Hallo alle miteinander.
Seit heute hab ich mir diesen 50 € trojaner über den hier alle reden eingefangen. Habe auch gelesen das man im abgesicherten modus starten soll ...allerdings funktioniert das bei mir nicht. Benutze Windows 7, geht das da allgemein nicht mehr? Habe schon alle möglichen F tasten versucht aber der abgesicherte modus startet nicht. Hoffe ihr könnt mir helfen meinen PC wieder zu säubern.

Vielen dank im vorraus !

hi
Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.


Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.

• Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
• Lege eine leere CD in Deinen Brenner.
• ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
• Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
• Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD


Bebilderte Anleitung: OTLpe-Scan

• Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
• Mache einen Doppelklick auf das OTLPE Icon.
• Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
• Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
• Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
• Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
• OTLpe sollte nun starten.
• Drücke Run Scan, um den Scan zu starten.
• Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
• Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
• Bitte poste den Inhalt von C:\OTL.txt und Extras.txt.

Danke für die schnelle antwort!
Habe das programm gebrannt und den pc über die cd gestartet.
Da steht auch starting reatogo-x-pe... Und ein ladebalken.
Der bleibt auf vollem laden ewig stehn und irgendwann kommt ein error screen:

A problem has ben detected and windows has been shut down to prevent damage to your computer.

If this is the first time you've seen this Stop error screen, restart your computer. If this screen appears again, follow these steps:

check for viruses on your computer. Remove any newly installed hard drives or hard drive controllers. Check your hard drive to make
sure it is proberly configured and terminated. Run CHKDSK /F to chech for hard drive corruption, and then restard your computer.

Technical information:
*** STOP: 0x0000007B (0xF78DA528, 0xC0000034, 0x00000000, 0x00000000)

Und nichts weiter passiert. Und nun?

Was auch komisch ist, zwischen ladebalken und dem error bildschirm ist ein kurzer screen in dem gerade windows XP gelauncht wird, geht doch gar nicht, hab ja windows 7!

was auch seltsam ist ist das zwischen dem ladescreen und dem error screen versucht wir dwindows XP zu starten, hab doch windows 7!

sorry, für die wartezeit.
das mit xp ist ok.
gehe mal ins bios, prüfe dort, ob der ide oder ahci mode eingestellt wurde, wähle jeweils das gegenteil aus, und die cd sollte laufen

Danke für die hilfe! Habe die OTL Logfile:

