TR/Ransom.PS.1, DDOS/Dofoil.A.73

OTL logfile created on: 25.01.2012 19:13:19 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Dokumente und Einstellungen\User\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1023,48 Mb Total Physical Memory | 292,01 Mb Available Physical Memory | 28,53% Memory free
6,90 Gb Paging File | 6,25 Gb Available in Paging File | 90,61% Paging File free
Paging file location(s): [Binary data over 100 bytes]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 10,02 Gb Total Space | 0,38 Gb Free Space | 3,76% Space Free | Partition Type: NTFS
Drive D: | 27,25 Gb Total Space | 0,80 Gb Free Space | 2,94% Space Free | Partition Type: NTFS
Drive F: | 38,28 Gb Total Space | 1,74 Gb Free Space | 4,55% Space Free | Partition Type: FAT32
Drive H: | 279,46 Gb Total Space | 3,43 Gb Free Space | 1,23% Space Free | Partition Type: NTFS
 
Computer Name: **** | User Name: **** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.25 18:35:45 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\User\Desktop\OTL.exe
PRC - [2012.01.22 20:00:57 | 000,924,632 | ---- | M] (Mozilla Corporation) -- D:\Mozilla Firefox\firefox.exe
PRC - [2011.10.25 12:26:39 | 000,490,448 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avscan.exe
PRC - [2011.10.11 14:00:02 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.10.11 13:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.10.11 13:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.10.11 13:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.01.09 13:34:32 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- D:\java\bin\jqs.exe
PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.11.15 21:03:36 | 000,109,344 | ---- | M] (Logitech Inc.) -- c:\Programme\Gemeinsame Dateien\Logitech\LVMVFM\LVPrcSrv.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.01.22 20:00:56 | 002,124,760 | ---- | M] () -- D:\Mozilla Firefox\mozjs.dll
MOD - [2011.12.14 21:23:03 | 003,316,000 | ---- | M] () -- c:\Programme\Gemeinsame Dateien\Akamai\netsession_win_b427739.dll
MOD - [2011.11.24 16:54:07 | 008,527,008 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
MOD - [2011.10.11 13:59:51 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2009.02.27 16:41:26 | 000,311,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] --  -- (UPnPService)
SRV - File not found [On_Demand | Stopped] --  -- (PavPrSrv)
SRV - File not found [Auto | Stopped] --  -- (OutpostFirewall)
SRV - File not found [On_Demand | Stopped] --  -- (NipSvc)
SRV - File not found [On_Demand | Stopped] --  -- (de_serv)
SRV - [2011.12.14 21:23:03 | 003,316,000 | ---- | M] () [Auto | Running] -- c:\programme\gemeinsame dateien\akamai/netsession_win_b427739.dll -- (Akamai)
SRV - [2011.10.11 13:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.10.11 13:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.01.09 13:34:32 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- D:\java\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009.06.11 20:49:00 | 002,862,620 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINDOWS\System32\GameMon.des -- (npggsvc)
SRV - [2009.04.28 10:06:06 | 001,195,008 | ---- | M] (Agnitum Ltd.) [Auto | Running] -- F:\Programme\Agnitum\2009\acs.exe -- (acssrv)
SRV - [2006.11.15 22:05:40 | 000,101,152 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\Logitech\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)
SRV - [2006.11.15 21:03:36 | 000,109,344 | ---- | M] (Logitech Inc.) [Auto | Running] -- c:\Programme\Gemeinsame Dateien\Logitech\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2005.04.03 23:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2012.01.15 17:21:47 | 000,239,168 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2012.01.15 17:11:36 | 000,428,088 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2011.12.08 16:54:16 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.10.11 14:00:01 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.10.11 14:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.12.07 14:12:24 | 000,025,088 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgandmodem.sys -- (ANDModem)
DRV - [2010.12.07 14:12:24 | 000,020,096 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgandgps.sys -- (AndGps)
DRV - [2010.12.07 14:12:22 | 000,020,736 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lganddiag.sys -- (AndDiag)
DRV - [2010.12.07 14:12:22 | 000,014,336 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgandbus.sys -- (Andbus)
DRV - [2010.08.02 16:19:22 | 000,025,728 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgandadb.sys -- (androidusb)
DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.12.14 09:21:44 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2009.09.29 08:11:22 | 000,012,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009.09.29 08:11:20 | 000,012,928 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009.09.29 08:11:20 | 000,010,496 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2009.04.06 10:37:12 | 000,704,384 | ---- | M] (Agnitum Ltd.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\SandBox.sys -- (SandBox)
DRV - [2009.02.18 16:30:56 | 000,031,128 | ---- | M] (Agnitum Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afw.sys -- (afw)
DRV - [2009.02.10 15:15:42 | 000,257,432 | ---- | M] (Agnitum Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afwcore.sys -- (afwcore)
DRV - [2008.06.23 16:43:46 | 000,094,624 | ---- | M] (AlcaTech) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\mmrtkrnl.sys -- (MMRTKRNL)
DRV - [2008.04.14 00:30:04 | 000,225,664 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2008.04.14 00:26:08 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008.04.14 00:23:10 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2006.11.15 21:03:12 | 000,024,736 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2006.11.15 21:02:50 | 001,962,912 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVMVdrv.sys -- (LVMVDrv)
DRV - [2006.11.15 21:00:56 | 001,678,368 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Lvckap.sys -- (LVcKap)
DRV - [2006.11.11 04:48:00 | 000,040,352 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2006.11.11 04:43:49 | 000,487,328 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LV561AV.SYS -- (PID_0928) Logitech QuickCam Express(PID_0928)
DRV - [2006.07.24 15:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2006.01.11 14:33:44 | 000,013,312 | ---- | M] (A4Tech Co.,Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Amusbprt.sys -- (Amusbprt)
DRV - [2006.01.11 14:33:32 | 000,008,704 | ---- | M] (A4Tech Co.,Ltd.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Amfilter.sys -- (Amfilter)
DRV - [2005.02.11 21:46:22 | 000,371,712 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcmwl5.sys -- (BCM43XX)
DRV - [2004.12.18 20:32:32 | 000,038,229 | ---- | M] (Generic) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\StMp3Rec.sys -- (StMp3Rec)
DRV - [2004.03.08 11:55:50 | 000,013,567 | ---- | M] (B.H.A Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\CDRBSDRV.SYS -- (cdrbsdrv)
DRV - [2002.09.09 19:54:06 | 000,016,269 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\ASNDIS5.sys -- (ASNDIS5)
DRV - [2002.07.17 08:05:10 | 000,016,512 | ---- | M] (Adaptec) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ASPI32.SYS -- (ASPI)
DRV - [2002.05.31 09:35:02 | 000,076,976 | R--- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\pnp680r.sys -- (Pnp680r)
DRV - [2001.09.21 10:45:26 | 000,282,688 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtaa.sys -- (ati2mtaa)
DRV - [2001.08.18 23:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2001.08.18 23:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
DRV - [2001.08.18 13:19:46 | 000,281,984 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mpaa.sys -- (ati2mpaa)
DRV - [2001.08.17 13:28:12 | 000,488,383 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\HSF_V124.sys -- (V124)
DRV - [2001.08.17 13:28:12 | 000,050,751 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\HSF_TONE.sys -- (Tones)
DRV - [2001.08.17 13:28:10 | 000,542,879 | ---- | M] (Conexant) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSF_MSFT.sys -- (hsf_msft)
DRV - [2001.08.17 13:28:10 | 000,073,279 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\HSF_SPKP.sys -- (SpeakerPhone)
DRV - [2001.08.17 13:28:10 | 000,057,471 | ---- | M] (Conexant) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSF_SAMP.sys -- (Rksample)
DRV - [2001.08.17 13:28:08 | 000,391,199 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\HSF_K56K.sys -- (K56)
DRV - [2001.08.17 13:28:06 | 000,289,887 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\HSF_FALL.sys -- (Fallback)
DRV - [2001.08.17 13:28:06 | 000,199,711 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\HSF_FAXX.sys -- (SoftFax)
DRV - [2001.08.17 13:28:06 | 000,115,807 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\HSF_FSKS.sys -- (Fsks)
DRV - [2001.08.17 13:28:04 | 000,067,167 | ---- | M] (Conexant) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSF_BSC2.sys -- (basic2)
DRV - [1998.08.12 10:54:24 | 000,131,804 | ---- | M] (Plustek Corporation.) [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\drivers\SCANDEV.SYS -- (SCANDEV)
