Hallo allerseits,

wurde gerade von einem AKM Trojaner befallen und wie im board schon beschrieben, habe ich OTLPE per cd gestartet und die folgende OTL.txt erhalten.

- Normales starten funktioniert nicht
- Abgesicherter Modus (alle Varianten) funktioniert nicht

Wie soll hier weiter vorgegangen werden?

Danke fuer jede Hilfe!

OTL logfile created on: 5/8/2012 8:28:36 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Ultimate Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 65.70 Mb Free Space | 65.70% Space Free | Partition Type: NTFS
Drive D: | 931.51 Gb Total Space | 109.22 Gb Free Space | 11.72% Space Free | Partition Type: NTFS
Drive E: | 465.66 Gb Total Space | 167.42 Gb Free Space | 35.95% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011/09/08 11:48:36 | 006,583,160 | ---- | M] (Wacom Technology, Corp.) [Auto] -- E:\Program Files\Tablet\Pen\Pen_Tablet.exe -- (TabletServicePen)
SRV:64bit: - [2011/09/08 11:48:36 | 000,528,760 | ---- | M] (Wacom Technology, Corp.) [Auto] -- E:\Program Files\Tablet\Pen\Pen_TouchService.exe -- (TouchServicePen)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/13 21:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Windows\System32\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2008/09/04 00:07:40 | 001,884,928 | ---- | M] (O&O Software GmbH) [Auto] -- E:\Windows\System32\oodag.exe -- (O&O Defrag)
SRV - [2012/04/18 11:31:32 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- E:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/02/29 20:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto] -- E:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012/02/29 08:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto] -- E:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012/02/29 03:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto] -- E:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/01/22 10:15:32 | 002,230,416 | ---- | M] (Giraffic) [Auto] -- E:\Program Files (x86)\Giraffic\Veoh_GirafficWatchdog.exe -- (Giraffic)
SRV - [2011/10/12 01:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- E:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/09/07 14:24:42 | 000,008,192 | ---- | M] () [Auto] -- E:\Windows\SysWOW64\srvany.exe -- (KMService)
SRV - [2011/08/02 00:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- E:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2011/06/06 06:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto] -- E:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/05/04 09:14:38 | 000,081,408 | ---- | M] () [Auto] -- E:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2011/03/16 04:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010/03/18 08:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 07:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- E:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto] -- E:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011/12/08 00:22:40 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\sscemdm.sys -- (sscemdm)
DRV:64bit: - [2011/12/08 00:22:40 | 000,127,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\sscebus.sys -- (sscebus) SAMSUNG USB Composite Device V2 driver (WDM)
DRV:64bit: - [2011/12/08 00:22:40 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\sscemdfl.sys -- (sscemdfl)
DRV:64bit: - [2011/10/07 01:23:46 | 000,283,728 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- E:\Windows\System32\drivers\avgldx64.sys -- (Avgldx64)
DRV:64bit: - [2011/09/13 00:30:08 | 000,037,456 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot] -- E:\Windows\System32\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:64bit: - [2011/09/08 11:49:26 | 000,012,848 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- E:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV:64bit: - [2011/09/08 11:49:24 | 000,016,168 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- E:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid)
DRV:64bit: - [2011/08/08 00:08:58 | 000,046,672 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System] -- E:\Windows\System32\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:64bit: - [2011/08/02 12:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/07/10 19:14:36 | 000,375,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- E:\Windows\System32\drivers\avgtdia.sys -- (Avgtdia)
DRV:64bit: - [2011/07/10 19:14:08 | 000,029,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand] -- E:\Windows\System32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV:64bit: - [2011/07/10 19:14:06 | 000,120,400 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand] -- E:\Windows\System32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV:64bit: - [2011/07/10 19:14:06 | 000,026,704 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot] -- E:\Windows\System32\drivers\AVGIDSEH.sys -- (AVGIDSEH)
DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 07:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010/06/25 11:08:10 | 000,036,928 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand] -- E:\Windows\System32\drivers\htcnprot.sys -- (htcnprot)
DRV:64bit: - [2009/11/01 14:16:50 | 000,033,736 | ---- | M] (HTC, Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ANDROIDUSB.sys -- (HTCAND64)
DRV:64bit: - [2009/07/24 14:28:52 | 000,036,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\nx6000.sys -- (MSHUSBVideo)
DRV:64bit: - [2009/07/08 21:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot] -- E:\Windows\System32\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009/06/24 22:14:46 | 000,058,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\l160x64.sys -- (AtcL001)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- E:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2005/03/28 20:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand] -- E:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
 