OTL logfile created on: 4/1/2012 7:28:39 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium  (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = I: | %SystemRoot% = I:\Windows | %ProgramFiles% = I:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 74.34 Mb Free Space | 74.35% Space Free | Partition Type: NTFS
Drive I: | 452.45 Gb Total Space | 184.73 Gb Free Space | 40.83% Space Free | Partition Type: NTFS
Drive J: | 452.96 Gb Total Space | 374.84 Gb Free Space | 82.75% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010/01/13 10:04:08 | 000,202,752 | ---- | M] (AMD) [Auto] -- I:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- I:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer) [Auto] -- I:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2012/01/31 03:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- I:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/01/31 03:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- I:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/06/29 08:26:06 | 000,520,216 | ---- | M] (Ant.com) [Auto] -- I:\Program Files (x86)\Ant.com\IE add-on\AntUpdaterService.exe -- (AntUpdaterService)
SRV - [2011/03/28 15:51:25 | 004,323,256 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand] -- I:\Windows\SysWow64\GameMon.des -- (npggsvc)
SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- I:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/09/10 09:42:46 | 000,305,448 | ---- | M] () [On_Demand] -- I:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)
SRV - [2009/08/28 05:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto] -- I:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- I:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/10/24 19:35:44 | 000,128,296 | ---- | M] () [Auto] -- I:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/01/31 03:56:33 | 000,132,320 | ---- | M] (Avira GmbH) [Kernel | System] -- I:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012/01/31 03:56:33 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto] -- I:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/12/26 08:15:39 | 000,530,488 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- I:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV:64bit: - [2011/09/16 11:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System] -- I:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011/08/02 11:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- I:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/06/06 18:07:00 | 000,231,440 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- I:\Windows\System32\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2010/01/13 10:26:00 | 006,327,296 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- I:\Windows\System32\drivers\atipmdag.sys -- (amdkmdag)
DRV:64bit: - [2010/01/13 09:10:56 | 000,185,344 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- I:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2009/11/05 10:15:40 | 000,291,328 | ---- | M] (Realtek                                            ) [Kernel | On_Demand] -- I:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/09/29 21:34:30 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand] -- I:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009/09/11 03:19:08 | 001,705,600 | ---- | M] (Hauppauge Computer Works) [Kernel | On_Demand] -- I:\Windows\System32\drivers\HCW85BDA.sys -- (HCW85BDA)
DRV:64bit: - [2009/07/13 20:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- I:\Windows\System32\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- I:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- I:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- I:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- I:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/02 07:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- I:\Windows\System32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009/06/02 07:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System] -- I:\Windows\System32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009/06/02 07:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- I:\Windows\System32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009/03/18 12:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- I:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2009/01/09 09:02:08 | 000,031,744 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand] -- I:\Windows\System32\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:64bit: - [2007/05/14 11:06:18 | 000,027,520 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand] -- I:\Windows\System32\drivers\RimUsb_AMD64.sys -- (RimUsb)
DRV - [2005/01/02 17:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand] -- I:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m3870&r=173607100506pe425v135w4551v208
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m3870&r=173607100506pe425v135w4551v208
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m3870&r=173607100506pe425v135w4551v208
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchqu.com/413
