertainment
[2011.09.11 11:15:45 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Anarchy
[2012.08.06 15:59:27 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Artifex Mundi
[2011.09.09 18:31:33 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Asus WebStorage
[2012.07.22 08:05:36 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\AtlanticJourney
[2011.11.02 13:26:54 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Awem
[2012.06.03 16:45:02 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\bigwig_media
[2012.04.29 08:48:32 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Blue Tea Games
[2011.11.09 20:34:43 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Boolat Games
[2012.06.05 16:53:00 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Boomzap
[2012.06.01 18:35:51 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Casual Box
[2012.04.09 09:21:16 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\casualArts
[2011.12.02 20:38:38 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\CatmoonGames
[2012.05.15 17:10:28 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\cerasus.media
[2012.07.15 16:36:04 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Chayowo Games
[2011.10.08 09:04:21 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Crown
[2011.10.29 09:42:26 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Daedalic Entertainment
[2012.08.25 20:35:03 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\DailyMagic
[2012.06.05 18:46:40 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Dark Blue Games
[2011.12.04 14:46:16 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\DarkParablesBriarRose_BFG
[2012.01.24 19:45:31 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\DieselPuppet
[2012.05.01 08:52:50 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Dreamsdwell Stories
[2012.04.10 19:29:44 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\EleFun Games
[2012.03.18 09:19:37 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Elephant Games
[2012.06.06 19:03:45 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\ERS Game Studios
[2011.11.13 11:59:06 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Fenomen Games
[2012.02.02 19:41:38 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\GameInvest
[2012.02.12 18:46:46 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\GameMill Entertainment
[2011.12.08 21:56:07 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\GO Games
[2012.02.21 18:33:51 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\GoBoingo
[2012.06.11 18:53:09 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Gogii
[2012.03.25 08:29:57 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\HitPoint Studios
[2011.09.09 18:13:43 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Identities
[2012.09.23 08:46:00 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\iWin
[2011.12.31 10:32:48 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\JaiboGames
[2012.06.02 09:24:07 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Joybits
[2011.09.18 12:57:37 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Lazy Turtle Games
[2011.09.09 18:54:13 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Macromedia
[2012.09.11 19:44:32 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Mad Head Games
[2012.01.31 20:29:54 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\MagicIndie
[2012.08.31 15:39:41 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Malwarebytes
[2011.09.16 18:40:56 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\margrave3_full
[2011.11.06 20:46:59 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Mariaglorum
[2009.07.14 09:44:38 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Media Center Programs
[2012.01.13 20:32:53 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\MediaArt
[2012.08.31 16:35:34 | 000,000,000 | --SD | M] -- C:\Users\Rina\AppData\Roaming\Microsoft
[2011.12.24 22:41:20 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Mozilla
[2012.05.03 16:22:42 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\MumboJumbo
[2011.10.02 10:32:04 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\OpenOffice.org
[2012.04.22 16:26:41 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Orneon
[2011.09.18 17:09:17 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\PlayFirst
[2012.05.20 07:49:09 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Playrix Entertainment
[2012.05.18 19:18:00 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\quickclick
[2011.10.03 10:41:54 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Skunk Studios
[2012.09.17 11:49:58 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Skype
[2011.09.23 19:26:35 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\SoftGrid Client
[2012.09.20 12:41:04 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\SoundSpectrum
[2012.03.04 08:52:58 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Specialbit
[2011.09.30 19:06:05 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\SpinTop Games
[2012.08.31 13:06:24 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Steganos
[2012.01.25 18:48:15 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Striped Arts
[2012.09.17 16:50:42 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\TeamViewer
[2011.11.27 15:48:39 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\TFS2
[2011.09.23 07:15:35 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\TP
[2011.10.29 16:30:11 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\TuneUp Software
[2012.01.06 17:24:49 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\URSE Games
[2011.10.03 07:12:48 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\VampireSagaHL
[2012.05.13 07:16:55 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Vast Studios
[2011.10.09 16:49:47 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\vlc
[2012.05.13 08:39:51 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\Vogat Interactive
[2012.09.17 11:17:00 | 000,000,000 | ---D | M] -- C:\Users\Rina\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
[2011.10.22 17:39:21 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\HiJackThis204.exe
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2010.04.27 21:56:03 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=3EBA5767211C34923584AAB02E7C1A20 -- C:\eSupport\eDriver\Software\Chipset\NVIDIA\MCP_SERIES\WIN7_32_5.1.2600.171\IDE\WIN7\SATA_IDE\NVSTOR32.SYS
[2010.04.27 21:56:03 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=3EBA5767211C34923584AAB02E7C1A20 -- C:\eSupport\eDriver\Software\Chipset\NVIDIA\MCP_SERIES\WIN7_32_5.1.2600.171\IDE\WINVISTA\SATA_IDE\NVSTOR32.SYS
[2010.04.08 20:32:55 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=8C98D67A228B7C4476656B80633CD485 -- C:\eSupport\eDriver\Software\Chipset\NVIDIA\MCP_SERIES\WIN7_32_5.1.2600.171\IDE\WIN7\SATARAID\NVSTOR32.SYS
[2010.04.08 20:32:55 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=8C98D67A228B7C4476656B80633CD485 -- C:\eSupport\eDriver\Software\Chipset\NVIDIA\MCP_SERIES\WIN7_32_5.1.2600.171\IDE\WINVISTA\SATARAID\NVSTOR32.SYS
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012.09.07 17:04:42 | 000,218,696 | ---- | M] () MD5=4E0D8C9F83B7FD82393F7D8CCC27E7AE -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.09.11 22:45:52 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2010.09.11 22:45:52 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 254 bytes -> C:\ProgramData\Temp:823606DE
@Alternate Data Stream - 247 bytes -> C:\ProgramData\Temp:D696AA12
@Alternate Data Stream - 245 bytes -> C:\ProgramData\Temp:D987CB43