DRV - [1997.07.23 10:45:46 | 000,130,384 | ---- | M] (Plustek Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\OpticPro.SYS -- (OpticPro)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Prev Search Bar = hxxp://google.icq.com/search/search_frame.php
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Prev Search Page = hxxp://google.icq.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/firefox?client=firefox-a&rls=org.mozilla:de:official
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Google"
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@anti-leech.com/Anti-Leech Plugin,version=1.0.2.3:  File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\java\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.46: D:\real\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.46: D:\real\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.46: D:\real\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: d:\vlc\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: H:\Adobe Reader\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\jqs@sun.com: D:\java\lib\deploy\jqs\ff [2011.01.09 13:34:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Programme\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.10.14 18:49:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: D:\Mozilla Firefox\components [2012.01.22 20:00:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: D:\Mozilla Firefox\plugins [2012.01.14 16:59:11 | 000,000,000 | ---D | M]
 
[2007.03.13 08:11:34 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Mozilla\Firefox\Profiles\rlu8c9yl.default\extensions
[2007.03.13 08:11:34 | 000,000,000 | ---D | M] (Firefox (default)) -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Mozilla\Firefox\Profiles\rlu8c9yl.default\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
O1 HOSTS File: ([2011.06.15 12:47:25 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\java\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\java\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OutpostFeedBack] F:\Programme\Agnitum\2009\feedback.exe (Agnitum Ltd.)
O4 - HKLM..\Run: [OutpostMonitor] F:\Programme\Agnitum\2009\op_mon.exe (Agnitum Ltd.)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: WayTech = C:\Dokumente und Einstellungen\User\Anwendungsdaten\csrss.exe ()
O8 - Extra context menu item: &Winamp Toolbar Search - Reg Error: Value error. File not found
O8 - Extra context menu item: Vorlesen mit MWS Reader 4 - Reg Error: Value error. File not found
O9 - Extra Button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - Reg Error: Key error. File not found
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - D:\icq\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - D:\icq\ICQ7.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Ranges: Range19 ([*] in Lokales Intranet)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab (Java Plug-in 1.5.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: Microsoft XML Parser for Java Reg Error: Value error. (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 82.212.62.62 78.42.43.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A1D6009F-873C-484C-B366-397732B18149}: DhcpNameServer = 82.212.62.62 78.42.43.62
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found
O20 - AppInit_DLLs: (f:\progra~1\agnitum\2009\wl_hook.dll) -f:\Programme\Agnitum\2009\wl_hook.dll (Agnitum Ltd.)
O20 - AppInit_DLLs: (f:\progra~1\agnitum\outpos~1.0\wl_hook.dll) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - File not found
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (LogonUI.EXE) - File not found
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - File not found
O20 - Winlogon\Notify\crypt32chain: DllName - (crypt32.dll) -  File not found
O20 - Winlogon\Notify\cryptnet: DllName - (cryptnet.dll) -  File not found
O20 - Winlogon\Notify\cscdll: DllName - (cscdll.dll) -  File not found
O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) -  File not found
O20 - Winlogon\Notify\Schedule: DllName - (wlnotify.dll) -  File not found
O20 - Winlogon\Notify\sclgntfy: DllName - (sclgntfy.dll) -  File not found
O20 - Winlogon\Notify\SensLogn: DllName - (WlNotify.dll) -  File not found
O20 - Winlogon\Notify\termsrv: DllName - (wlnotify.dll) -  File not found
O20 - Winlogon\Notify\wlballoon: DllName - (wlnotify.dll) -  File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\IrfanView_Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\IrfanView_Wallpaper.bmp
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll File not found
O29 - HKLM SecurityProviders - (msapsspc.dll) - File not found
O29 - HKLM SecurityProviders - (schannel.dll) - File not found