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\stefan_dotter_ON_I\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - Reg Error: Key error. File not found
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: I:\Windows\System32\Macromed\Flash\NPSWF64_11_0_1.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: I:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: I:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: I:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: I:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: I:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: I:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: I:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: I:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: I:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: I:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/02/19 11:17:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012/02/14 03:53:21 | 000,000,000 | ---D | M] (No name found) -- I:\Program Files (x86)\Mozilla Firefox\extensions
[2012/02/19 11:17:21 | 000,134,104 | ---- | M] (Mozilla Foundation) -- I:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/12/21 01:08:50 | 000,001,392 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/12/21 01:02:40 | 000,002,252 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/12/21 01:08:50 | 000,001,153 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011/12/21 01:08:50 | 000,006,805 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/02/09 13:57:04 | 000,002,515 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
[2011/12/21 01:08:50 | 000,001,178 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/12/21 01:08:50 | 000,001,105 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010/09/22 16:24:44 | 000,001,023 | ---- | M]) - I:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 static3.cdn.ubi.com 
O1 - Hosts: 127.0.0.1 ubisoft-orbit.s3.amazonaws.com 
O1 - Hosts: 127.0.0.1 onlineconfigservice.ubi.com 
O1 - Hosts: 127.0.0.1 orbitservice.ubi.com 
O1 - Hosts: 127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com 
O2 - BHO: (Ant.com browser helper (video detector)) - {346FDE31-DFF9-418A-90C8-BA31DC9FF2EF} - I:\Program Files (x86)\Ant.com\IE add-on\Download.dll (Ant.com)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ant.com Video Downloader toolbar) - {2E924F4F-67F0-4BD8-9560-49F468E843D2} - I:\Program Files (x86)\Ant.com\IE add-on\AntToolbar.dll (Ant.com)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\stefan_dotter_ON_I\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\stefan_dotter_ON_I\..\Toolbar\WebBrowser: (Ant.com Video Downloader toolbar) - {2E924F4F-67F0-4BD8-9560-49F468E843D2} - I:\Program Files (x86)\Ant.com\IE add-on\AntToolbar.dll (Ant.com)
O4:64bit: - HKLM..\Run: [mwlDaemon] I:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] I:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] I:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] I:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [EgisTecLiveUpdate] I:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [Hotkey Utility] I:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe ()
O4 - HKU\.DEFAULT..\Run: [HanaConnect]  File not found
O4 - HKU\LocalService_ON_I..\Run: [Sidebar] I:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_I..\Run: [Sidebar] I:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\stefan_dotter_ON_I..\Run: [ABBYY Screenshot Reader Bonus]  File not found
O4 - HKU\stefan_dotter_ON_I..\Run: [ApplePhotoStreams] I:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.)
O4 - HKU\stefan_dotter_ON_I..\Run: [DAEMON Tools Lite] I:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\stefan_dotter_ON_I..\Run: [iCloudServices] I:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
O4 - HKU\stefan_dotter_ON_I..\Run: [RGSC]  File not found
O4 - HKU\stefan_dotter_ON_I..\Run: [SkypePM] I:\Users\stefan dotter\AppData\Local\Skype\SkypePM.exe ()
O4 - HKU\LocalService_ON_I..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_I..\RunOnce: [mctadmin]  File not found
O4 - Startup: Error locating startup folders.
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Download videos by Ant.com - {70AF6C9F-0818-4cf7-924A-BBDBB24211D3} - I:\Program Files (x86)\Ant.com\IE add-on\Download.dll (Ant.com)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - I:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - I:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - I:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - I:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - I:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - I:\Windows\System32\DreamScene.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
MsConfig:64bit - StartUpFolder: C:^Users^stefan dotter^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk - I:\Users\stefan dotter\AppData\Roaming\Dropbox\bin\Dropbox.exe - (Dropbox, Inc.)
