Trojaner-Board - Windows wurde aus Sicherheitsgründen bockiert

Also ich hab jetzt alle Schritte befolgt, da ich wirklich selbst null Plan habe, weiß ich nicht genau, wie das mit den code tags posten geht....

ich hoffe, dass es auch klappt, wenn ich das so reinstelle.

Code:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=ead3bd6bffc7244da40ffebbd42448e4

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-04-08 09:33:48

# local_time=2012-04-08 11:33:48 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 13978611 13978611 0 0

# compatibility_mode=5892 16776573 100 100 9084 171441111 0 0

# compatibility_mode=8192 67108863 100 0 106 106 0 0

# scanned=340134

# found=105

# cleaned=0

# scan_time=12445

C:\Users\Fatih & Nuli\AppData\Local\Skype\SkypePM.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\Local\Temp\cgs8h0.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\Local\Temp\cgs8h1.exe        Win32/Agent.STT trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\Local\Temp\cgs8h2.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\Local\Temp\cgs8h3.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\Local\Temp\jar_cache195968457379980758.tmp        Java/Exploit.CVE-2012-0507.D trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\Local\Temp\jar_cache2997841395078160404.tmp        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\Local\Temp\jar_cache5326574150775333862.tmp        OSX/Exploit.Smid.D trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\Local\Temp\14066578.Uninstall\Uninstall.exe        a variant of Win32/InstallCore.C application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\Local\Temp\5E2849CD-BAB0-7891-B398-3BDB82FF5D22\MyBabylonTB.exe        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\Local\Temp\nsm7149.tmp\nsh840F.tmp\SetupDataMngr_Searchqu.exe        a variant of Win32/Toolbar.SearchSuite application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\6e8ca900-5fb4382b        a variant of Java/Exploit.CVE-2012-0507.B trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\252699c1-13c1a5b6        Java/Agent.Z trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\36d40641-11266ff5        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\346c2815-576acd07        Java/Agent.DR trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\3bd8d795-20235b1f        Java/Agent.Z trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\1af16d9c-781d1526        Java/Agent.EI trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\6069a99f-3a97de12        Java/Agent.DR trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32\44bebe0-16c7169e        a variant of Java/TrojanDownloader.OpenConnection.MU trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\4620d1a1-57926d3d        a variant of Java/Exploit.CVE-2012-0507.B trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\4cd19764-6d27c09d        Java/Agent.Y trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\50a38ea7-2d91c665        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\163851ea-357304cd        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\2006fb30-39be5355        a variant of Java/Exploit.Blacole.AN trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\75839fb3-21ec0135        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\56bc3dba-2a303b00        Java/Agent.Y trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\768559be-1e512c5d        Java/Agent.DR trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows\$NtUninstallKB51148$\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GCY2LXAU\981950eda54ef12e7e16c2ee16084591[1].htm        HTML/Iframe.B.Gen virus (unable to clean)        00000000000000000000000000000000        I

C:\Windows\$NtUninstallKB51148$\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GCY2LXAU\b39c81be7525c35c9cbe036e975732a6[1].htm        HTML/Iframe.B.Gen virus (unable to clean)        00000000000000000000000000000000        I

C:\Windows\$NtUninstallKB51148$\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\68b3ed9a-66bac826        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows\$NtUninstallKB51148$\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\659d781f-2a38e004        Java/TrojanDownloader.OpenStream.NCO trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows\$NtUninstallKB51148$\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32\55a41160-5018762e        Java/Exploit.Agent.NAO trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows\$NtUninstallKB51148$\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\4d0eff64-35cff0be        Java/Exploit.Agent.NAO trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows\$NtUninstallKB51148$\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\6c015d64-73de26e7        Java/Exploit.Agent.NAO trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows\$NtUninstallKB51148$\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\2a77ed28-38893f70        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows\$NtUninstallKB51148$\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\58a3b034-1ee32290        Java/Exploit.Agent.NAO trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows\$NtUninstallKB51148$\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\4bda146-66aa20e6        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows\$NtUninstallKB51148$\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\6da4033e-4eb2c27d        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows\$NtUninstallKB51148$\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\5a032349-3864bc79        Java/Exploit.Agent.NAO trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GCY2LXAU\981950eda54ef12e7e16c2ee16084591[1].htm        HTML/Iframe.B.Gen virus (unable to clean)        00000000000000000000000000000000        I