O29 - HKLM SecurityProviders - (digest.dll) - File not found
O29 - HKLM SecurityProviders - (msnsspc.dll) - File not found
O30 - LSA: Authentication Packages - (nwprovau) -C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.01.03 02:44:14 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005.11.11 08:22:12 | 000,000,144 | ---- | M] () - F:\AUTOEXEC.DOS -- [ FAT32 ]
O32 - AutoRun File - [2005.11.09 19:29:02 | 000,000,199 | ---- | M] () - F:\AUTOEXEC.SYD -- [ FAT32 ]
O32 - AutoRun File - [2005.11.09 09:06:18 | 000,000,199 | ---- | M] () - F:\AUTOEXEC.VIA -- [ FAT32 ]
O32 - AutoRun File - [2005.12.09 07:32:08 | 000,000,144 | ---- | M] () - F:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2010.01.23 19:03:59 | 000,000,100 | ---- | M] () - H:\AUTORUN.INF -- [ NTFS ]
O33 - MountPoints2\{11595d5a-7db7-11de-8361-0018f32b0b21}\Shell\AutoRun\command - "" = WDKHCR.Exe
O33 - MountPoints2\{11595d5a-7db7-11de-8361-0018f32b0b21}\Shell\Open\comMAND - "" = WDkhcr.EXE
O33 - MountPoints2\{146fc1ee-037c-11dc-ae91-0018f32b0b21}\Shell\AutoRun\command - "" = H:\setupSNK.exe -- [2008.04.14 07:53:06 | 000,028,672 | ---- | M] (Microsoft Corporation)
O33 - MountPoints2\{650b0998-e956-11de-84da-0018f32b0b21}\Shell\AutoRun\command - "" = J:\Menu.exe
O33 - MountPoints2\{6b9fce08-3265-11df-85af-806d6172696f}\Shell\AutoRun\command - "" = shaila/spermici.exe
O33 - MountPoints2\{6b9fce08-3265-11df-85af-806d6172696f}\Shell\Explore\command - "" = shaila/spermici.exe
O33 - MountPoints2\{6b9fce08-3265-11df-85af-806d6172696f}\Shell\Open\command - "" = shaila/spermici.exe
O33 - MountPoints2\{b0dcd422-ccdb-11e0-89e9-0018f32b0b21}\Shell\AutoRun\command - "" = Menu.exe
O33 - MountPoints2\{b1492b00-c919-11dc-b0a4-0018f32b0b21}\Shell - "" = AutoRun
O33 - MountPoints2\{b1492b00-c919-11dc-b0a4-0018f32b0b21}\Shell\Auto\command - "" = adp.exe
O33 - MountPoints2\{b1492b00-c919-11dc-b0a4-0018f32b0b21}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b1492b00-c919-11dc-b0a4-0018f32b0b21}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL adp.exe
O33 - MountPoints2\{e5be7da4-96f6-11de-83ac-0018f32b0b21}\Shell\AutoRun\command - "" = Menu.exe
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\setupSNK.exe -- [2008.04.14 07:53:06 | 000,028,672 | ---- | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.25 18:35:42 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\User\Desktop\OTL.exe
[2012.01.25 18:31:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe
[2012.01.15 17:40:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente\DAEMON Tools Images
[2012.01.15 17:25:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Games
[2012.01.15 17:24:26 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\User\Recent
[2012.01.15 17:21:47 | 000,239,168 | ---- | C] (DT Soft Ltd) -- C:\WINDOWS\System32\drivers\dtsoftbus01.sys
[2012.01.15 17:08:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2012.01.07 23:12:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Desktop\286395802 Resi
[3 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.25 18:35:45 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\User\Desktop\OTL.exe
[2012.01.25 17:51:00 | 000,001,170 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.01.25 17:50:57 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.01.25 17:50:55 | 1073,270,784 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.23 20:24:00 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012.01.22 20:22:25 | 003,072,054 | ---- | M] () -- C:\WINDOWS\IrfanView_Wallpaper.bmp
[2012.01.21 15:51:43 | 000,007,317 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Eigene Dateien\awwyeah.m3u
[2012.01.18 20:35:08 | 000,406,126 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.01.18 20:35:08 | 000,392,876 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.01.18 20:35:08 | 000,071,096 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.01.18 20:35:08 | 000,058,984 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.01.15 18:20:49 | 000,000,027 | ---- | M] () -- C:\WINDOWS\ic.ini
[2012.01.15 17:21:47 | 000,239,168 | ---- | M] (DT Soft Ltd) -- C:\WINDOWS\System32\drivers\dtsoftbus01.sys
[2012.01.14 16:59:12 | 000,001,450 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 9.lnk
[2012.01.13 13:51:37 | 000,001,459 | ---- | M] () -- C:\Dokumente und Einstellungen\User\.recently-used.xbel
[2012.01.07 19:32:44 | 000,950,450 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Eigene Dateien\allez.m3u
[3 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.01.21 15:51:43 | 000,007,317 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Eigene Dateien\awwyeah.m3u