MsConfig:64bit - StartUpFolder: C:^Users^stefan dotter^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk - I:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig:64bit - StartUpReg: DivXUpdate - hkey= - key= - I:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MsConfig:64bit - StartUpReg: HanaConnect - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - I:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - I:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: StartCCC - hkey= - key= - I:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - I:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig:64bit - State: "startup" - 2
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/03/21 11:37:26 | 000,000,000 | ---D | C] -- I:\Users\stefan dotter\Desktop\Setcard
[2010/03/25 15:15:40 | 000,036,136 | ---- | C] (Oberon Media) -- I:\ProgramData\FullRemove.exe
[3 I:\Windows\*.tmp files -> I:\Windows\*.tmp -> ]
[1 I:\Windows\SysWow64\*.tmp files -> I:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/04/01 06:12:55 | 000,067,584 | --S- | M] () -- I:\Windows\bootstat.dat
[2012/04/01 06:12:03 | 000,001,120 | ---- | M] () -- I:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/04/01 06:11:46 | 3163,901,952 | -HS- | M] () -- I:\hiberfil.sys
[2012/04/01 06:09:50 | 000,009,696 | -H-- | M] () -- I:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/01 06:09:50 | 000,009,696 | -H-- | M] () -- I:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/01 06:07:35 | 000,708,862 | ---- | M] () -- I:\Windows\System32\perfh007.dat
[2012/04/01 06:07:35 | 000,662,414 | ---- | M] () -- I:\Windows\System32\perfh009.dat
[2012/04/01 06:07:35 | 000,154,136 | ---- | M] () -- I:\Windows\System32\perfc007.dat
[2012/04/01 06:07:35 | 000,126,292 | ---- | M] () -- I:\Windows\System32\perfc009.dat
[2012/03/31 12:42:03 | 000,001,124 | ---- | M] () -- I:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/03/30 19:12:53 | 000,339,487 | ---- | M] () -- I:\Users\stefan dotter\Desktop\007.jpg
[2012/03/26 11:49:42 | 000,079,461 | ---- | M] () -- I:\Users\stefan dotter\Desktop\ArtDepartmentTimeLapseLogo.jpg
[2012/03/26 11:48:39 | 003,190,752 | ---- | M] () -- I:\Users\stefan dotter\Desktop\artdept.jpg
[2012/03/26 11:42:40 | 000,127,688 | ---- | M] () -- I:\Users\stefan dotter\Desktop\artworks-000005912391-i61zh5-original.jpg
[2012/03/25 05:45:12 | 213,450,632 | ---- | M] () -- I:\Users\stefan dotter\Desktop\Art Department - Essential Mix (BBC Radio1) - 22-10-2011.mp3
[2012/03/22 18:24:53 | 000,227,110 | ---- | M] () -- I:\Users\stefan dotter\Desktop\6f_03.jpg
[2012/03/22 18:24:06 | 000,176,371 | ---- | M] () -- I:\Users\stefan dotter\Desktop\5f_09.jpg
[2012/03/22 18:23:58 | 000,249,010 | ---- | M] () -- I:\Users\stefan dotter\Desktop\5f_08.jpg
[2012/03/22 18:23:46 | 000,116,751 | ---- | M] () -- I:\Users\stefan dotter\Desktop\5f_05.jpg
[2012/03/22 18:23:22 | 000,095,806 | ---- | M] () -- I:\Users\stefan dotter\Desktop\5f_01.jpg
[2012/03/22 18:22:50 | 000,190,726 | ---- | M] () -- I:\Users\stefan dotter\Desktop\4f_09.jpg
[2012/03/22 18:22:26 | 000,165,684 | ---- | M] () -- I:\Users\stefan dotter\Desktop\4f_04.jpg
[2012/03/22 18:21:19 | 000,133,028 | ---- | M] () -- I:\Users\stefan dotter\Desktop\3f_11.jpg
[2012/03/22 18:21:16 | 000,098,291 | ---- | M] () -- I:\Users\stefan dotter\Desktop\3f_10.jpg
[2012/03/22 18:21:01 | 000,162,417 | ---- | M] () -- I:\Users\stefan dotter\Desktop\3f_09.jpg
[2012/03/22 18:20:26 | 000,116,894 | ---- | M] () -- I:\Users\stefan dotter\Desktop\3f_04.jpg
[2012/03/22 18:20:03 | 000,469,995 | ---- | M] () -- I:\Users\stefan dotter\Desktop\3f_01.jpg
[2012/03/22 18:19:17 | 000,113,329 | ---- | M] () -- I:\Users\stefan dotter\Desktop\2f_02.jpg
[2012/03/22 18:19:15 | 000,236,331 | ---- | M] () -- I:\Users\stefan dotter\Desktop\2f_01.jpg
[2012/03/22 12:39:10 | 000,033,699 | ---- | M] () -- I:\Users\stefan dotter\Desktop\123.JPG
[2012/03/21 15:36:42 | 000,612,851 | ---- | M] () -- I:\Users\stefan dotter\Desktop\13310470374095eff1_cfake.jpg
[2012/03/21 11:51:36 | 000,074,202 | ---- | M] () -- I:\Users\stefan dotter\Desktop\tumblr_ltjw83NQMR1qjcgic.jpg
[2012/03/21 10:56:22 | 008,326,709 | ---- | M] () -- I:\Users\stefan dotter\Desktop\colette c'est chouette.mp3
[2012/03/20 13:37:50 | 000,017,037 | ---- | M] () -- I:\Users\stefan dotter\Desktop\1000.JPG
[2012/03/20 13:36:58 | 000,074,518 | ---- | M] () -- I:\Users\stefan dotter\Desktop\kawsbearbrick-640x490.jpg
[2012/03/20 13:30:50 | 000,015,019 | ---- | M] () -- I:\Users\stefan dotter\Desktop\999.JPG
[2012/03/20 13:29:37 | 000,077,726 | ---- | M] () -- I:\Users\stefan dotter\Desktop\recapturing-reality7-550x435.jpg
[2012/03/20 13:23:11 | 000,948,295 | ---- | M] () -- I:\Users\stefan dotter\Desktop\mercedes-benz-300-sl.2000x1333.Jan-12-2012_09.00.14.213301.jpg
[2012/03/20 11:59:50 | 000,033,196 | ---- | M] () -- I:\Users\stefan dotter\Desktop\Mr_-Bathing-Ape-Spring-Summer-2012-Collection-02.jpg
[2012/03/20 11:57:36 | 000,167,261 | ---- | M] () -- I:\Users\stefan dotter\Desktop\1jaimeellicson.jpg
[2012/03/20 11:56:26 | 000,101,156 | ---- | M] () -- I:\Users\stefan dotter\Desktop\2013-mercedes-benz-sl65-amg-2-620x413.jpg
[2012/03/20 11:49:56 | 000,120,814 | ---- | M] () -- I:\Users\stefan dotter\Desktop\JR-NYC-Arrested-motion.jpg
[2012/03/20 11:43:16 | 000,039,235 | ---- | M] () -- I:\Users\stefan dotter\Desktop\t-f-slack-oki-ni-exclusive-shoes-2-522x540.jpg