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GCY2LXAU\b39c81be7525c35c9cbe036e975732a6[1].htm        HTML/Iframe.B.Gen virus (unable to clean)        00000000000000000000000000000000        I

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\68b3ed9a-66bac826        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\659d781f-2a38e004        Java/TrojanDownloader.OpenStream.NCO trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32\55a41160-5018762e        Java/Exploit.Agent.NAO trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\4d0eff64-35cff0be        Java/Exploit.Agent.NAO trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\6c015d64-73de26e7        Java/Exploit.Agent.NAO trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\2a77ed28-38893f70        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\58a3b034-1ee32290        Java/Exploit.Agent.NAO trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\4bda146-66aa20e6        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\6da4033e-4eb2c27d        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\5a032349-3864bc79        Java/Exploit.Agent.NAO trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\Local\Skype\SkypePM.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\Local\Temp\cgs8h0.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\Local\Temp\cgs8h1.exe        Win32/Agent.STT trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\Local\Temp\cgs8h2.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\Local\Temp\cgs8h3.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\Local\Temp\jar_cache195968457379980758.tmp        Java/Exploit.CVE-2012-0507.D trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\Local\Temp\jar_cache2997841395078160404.tmp        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\Local\Temp\jar_cache5326574150775333862.tmp        OSX/Exploit.Smid.D trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\Local\Temp\14066578.Uninstall\Uninstall.exe        a variant of Win32/InstallCore.C application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\Local\Temp\5E2849CD-BAB0-7891-B398-3BDB82FF5D22\MyBabylonTB.exe        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\Local\Temp\nsm7149.tmp\nsh840F.tmp\SetupDataMngr_Searchqu.exe        a variant of Win32/Toolbar.SearchSuite application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\6e8ca900-5fb4382b        a variant of Java/Exploit.CVE-2012-0507.B trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\252699c1-13c1a5b6        Java/Agent.Z trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\36d40641-11266ff5        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\346c2815-576acd07        Java/Agent.DR trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\3bd8d795-20235b1f        Java/Agent.Z trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\1af16d9c-781d1526        Java/Agent.EI trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\6069a99f-3a97de12        Java/Agent.DR trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32\44bebe0-16c7169e        a variant of Java/TrojanDownloader.OpenConnection.MU trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\4620d1a1-57926d3d        a variant of Java/Exploit.CVE-2012-0507.B trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\4cd19764-6d27c09d        Java/Agent.Y trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\50a38ea7-2d91c665        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\163851ea-357304cd        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\2006fb30-39be5355        a variant of Java/Exploit.Blacole.AN trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\75839fb3-21ec0135        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\56bc3dba-2a303b00        Java/Agent.Y trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Documents and Settings\Fatih & Nuli\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\768559be-1e512c5d        Java/Agent.DR trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Anwendungsdaten\Skype\SkypePM.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Anwendungsdaten\Temp\cgs8h0.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Anwendungsdaten\Temp\cgs8h1.exe        Win32/Agent.STT trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Anwendungsdaten\Temp\cgs8h2.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Anwendungsdaten\Temp\cgs8h3.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Anwendungsdaten\Temp\jar_cache195968457379980758.tmp        Java/Exploit.CVE-2012-0507.D trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Anwendungsdaten\Temp\jar_cache2997841395078160404.tmp        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Anwendungsdaten\Temp\jar_cache5326574150775333862.tmp        OSX/Exploit.Smid.D trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Anwendungsdaten\Temp\14066578.Uninstall\Uninstall.exe        a variant of Win32/InstallCore.C application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Anwendungsdaten\Temp\5E2849CD-BAB0-7891-B398-3BDB82FF5D22\MyBabylonTB.exe        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Anwendungsdaten\Temp\nsm7149.tmp\nsh840F.tmp\SetupDataMngr_Searchqu.exe        a variant of Win32/Toolbar.SearchSuite application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Temp\kjkmp.bak1        Win32/Adware.Virtumonde.NEO application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Temp\kjkmp.bak2        Win32/Adware.Virtumonde.NEO application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Temp\kjkmp.ini        Win32/Adware.Virtumonde.NEO application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Temp\kjkmp.ini2        Win32/Adware.Virtumonde.NEO application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\AppData\Local\Temp\kjkmp.tmp        Win32/Adware.Virtumonde.NEO application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\Lokale Einstellungen\Skype\SkypePM.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\Lokale Einstellungen\Temp\cgs8h0.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\Lokale Einstellungen\Temp\cgs8h1.exe        Win32/Agent.STT trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\Lokale Einstellungen\Temp\cgs8h2.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\Lokale Einstellungen\Temp\cgs8h3.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\Lokale Einstellungen\Temp\jar_cache195968457379980758.tmp        Java/Exploit.CVE-2012-0507.D trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\Lokale Einstellungen\Temp\jar_cache2997841395078160404.tmp        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\Lokale Einstellungen\Temp\jar_cache5326574150775333862.tmp        OSX/Exploit.Smid.D trojan (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\Lokale Einstellungen\Temp\14066578.Uninstall\Uninstall.exe        a variant of Win32/InstallCore.C application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\Lokale Einstellungen\Temp\5E2849CD-BAB0-7891-B398-3BDB82FF5D22\MyBabylonTB.exe        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Windows.old\Users\Fatih & Nuli\Lokale Einstellungen\Temp\nsm7149.tmp\nsh840F.tmp\SetupDataMngr_Searchqu.exe        a variant of Win32/Toolbar.SearchSuite application (unable to clean)        00000000000000000000000000000000        I