IE - HKU\Julian_ON_E\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.plusnetwork.com/?sp=addr&q={searchTerms}
IE - HKU\Julian_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\Julian_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
IE - HKU\Julian_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at
IE - HKU\Julian_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 02 BE 23 90 CA 52 CC 01  [binary data]
IE - HKU\Julian_ON_E\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.plusnetwork.com/?sp=addr&q={searchTerms}
IE - HKU\Julian_ON_E\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.plusnetwork.com/?sp=addr&q={searchTerms}
IE - HKU\Julian_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Julian_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..keyword.URL: "hxxp://www.plusnetwork.com/?sp=faddr&q="
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\System32\Macromed\Flash\NPSWF64_11_2_202_233.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: E:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer: E:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: E:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@idsoftware.com/QuakeLive: E:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: E:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: E:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: E:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: E:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision: E:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming: E:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: E:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pptv.com/plugin: E:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.0659\npplugin2.dll (PPLive Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.10: E:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@wacom.com/wtPlugin,version=2.0.0.1: E:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Acrobat: E:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: E:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: E:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\wacom.com/WacomTabletPlugin: E:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2012/02/01 12:33:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2011/08/05 13:47:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011/10/19 12:33:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/04/01 04:30:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2011/12/11 12:33:32 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Julian\AppData\Roaming\Mozilla\Extensions
[2012/05/05 09:58:35 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\8dc30g66.default\extensions
[2012/04/01 04:36:44 | 000,000,000 | ---D | M] (DownloadHelper) -- E:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\8dc30g66.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/02/18 11:15:08 | 000,000,000 | ---D | M] (Cookies Manager+) -- E:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\8dc30g66.default\extensions\{bb6bc1bb-f824-4702-90cd-35e2fb24f25d}
[2012/04/01 04:30:11 | 000,000,000 | ---D | M] (Ghostery) -- E:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\8dc30g66.default\extensions\firefox@ghostery.com
[2011/12/11 12:34:59 | 000,000,000 | ---D | M] ("NetVideoHunter") -- E:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\8dc30g66.default\extensions\netvideohunter@netvideohunter.com
[2012/03/19 14:41:41 | 000,002,244 | ---- | M] () -- E:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\8dc30g66.default\searchplugins\Messenger Plus Smartbar Search.xml
[2012/02/10 11:41:31 | 000,000,000 | ---D | M] (No name found) -- E:\Program Files (x86)\Mozilla Firefox\extensions
[2012/03/22 16:08:55 | 000,000,000 | ---D | M] (Skype Click to Call) -- E:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
File not found (No name found) -- 
() (No name found) -- E:\USERS\JULIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8DC30G66.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- E:\USERS\JULIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8DC30G66.DEFAULT\EXTENSIONS\NOGROOVESHARKADS@TOBBI.TK.XPI
[2012/04/01 04:30:05 | 000,097,208 | ---- | M] (Mozilla Foundation) -- E:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/02/19 12:09:08 | 000,002,252 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/02/19 12:09:08 | 000,002,040 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml
 
O1 HOSTS File: ([2011/08/05 13:31:00 | 000,001,131 | ---- | M]) - E:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1                   activate.adobe.com
O1 - Hosts: 127.0.0.1                   practivate.adobe.com
O1 - Hosts: 127.0.0.1 activate.adobe.com   Blocking Adobe Activation
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - E:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - E:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - E:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - E:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - E:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - E:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - E:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - E:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKU\Julian_ON_E\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] E:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [OODefragTray] E:\Windows\System32\oodtray.exe (O&O Software GmbH)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] E:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] E:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager]  File not found
O4 - HKLM..\Run: [AdobeCS5ServiceManager] E:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] E:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] E:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BambooCore] E:\Program Files (x86)\Bamboo Dock\BambooCore.exe ()
O4 - HKLM..\Run: [KiesTrayAgent] E:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [PlusService] E:\Program Files (x86)\Messenger Plus!\PlusService.exe (Yuna Software)
O4 - HKLM..\Run: [PWRISOVM.EXE] E:\Program Files (x86)\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [SwitchBoard] E:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [VX5LWxsct4OYCCz] E:\Users\Julian\AppData\Roaming\itunes_service86.exe ()
O4 - HKU\Julian_ON_E..\Run: [KiesHelper] E:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKU\Julian_ON_E..\Run: [Pando Media Booster] E:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
O4 - HKU\Julian_ON_E..\Run: [PPAP] E:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe (PPLive Corporation)
O4 - HKU\Julian_ON_E..\Run: [VX5LWxsct4OYCCz] E:\Users\Julian\AppData\Roaming\itunes_service86.exe ()
O4 - HKU\LocalService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\UpdatusUser.Julian-PC_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\UpdatusUser_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser.Julian-PC_ON_E..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser_ON_E..\RunOnce: [mctadmin]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\Julian_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Julian_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Julian_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Julian_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - E:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - E:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - E:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - E:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - E:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - E:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - E:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - E:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - E:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - E:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - E:\Program Files (x86)\PPLive\PPTV\PPLive.exe (PPLive Corporation)
O9 - Extra 'Tools' menuitem : PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - E:\Program Files (x86)\PPLive\PPTV\PPLive.exe (PPLive Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - E:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - E:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 10.0.0)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 1.7.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - E:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (C:\Users\Julian\AppData\Roaming\itunes_service86.exe) - E:\Users\Julian\AppData\Roaming\itunes_service86.exe ()
O20 - HKLM Winlogon: UserInit - (C:\Users\Julian\AppData\Roaming\itunes_service86.exe) - E:\Users\Julian\AppData\Roaming\itunes_service86.exe ()
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\Julian_ON_E Winlogon: Shell - (C:\Users\Julian\AppData\Roaming\itunes_service86.exe) - E:\Users\Julian\AppData\Roaming\itunes_service86.exe ()
O20 - HKU\Julian_ON_E Winlogon: UserInit - (C:\Users\Julian\AppData\Roaming\itunes_service86.exe) - E:\Users\Julian\AppData\Roaming\itunes_service86.exe ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{28b11e63-bebc-11e0-9fa4-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{28b11e63-bebc-11e0-9fa4-806e6f6e6963}\Shell\AutoRun\command - "" = E:\SETUP.EXE
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (OODBS) -  File not found
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart) - E:\Program Files (x86)\AVG\AVG2012\avgrsa.exe (AVG Technologies CZ, s.r.o.)
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs:64bit: AppMgmt - E:\Windows\System32\appmgmts.dll (Microsoft Corporation)
 