[2012/03/19 17:14:59 | 000,139,428 | ---- | M] () -- I:\Users\stefan dotter\Desktop\Kanye1.jpg
[2012/03/19 17:10:34 | 000,132,971 | ---- | M] () -- I:\Users\stefan dotter\Desktop\wtaps-leopard-hoodie-3.jpg
[2012/03/19 17:09:58 | 000,051,804 | ---- | M] () -- I:\Users\stefan dotter\Desktop\tyler-the-creator-and-glenn-obrien-supreme-0.jpg
[2012/03/19 17:08:20 | 000,096,981 | ---- | M] () -- I:\Users\stefan dotter\Desktop\herschel-supply-co-s2012-01.jpg
[2012/03/19 12:26:26 | 000,426,971 | ---- | M] () -- I:\Users\stefan dotter\Desktop\lana-del-rey-diet-mountain-dew-urban-noize.png
[2012/03/19 12:24:55 | 000,338,373 | ---- | M] () -- I:\Users\stefan dotter\Desktop\louis-vuitton-marc-jacobs-book-02.jpg
[2012/03/19 12:17:11 | 000,042,109 | ---- | M] () -- I:\Users\stefan dotter\Desktop\deadmau-cypress-hill.jpg
[2012/03/19 12:13:46 | 000,409,617 | ---- | M] () -- I:\Users\stefan dotter\Desktop\Prometheus-2012-Movie.jpg
[2012/03/19 12:10:04 | 000,052,247 | ---- | M] () -- I:\Users\stefan dotter\Desktop\i-love-ugly-caps-1.jpg
[2012/03/19 12:09:10 | 000,092,371 | ---- | M] () -- I:\Users\stefan dotter\Desktop\frank-ocean-whip-appeal-music.jpg
[2012/03/19 12:03:04 | 000,075,808 | ---- | M] () -- I:\Users\stefan dotter\Desktop\lana-del-rey-blue-jeans-official-video.jpg
[2012/03/18 12:10:18 | 000,029,431 | ---- | M] () -- I:\Users\stefan dotter\Desktop\nike-nsw-destroyer-trench-1.jpg
[2012/03/18 12:08:38 | 000,471,295 | ---- | M] () -- I:\Users\stefan dotter\Desktop\MARKMCNAIRYSTHLMLOOKBOOK014.jpg
[2012/03/18 12:01:06 | 000,109,445 | ---- | M] () -- I:\Users\stefan dotter\Desktop\tumblr_m0cyxmNRcl1r0rwm3o1_500.jpg
[2012/03/18 12:00:30 | 000,089,655 | ---- | M] () -- I:\Users\stefan dotter\Desktop\mark-mcnairy-ss2012-caliroots-shoot-13.jpg
[2012/03/17 12:30:22 | 000,101,404 | ---- | M] () -- I:\Users\stefan dotter\Desktop\generationtoge5.jpg
[2012/03/17 08:27:01 | 000,303,028 | ---- | M] () -- I:\Users\stefan dotter\Desktop\extra-butter-reebok-pump-oxt-00.jpg
[2012/03/17 08:25:10 | 000,046,448 | ---- | M] () -- I:\Users\stefan dotter\Desktop\hiroshi-fujiwara-memories-of-green-1.jpg
[2012/03/17 08:24:24 | 000,027,031 | ---- | M] () -- I:\Users\stefan dotter\Desktop\IMG_4047-e1327965224350.jpg
[2012/03/17 08:19:47 | 000,014,293 | ---- | M] () -- I:\Users\stefan dotter\Desktop\lego-imagine-ad-campaign.jpg
[2012/03/13 22:06:38 | 001,624,720 | ---- | M] () -- I:\Windows\SysWow64\PerfStringBackup.INI
[2012/03/06 18:00:56 | 000,081,642 | ---- | M] () -- I:\Users\stefan dotter\Desktop\DarcelColette150-640x905.jpg
[3 I:\Windows\*.tmp files -> I:\Windows\*.tmp -> ]
[1 I:\Windows\SysWow64\*.tmp files -> I:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/03/30 19:12:53 | 000,339,487 | ---- | C] () -- I:\Users\stefan dotter\Desktop\007.jpg
[2012/03/26 11:49:42 | 000,079,461 | ---- | C] () -- I:\Users\stefan dotter\Desktop\ArtDepartmentTimeLapseLogo.jpg
[2012/03/26 11:48:39 | 003,190,752 | ---- | C] () -- I:\Users\stefan dotter\Desktop\artdept.jpg
[2012/03/26 11:42:40 | 000,127,688 | ---- | C] () -- I:\Users\stefan dotter\Desktop\artworks-000005912391-i61zh5-original.jpg
[2012/03/25 05:38:37 | 213,450,632 | ---- | C] () -- I:\Users\stefan dotter\Desktop\Art Department - Essential Mix (BBC Radio1) - 22-10-2011.mp3
[2012/03/22 18:24:53 | 000,227,110 | ---- | C] () -- I:\Users\stefan dotter\Desktop\6f_03.jpg
[2012/03/22 18:24:06 | 000,176,371 | ---- | C] () -- I:\Users\stefan dotter\Desktop\5f_09.jpg
[2012/03/22 18:23:58 | 000,249,010 | ---- | C] () -- I:\Users\stefan dotter\Desktop\5f_08.jpg
[2012/03/22 18:23:46 | 000,116,751 | ---- | C] () -- I:\Users\stefan dotter\Desktop\5f_05.jpg
[2012/03/22 18:23:22 | 000,095,806 | ---- | C] () -- I:\Users\stefan dotter\Desktop\5f_01.jpg
[2012/03/22 18:22:50 | 000,190,726 | ---- | C] () -- I:\Users\stefan dotter\Desktop\4f_09.jpg
[2012/03/22 18:22:26 | 000,165,684 | ---- | C] () -- I:\Users\stefan dotter\Desktop\4f_04.jpg
[2012/03/22 18:21:19 | 000,133,028 | ---- | C] () -- I:\Users\stefan dotter\Desktop\3f_11.jpg
[2012/03/22 18:21:16 | 000,098,291 | ---- | C] () -- I:\Users\stefan dotter\Desktop\3f_10.jpg
[2012/03/22 18:21:01 | 000,162,417 | ---- | C] () -- I:\Users\stefan dotter\Desktop\3f_09.jpg
[2012/03/22 18:20:26 | 000,116,894 | ---- | C] () -- I:\Users\stefan dotter\Desktop\3f_04.jpg
[2012/03/22 18:20:03 | 000,469,995 | ---- | C] () -- I:\Users\stefan dotter\Desktop\3f_01.jpg
[2012/03/22 18:19:17 | 000,113,329 | ---- | C] () -- I:\Users\stefan dotter\Desktop\2f_02.jpg
[2012/03/22 18:19:15 | 000,236,331 | ---- | C] () -- I:\Users\stefan dotter\Desktop\2f_01.jpg
[2012/03/22 12:39:07 | 000,033,699 | ---- | C] () -- I:\Users\stefan dotter\Desktop\123.JPG
[2012/03/21 15:36:41 | 000,612,851 | ---- | C] () -- I:\Users\stefan dotter\Desktop\13310470374095eff1_cfake.jpg
[2012/03/21 11:51:36 | 000,074,202 | ---- | C] () -- I:\Users\stefan dotter\Desktop\tumblr_ltjw83NQMR1qjcgic.jpg
[2012/03/21 10:56:09 | 008,326,709 | ---- | C] () -- I:\Users\stefan dotter\Desktop\colette c'est chouette.mp3
[2012/03/20 13:37:50 | 000,017,037 | ---- | C] () -- I:\Users\stefan dotter\Desktop\1000.JPG
[2012/03/20 13:36:58 | 000,074,518 | ---- | C] () -- I:\Users\stefan dotter\Desktop\kawsbearbrick-640x490.jpg