OTL Logfile:

Code:

OTL logfile created on: 10.04.2012 21:07:59 - Run 2

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Fatih & Nuli\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,02 Gb Available Physical Memory | 51,12% Memory free

4,23 Gb Paging File | 3,05 Gb Available in Paging File | 72,08% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 78,76 Gb Total Space | 19,80 Gb Free Space | 25,15% Space Free | Partition Type: NTFS

Drive D: | 111,78 Gb Total Space | 111,69 Gb Free Space | 99,92% Space Free | Partition Type: NTFS

Drive E: | 19,36 Gb Total Space | 19,27 Gb Free Space | 99,54% Space Free | Partition Type: NTFS

 

Computer Name: FATIH | User Name: Fatih & Nuli | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Fatih & Nuli\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)

PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)

PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Programme\WinRAR\RarExt.dll ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)

SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) -- C:\Programme\WinPcap\rpcapd.exe (CACE Technologies, Inc.)

SRV - (Microsoft Office Groove Audit Service) -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)

SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found

DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found

DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found

DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- system32\drivers\RTKVHDA.sys File not found

DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found

DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)

DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)

DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)

DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)

DRV - (BthAvrcp) -- C:\Windows\System32\drivers\BthAvrcp.sys (CSR, plc)

DRV - (NPF) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)

DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (FsUsbExDisk) -- C:\Windows\System32\FsUsbExDisk.Sys ()

DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)

DRV - (MSHUSBVideo) -- C:\Windows\System32\drivers\nx6000.sys (Microsoft Corporation)

DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)

DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)

DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)

DRV - (StarOpen) -- C:\Windows\System32\drivers\StarOpen.sys ()

DRV - (Tosrfusb) -- C:\Windows\System32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)

DRV - (Ser2pl) -- C:\Windows\System32\drivers\ser2pl.sys (Prolific Technology Inc.)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKU\.DEFAULT\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKU\S-1-5-18\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\Fatih & Nuli\Desktop