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/05/08 11:11:16 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{40CB4E5F-0EB4-403E-8055-343BC48CF327}
[2012/05/08 11:11:04 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{34B8B237-13DE-4669-80DD-C09B23AA8D2B}
[2012/05/07 13:36:21 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{167D1434-CFBF-4BCB-938F-F6E03D50D3C3}
[2012/05/07 13:36:09 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{17C6FB0F-B6A7-4799-9899-E9584318ED77}
[2012/05/06 08:41:40 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{E8D932F4-9EDF-4CD6-82F1-4814A9117A68}
[2012/05/06 08:41:28 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{A4AE8161-070E-47E5-A348-1B433CA30F37}
[2012/05/05 17:04:38 | 000,000,000 | ---D | C] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\id Software
[2012/05/05 17:04:38 | 000,000,000 | ---D | C] -- E:\ProgramData\id Software
[2012/05/05 09:18:16 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{AE93A574-015B-472B-A6E4-4082511CC651}
[2012/05/05 09:18:05 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{CC01C58C-2EAA-488B-9527-E0EF97D4E249}
[2012/05/05 08:17:32 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
[2012/05/05 08:17:01 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Roaming\Wacom
[2012/05/05 08:16:54 | 000,000,000 | ---D | C] -- E:\ProgramData\Wacom
[2012/05/05 08:16:54 | 000,000,000 | ---D | C] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bamboo Dock
[2012/05/05 08:16:29 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Bamboo Dock
[2012/05/05 08:15:26 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Roaming\WTablet
[2012/05/05 08:15:25 | 001,326,456 | ---- | C] (Wacom Technology, Corp.) -- E:\Windows\System32\Pen_Touch_Tablet.dll
[2012/05/05 08:15:25 | 001,107,832 | ---- | C] (Wacom Technology, Corp.) -- E:\Windows\SysWow64\Pen_Touch_Tablet.dll
[2012/05/05 08:15:20 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\TabletPlugins
[2012/05/05 08:15:19 | 000,000,000 | R--D | C] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bamboo
[2012/05/05 08:15:13 | 000,012,848 | ---- | C] (Wacom Technology) -- E:\Windows\System32\drivers\wacommousefilter.sys
[2012/05/05 08:14:52 | 000,016,168 | ---- | C] (Wacom Technology) -- E:\Windows\System32\drivers\wacomvhid.sys
[2012/05/05 08:14:49 | 001,665,400 | ---- | C] (Wacom Technology, Corp.) -- E:\Windows\System32\Pen_Tablet.dll
[2012/05/05 08:14:49 | 001,401,208 | ---- | C] (Wacom Technology, Corp.) -- E:\Windows\System32\Wintab32.dll
[2012/05/05 08:14:49 | 001,392,504 | ---- | C] (Wacom Technology, Corp.) -- E:\Windows\System32\WacomMT.dll
[2012/05/05 08:14:49 | 001,369,464 | ---- | C] (Wacom Technology, Corp.) -- E:\Windows\SysWow64\Pen_Tablet.dll
[2012/05/05 08:14:49 | 001,156,472 | ---- | C] (Wacom Technology, Corp.) -- E:\Windows\SysWow64\Wintab32.dll
[2012/05/05 08:14:49 | 001,152,888 | ---- | C] (Wacom Technology, Corp.) -- E:\Windows\SysWow64\WacomMT.dll
[2012/05/05 08:14:47 | 000,000,000 | ---D | C] -- E:\Program Files\Tablet
[2012/05/04 17:09:20 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{B3DEE80D-89F5-477C-9565-E95B1EE57E17}
[2012/05/04 17:09:08 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{363D3840-E23C-4725-9B6F-7A1B81275FEB}
[2012/05/03 15:54:34 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{D5923484-09A7-4D13-9870-EBB51BBB3AF7}
[2012/05/03 15:54:22 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{59A49A6A-DBA3-481E-93ED-EC611E4A8EB0}
[2012/05/02 15:03:12 | 000,000,000 | ---D | C] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\PPLive
[2012/05/02 15:03:12 | 000,000,000 | ---D | C] -- E:\ProgramData\Jlcm
[2012/05/02 15:03:09 | 000,000,000 | ---D | C] -- E:\Users\Public\Documents\PPTV
[2012/05/02 15:03:09 | 000,000,000 | ---D | C] -- E:\Users\Julian\Documents\PPTV
[2012/05/02 15:03:06 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Roaming\PPLive
[2012/05/02 15:03:06 | 000,000,000 | ---D | C] -- E:\ProgramData\PPLive
[2012/05/02 15:03:06 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Roaming\Application Data
[2012/05/02 15:02:47 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Common Files\PPLiveNetwork
[2012/05/02 15:02:47 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\PPLive
[2012/05/02 11:14:31 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{76FC86E2-2601-43F6-864E-FFCF3FDC57A7}
[2012/05/02 11:14:18 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{47869CCC-6378-4166-9EE0-D1B086FF11D7}
[2012/05/01 06:17:49 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{FC900E33-F8CD-40BC-BABF-BCEBA78B18B8}
[2012/05/01 06:17:38 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{2DFB9162-F21D-4D92-889C-581A231C23ED}
[2012/04/30 10:21:37 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{D76DF6FD-141F-483D-AB76-DB67A8298838}
[2012/04/30 10:21:25 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{2493C0E1-FA43-4429-9D3F-6E33B290CBB9}
[2012/04/30 08:23:18 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{779F536F-FAE4-4E5E-8DAB-DCF6F23BD575}
[2012/04/30 08:23:06 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{F6248C30-2189-406D-A20E-9719FE53DCAE}
[2012/04/30 06:59:27 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{78BD7632-9CAD-4E95-BB24-66B474F2CF65}
[2012/04/30 06:59:14 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{352517C7-605B-4EFF-9E75-39FF7B86E309}
[2012/04/29 06:53:40 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{4118A2B1-E66B-4275-A8BA-CB1E7D765FE1}
[2012/04/29 06:53:28 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{27739F15-3D88-40B4-8977-8AAD5A1F4700}
[2012/04/28 10:11:28 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{1B85BC30-02DF-4D5D-B30A-E82D1C26E054}
[2012/04/28 10:11:16 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{97F3BB5F-621E-4561-8461-E2A55FCB5C29}
[2012/04/27 09:01:00 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{4B8A40AB-5183-4F9F-A68B-1028CE180E6B}
[2012/04/27 09:00:47 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{404AAD34-B09C-4B67-98CA-7C1E03A097FC}
[2012/04/26 11:07:12 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{FED093E8-73D9-4D2C-90D7-A27B6DA0FA85}
[2012/04/26 11:07:00 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{6B7FA4AD-169D-423C-AA94-209F7C4F497B}
[2012/04/25 14:15:19 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2012/04/25 14:05:10 | 000,102,400 | ---- | C] (Blizzard Entertainment) -- E:\Windows\DIIUnin.exe
[2012/04/25 14:05:10 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diablo II
[2012/04/25 14:05:10 | 000,000,000 | ---D | C] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo II
[2012/04/25 13:54:20 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Diablo II
[2012/04/25 13:41:25 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{15EE9601-3D85-4CC6-ABB4-A5F9A00B004E}
[2012/04/25 13:41:12 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{CBFB8385-6CF7-42CC-8755-BA3206AFEB26}