@Alternate Data Stream - 237 bytes -> C:\ProgramData\Temp:85376176
@Alternate Data Stream - 236 bytes -> C:\ProgramData\Temp:404908B5
@Alternate Data Stream - 236 bytes -> C:\ProgramData\Temp:1C201DEB
@Alternate Data Stream - 233 bytes -> C:\ProgramData\Temp:D6D084A5
@Alternate Data Stream - 230 bytes -> C:\ProgramData\Temp:30E0D641
@Alternate Data Stream - 229 bytes -> C:\ProgramData\Temp:902C848D
@Alternate Data Stream - 229 bytes -> C:\ProgramData\Temp:884C7316
@Alternate Data Stream - 228 bytes -> C:\ProgramData\Temp:18A25CF1
@Alternate Data Stream - 223 bytes -> C:\ProgramData\Temp:661DC753
@Alternate Data Stream - 217 bytes -> C:\ProgramData\Temp:89A5891E
@Alternate Data Stream - 201 bytes -> C:\ProgramData\Temp:2F141B68
@Alternate Data Stream - 196 bytes -> C:\ProgramData\Temp:1A8BB29B
@Alternate Data Stream - 154 bytes -> C:\ProgramData\Temp:F7FFE8AF
@Alternate Data Stream - 148 bytes -> C:\ProgramData\Temp:4244811A
@Alternate Data Stream - 148 bytes -> C:\ProgramData\Temp:2A874675
@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:5A9F1AE5
@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:1E2D49E0
@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:51E83E25
@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:46283136
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:FB71A279
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:025DF3DE
@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:F9EDCFB0
@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:9812B773
@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:89CC7FD8
@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:2F474C84
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:F5E8CAE0
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:E7B4296D
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:B6D84F71
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:9195103F
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:7C8AA9A6
@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:E690114B
@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:B0A727D1
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:D5CCCBAA
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:6CF828C2
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:53BA2DF6
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:183A9046
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:13CDB0E0
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:13019F4B
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:EDE28CFC
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:BCFEA004
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:A6B07419
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:2B9555D8
@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:AD020DC3
@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:6EE8565A
@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:0988A428
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:ECF3C50F
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:6294B369
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:5FC043A8
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:5E8C18F1
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:5E73E1C2
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:ED2D63E4
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:BE0654D6
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:6A0A47E7
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:4E79C4F8
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:B3C7433B
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:4C3D5A8B
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:000D6A25
@Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:B36361EE
@Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:5DB36C47
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:BD34FFC5
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:7BFAAE70
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:6757F885
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:1709732A
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:E0888117
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:70BDB805
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:2F370DA6
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:084612C9
@Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:65C4D44A
@Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:587F3582
@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:F13867C6
@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:D999FFD5
@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:1E942FB9
@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:F26F5952
@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:4CF61E54
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:754E278B
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:2F70C0B4
@Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:B8791731
@Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:6ED8B881
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:F89F2593
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:8204AA35
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:678C1866
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:12258D63
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:E5496666
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:DC7EDF41
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:5B4686D7
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:363E775E
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:041ED421
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:F6A0889A
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:AFC732F7
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:68A41423
@Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:8AED9359
@Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:384AA0FD
@Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:2F8138B7
@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:C370B84F
@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:3C4BD225
@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:2E636DD9
@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:65137F0D
@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:4CD3F344
@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:BF6C81B2
@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:96C9689F
@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:46CBC45C
@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:2B40A7DB
@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:1E5EC928
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:4EE95FE7
@Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:E6708F08
@Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:943971F5
@Alternate Data Stream - 114 bytes -> C:\ProgramData\Temp:00258EE7
@Alternate Data Stream - 113 bytes -> C:\ProgramData\Temp:553056F1
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:DA5888A7
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:26499772
@Alternate Data Stream - 110 bytes -> C:\ProgramData\Temp:57B2B96C
@Alternate Data Stream - 109 bytes -> C:\ProgramData\Temp:1A5822A3
@Alternate Data Stream - 107 bytes -> C:\ProgramData\Temp:96AFAB10
@Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:EF4FB3C5
@Alternate Data Stream - 104 bytes -> C:\ProgramData\Temp:28DB0DC4
@Alternate Data Stream - 102 bytes -> C:\ProgramData\Temp:213AFE42
@Alternate Data Stream - 101 bytes -> C:\ProgramData\Temp:F44D3C53
@Alternate Data Stream - 100 bytes -> C:\ProgramData\Temp:27D1368B

< End of report >

cosinus 23.09.2012 19:39
Meine Anleitungen musst du auch schon richtig lesen!