IE - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = 

IE - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 

IE - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.fanatik.com.tr/

IE - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=gppc&s={searchTerms}&f=4

IE - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/web/{searchTerms}?babsrc=SP_ss&affID=19950&mntrId=7cde3d99000000000000001060d01f25

IE - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADFA_de

IE - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local

 

 
 ========== FireFox ==========

 

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

 

[2009.04.06 22:54:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fatih & Nuli\AppData\Roaming\mozilla\Extensions

[2009.04.06 22:54:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fatih & Nuli\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org

[2012.03.23 10:19:51 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2011.04.14 13:36:41 | 000,002,047 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml

 

Hosts file not found

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O3 - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.

O3 - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.

O3 - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O3 - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" File not found

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000..\Run: [InfoProc] C:\ProgramData\InfoProc\jirkbgfm.exe File not found

O4 - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000..\Run: [lphcgqvj0etdv] C:\Windows\system32\lphcgqvj0etdv.exe File not found

O4 - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000..\Run: [LWgVNCM9eh] C:\ProgramData\alclujsd\uvslqvih.exe File not found

O4 - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe File not found

O4 - HKU\S-1-5-21-1003115116-3121801580-4241419497-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

O4 - Startup: C:\Users\Fatih & Nuli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_04776251.lnk = C:\Users\Fatih & Nuli\AppData\Local\Temp\_uninst_04776251.bat ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28

O8 - Extra context menu item: Free YouTube Download - C:\Users\Fatih & Nuli\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Fatih & Nuli\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Reg Error: Key error.)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)

O16 - DPF: {34635AA6-B593-4F06-9EDD-5FF60FC13310} hxxp://download.speakyweb.com/speakyldr.cab (Speaky Chat)

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} hxxp://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUplden-us.cab (MSN Photo Upload Tool)

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab (EPUImageControl Class)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} hxxp://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx (CRLDownloadWrapper Class)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} hxxp://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab (IWinAmpActiveX Class)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{75EB328B-1767-4D95-B9B9-76EF12A73CF4}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A8CBCE45-D8FE-4D0C-9544-641900AA39AD}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\Fatih & Nuli\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\Fatih & Nuli\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\G\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL NTDETECT.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {DE6B1AD2-F77E-FAFC-7B28-6BA3308464BF} - Java (Sun)

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.divxa32 - C:\Windows\System32\divxa32.acm (Kristal StudioDFileDescription)

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.3IV2 - C:\Windows\System32\3ivxVfWCodec.dll (3ivx.com)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.10 21:02:34 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\Fatih & Nuli\Desktop\OTL.exe

[2012.04.09 21:10:12 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.04.09 21:00:22 | 000,000,000 | ---D | C] -- C:\Users\Fatih & Nuli\AppData\Roaming\Avira

[2012.04.09 20:54:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2012.04.09 20:54:08 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2012.04.09 20:54:07 | 000,137,416 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2012.04.09 20:54:07 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2012.04.09 20:54:07 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys

[2012.04.09 20:54:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2012.04.09 20:54:06 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2012.04.09 18:11:33 | 000,000,000 | ---D | C] -- C:\Users\Fatih & Nuli\AppData\Roaming\Malwarebytes

[2012.04.09 18:11:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.04.09 18:11:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.04.09 18:11:24 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.04.09 18:11:24 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.04.08 20:04:37 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.04.07 16:18:00 | 000,000,000 | ---D | C] -- C:\Users\Fatih & Nuli\AppData\Roaming\Systweak

[2012.04.07 16:17:59 | 000,017,280 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\Windows\System32\roboot.exe

[2012.03.30 23:40:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab

[2012.03.23 10:52:51 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software

[2012.03.23 10:52:51 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software

[2012.03.23 10:28:53 | 000,000,000 | ---D | C] -- C:\Program Files\WiseConvert

[2012.03.18 00:27:17 | 000,000,000 | ---D | C] -- C:\Users\Fatih & Nuli\AppData\Local\{54693BFA-1511-4B53-95DE-CEB5D7EBACE6}