[2012.01.15 18:20:49 | 000,000,027 | ---- | C] () -- C:\WINDOWS\ic.ini
[2012.01.15 17:20:38 | 000,000,498 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Startmenü\Programme\DTLite.lnk
[2012.01.14 16:59:12 | 000,001,804 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Reader 9.lnk
[2012.01.14 16:59:12 | 000,001,450 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 9.lnk
[2012.01.13 13:51:37 | 000,001,459 | ---- | C] () -- C:\Dokumente und Einstellungen\User\.recently-used.xbel
[2011.10.17 16:22:14 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini
[2011.10.17 14:56:05 | 000,040,448 | ---- | C] () -- C:\WINDOWS\System32\drivers\SCANTEST.EXE
[2011.10.17 14:43:04 | 000,000,408 | ---- | C] () -- C:\WINDOWS\SCANFX.INI
[2011.08.01 13:58:49 | 000,042,594 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2011.01.11 20:16:53 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\CommonDL.dll
[2011.01.11 20:16:53 | 000,002,413 | ---- | C] () -- C:\WINDOWS\System32\lgAxconfig.ini
[2010.09.06 22:54:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\KIZ Neuruppin.ini
[2010.08.23 11:38:06 | 000,000,025 | ---- | C] () -- C:\WINDOWS\popcinfot.dat
[2010.06.29 05:34:58 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\StarOpen.sys
[2010.03.31 14:03:11 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LauncherAccess.dt
[2010.03.26 16:56:22 | 000,036,608 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys
[2010.03.26 16:56:21 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll
[2010.02.10 17:31:43 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\qtcf.dll
[2010.01.03 18:42:03 | 000,000,229 | ---- | C] () -- C:\WINDOWS\ULEAD32.INI
[2009.11.12 15:26:07 | 000,012,800 | ---- | C] () -- C:\WINDOWS\jrew.exe
[2009.11.12 15:26:07 | 000,012,288 | ---- | C] () -- C:\WINDOWS\jre.exe
[2009.08.18 17:23:57 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2009.08.18 17:22:41 | 000,000,598 | ---- | C] () -- C:\WINDOWS\disney.ini
[2009.05.25 15:27:20 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS61.DLL
[2009.04.09 18:14:00 | 000,113,269 | ---- | C] () -- C:\WINDOWS\GXTranscoder v2 Uninstaller.exe
[2009.03.15 17:00:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\pestpatrol5.INI
[2009.01.25 11:08:20 | 000,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys
[2008.12.19 13:55:20 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2008.06.29 12:42:58 | 000,061,952 | ---- | C] () -- C:\WINDOWS\SSEUninstaller.exe
[2008.02.21 08:39:10 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2008.01.07 07:59:36 | 000,000,023 | -HS- | C] () -- C:\WINDOWS\System32\fbdfad4_g.dll
[2007.11.17 21:35:53 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\GIF89.DLL
[2007.11.17 21:34:52 | 000,000,139 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2007.10.25 17:26:10 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2007.06.22 11:41:22 | 000,003,489 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2007.05.08 19:28:05 | 000,000,048 | ---- | C] () -- C:\WINDOWS\scmate.ini
[2007.04.16 07:48:37 | 000,000,318 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2007.04.16 07:40:07 | 000,004,233 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2007.02.23 20:45:16 | 000,003,196 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2006.12.08 08:23:50 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\vusetup.dll
[2006.12.07 09:17:35 | 000,338,944 | ---- | C] () -- C:\WINDOWS\System32\lffpx7.dll
[2006.12.07 09:17:34 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\lfkodak.dll
[2006.12.07 09:17:28 | 000,659,520 | ---- | C] () -- C:\WINDOWS\System32\vbid3lib.dll
[2006.11.15 21:03:12 | 000,024,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2006.11.15 21:00:56 | 001,678,368 | ---- | C] () -- C:\WINDOWS\System32\drivers\Lvckap.sys
[2006.10.10 15:56:01 | 002,729,472 | ---- | C] () -- C:\WINDOWS\System32\fun_avcodec.dll
[2006.07.13 07:09:17 | 000,000,253 | ---- | C] () -- C:\WINDOWS\tm.ini
[2006.05.17 12:32:13 | 000,000,034 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006.04.04 13:41:18 | 000,008,192 | ---- | C] () -- C:\WINDOWS\d3dx.dat