[2012/04/24 18:42:17 | 000,096,256 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\mshtmled.dll
[2012/04/24 18:42:17 | 000,072,704 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\mshtmled.dll
[2012/04/24 18:42:16 | 002,311,168 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\jscript9.dll
[2012/04/24 18:42:16 | 000,231,936 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\url.dll
[2012/04/24 18:42:15 | 001,799,168 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\jscript9.dll
[2012/04/24 18:42:15 | 000,716,800 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\jscript.dll
[2012/04/24 18:42:15 | 000,248,320 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\ieui.dll
[2012/04/24 18:42:15 | 000,237,056 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\url.dll
[2012/04/24 18:42:15 | 000,176,640 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\ieui.dll
[2012/04/24 18:42:14 | 001,493,504 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\inetcpl.cpl
[2012/04/24 18:42:14 | 001,427,456 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\inetcpl.cpl
[2012/04/24 18:42:14 | 000,818,688 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\jscript.dll
[2012/04/24 18:41:55 | 005,559,152 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\ntoskrnl.exe
[2012/04/24 18:41:54 | 003,968,368 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\ntkrnlpa.exe
[2012/04/24 18:41:54 | 003,913,072 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\ntoskrnl.exe
[2012/04/24 18:37:36 | 000,023,408 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\drivers\fs_rec.sys
[2012/04/24 18:37:35 | 000,220,672 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\wintrust.dll
[2012/04/24 18:37:35 | 000,172,544 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\wintrust.dll
[2012/04/24 18:37:35 | 000,159,232 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\imagehlp.dll
[2012/04/24 18:37:35 | 000,081,408 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\imagehlp.dll
[2012/04/24 11:28:24 | 000,509,952 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\ntshrui.dll
[2012/04/24 11:28:21 | 000,515,584 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\timedate.cpl
[2012/04/24 11:28:21 | 000,478,720 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\timedate.cpl
[2012/04/24 11:28:20 | 001,544,192 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\DWrite.dll
[2012/04/24 11:28:19 | 001,077,248 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\DWrite.dll
[2012/04/24 11:27:55 | 000,634,880 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\msvcrt.dll
[2012/04/24 11:26:51 | 000,149,504 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\rdpcorekmts.dll
[2012/04/24 11:26:51 | 000,077,312 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\rdpwsx.dll
[2012/04/24 11:26:51 | 000,009,216 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\rdrmemptylst.exe
[2012/04/24 11:26:23 | 001,112,064 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\rdpcorets.dll
[2012/04/24 11:26:23 | 001,031,680 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\rdpcore.dll
[2012/04/24 11:26:22 | 000,826,880 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\rdpcore.dll
[2012/04/24 11:22:08 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{32450C63-5F2A-4251-A7D3-DDDD2BD9C4B3}
[2012/04/24 11:21:56 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{19D68E7E-D1D2-4C2B-8B23-B95E9497B9AA}
[2012/04/23 12:34:14 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{551B165D-7968-4FCF-BD65-0A0ED8C2C2EC}
[2012/04/23 12:34:02 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{3C6FE314-C415-482E-93FD-709201DBDDC8}
[2012/04/23 12:30:42 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{22DE0204-EF09-451D-A4CB-48FDB56036EA}
[2012/04/23 12:30:30 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{62D493E8-5E79-4A49-B8EE-5C1370BE9BCB}
[2012/04/23 11:10:13 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{261FF8B3-DB33-48BE-B1C7-30E3D9A9700D}
[2012/04/23 11:10:02 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{1D2E84CE-B085-4245-B437-6FE44179A090}
[2012/04/22 14:34:14 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{F4916C91-64FA-4933-9C5D-3D22A963B02B}
[2012/04/22 14:34:02 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{83758DAA-E724-4CDD-A357-CAF3A235BA39}
[2012/04/19 11:42:25 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{12DE84A7-70E6-48D6-8876-8875A7DAA093}
[2012/04/19 11:42:12 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{1BE865D6-EE35-432C-BE73-2A7F1026D0FD}
[2012/04/18 11:32:29 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{F8FDBD88-1EC3-4692-BFF1-E71FF316A8FD}
[2012/04/18 11:32:18 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{52008B94-F0CA-413F-8EAF-3A7303D2D207}
[2012/04/17 02:56:49 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{566926CB-30A1-4891-88CC-6C37534898CA}
[2012/04/17 02:56:36 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{C65BCDC1-4128-4258-AC39-E49428555127}
[2012/04/16 23:04:10 | 000,202,112 | ---- | C] (PPLive Corporation) -- E:\Windows\SysWow64\PPTVLauncher.exe
[2012/04/16 11:48:25 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{BAA897F2-5E02-4A26-9AA6-056754AEBF83}
[2012/04/16 11:48:12 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{919F5E70-A335-49DC-B84B-803C099889FD}
[2012/04/15 12:14:27 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{5FFCB9EF-4A59-461F-BA0D-6E339717782A}
[2012/04/15 12:14:16 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{FFB5DCCA-620F-42EB-A533-D64812B3DCEA}
[2012/04/14 15:45:58 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Roaming\FileZilla
[2012/04/14 15:45:52 | 000,000,000 | ---D | C] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
[2012/04/14 15:45:51 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\FileZilla FTP Client
[2012/04/14 13:02:08 | 000,000,000 | ---D | C] -- E:\Alexander
[2012/04/14 04:23:53 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{90E32716-65BE-4761-B5B3-CAF88A103FE4}
[2012/04/14 04:23:42 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{D71D5583-60CB-43A9-A267-DFAB08D01C21}
[2012/04/13 09:43:54 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{2AD57827-4AFE-4835-B709-585CD489212F}
[2012/04/12 11:30:44 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{3D53AFBE-45EA-4192-8C1D-98B1829F465F}
[2012/04/11 12:37:17 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{DC814BCF-DAD9-4714-8E8D-9B1187BFD117}
[2012/04/10 11:31:52 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{B4E1EF41-AAE8-4F7C-9891-D959502E280D}
[2012/04/09 07:45:15 | 000,000,000 | ---D | C] -- E:\Users\Julian\AppData\Local\{FF1BABA4-6CA6-45AE-AD35-F6473E32DD21}
[2011/08/04 17:49:29 | 012,231,456 | ---- | C] (D-Link) -- E:\Program Files (x86)\DNS-323_C1_FW_v1.08_Easysearch_v4.7.0.0.exe
 