[2012.03.18 00:27:04 | 000,000,000 | ---D | C] -- C:\Users\Fatih & Nuli\AppData\Local\{08FC6BA2-704D-4E06-AAE9-1E3AC888AF47}

[1 C:\Users\Fatih & Nuli\Desktop\*.tmp files -> C:\Users\Fatih & Nuli\Desktop\*.tmp -> ]

[1 C:\*.tmp files -> C:\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.10 21:02:34 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Fatih & Nuli\Desktop\OTL.exe

[2012.04.10 20:48:30 | 000,634,794 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.04.10 20:48:30 | 000,601,516 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.04.10 20:48:30 | 000,128,666 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.04.10 20:48:30 | 000,106,128 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.04.10 20:42:33 | 000,028,000 | ---- | M] () -- C:\Users\Fatih & Nuli\AppData\Roaming\nvModes.001

[2012.04.10 20:42:24 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.04.10 20:42:24 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.04.10 20:42:19 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.04.10 20:42:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.04.10 20:42:01 | 2145,574,912 | -HS- | M] () -- C:\hiberfil.sys

[2012.04.10 20:40:49 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012.04.10 12:39:13 | 000,002,631 | ---- | M] () -- C:\Users\Fatih & Nuli\Desktop\Microsoft Office Word 2007.lnk

[2012.04.09 21:24:51 | 000,000,955 | ---- | M] () -- C:\Users\Fatih & Nuli\Desktop\Internet Explorer.lnk

[2012.04.09 20:54:32 | 000,001,853 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.04.09 18:11:26 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.04.07 18:22:33 | 000,000,680 | ---- | M] () -- C:\Users\Fatih & Nuli\AppData\Local\d3d9caps.dat

[2012.03.30 12:14:46 | 000,017,280 | ---- | M] (Systweak Inc., (www.systweak.com)) -- C:\Windows\System32\roboot.exe

[2012.03.24 14:57:54 | 000,006,500 | -HS- | M] () -- C:\Windows\8745717drv.spi

[2012.03.23 13:38:26 | 000,400,400 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.03.23 11:23:00 | 000,000,816 | ---- | M] () -- C:\Users\Fatih & Nuli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_04776251.lnk

[2012.03.23 10:53:44 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt

[2012.03.23 10:21:38 | 000,000,116 | ---- | M] () -- C:\user.js

[1 C:\Users\Fatih & Nuli\Desktop\*.tmp files -> C:\Users\Fatih & Nuli\Desktop\*.tmp -> ]

[1 C:\*.tmp files -> C:\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.04.09 21:24:51 | 000,000,955 | ---- | C] () -- C:\Users\Fatih & Nuli\Desktop\Internet Explorer.lnk

[2012.04.09 20:54:32 | 000,001,853 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.04.09 20:50:12 | 2145,574,912 | -HS- | C] () -- C:\hiberfil.sys

[2012.04.09 18:11:26 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.04.07 15:57:32 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.04.02 01:00:18 | 000,000,680 | ---- | C] () -- C:\Users\Fatih & Nuli\AppData\Local\d3d9caps.dat

[2012.03.24 11:42:19 | 000,006,500 | -HS- | C] () -- C:\Windows\8745717drv.spi

[2012.03.23 11:23:00 | 000,000,816 | ---- | C] () -- C:\Users\Fatih & Nuli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_04776251.lnk

[2012.03.23 10:19:52 | 000,000,116 | ---- | C] () -- C:\user.js

[2011.11.22 09:56:51 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2011.11.22 09:55:25 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2011.11.22 09:55:25 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2011.11.07 12:35:25 | 000,017,408 | ---- | C] () -- C:\Users\Fatih & Nuli\AppData\Local\WebpageIcons.db

[2011.10.30 02:02:59 | 000,019,484 | ---- | C] () -- C:\Windows\prodsett_copy.ini