Das war eine alte Version von OTL und ein CustomScan war das auch nicht!

Shizznut 23.09.2012 20:32
Sry, mein Fehler.
Könnte den Scan jetzt nur mit Teamviewer durchführen. Scanne und poste morgen bei geschlossenen Programmen.

Code:
OTL logfile created on: 24.09.2012 10:53:35 - Run 5
OTL by OldTimer - Version 3.2.66.2    Folder = C:\Users\*\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,84 Gb Available Physical Memory | 70,97% Memory free
10,00 Gb Paging File | 8,82 Gb Available in Paging File | 88,26% Paging File free
Paging file location(s): c:\pagefile.sys 6142 6142 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 278,56 Gb Total Space | 210,83 Gb Free Space | 75,69% Space Free | Partition Type: NTFS
 
Computer Name: * | User Name: * | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\*\Downloads\OTL (2).exe (OldTimer Tools)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Windows\SysWOW64\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe ()
PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()
PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe ()
MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV:64bit: - (AFBAgent) -- C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (Stereo Service) -- C:\Windows\SysWOW64\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (Point64) -- C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (dc3d) -- C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys (Nokia)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia)
DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (UnlockerDriver5) -- C:\Program Files\Unlocker\UnlockerDriver5.sys ()
DRV:64bit: - (SPUVCbv) -- C:\Windows\SysNative\drivers\SPUVCBv_x64.sys (Digital Camera)
DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronic Corp.)
DRV:64bit: - (AmUStor) -- C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( )
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ATK64AMD.sys (ASUS)
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (SLEE_17_DRIVER) -- C:\Windows\SleeN1764.sys (Softwareentwicklung Remus - ArchiCrypt - )
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
IE - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.de/
IE - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000\..\SearchScopes\{6358B70C-BB3E-4389-BFD6-4802993AFFD5}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://de.msn.com/?rd=1&ucc=DE&dcc=DE&opt=0"
FF - prefs.js..extensions.enabledAddons: netvideohunter@netvideohunter.com:1.9.1
FF - prefs.js..extensions.enabledAddons: wrc@avast.com:7.0.1466
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.09.18 08:34:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.31 17:10:41 | 000,000,000 | ---D | M]
 
[2011.12.24 22:41:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*\AppData\Roaming\mozilla\Extensions
[2012.09.19 15:56:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*\AppData\Roaming\mozilla\Firefox\Profiles\x7v2uwab.default\extensions
[2011.12.24 22:43:04 | 000,000,000 | ---D | M] ("NetVideoHunter") -- C:\Users\*\AppData\Roaming\mozilla\Firefox\Profiles\x7v2uwab.default\extensions\netvideohunter@netvideohunter.com
[2012.08.09 07:27:27 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\*\AppData\Roaming\mozilla\firefox\profiles\x7v2uwab.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.08.31 17:35:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.09.18 08:34:36 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2012.08.25 04:00:05 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.08.25 04:49:52 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.25 04:49:52 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.08.25 04:49:52 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.08.25 04:49:52 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.08.25 04:49:52 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.08.25 04:49:52 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/ig/redirectdomain?brand=ASUT&bmod=ASUT
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/ig/redirectdomain?brand=ASUT&bmod=ASUT
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Java Deployment Toolkit 7.0.70.10 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: avast! WebRep = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1466_0\
 
O1 HOSTS File: ([2012.08.31 14:21:29 | 000,444,231 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 127.0.0.1        www.123fporn.info
O1 - Hosts: 15256 more lines...
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000\..\Toolbar\WebBrowser: (no name) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - No CLSID value found.