[2012/03/20 13:30:50 | 000,015,019 | ---- | C] () -- I:\Users\stefan dotter\Desktop\999.JPG
[2012/03/20 13:29:37 | 000,077,726 | ---- | C] () -- I:\Users\stefan dotter\Desktop\recapturing-reality7-550x435.jpg
[2012/03/20 13:23:11 | 000,948,295 | ---- | C] () -- I:\Users\stefan dotter\Desktop\mercedes-benz-300-sl.2000x1333.Jan-12-2012_09.00.14.213301.jpg
[2012/03/20 11:59:50 | 000,033,196 | ---- | C] () -- I:\Users\stefan dotter\Desktop\Mr_-Bathing-Ape-Spring-Summer-2012-Collection-02.jpg
[2012/03/20 11:57:36 | 000,167,261 | ---- | C] () -- I:\Users\stefan dotter\Desktop\1jaimeellicson.jpg
[2012/03/20 11:56:26 | 000,101,156 | ---- | C] () -- I:\Users\stefan dotter\Desktop\2013-mercedes-benz-sl65-amg-2-620x413.jpg
[2012/03/20 11:49:56 | 000,120,814 | ---- | C] () -- I:\Users\stefan dotter\Desktop\JR-NYC-Arrested-motion.jpg
[2012/03/20 11:43:16 | 000,039,235 | ---- | C] () -- I:\Users\stefan dotter\Desktop\t-f-slack-oki-ni-exclusive-shoes-2-522x540.jpg
[2012/03/19 17:14:59 | 000,139,428 | ---- | C] () -- I:\Users\stefan dotter\Desktop\Kanye1.jpg
[2012/03/19 17:10:34 | 000,132,971 | ---- | C] () -- I:\Users\stefan dotter\Desktop\wtaps-leopard-hoodie-3.jpg
[2012/03/19 17:09:58 | 000,051,804 | ---- | C] () -- I:\Users\stefan dotter\Desktop\tyler-the-creator-and-glenn-obrien-supreme-0.jpg
[2012/03/19 17:08:20 | 000,096,981 | ---- | C] () -- I:\Users\stefan dotter\Desktop\herschel-supply-co-s2012-01.jpg
[2012/03/19 12:26:26 | 000,426,971 | ---- | C] () -- I:\Users\stefan dotter\Desktop\lana-del-rey-diet-mountain-dew-urban-noize.png
[2012/03/19 12:24:55 | 000,338,373 | ---- | C] () -- I:\Users\stefan dotter\Desktop\louis-vuitton-marc-jacobs-book-02.jpg
[2012/03/19 12:17:11 | 000,042,109 | ---- | C] () -- I:\Users\stefan dotter\Desktop\deadmau-cypress-hill.jpg
[2012/03/19 12:13:46 | 000,409,617 | ---- | C] () -- I:\Users\stefan dotter\Desktop\Prometheus-2012-Movie.jpg
[2012/03/19 12:10:04 | 000,052,247 | ---- | C] () -- I:\Users\stefan dotter\Desktop\i-love-ugly-caps-1.jpg
[2012/03/19 12:09:10 | 000,092,371 | ---- | C] () -- I:\Users\stefan dotter\Desktop\frank-ocean-whip-appeal-music.jpg
[2012/03/19 12:03:04 | 000,075,808 | ---- | C] () -- I:\Users\stefan dotter\Desktop\lana-del-rey-blue-jeans-official-video.jpg
[2012/03/18 12:10:18 | 000,029,431 | ---- | C] () -- I:\Users\stefan dotter\Desktop\nike-nsw-destroyer-trench-1.jpg
[2012/03/18 12:08:38 | 000,471,295 | ---- | C] () -- I:\Users\stefan dotter\Desktop\MARKMCNAIRYSTHLMLOOKBOOK014.jpg
[2012/03/18 12:01:06 | 000,109,445 | ---- | C] () -- I:\Users\stefan dotter\Desktop\tumblr_m0cyxmNRcl1r0rwm3o1_500.jpg
[2012/03/18 12:00:30 | 000,089,655 | ---- | C] () -- I:\Users\stefan dotter\Desktop\mark-mcnairy-ss2012-caliroots-shoot-13.jpg
[2012/03/17 12:30:22 | 000,101,404 | ---- | C] () -- I:\Users\stefan dotter\Desktop\generationtoge5.jpg
[2012/03/17 08:27:01 | 000,303,028 | ---- | C] () -- I:\Users\stefan dotter\Desktop\extra-butter-reebok-pump-oxt-00.jpg
[2012/03/17 08:25:10 | 000,046,448 | ---- | C] () -- I:\Users\stefan dotter\Desktop\hiroshi-fujiwara-memories-of-green-1.jpg
[2012/03/17 08:24:24 | 000,027,031 | ---- | C] () -- I:\Users\stefan dotter\Desktop\IMG_4047-e1327965224350.jpg
[2012/03/17 08:19:47 | 000,014,293 | ---- | C] () -- I:\Users\stefan dotter\Desktop\lego-imagine-ad-campaign.jpg
[2012/03/06 18:00:56 | 000,081,642 | ---- | C] () -- I:\Users\stefan dotter\Desktop\DarcelColette150-640x905.jpg
[2012/02/12 15:51:07 | 000,000,481 | ---- | C] () -- I:\Users\stefan dotter\AppData\Roaming\Poladroid prefs.plist
[2011/08/27 09:17:34 | 000,000,101 | ---- | C] () -- I:\Users\stefan dotter\AppData\Local\fusioncache.dat
[2011/08/24 14:19:10 | 000,056,320 | ---- | C] () -- I:\Windows\SysWow64\OpenVideo.dll
[2011/05/28 12:28:17 | 000,009,216 | ---- | C] () -- I:\Users\stefan dotter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/15 12:13:20 | 000,000,828 | ---- | C] () -- I:\Windows\my.ini
[2010/12/29 06:34:13 | 001,624,720 | ---- | C] () -- I:\Windows\SysWow64\PerfStringBackup.INI
[2010/12/24 10:02:38 | 000,000,056 | -H-- | C] () -- I:\ProgramData\ezsidmv.dat
[2010/11/17 07:54:08 | 000,001,868 | ---- | C] () -- I:\Windows\WinInit.Ini
[2010/08/22 09:28:26 | 000,000,023 | ---- | C] () -- I:\Windows\BlendSettings.ini
[2010/07/18 03:25:40 | 000,000,000 | ---- | C] () -- I:\Windows\nsreg.dat
[2010/05/03 10:31:57 | 000,000,000 | ---- | C] () -- I:\Windows\ativpsrm.bin
[2010/03/08 02:17:43 | 000,001,035 | ---- | C] () -- I:\Windows\SysWow64\atipblag.dat
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- I:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- I:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- I:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- I:\Windows\mib.bin
[2009/07/13 20:02:54 | 000,245,248 | ---- | C] () -- I:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- I:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- I:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- I:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- I:\Windows\SysWow64\mlang.dat
[2002/03/13 08:15:06 | 000,057,344 | ---- | C] () -- I:\Windows\SysWow64\mupkernps11.dll
 