========== Files - Modified Within 30 Days ==========
 
[2012/05/08 13:05:13 | 000,067,584 | --S- | M] () -- E:\Windows\bootstat.dat
[2012/05/08 13:03:27 | 3220,529,152 | -HS- | M] () -- E:\hiberfil.sys
[2012/05/08 13:03:25 | 000,393,316 | ---- | M] () -- E:\Windows\System32\oodbs.lor
[2012/05/08 12:41:27 | 000,615,810 | ---- | M] () -- E:\Windows\System32\perfh009.dat
[2012/05/08 12:41:27 | 000,106,190 | ---- | M] () -- E:\Windows\System32\perfc009.dat
[2012/05/08 12:32:29 | 000,299,520 | ---- | M] () -- E:\Users\Julian\AppData\Roaming\itunes_service86.exe
[2012/05/08 12:22:00 | 000,000,830 | ---- | M] () -- E:\Windows\tasks\Adobe Flash Player Updater.job
[2012/05/08 11:08:02 | 097,480,699 | ---- | M] () -- E:\Windows\System32\drivers\AVG\incavi.avm
[2012/05/06 13:25:54 | 000,454,785 | ---- | M] () -- E:\Windows\System32\drivers\AVG\iavichjg.avm
[2012/05/05 17:04:38 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\id Software
[2012/05/05 08:16:55 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bamboo Dock
[2012/05/05 08:15:20 | 000,000,000 | R--D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bamboo
[2012/05/02 17:14:31 | 000,014,224 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/05/02 17:14:31 | 000,014,224 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/05/02 15:03:12 | 000,001,134 | ---- | M] () -- E:\Users\Julian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PPTV .lnk
[2012/05/02 15:03:12 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\PPLive
[2012/04/30 09:47:35 | 000,001,456 | ---- | M] () -- E:\Users\Julian\AppData\Local\Adobe Save for Web 12.0 Prefs
[2012/04/25 14:20:31 | 000,040,544 | ---- | M] () -- E:\Windows\DIIUnin.dat
[2012/04/25 14:20:06 | 000,021,840 | ---- | M] () -- E:\Windows\SysWow64\SIntfNT.dll
[2012/04/25 14:20:06 | 000,017,212 | ---- | M] () -- E:\Windows\SysWow64\SIntf32.dll
[2012/04/25 14:20:06 | 000,012,067 | ---- | M] () -- E:\Windows\SysWow64\SIntf16.dll
[2012/04/25 14:14:39 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo II
[2012/04/25 14:05:10 | 000,102,400 | ---- | M] (Blizzard Entertainment) -- E:\Windows\DIIUnin.exe
[2012/04/25 14:05:10 | 000,002,829 | ---- | M] () -- E:\Windows\DIIUnin.pif
[2012/04/25 13:38:46 | 004,986,304 | ---- | M] () -- E:\Windows\System32\FNTCACHE.DAT
[2012/04/24 18:41:40 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012/04/23 12:27:48 | 000,002,486 | ---- | M] () -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2012/04/18 13:44:03 | 000,000,132 | ---- | M] () -- E:\Users\Julian\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012/04/18 11:31:32 | 000,418,464 | ---- | M] (Adobe Systems Incorporated) -- E:\Windows\SysWow64\FlashPlayerApp.exe
[2012/04/18 11:31:32 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- E:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/04/16 23:04:12 | 000,424,296 | ---- | M] () -- E:\Windows\SysWow64\kindling.dll
[2012/04/16 23:04:10 | 000,202,112 | ---- | M] (PPLive Corporation) -- E:\Windows\SysWow64\PPTVLauncher.exe
[2012/04/14 15:45:52 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
 