[2011.10.29 22:40:57 | 000,000,112 | ---- | C] () -- C:\ProgramData\hCK0P4.dat

[2010.05.01 14:44:31 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt

 
 ========== LOP Check ==========

 

[2011.11.07 00:29:42 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Amakj

[2010.11.15 23:18:34 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Any Video Converter

[2011.07.17 22:39:31 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Babylon

[2008.10.22 22:31:09 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Bullzip

[2008.10.24 09:49:48 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

[2009.01.26 09:07:37 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Dev-Cpp

[2011.12.22 23:32:29 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\DVDVideoSoft

[2011.11.24 00:26:47 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.11.08 01:47:23 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Ekkaza

[2011.11.08 01:57:46 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Ezobnu

[2009.12.10 20:58:49 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\FrostWire

[2011.11.06 17:41:39 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Geru

[2010.06.21 07:16:20 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\GetRightToGo

[2007.12.08 18:30:16 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\ICQ

[2007.02.06 21:06:02 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\ICQ Toolbar

[2007.02.07 20:15:07 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\ICQLite

[2012.03.24 03:16:38 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Ihaso

[2009.07.25 20:37:07 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\IrfanView

[2008.05.04 23:11:57 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\kantaris

[2009.12.10 21:00:13 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\LimeWire

[2011.11.07 10:41:12 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Ohbapu

[2012.03.24 03:16:45 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Omosga

[2010.01.23 14:33:14 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\OpenOffice.org

[2011.01.25 02:24:00 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\PDF Writer

[2011.11.07 01:35:20 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Royl

[2010.05.01 14:45:17 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Samsung

[2012.04.09 20:58:30 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Systweak

[2012.03.24 03:16:41 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Taetu

[2007.01.29 15:15:48 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Template

[2012.03.24 03:16:49 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Ulta

[2009.01.05 17:30:44 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Uniblue

[2009.10.19 14:07:47 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Windows Live Writer

[2012.04.10 20:40:50 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.03.07 09:03:53 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Adobe

[2007.11.14 14:13:43 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Ahead

[2011.11.07 00:29:42 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Amakj

[2010.11.15 23:18:34 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Any Video Converter

[2012.04.09 21:00:22 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Avira

[2008.10.22 22:16:51 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\AVS4YOU

[2011.07.17 22:39:31 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Babylon

[2008.10.22 22:31:09 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Bullzip

[2008.10.24 09:49:48 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

[2009.01.26 09:07:37 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Dev-Cpp

[2010.12.29 23:24:18 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\DivX

[2011.12.22 23:32:29 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\DVDVideoSoft

[2011.11.24 00:26:47 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.11.08 01:47:23 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Ekkaza

[2011.11.08 01:57:46 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Ezobnu

[2009.12.10 20:58:49 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\FrostWire

[2011.11.06 17:41:39 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Geru

[2010.06.21 07:16:20 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\GetRightToGo

[2007.01.29 15:08:37 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Google

[2007.12.08 18:30:16 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\ICQ

[2007.02.06 21:06:02 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\ICQ Toolbar

[2007.02.07 20:15:07 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\ICQLite

[2007.01.25 02:06:29 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Identities

[2012.03.24 03:16:38 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Ihaso

[2007.11.24 11:19:54 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\InstallShield

[2009.07.25 20:37:07 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\IrfanView

[2008.05.04 23:11:57 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\kantaris

[2009.12.10 21:00:13 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\LimeWire

[2007.01.27 08:51:28 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Macromedia

[2012.04.09 18:11:33 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Malwarebytes

[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Media Center Programs

[2011.10.30 00:35:58 | 000,000,000 | --SD | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Microsoft

[2010.08.05 06:50:36 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Mozilla

[2011.11.07 10:41:12 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Ohbapu

[2012.03.24 03:16:45 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Omosga

[2010.01.23 14:33:14 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\OpenOffice.org

[2011.01.25 02:24:00 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\PDF Writer

[2011.11.07 01:35:20 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Royl

[2010.05.01 14:45:17 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Samsung