========== LOP Check ==========
 
[2010/03/25 15:55:59 | 000,000,000 | ---D | M] -- I:\ProgramData\AAV
[2010/03/25 16:09:22 | 000,000,000 | ---D | M] -- I:\ProgramData\Acer
[2011/01/20 19:28:57 | 000,000,000 | ---D | M] -- I:\ProgramData\Acoustica
[2011/12/19 09:28:39 | 000,000,000 | ---D | M] -- I:\ProgramData\Ant.com
[2010/07/17 09:09:36 | 000,000,000 | -HSD | M] -- I:\ProgramData\Anwendungsdaten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Application Data
[2011/10/12 08:54:10 | 000,000,000 | ---D | M] -- I:\ProgramData\Babylon
[2012/02/09 13:57:04 | 000,000,000 | ---D | M] -- I:\ProgramData\boost_interprocess
[2010/03/25 15:42:54 | 000,000,000 | ---D | M] -- I:\ProgramData\Brockhaus Multimedia
[2011/10/26 17:17:31 | 000,000,000 | ---D | M] -- I:\ProgramData\DAEMON Tools Lite
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Documents
[2010/07/17 09:09:36 | 000,000,000 | -HSD | M] -- I:\ProgramData\Dokumente
[2011/10/26 17:43:57 | 000,000,000 | ---D | M] -- I:\ProgramData\EA Core
[2010/05/03 10:33:03 | 000,000,000 | ---D | M] -- I:\ProgramData\EgisTec
[2011/12/30 12:14:05 | 000,000,000 | ---D | M] -- I:\ProgramData\Electronic Arts
[2010/08/13 12:17:55 | 000,000,000 | ---D | M] -- I:\ProgramData\eMule
[2010/03/25 16:02:11 | 000,000,000 | ---D | M] -- I:\ProgramData\eSobi
[2010/07/17 09:09:36 | 000,000,000 | -HSD | M] -- I:\ProgramData\Favoriten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Favorites
[2010/07/17 09:15:36 | 000,000,000 | ---D | M] -- I:\ProgramData\McQcModifier-5c47-a7b0
[2011/10/07 06:57:49 | 000,000,000 | ---D | M] -- I:\ProgramData\Nevercenter
[2010/07/17 09:09:48 | 000,000,000 | ---D | M] -- I:\ProgramData\OEM
[2010/10/21 11:53:33 | 000,000,000 | ---D | M] -- I:\ProgramData\Partner
[2012/02/10 05:30:32 | 000,000,000 | ---D | M] -- I:\ProgramData\PMB Files
[2011/05/29 12:47:39 | 000,000,000 | ---D | M] -- I:\ProgramData\regid.1986-12.com.adobe
[2011/12/26 08:38:03 | 000,000,000 | ---D | M] -- I:\ProgramData\Solidshield
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Start Menu
[2010/07/17 09:26:47 | 000,000,000 | ---D | M] -- I:\ProgramData\Temp
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Templates
[2011/04/06 13:19:30 | 000,000,000 | ---D | M] -- I:\ProgramData\Ubisoft
[2010/07/17 09:09:36 | 000,000,000 | -HSD | M] -- I:\ProgramData\Vorlagen
[2010/08/13 17:39:53 | 000,000,000 | ---D | M] -- I:\ProgramData\WinZip
[2010/07/18 06:15:59 | 000,000,000 | ---D | M] -- I:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2012/02/23 04:37:58 | 000,032,632 | ---- | M] () -- I:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2010/07/18 06:42:17 | 000,000,000 | -HSD | M] -- I:\$Recycle.Bin
[2010/05/03 10:55:57 | 000,000,000 | -H-D | M] -- I:\AcerSW
[2011/09/05 08:25:52 | 000,000,000 | ---D | M] -- I:\AMD
[2011/09/05 08:30:17 | 000,000,000 | ---D | M] -- I:\ATI
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\Documents and Settings
[2010/07/17 09:09:36 | 000,000,000 | -HSD | M] -- I:\Dokumente und Einstellungen
[2010/03/25 15:07:03 | 000,000,000 | ---D | M] -- I:\Intel
[2010/03/25 16:03:33 | 000,000,000 | RH-D | M] -- I:\MSOCache
[2010/07/17 09:12:54 | 000,000,000 | -H-D | M] -- I:\OEM
[2009/07/13 23:20:08 | 000,000,000 | ---D | M] -- I:\PerfLogs
[2012/03/02 03:30:45 | 000,000,000 | R--D | M] -- I:\Program Files
[2012/03/22 04:37:17 | 000,000,000 | ---D | M] -- I:\Program Files (x86)
[2012/03/02 03:33:54 | 000,000,000 | -H-D | M] -- I:\ProgramData
[2010/07/17 09:09:36 | 000,000,000 | -HSD | M] -- I:\Programme
[2010/07/17 09:09:36 | 000,000,000 | -HSD | M] -- I:\Recovery
[2012/03/31 22:18:07 | 000,000,000 | -HSD | M] -- I:\System Volume Information
[2010/07/17 09:09:39 | 000,000,000 | R--D | M] -- I:\Users
[2012/03/31 22:20:34 | 000,000,000 | ---D | M] -- I:\Windows
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- I:\Windows\System32\drivers\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- I:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- I:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- I:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- I:\Windows\System32\drivers\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- I:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- I:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- I:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- I:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- I:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- I:\Windows\System32\cngaudit.dll
[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- I:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2009/10/06 02:06:36 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_b8b0208ee0ce1889\explorer.exe
[2011/02/26 02:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- I:\Windows\explorer.exe
[2011/02/26 02:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 01:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 21:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 01:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009/10/31 01:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- I:\Windows\SysWOW64\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 02:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 08:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009/10/06 02:35:29 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=6D4F9E4B640B413C6F73414327484C80 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_addea9f19345cd81\explorer.exe
[2010/02/04 06:49:48 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009/10/31 02:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2010/02/04 06:49:48 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 09:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/10/31 02:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2010/02/04 06:49:48 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 21:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 02:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2009/10/06 02:31:09 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=CA17F8620815267DC838E30B68CB5052 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_ae5b763cac6d568e\explorer.exe
[2011/02/26 02:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2010/02/04 06:49:48 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[2009/10/06 01:53:03 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_b8335443c7a68f7c\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2009/12/09 05:20:44 | 000,432,664 | ---- | M] (Intel Corporation) MD5=5A6C5876FB84418D08D67B8CAED5EFCF -- I:\OEM\Preload\4K\X86\iaStor.sys
[2009/12/09 05:20:44 | 000,432,664 | ---- | M] (Intel Corporation) MD5=5A6C5876FB84418D08D67B8CAED5EFCF -- I:\OEM\Preload\4KD\X86\iaStor.sys
[2009/10/02 00:58:58 | 000,537,112 | ---- | M] (Intel Corporation) MD5=631FA8935163B01FC0C02966CB3ADB92 -- I:\OEM\Preload\Autorun\DRV\Intel Storage Generic Driver\iaStor.sys
[2009/10/02 00:58:58 | 000,537,112 | ---- | M] (Intel Corporation) MD5=631FA8935163B01FC0C02966CB3ADB92 -- I:\Windows\System32\DriverStore\FileRepository\iaahci.inf_amd64_neutral_b03f80929ac23556\iaStor.sys
[2009/10/02 00:58:58 | 000,537,112 | ---- | M] (Intel Corporation) MD5=631FA8935163B01FC0C02966CB3ADB92 -- I:\Windows\System32\DriverStore\FileRepository\iastor.inf_amd64_neutral_093f326ff5f9285e\iaStor.sys
[2009/12/09 05:39:52 | 000,537,624 | ---- | M] (Intel Corporation) MD5=BF5442DC14608D18949DC83DE37E667A -- I:\OEM\Preload\4K\X64\iaStor.sys
[2009/12/09 05:39:52 | 000,537,624 | ---- | M] (Intel Corporation) MD5=BF5442DC14608D18949DC83DE37E667A -- I:\OEM\Preload\4KD\X64\iaStor.sys
[2009/12/09 05:39:52 | 000,537,624 | ---- | M] (Intel Corporation) MD5=BF5442DC14608D18949DC83DE37E667A -- I:\Windows\System32\drivers\iaStor.sys
[2009/12/09 05:39:52 | 000,537,624 | ---- | M] (Intel Corporation) MD5=BF5442DC14608D18949DC83DE37E667A -- I:\Windows\System32\DriverStore\FileRepository\iaahci.inf_amd64_neutral_a850f9740f1a3db7\iaStor.sys
[2009/12/09 05:39:52 | 000,537,624 | ---- | M] (Intel Corporation) MD5=BF5442DC14608D18949DC83DE37E667A -- I:\Windows\System32\DriverStore\FileRepository\iastor.inf_amd64_neutral_c102f5ecab1a70a7\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010/11/20 09:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011/03/11 02:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011/03/11 02:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- I:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 02:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- I:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0033117673c16921\iaStorV.sys
[2011/03/11 02:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011/03/11 02:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009/07/13 21:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- I:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/13 21:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009/07/13 21:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- I:\Windows\System32\netlogon.dll
[2009/07/13 21:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- I:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010/11/20 09:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010/11/20 08:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009/07/13 21:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- I:\Windows\SysWOW64\netlogon.dll
[2009/07/13 21:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- I:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009/07/13 21:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- I:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/13 21:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011/03/11 02:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- I:\Windows\System32\drivers\nvstor.sys
[2011/03/11 02:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- I:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_38e464dbe521cc7f\nvstor.sys
[2011/03/11 02:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011/03/11 02:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011/03/11 02:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010/11/20 09:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/13 21:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- I:\Windows\SysWOW64\scecli.dll
[2009/07/13 21:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- I:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 21:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- I:\Windows\System32\scecli.dll
[2009/07/13 21:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- I:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010/11/20 08:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010/11/20 09:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010/11/20 08:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009/07/13 21:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- I:\Windows\System32\user32.dll
[2009/07/13 21:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- I:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009/07/13 21:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- I:\Windows\SysWOW64\user32.dll
[2009/07/13 21:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- I:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010/11/20 09:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 08:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- I:\Windows\SysWOW64\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- I:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 21:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- I:\Windows\System32\userinit.exe
[2009/07/13 21:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- I:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 09:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010/11/20 09:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 21:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- I:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009/10/28 03:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- I:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009/10/28 02:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- I:\Windows\System32\winlogon.exe
[2009/10/28 02:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- I:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- I:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- I:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 147 bytes -> I:\ProgramData\Temp:4D066AD2
< End of report >
         