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2572183007-3965706403-1613814924-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Plugin Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4CFD4E55-A208-481B-8D1A-C74644E8D949}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O27:64bit: - HKLM IFEO\ccleaner64.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\dplaunch.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\firefox.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\qs.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\skype.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27:64bit: - HKLM IFEO\uninst.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\ccleaner64.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\dplaunch.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\firefox.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\qs.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\skype.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O27 - HKLM IFEO\uninst.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
 
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.ac3filter - C:\Windows\SysWow64\ac3filter.acm ()
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.23 13:04:09 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4.1
[2012.09.23 08:46:00 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\iWin
[2012.09.23 08:46:00 | 000,000,000 | ---D | C] -- C:\ProgramData\iWin
[2012.09.23 08:41:41 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jewel Quest Mysteries - Das Orakel von Ur
[2012.09.23 08:41:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Jewel Quest Mysteries - Das Orakel von Ur
[2012.09.23 08:41:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Jewel Quest Mysteries - Das Orakel von Ur
[2012.09.19 15:51:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.09.18 08:35:03 | 000,025,232 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2012.09.18 08:35:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2012.09.18 08:35:02 | 000,359,464 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2012.09.18 08:34:58 | 000,054,072 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2012.09.18 08:34:57 | 000,059,728 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2012.09.18 08:34:55 | 000,969,200 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2012.09.18 08:34:50 | 000,285,328 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2012.09.18 08:34:50 | 000,071,600 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2012.09.18 08:34:27 | 000,041,224 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.09.18 08:34:26 | 000,227,648 | ---- | C] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2012.09.18 08:34:15 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2012.09.18 08:34:15 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012.09.17 15:47:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.09.17 13:59:32 | 000,000,000 | ---D | C] -- C:\Users\*\Documents\Logfiles
[2012.09.17 12:41:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.09.17 12:41:24 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.09.17 12:41:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.09.17 12:17:57 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%
[2012.09.17 12:06:41 | 000,016,200 | ---- | C] (McAfee, Inc.) -- C:\Windows\stinger.sys
[2012.09.17 12:03:01 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.09.17 11:08:20 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\WinRAR
[2012.09.17 11:08:20 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.09.17 11:08:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.09.17 11:07:53 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012.09.17 11:02:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.09.11 19:44:32 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Mad Head Games
[2012.09.11 11:02:01 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rite of Passage - Die perfekte Show Sammleredition
[2012.09.11 11:02:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rite of Passage - Die perfekte Show Sammleredition
[2012.09.11 11:02:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rite of Passage - Die perfekte Show Sammleredition
[2012.09.09 16:38:25 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Royal Detective - Herr der Statuen Sammleredition
[2012.09.09 16:38:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Royal Detective - Herr der Statuen Sammleredition
[2012.09.09 16:38:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Royal Detective - Herr der Statuen Sammleredition
[2012.09.02 13:26:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Software
[2012.09.01 17:50:25 | 000,000,000 | ---D | C] -- C:\Windows\FltMgr
[2012.09.01 17:45:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Backup
[2012.09.01 17:44:50 | 000,839,488 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysNative\PavSHook64.dll
[2012.09.01 17:44:50 | 000,546,624 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysWow64\PavSHookWow.dll
[2012.09.01 17:44:50 | 000,114,496 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysNative\PavLspHook64.dll
[2012.09.01 17:44:50 | 000,087,872 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysWow64\PavLspHookWow.dll
[2012.09.01 17:44:50 | 000,025,344 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysNative\sysHelper64.dll
[2012.09.01 17:44:50 | 000,025,344 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysWow64\sysHelper32.dll
[2012.09.01 17:44:49 | 000,216,648 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysNative\drivers\n64i1644.sys
[2012.09.01 17:44:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Security
[2012.09.01 17:44:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Panda Security
[2012.08.31 17:41:09 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.08.31 17:17:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012.08.31 16:21:47 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2012.08.31 16:21:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.08.31 16:21:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012.08.31 15:39:41 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Malwarebytes
[2012.08.31 15:39:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.31 15:18:34 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.08.31 12:48:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2012.08.31 12:42:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton
[2012.08.31 12:42:51 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Local\NPE
[2012.08.31 12:24:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012.08.31 12:24:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2012.08.31 12:24:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2012.08.30 11:54:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ewige Reise - Das neue Atlantis Sammleredition