========== Files Created - No Company Name ==========
 
[2012/05/08 12:32:34 | 000,299,520 | ---- | C] () -- E:\Users\Julian\AppData\Roaming\itunes_service86.exe
[2012/05/05 08:14:47 | 000,000,488 | ---- | C] () -- E:\Windows\System32\PenTouchTabletUserDefaults.xml
[2012/05/05 08:14:47 | 000,000,488 | ---- | C] () -- E:\Windows\System32\PenTabletUserDefaults.xml
[2012/05/02 15:03:12 | 000,001,134 | ---- | C] () -- E:\Users\Julian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PPTV .lnk
[2012/04/25 14:15:29 | 000,021,840 | ---- | C] () -- E:\Windows\SysWow64\SIntfNT.dll
[2012/04/25 14:15:29 | 000,017,212 | ---- | C] () -- E:\Windows\SysWow64\SIntf32.dll
[2012/04/25 14:15:29 | 000,012,067 | ---- | C] () -- E:\Windows\SysWow64\SIntf16.dll
[2012/04/25 14:05:11 | 000,040,544 | ---- | C] () -- E:\Windows\DIIUnin.dat
[2012/04/25 14:05:10 | 000,002,829 | ---- | C] () -- E:\Windows\DIIUnin.pif
[2012/04/16 23:04:12 | 000,424,296 | ---- | C] () -- E:\Windows\SysWow64\kindling.dll
[2012/04/01 08:41:48 | 000,000,132 | ---- | C] () -- E:\Users\Julian\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2012/02/29 08:26:56 | 000,416,064 | ---- | C] () -- E:\Windows\SysWow64\nvStreaming.exe
[2012/01/31 13:15:44 | 000,030,568 | ---- | C] () -- E:\Windows\MusiccityDownload.exe
[2012/01/31 13:15:42 | 000,974,848 | ---- | C] () -- E:\Windows\SysWow64\cis-2.4.dll
[2012/01/31 13:15:42 | 000,081,920 | ---- | C] () -- E:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012/01/31 13:15:42 | 000,065,536 | ---- | C] () -- E:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012/01/31 13:15:42 | 000,057,344 | ---- | C] () -- E:\Windows\SysWow64\issacapi_se-2.3.dll
[2012/01/21 10:18:48 | 000,000,132 | ---- | C] () -- E:\Users\Julian\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012/01/20 09:42:37 | 000,252,928 | ---- | C] () -- E:\Windows\SysWow64\DShowRdpFilter.dll
[2011/09/07 14:25:31 | 000,008,192 | ---- | C] () -- E:\Windows\SysWow64\srvany.exe
[2011/09/07 14:24:59 | 000,077,824 | ---- | C] () -- E:\Windows\KMService.exe
[2011/09/07 14:19:24 | 000,446,258 | ---- | C] () -- E:\Windows\AutoKMS.exe
[2011/08/05 14:46:26 | 000,001,456 | ---- | C] () -- E:\Users\Julian\AppData\Local\Adobe Save for Web 12.0 Prefs
[2011/08/04 16:47:14 | 000,000,000 | ---- | C] () -- E:\Windows\oodcnt.INI
[2011/08/04 13:24:07 | 000,650,752 | ---- | C] () -- E:\Windows\SysWow64\xvidcore.dll
[2011/08/04 13:24:07 | 000,243,200 | ---- | C] () -- E:\Windows\SysWow64\xvidvfw.dll
[2011/08/04 13:24:07 | 000,175,616 | ---- | C] () -- E:\Windows\SysWow64\unrar.dll
[2011/08/04 13:24:07 | 000,000,038 | ---- | C] () -- E:\Windows\avisplitter.ini
[2011/08/04 13:24:06 | 000,074,752 | ---- | C] () -- E:\Windows\SysWow64\ff_vfw.dll
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- E:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- E:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- E:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- E:\Windows\mib.bin
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- E:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- E:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- E:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- E:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Application Data
[2012/05/08 13:03:42 | 000,000,000 | ---D | M] -- E:\ProgramData\AutoKMS
[2011/10/23 12:51:00 | 000,000,000 | ---D | M] -- E:\ProgramData\AVG2012
[2012/01/31 14:45:59 | 000,000,000 | ---D | M] -- E:\ProgramData\boost_interprocess
[2011/09/01 12:10:57 | 000,000,000 | ---D | M] -- E:\ProgramData\ClubSanDisk
[2011/08/04 13:31:49 | 000,000,000 | -H-D | M] -- E:\ProgramData\Common Files
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Documents
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favorites
[2011/08/14 18:40:54 | 000,000,000 | ---D | M] -- E:\ProgramData\Giraffic
[2012/05/05 17:04:38 | 000,000,000 | ---D | M] -- E:\ProgramData\id Software
[2012/05/02 15:03:43 | 000,000,000 | ---D | M] -- E:\ProgramData\Jlcm
[2012/02/23 17:39:30 | 000,000,000 | ---D | M] -- E:\ProgramData\Messenger Plus!
[2012/05/08 11:08:15 | 000,000,000 | ---D | M] -- E:\ProgramData\MFAData
[2011/09/19 16:16:30 | 000,000,000 | ---D | M] -- E:\ProgramData\PMB Files
[2012/05/02 15:03:55 | 000,000,000 | ---D | M] -- E:\ProgramData\PPLive
[2012/03/09 14:38:28 | 000,000,000 | ---D | M] -- E:\ProgramData\Recisio
[2012/04/03 13:54:00 | 000,000,000 | ---D | M] -- E:\ProgramData\regid.1986-12.com.adobe
[2012/03/05 13:18:32 | 000,000,000 | ---D | M] -- E:\ProgramData\Samsung
[2012/02/07 12:26:46 | 000,000,000 | ---D | M] -- E:\ProgramData\SplitMediaLabs
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Start Menu
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Templates
[2012/05/05 08:17:33 | 000,000,000 | ---D | M] -- E:\ProgramData\Wacom
[2012/01/29 07:34:24 | 000,000,000 | ---D | M] -- E:\ProgramData\Xilisoft
[2012/01/29 10:36:30 | 000,000,000 | ---D | M] -- E:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2012/03/29 11:25:31 | 000,032,620 | ---- | M] () -- E:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011/08/05 06:59:15 | 000,000,000 | -H-D | M] -- E:\$AVG
[2011/08/04 13:16:40 | 000,000,000 | -HSD | M] -- E:\$Recycle.Bin
[2012/04/25 14:33:33 | 000,000,000 | ---D | M] -- E:\001_Julian
[2012/05/06 09:59:02 | 000,000,000 | ---D | M] -- E:\002_Photos
[2012/04/14 15:57:21 | 000,000,000 | ---D | M] -- E:\Alexander
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\Documents and Settings
[2011/08/05 08:28:31 | 000,000,000 | ---D | M] -- E:\Lightroom Catalogs
[2011/08/04 14:42:25 | 000,000,000 | RH-D | M] -- E:\MSOCache
[2012/03/13 15:11:29 | 000,000,000 | ---D | M] -- E:\NVIDIA
[2009/07/13 23:20:08 | 000,000,000 | ---D | M] -- E:\PerfLogs
[2012/05/05 08:14:47 | 000,000,000 | R--D | M] -- E:\Program Files
[2012/05/05 08:16:29 | 000,000,000 | R--D | M] -- E:\Program Files (x86)
[2012/05/05 17:04:38 | 000,000,000 | -H-D | M] -- E:\ProgramData
[2011/08/04 13:13:54 | 000,000,000 | -HSD | M] -- E:\Recovery
[2011/08/17 15:22:58 | 000,000,000 | ---D | M] -- E:\SC2Replay Archive
[2012/05/05 17:04:23 | 000,000,000 | -HSD | M] -- E:\System Volume Information
[2012/05/07 15:13:05 | 000,000,000 | ---D | M] -- E:\Temp
[2012/01/21 15:52:32 | 000,000,000 | ---D | M] -- E:\trinhthanhdam
[2012/03/13 15:11:43 | 000,000,000 | R--D | M] -- E:\Users
[2012/05/08 12:37:11 | 000,000,000 | ---D | M] -- E:\Windows