[2006.03.31 15:52:20 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2006.03.25 09:04:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2006.03.07 09:13:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2006.03.06 19:51:43 | 000,000,143 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006.03.05 20:08:49 | 000,000,525 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006.02.18 17:39:32 | 000,148,992 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006.02.18 17:32:25 | 000,000,177 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2006.02.18 12:43:43 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2006.01.03 02:47:15 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2006.01.03 02:41:21 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2006.01.03 02:36:33 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006.01.03 02:35:51 | 000,133,280 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2006.01.02 17:53:52 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006.01.02 17:53:35 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2006.01.02 17:53:14 | 000,004,536 | ---- | C] () -- C:\WINDOWS\oembios.dat
[2006.01.02 17:53:12 | 013,107,200 | ---- | C] () -- C:\WINDOWS\oembios.bin
[2006.01.02 17:51:55 | 000,000,941 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2006.01.02 17:51:36 | 000,002,606 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005.02.24 07:32:00 | 000,540,672 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2004.08.02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003.08.07 20:01:50 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2001.08.30 22:18:52 | 000,032,336 | ---- | C] () -- C:\WINDOWS\System32\drivers\atinxsxx.sys
[2001.08.30 22:18:38 | 000,020,960 | ---- | C] () -- C:\WINDOWS\System32\drivers\atinttxx.sys
[2001.08.30 22:18:32 | 000,011,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\atinpdxx.sys
[2001.08.30 22:18:26 | 000,011,280 | ---- | C] () -- C:\WINDOWS\System32\drivers\atinmdxx.sys
[2001.08.30 22:18:20 | 000,032,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\atinraxx.sys
[2001.08.30 22:17:56 | 000,060,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\atinbtxx.sys
[2001.08.30 22:16:52 | 000,065,008 | ---- | C] () -- C:\WINDOWS\System32\drivers\atinrvxx.sys
[2001.08.30 22:15:58 | 000,032,064 | ---- | C] () -- C:\WINDOWS\System32\drivers\atintuxx.sys
[2000.11.30 14:30:40 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.exe
[1980.01.01 09:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[1980.01.01 09:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[1980.01.01 09:00:00 | 000,406,126 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[1980.01.01 09:00:00 | 000,392,876 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[1980.01.01 09:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[1980.01.01 09:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[1980.01.01 09:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[1980.01.01 09:00:00 | 000,071,096 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[1980.01.01 09:00:00 | 000,058,984 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[1980.01.01 09:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[1980.01.01 09:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[1980.01.01 09:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[1980.01.01 09:00:00 | 000,004,536 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[1980.01.01 09:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[1980.01.01 09:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
 
========== LOP Check ==========
 
[2010.09.08 12:58:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Agnitum
[2010.01.27 12:51:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AlcaTech
[2010.07.26 16:40:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avg7
[2012.01.15 17:08:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2009.03.15 17:39:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ESET
[2007.12.11 08:06:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Grisoft
[2010.11.16 19:24:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2011.01.11 21:41:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LGMOBILEAX
[2007.06.22 11:44:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2009.02.14 12:48:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Phase6
[2010.08.23 11:37:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PopCap Games
[2006.12.07 09:44:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\River Past G5
[2010.03.26 16:56:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung
[2008.04.29 12:35:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2006.10.31 19:43:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2010.09.27 14:54:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Vokabel Trainer
[2009.06.18 11:04:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010.01.26 17:49:07 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2007.12.11 08:06:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\AVG7
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 98 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2

< End of report >