Sollte ja beide log dateien posten, aber es wurde nur die otl.txt erstellt. Hab ich was falsch gemacht?

Danke schonmal

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die + E Taste.

• Öffne dein Systemlaufwerk ( meistens C: )
• Suche nun
  folgenden Ordner: _OTL und öffne diesen.
• Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
• 
  Dies wird eine Movedfiles.zip Datei in _OTL erstellen
• Lade diese bitte in unseren Uploadchannel
  hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

Einen _otl ordner hat es nicht erstellt aber eine OTL.txt und extras.txt file. Bei mir war im programm der haken bei dem extra weg.
Habe sie geuploadet

edit: moment

hatte nur die hälfte kopiert
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

:OTL
O4 - HKU\stefan_dotter_ON_I..\Run: [SkypePM] I:\Users\stefan dotter\AppData\Local\Skype\SkypePM.exe ()
:Files
I:\Users\stefan dotter\AppData\Local\Skype
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.



falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die + E Taste.

• Öffne dein Systemlaufwerk ( meistens C: )
• Suche nun
  folgenden Ordner: _OTL und öffne diesen.
• Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
• 
  Dies wird eine Movedfiles.zip Datei in _OTL erstellen
• Lade diese bitte in unseren Uploadchannel
  hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus
edit: bei dir i:

Konnte den fix nicht aus der datei öffnen. Sobald ich nach der file suchen wikl kommt ein access denied error und otl hängt sich auf. Bin am befallenen pc ins internet und hab den Fix hier aus dem forum kopiert und in die textbox der otl exe eingefügt un den fix laufen lassen. Bei reboot am ende kommt ein bestätigungsfenster und danach hämgt sichs auf. Hab ihn dann runterfahren können , cd raus wieder von ide auf ahci umgestellt und normal gebootet. Zack sperrbildschirm wieder da

fix manuell eingetippt?

Nope. Copy + Paste . Läuft auch normal durch bis process conplete ist.

poste noch mal ein neues log bitte