[2012.08.30 11:54:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ewige Reise - Das neue Atlantis Sammleredition
[2012.08.25 20:35:03 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\DailyMagic
[2012.08.25 20:35:03 | 000,000,000 | ---D | C] -- C:\ProgramData\DailyMagic
[2012.08.25 20:33:19 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dark Dimensions - Das Wachsmuseum Sammleredition
[2012.08.25 20:33:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dark Dimensions - Das Wachsmuseum Sammleredition
[2012.08.25 20:33:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Dark Dimensions - Das Wachsmuseum Sammleredition
[2012.08.25 20:26:54 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nightmares from the Deep - Die Schaedelinsel
[2012.08.25 20:26:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nightmares from the Deep - Die Schaedelinsel
[2012.08.25 20:26:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nightmares from the Deep - Die Schaedelinsel
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.24 10:48:32 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.24 10:48:32 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.24 10:41:19 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.24 10:40:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.23 20:40:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.23 20:39:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.23 17:13:04 | 000,001,980 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini
[2012.09.23 17:11:43 | 000,298,360 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.09.23 13:04:56 | 000,001,251 | ---- | M] () -- C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
[2012.09.23 12:26:43 | 000,001,028 | ---- | M] () -- C:\Users\*\Desktop\Logfiles - Verknüpfung.lnk
[2012.09.21 10:16:44 | 001,529,502 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.09.21 10:16:44 | 000,665,812 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.09.21 10:16:44 | 000,627,654 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.09.21 10:16:44 | 000,133,992 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.09.21 10:16:44 | 000,110,374 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.09.20 13:19:22 | 000,007,627 | ---- | M] () -- C:\Users\*\AppData\Local\Resmon.ResmonCfg
[2012.09.18 12:01:15 | 000,001,527 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini
[2012.09.18 08:34:50 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.09.17 18:13:33 | 000,000,000 | ---- | M] () -- C:\Windows\PAVSHRB.INI
[2012.09.17 15:30:20 | 000,284,700 | ---- | M] () -- C:\Windows\SysNative\drivers\APPFCONT.DAT.bck
[2012.09.17 15:30:20 | 000,284,700 | ---- | M] () -- C:\Windows\SysNative\drivers\APPFCONT.DAT
[2012.09.17 15:30:20 | 000,001,132 | ---- | M] () -- C:\Windows\SysNative\drivers\APPFLTR.CFG.bck
[2012.09.17 15:30:20 | 000,001,132 | ---- | M] () -- C:\Windows\SysNative\drivers\APPFLTR.CFG
[2012.09.17 15:30:20 | 000,000,252 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\IdsFlt.cfg.bck
[2012.09.17 15:30:20 | 000,000,068 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\NetFlt.cfg.bck
[2012.09.17 15:30:20 | 000,000,068 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\NetFlt.cfg
[2012.09.17 15:30:20 | 000,000,056 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\WnmFlt.cfg.bck
[2012.09.17 15:30:20 | 000,000,056 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\WnmFlt.cfg
[2012.09.17 15:30:20 | 000,000,056 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\DsaFlt.cfg.bck
[2012.09.17 15:30:19 | 000,303,044 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\DsaFlt.rls.bck
[2012.09.17 15:28:17 | 000,000,064 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\NetAR.wlt.bck
[2012.09.17 15:28:17 | 000,000,064 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\NetAR.wlt
[2012.09.17 14:32:36 | 000,008,627 | ---- | M] () -- C:\Windows\SysWow64\PAV_FOG.OPC
[2012.09.17 12:41:25 | 000,001,125 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.09.17 12:11:59 | 000,016,200 | ---- | M] (McAfee, Inc.) -- C:\Windows\stinger.sys
[2012.09.17 11:02:41 | 000,000,834 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.09.07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.31 16:21:47 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.08.31 14:21:29 | 000,444,231 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.08.31 12:59:24 | 000,001,139 | ---- | M] () -- C:\Users\*\Desktop\TeamViewer.exe.lnk
[2012.08.31 12:24:23 | 000,001,264 | ---- | M] () -- C:\Users\*\Desktop\Spybot - Search & Destroy.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.23 17:11:27 | 000,298,360 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.09.23 13:04:56 | 000,001,251 | ---- | C] () -- C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
[2012.09.23 12:26:43 | 000,001,028 | ---- | C] () -- C:\Users\*\Desktop\Logfiles - Verknüpfung.lnk
[2012.09.18 08:34:50 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt
[2012.09.17 18:13:33 | 000,000,000 | ---- | C] () -- C:\Windows\PAVSHRB.INI
[2012.09.17 12:41:25 | 000,001,125 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.09.01 17:54:38 | 000,008,627 | ---- | C] () -- C:\Windows\SysWow64\PAV_FOG.OPC
[2012.09.01 17:46:13 | 000,284,700 | ---- | C] () -- C:\Windows\SysNative\drivers\APPFCONT.DAT.bck
[2012.09.01 17:46:13 | 000,284,700 | ---- | C] () -- C:\Windows\SysNative\drivers\APPFCONT.DAT
[2012.09.01 17:46:13 | 000,001,132 | ---- | C] () -- C:\Windows\SysNative\drivers\APPFLTR.CFG.bck
[2012.09.01 17:46:13 | 000,001,132 | ---- | C] () -- C:\Windows\SysNative\drivers\APPFLTR.CFG
[2012.08.31 17:10:48 | 000,001,158 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.08.31 16:21:47 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.08.31 13:30:38 | 000,007,627 | ---- | C] () -- C:\Users\*\AppData\Local\Resmon.ResmonCfg
[2012.08.31 12:59:24 | 000,001,139 | ---- | C] () -- C:\Users\*\Desktop\TeamViewer.exe.lnk
[2012.08.31 12:24:23 | 000,001,264 | ---- | C] () -- C:\Users\*\Desktop\Spybot - Search & Destroy.lnk
[2011.09.23 07:14:23 | 001,526,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.09.10 13:59:55 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2010.09.11 22:39:26 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.06.10 08:49:32 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\4 Friends Games
[2012.07.15 16:47:05 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Alawar
[2011.11.08 21:28:47 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Alawar Entertainment
[2011.11.15 19:14:20 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Alawar Stargaze
[2012.02.24 19:54:48 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\AlawarEntertainment
[2011.09.11 11:15:45 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Anarchy
[2012.08.06 15:59:27 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Artifex Mundi
[2011.09.09 18:31:33 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Asus WebStorage