[2011.10.30 00:37:30 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Skype

[2008.08.08 08:09:43 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\skypePM

[2012.04.09 20:58:30 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Systweak

[2012.03.24 03:16:41 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Taetu

[2007.01.29 15:15:48 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Template

[2010.02.27 18:21:41 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\TVU Networks

[2012.03.24 03:16:49 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Ulta

[2009.01.05 17:30:44 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Uniblue

[2009.10.19 14:07:47 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\Windows Live Writer

[2009.01.05 17:25:21 | 000,000,000 | ---D | M] -- C:\Users\Fatih & Nuli\AppData\Roaming\WinRAR

 
 < %APPDATA%\*.exe /s >

[2009.04.21 10:30:30 | 000,000,000 | ---- | M] () -- C:\Users\Fatih & Nuli\AppData\Roaming\FrostWire\.NetworkShare\Incomplete\T-4506256-LimeWireWin4.16.6.exe

[2009.04.06 22:54:41 | 000,163,840 | ---- | M] (Mozilla Foundation) -- C:\Users\Fatih & Nuli\AppData\Roaming\LimeWire\browser\xulrunner\crashreporter.exe

[2009.04.06 22:54:41 | 000,196,608 | ---- | M] (Mozilla Foundation) -- C:\Users\Fatih & Nuli\AppData\Roaming\LimeWire\browser\xulrunner\updater.exe

[2009.04.06 22:54:41 | 000,014,848 | ---- | M] () -- C:\Users\Fatih & Nuli\AppData\Roaming\LimeWire\browser\xulrunner\xpcshell.exe

[2009.04.06 22:54:41 | 000,077,824 | ---- | M] (Mozilla Foundation) -- C:\Users\Fatih & Nuli\AppData\Roaming\LimeWire\browser\xulrunner\xpicleanup.exe

[2009.04.06 22:54:41 | 000,266,240 | ---- | M] (Mozilla Foundation) -- C:\Users\Fatih & Nuli\AppData\Roaming\LimeWire\browser\xulrunner\xpidl.exe

[2009.04.06 22:54:41 | 000,018,432 | ---- | M] () -- C:\Users\Fatih & Nuli\AppData\Roaming\LimeWire\browser\xulrunner\xpt_dump.exe

[2009.04.06 22:54:41 | 000,014,336 | ---- | M] () -- C:\Users\Fatih & Nuli\AppData\Roaming\LimeWire\browser\xulrunner\xpt_link.exe

[2009.04.06 22:54:42 | 000,073,728 | ---- | M] (Mozilla Foundation) -- C:\Users\Fatih & Nuli\AppData\Roaming\LimeWire\browser\xulrunner\xulrunner-stub.exe

[2009.04.06 22:54:42 | 000,102,400 | ---- | M] (Mozilla Foundation) -- C:\Users\Fatih & Nuli\AppData\Roaming\LimeWire\browser\xulrunner\xulrunner.exe

[2008.06.12 12:09:06 | 000,033,088 | ---- | M] () -- C:\Users\Fatih & Nuli\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.19 00:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2007.03.20 08:49:51 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\machine.inf_8ed06b47\AGP440.sys

[2007.03.20 08:49:51 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 -- C:\Windows.old\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.16400_none_b82caac9c18a4e3b\AGP440.sys

[2007.03.20 08:49:51 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=BF34B4A0E0B64440C5389AA6B902F4AD -- C:\Windows.old\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20496_none_b85af81edaeb8461\AGP440.sys

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows.old\Windows\System32\drivers\AGP440.sys

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.19 00:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.19 00:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2007.03.20 08:55:58 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows.old\Windows\System32\drivers\atapi.sys

[2007.03.20 08:55:58 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\mshdc.inf_c2a1b5ae\atapi.sys

[2007.03.20 08:55:58 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows.old\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20518_none_dbd8b4d73d81c9d0\atapi.sys