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- E:\Windows\System32\drivers\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- E:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- E:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- E:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- E:\Windows\System32\drivers\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- E:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- E:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- E:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- E:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- E:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- E:\Windows\System32\cngaudit.dll
[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- E:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011/02/26 02:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 01:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 21:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 01:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009/10/31 01:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- E:\Windows\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 02:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 08:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009/08/03 02:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- E:\Windows\SysWOW64\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009/10/31 02:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009/08/03 01:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 09:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/10/31 02:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009/08/03 01:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 21:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 02:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011/02/26 02:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009/08/03 02:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2010/11/20 09:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- E:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 09:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011/03/11 02:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- E:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- E:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011/03/11 02:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011/03/11 02:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009/07/13 21:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009/07/13 21:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- E:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010/11/20 09:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- E:\Windows\System32\netlogon.dll
[2010/11/20 09:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- E:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010/11/20 08:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- E:\Windows\SysWOW64\netlogon.dll
[2010/11/20 08:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- E:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009/07/13 21:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- E:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009/07/13 21:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011/03/11 02:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011/03/11 02:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011/03/11 02:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- E:\Windows\System32\drivers\nvstor.sys
[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- E:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010/11/20 09:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- E:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 09:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/13 21:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- E:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 21:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- E:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010/11/20 08:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- E:\Windows\SysWOW64\scecli.dll
[2010/11/20 08:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- E:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010/11/20 09:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- E:\Windows\System32\scecli.dll
[2010/11/20 09:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- E:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2012/01/30 14:32:25 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=2C353B6CE0C8D03225CAA2AF33B68D79 -- E:\Windows\System32\user32.dll
[2010/11/20 08:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- E:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009/07/13 21:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- E:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2012/01/30 14:32:25 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=861C4346F9281DC0380DE72C8D55D6BE -- E:\Windows\SysWOW64\user32.dll
[2009/07/13 21:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- E:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010/11/20 09:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- E:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 08:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- E:\Windows\SysWOW64\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- E:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- E:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 21:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- E:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 09:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- E:\Windows\System32\userinit.exe
[2010/11/20 09:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- E:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010/11/20 09:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- E:\Windows\System32\winlogon.exe
[2010/11/20 09:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- E:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 21:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- E:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009/10/28 03:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- E:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009/10/28 02:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- E:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- E:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- E:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
< End of report >
         

Hallo und Herzlich Willkommen!