[2012.07.22 08:05:36 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\AtlanticJourney
[2011.11.02 13:26:54 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Awem
[2012.06.03 16:45:02 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\bigwig_media
[2012.04.29 08:48:32 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Blue Tea Games
[2011.11.09 20:34:43 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Boolat Games
[2012.06.05 16:53:00 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Boomzap
[2012.06.01 18:35:51 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Casual Box
[2012.04.09 09:21:16 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\casualArts
[2011.12.02 20:38:38 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\CatmoonGames
[2012.05.15 17:10:28 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\cerasus.media
[2012.07.15 16:36:04 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Chayowo Games
[2011.10.08 09:04:21 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Crown
[2011.10.29 09:42:26 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Daedalic Entertainment
[2012.08.25 20:35:03 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\DailyMagic
[2012.06.05 18:46:40 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Dark Blue Games
[2011.12.04 14:46:16 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\DarkParablesBriarRose_BFG
[2012.01.24 19:45:31 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\DieselPuppet
[2012.05.01 08:52:50 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Dreamsdwell Stories
[2012.04.10 19:29:44 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\EleFun Games
[2012.03.18 09:19:37 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Elephant Games
[2012.06.06 19:03:45 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\ERS Game Studios
[2011.11.13 11:59:06 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Fenomen Games
[2012.02.02 19:41:38 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\GameInvest
[2012.02.12 18:46:46 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\GameMill Entertainment
[2011.12.08 21:56:07 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\GO Games
[2012.02.21 18:33:51 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\GoBoingo
[2012.06.11 18:53:09 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Gogii
[2012.03.25 08:29:57 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\HitPoint Studios
[2012.09.23 08:46:00 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\iWin
[2011.12.31 10:32:48 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\JaiboGames
[2012.06.02 09:24:07 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Joybits
[2011.09.18 12:57:37 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Lazy Turtle Games
[2012.09.11 19:44:32 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Mad Head Games
[2012.01.31 20:29:54 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\MagicIndie
[2011.09.16 18:40:56 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\margrave3_full
[2011.11.06 20:46:59 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Mariaglorum
[2012.01.13 20:32:53 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\MediaArt
[2012.05.03 16:22:42 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\MumboJumbo
[2011.10.02 10:32:04 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\OpenOffice.org
[2012.04.22 16:26:41 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Orneon
[2011.09.18 17:09:17 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\PlayFirst
[2012.05.20 07:49:09 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Playrix Entertainment
[2012.05.18 19:18:00 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\quickclick
[2011.10.03 10:41:54 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Skunk Studios
[2011.09.23 19:26:35 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\SoftGrid Client
[2012.09.20 12:41:04 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\SoundSpectrum
[2012.03.04 08:52:58 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Specialbit
[2011.09.30 19:06:05 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\SpinTop Games
[2012.08.31 13:06:24 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Steganos
[2012.01.25 18:48:15 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Striped Arts
[2012.09.17 16:50:42 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\TeamViewer
[2011.11.27 15:48:39 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\TFS2
[2011.09.23 07:15:35 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\TP
[2011.10.29 16:30:11 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\TuneUp Software
[2012.01.06 17:24:49 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\URSE Games
[2011.10.03 07:12:48 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\VampireSagaHL
[2012.05.13 07:16:55 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Vast Studios
[2012.05.13 08:39:51 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Vogat Interactive
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.06.10 08:49:32 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\4 Friends Games
[2011.09.10 08:27:19 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Adobe
[2012.07.15 16:47:05 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Alawar
[2011.11.08 21:28:47 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Alawar Entertainment
[2011.11.15 19:14:20 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Alawar Stargaze
[2012.02.24 19:54:48 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\AlawarEntertainment
[2011.09.11 11:15:45 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Anarchy
[2012.08.06 15:59:27 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Artifex Mundi
[2011.09.09 18:31:33 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Asus WebStorage
[2012.07.22 08:05:36 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\AtlanticJourney
[2011.11.02 13:26:54 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Awem
[2012.06.03 16:45:02 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\bigwig_media
[2012.04.29 08:48:32 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Blue Tea Games
[2011.11.09 20:34:43 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Boolat Games
[2012.06.05 16:53:00 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Boomzap
[2012.06.01 18:35:51 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Casual Box
[2012.04.09 09:21:16 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\casualArts
[2011.12.02 20:38:38 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\CatmoonGames
[2012.05.15 17:10:28 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\cerasus.media
[2012.07.15 16:36:04 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Chayowo Games
[2011.10.08 09:04:21 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Crown
[2011.10.29 09:42:26 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Daedalic Entertainment