[2008.02.13 22:01:06 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys

[2008.02.13 22:01:06 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys

[2008.02.13 22:01:06 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows.old\Windows\System32\cngaudit.dll

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows.old\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2006.05.11 11:30:52 | 000,247,808 | ---- | M] (Intel Corporation) MD5=294110966CEDD127629C5BE48367C8CF -- C:\Windows.old\Windows\System32\drivers\iaStor.sys

[2006.05.11 11:30:52 | 000,247,808 | ---- | M] (Intel Corporation) MD5=294110966CEDD127629C5BE48367C8CF -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\iaahci.inf_6c3369af\iaStor.sys

[2006.05.11 11:30:52 | 000,247,808 | ---- | M] (Intel Corporation) MD5=294110966CEDD127629C5BE48367C8CF -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\iastor.inf_0d20ce62\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2008.01.19 00:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.19 00:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows.old\Windows\System32\drivers\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows.old\Windows\System32\netlogon.dll

[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows.old\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

[2009.04.11 00:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.11 00:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.19 00:35:38 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVATABUS.SYS  >

[2006.07.14 14:55:34 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=7D960340BE5B0E008BB94E4C3B991339 -- C:\Windows.old\Windows\System32\drivers\nvatabus.sys

[2006.07.14 14:55:34 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=7D960340BE5B0E008BB94E4C3B991339 -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\nvraid.inf_27229839\nvatabus.sys

 
 < MD5 for: NVSTOR.SYS  >

[2007.01.05 22:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\drivers\nvstor.sys

[2007.01.05 22:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_45f67928\nvstor.sys

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows.old\Windows\System32\drivers\nvstor.sys

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.19 00:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.19 00:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.19 00:36:20 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows.old\Windows\System32\scecli.dll

[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

[2009.04.11 00:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.11 00:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2007.04.11 23:38:44 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows.old\Windows\System32\user32.dll

[2007.04.11 23:38:44 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows.old\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll

[2007.11.03 00:15:03 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll

[2007.04.11 23:38:45 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows.old\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll

[2007.11.03 00:15:04 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll

[2008.01.19 00:36:48 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows.old\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll

[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll

[2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.19 00:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.19 00:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows.old\Windows\System32\userinit.exe

[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows.old\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

 
 < MD5 for: VIAMRAID.SYS  >

[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\DRIVER\SATA\VIA\viamraid.sys

[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows.old\Windows\System32\drivers\viamraid.sys

[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\viamraid.inf_74a36694\viamraid.sys

[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\drivers\viamraid.sys

[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\DriverStore\FileRepository\viamraid.inf_74a36694\viamraid.sys

[2006.03.31 02:18:30 | 000,100,992 | ---- | M] (VIA Technologies inc,.ltd) MD5=9F3F276C7300ED211129757A411B605F -- C:\Windows.old\Windows\System32\DriverStore\FileRepository\viamraid.inf_2d6a7e3a\viamraid.sys

 
 < MD5 for: WININIT.EXE  >

[2008.01.19 00:33:38 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.19 00:33:38 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows.old\Windows\System32\wininit.exe

[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.04.11 00:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 00:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows.old\Windows\System32\winlogon.exe

[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows.old\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe

[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe

[2008.01.19 00:33:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows.old\Windows\System32\drivers\ws2ifsl.sys

[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows.old\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys

[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys

[2008.01.18 22:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.18 22:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2007.01.25 10:24:26 | 008,753,152 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2007.01.25 10:24:20 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2007.01.25 10:24:27 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2007.01.25 10:24:44 | 015,724,544 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2007.01.25 10:24:47 | 006,008,832 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2011.11.23 02:43:48 | 000,353,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll

[2011.11.23 02:43:48 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll

 
 <           >

 
 ========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========

[C:\Windows\$NtUninstallKB51148$] -> Error: Cannot create file handle -> Unknown point type

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 24 bytes -> C:\Windows:D238450A337848CA

@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:A5B56640
 

< End of report >

--- --- ---