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:

• "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
  - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
  - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
• Charakteristische Merkmale/Profilinformationen:
  - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du durch [X] oder Sternchen (*) ersetzen
• Die Systemprüfung und Bereinigung:
  - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
• Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
• Innerhalb der Betreuungszeit:
  - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
• Die Reihenfolge:
  - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
• GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
• Ansonsten unsere Forumsregeln:
  - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
• Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen

Wenn ein System kompromittiert wurde, ist das System nicht mehr vertrauenswürdig
Eine Neuinstallation garantiert die rückstandsfreie Entfernung der Infektion - Lesestoff: "Hilfe: Ich wurde das Opfer eines Hackerangriffs. Was soll ich tun?" - Säubern eines gefährdeten Systems

Falls du doch für die Systemreinigung entscheidest:

1.
Hast du es denn in der Hosts selbst eingetragen bzw absichtlich zugefügt? Wenn ja, warum?

O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1                   activate.adobe.com
O1 - Hosts: 127.0.0.1                   practivate.adobe.com
O1 - Hosts: 127.0.0.1 activate.adobe.com   Blocking Adobe Activation
         

alle Anwendungen aus der Adobe Produktfamilie legal erworben?
außerdem noch:

Microsoft Office
die Datei AutoKMS.exe mit Schädlingen der Familie HackTool:Win32/Keygen in Verbindung steht.
E:\Windows\KMService.exe
E:\Windows\AutoKMS.exe

-> Forumregel!

2.

Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)

Fixen mit OTLPE

• Starte die OTLPE
• Kopiere folgendes Skript (unverändert inkl. :OTL, also - nach dem "Code", alles was in der Codebox steht -
  :

:OTL
IE - HKU\Julian_ON_E\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.plusnetwork.com/?sp=addr&q={searchTerms}
IE - HKU\Julian_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://at.msn.com/?ocid=iehp
IE - HKU\Julian_ON_E\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.plusnetwork.com/?sp=addr&q={searchTerms}
IE - HKU\Julian_ON_E\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.plusnetwork.com/?sp=addr&q={searchTerms}
IE - HKU\Julian_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Julian_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - prefs.js..keyword.URL: "hxxp://www.plusnetwork.com/?sp=faddr&q="
O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [VX5LWxsct4OYCCz] E:\Users\Julian\AppData\Roaming\itunes_service86.exe ()
O4 - HKU\Julian_ON_E..\Run: [VX5LWxsct4OYCCz] E:\Users\Julian\AppData\Roaming\itunes_service86.exe ()
O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser.Julian-PC_ON_E..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser_ON_E..\RunOnce: [mctadmin]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\Julian_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Julian_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Julian_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O20 - HKLM Winlogon: Shell - (C:\Users\Julian\AppData\Roaming\itunes_service86.exe) - E:\Users\Julian\AppData\Roaming\itunes_service86.exe ()
O20 - HKLM Winlogon: UserInit - (C:\Users\Julian\AppData\Roaming\itunes_service86.exe) - E:\Users\Julian\AppData\Roaming\itunes_service86.exe ()
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{28b11e63-bebc-11e0-9fa4-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{28b11e63-bebc-11e0-9fa4-806e6f6e6963}\Shell\AutoRun\command - "" = E:\SETUP.EXE
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
[2012/05/08 12:32:34 | 000,299,520 | ---- | C] () -- E:\Users\Julian\AppData\Roaming\itunes_service86.exe

:Files
E:\Users\Julian\AppData\Roaming\itunes_service86.exe 
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
         

• und füge es hier ein:
• Schließe alle Programme.
• Klicke auf den Run Fix Button.
• Klick auf .
• OTL verlangt einen Neustart. Bitte zulassen.
• Nach dem Neustart findest Du ein Textdokument.
  Kopiere den Inhalt hier in Code-Tags in Deinen Thread.

3.
Boote neu und schaue nach, ob Du schon im normalen Modus arbeiten kannst?
wenn ja, so geht es weiter:

4.
Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org

• Installieren und per Doppelklick starten.
• Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
• "Komplett Scan durchführen" wählen (überall Haken setzen)
• wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
• Alle Funde - falls MBAM meldet in C:\System Volume Information - den Haken bitte entfernen - markieren und auf "Löschen" - "Ausgewähltes entfernen") klicken.
• Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"

eine bebilderte Anleitung findest Du hier: Anleitung

5.
Systemscan mit OTL - nicht mehr das OTLPE starten!

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop.

• Doppelklick auf die OTL.exe
• Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
• Oben findest Du ein Kästchen mit Ausgabe.
  Wähle bitte Standard-Ausgabe
• Unter Extra-Registrierung wähle bitte Benutze SafeList.
• Mache Häckchen bei LOP- und Purity-Prüfung.
• Klicke nun auf Scan links oben.
  
  
  
• Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
  Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
• Poste die Logfiles in Code-Tags hier in den Thread.

6.
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:

• Download den CCleaner - Installer herunter
  
• Software-Lizenzvereinbarung lesen, falls irgendeine Toolbar angeboten wird, bitte abwählen!-> starten -> Falls nötig, auf "Deutsch" einstellen.
• starten-> klick auf `Extras` (um auf deinem System installierte Software zu anzeigen)-> dann auf `Als Textdatei speichern...`
• ein Textdatei wird automatisch erstellt, poste auch dieses Logfile (also die Liste alle installierten Programme...eine Textdatei)

Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]

** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw

gruß
kira