[2012.08.25 20:35:03 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\DailyMagic
[2012.06.05 18:46:40 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Dark Blue Games
[2011.12.04 14:46:16 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\DarkParablesBriarRose_BFG
[2012.01.24 19:45:31 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\DieselPuppet
[2012.05.01 08:52:50 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Dreamsdwell Stories
[2012.04.10 19:29:44 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\EleFun Games
[2012.03.18 09:19:37 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Elephant Games
[2012.06.06 19:03:45 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\ERS Game Studios
[2011.11.13 11:59:06 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Fenomen Games
[2012.02.02 19:41:38 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\GameInvest
[2012.02.12 18:46:46 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\GameMill Entertainment
[2011.12.08 21:56:07 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\GO Games
[2012.02.21 18:33:51 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\GoBoingo
[2012.06.11 18:53:09 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Gogii
[2012.03.25 08:29:57 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\HitPoint Studios
[2011.09.09 18:13:43 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Identities
[2012.09.23 08:46:00 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\iWin
[2011.12.31 10:32:48 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\JaiboGames
[2012.06.02 09:24:07 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Joybits
[2011.09.18 12:57:37 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Lazy Turtle Games
[2011.09.09 18:54:13 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Macromedia
[2012.09.11 19:44:32 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Mad Head Games
[2012.01.31 20:29:54 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\MagicIndie
[2012.08.31 15:39:41 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Malwarebytes
[2011.09.16 18:40:56 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\margrave3_full
[2011.11.06 20:46:59 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Mariaglorum
[2009.07.14 09:44:38 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Media Center Programs
[2012.01.13 20:32:53 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\MediaArt
[2012.08.31 16:35:34 | 000,000,000 | --SD | M] -- C:\Users\*\AppData\Roaming\Microsoft
[2011.12.24 22:41:20 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Mozilla
[2012.05.03 16:22:42 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\MumboJumbo
[2011.10.02 10:32:04 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\OpenOffice.org
[2012.04.22 16:26:41 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Orneon
[2011.09.18 17:09:17 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\PlayFirst
[2012.05.20 07:49:09 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Playrix Entertainment
[2012.05.18 19:18:00 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\quickclick
[2011.10.03 10:41:54 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Skunk Studios
[2012.09.17 11:49:58 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Skype
[2011.09.23 19:26:35 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\SoftGrid Client
[2012.09.20 12:41:04 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\SoundSpectrum
[2012.03.04 08:52:58 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Specialbit
[2011.09.30 19:06:05 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\SpinTop Games
[2012.08.31 13:06:24 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Steganos
[2012.01.25 18:48:15 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Striped Arts
[2012.09.17 16:50:42 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\TeamViewer
[2011.11.27 15:48:39 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\TFS2
[2011.09.23 07:15:35 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\TP
[2011.10.29 16:30:11 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\TuneUp Software
[2012.01.06 17:24:49 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\URSE Games
[2011.10.03 07:12:48 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\VampireSagaHL
[2012.05.13 07:16:55 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Vast Studios
[2011.10.09 16:49:47 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\vlc
[2012.05.13 08:39:51 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\Vogat Interactive
[2012.09.17 11:17:00 | 000,000,000 | ---D | M] -- C:\Users\*\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
[2011.10.22 17:39:21 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\HiJackThis204.exe
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2010.04.27 21:56:03 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=3EBA5767211C34923584AAB02E7C1A20 -- C:\eSupport\eDriver\Software\Chipset\NVIDIA\MCP_SERIES\WIN7_32_5.1.2600.171\IDE\WIN7\SATA_IDE\NVSTOR32.SYS
[2010.04.27 21:56:03 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=3EBA5767211C34923584AAB02E7C1A20 -- C:\eSupport\eDriver\Software\Chipset\NVIDIA\MCP_SERIES\WIN7_32_5.1.2600.171\IDE\WINVISTA\SATA_IDE\NVSTOR32.SYS
[2010.04.08 20:32:55 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=8C98D67A228B7C4476656B80633CD485 -- C:\eSupport\eDriver\Software\Chipset\NVIDIA\MCP_SERIES\WIN7_32_5.1.2600.171\IDE\WIN7\SATARAID\NVSTOR32.SYS
[2010.04.08 20:32:55 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=8C98D67A228B7C4476656B80633CD485 -- C:\eSupport\eDriver\Software\Chipset\NVIDIA\MCP_SERIES\WIN7_32_5.1.2600.171\IDE\WINVISTA\SATARAID\NVSTOR32.SYS
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012.09.07 17:04:42 | 000,218,696 | ---- | M] () MD5=4E0D8C9F83B7FD82393F7D8CCC27E7AE -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.09.11 22:45:52 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2010.09.11 22:45:52 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 254 bytes -> C:\ProgramData\Temp:823606DE
@Alternate Data Stream - 247 bytes -> C:\ProgramData\Temp:D696AA12
@Alternate Data Stream - 245 bytes -> C:\ProgramData\Temp:D987CB43
@Alternate Data Stream - 237 bytes -> C:\ProgramData\Temp:85376176
@Alternate Data Stream - 236 bytes -> C:\ProgramData\Temp:404908B5
@Alternate Data Stream - 236 bytes -> C:\ProgramData\Temp:1C201DEB
@Alternate Data Stream - 233 bytes -> C:\ProgramData\Temp:D6D084A5
@Alternate Data Stream - 230 bytes -> C:\ProgramData\Temp:30E0D641
@Alternate Data Stream - 229 bytes -> C:\ProgramData\Temp:902C848D
@Alternate Data Stream - 229 bytes -> C:\ProgramData\Temp:884C7316
@Alternate Data Stream - 228 bytes -> C:\ProgramData\Temp:18A25CF1
@Alternate Data Stream - 223 bytes -> C:\ProgramData\Temp:661DC753
@Alternate Data Stream - 217 bytes -> C:\ProgramData\Temp:89A5891E
@Alternate Data Stream - 201 bytes -> C:\ProgramData\Temp:2F141B68
@Alternate Data Stream - 196 bytes -> C:\ProgramData\Temp:1A8BB29B
@Alternate Data Stream - 154 bytes -> C:\ProgramData\Temp:F7FFE8AF
@Alternate Data Stream - 148 bytes -> C:\ProgramData\Temp:4244811A
@Alternate Data Stream - 148 bytes -> C:\ProgramData\Temp:2A874675
@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:5A9F1AE5
@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:1E2D49E0
@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:51E83E25
@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:46283136
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:FB71A279
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:025DF3DE
@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:F9EDCFB0
@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:9812B773
@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:89CC7FD8
@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:2F474C84
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:F5E8CAE0
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:E7B4296D
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:B6D84F71
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:9195103F
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:7C8AA9A6
@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:E690114B
@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:B0A727D1
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:D5CCCBAA
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:6CF828C2
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:53BA2DF6
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:183A9046
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:13CDB0E0
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:13019F4B
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:EDE28CFC
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:BCFEA004
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:A6B07419
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:2B9555D8
@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:AD020DC3
@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:6EE8565A
@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:0988A428
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:ECF3C50F
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:6294B369
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:5FC043A8
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:5E8C18F1
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:5E73E1C2
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:ED2D63E4
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:BE0654D6
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:6A0A47E7
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:4E79C4F8
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:B3C7433B
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:4C3D5A8B
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:000D6A25
@Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:B36361EE
@Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:5DB36C47
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:BD34FFC5
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:7BFAAE70
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:6757F885
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:1709732A
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:E0888117
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:70BDB805
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:2F370DA6
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:084612C9
@Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:65C4D44A
@Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:587F3582
@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:F13867C6
@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:D999FFD5
@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:1E942FB9
@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:F26F5952
@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:4CF61E54
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:754E278B
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:2F70C0B4
@Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:B8791731
@Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:6ED8B881
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:F89F2593
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:8204AA35
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:678C1866
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:12258D63
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:E5496666
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:DC7EDF41
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:5B4686D7
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:363E775E
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:041ED421
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:F6A0889A
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:AFC732F7
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:68A41423
@Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:8AED9359
@Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:384AA0FD
@Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:2F8138B7
@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:C370B84F
@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:3C4BD225
@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:2E636DD9
@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:65137F0D
@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:4CD3F344
@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:BF6C81B2
@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:96C9689F
@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:46CBC45C
@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:2B40A7DB
@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:1E5EC928
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:4EE95FE7
@Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:E6708F08
@Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:943971F5
@Alternate Data Stream - 114 bytes -> C:\ProgramData\Temp:00258EE7
@Alternate Data Stream - 113 bytes -> C:\ProgramData\Temp:553056F1
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:DA5888A7
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:26499772
@Alternate Data Stream - 110 bytes -> C:\ProgramData\Temp:57B2B96C
@Alternate Data Stream - 109 bytes -> C:\ProgramData\Temp:1A5822A3
@Alternate Data Stream - 107 bytes -> C:\ProgramData\Temp:96AFAB10
@Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:EF4FB3C5
@Alternate Data Stream - 104 bytes -> C:\ProgramData\Temp:28DB0DC4
@Alternate Data Stream - 102 bytes -> C:\ProgramData\Temp:213AFE42
@Alternate Data Stream - 101 bytes -> C:\ProgramData\Temp:F44D3C53
@Alternate Data Stream - 100 bytes -> C:\ProgramData\Temp:27D1368B

< End of report >


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:56 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131