Ebenfalls vom Gema-Trojaner befallen

OTL logfile created on: 3/18/2012 8:19:18 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows Vista (TM) Business Service Pack 2 (Version = 6.0.6002) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 87.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 96.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = J: | %SystemRoot% = J:\Windows | %ProgramFiles% = J:\Program Files (x86)
Drive C: | 48.83 Gb Total Space | 0.75 Gb Free Space | 1.54% Space Free | Partition Type: NTFS
Drive D: | 931.51 Gb Total Space | 192.32 Gb Free Space | 20.65% Space Free | Partition Type: NTFS
Drive E: | 698.63 Gb Total Space | 10.39 Gb Free Space | 1.49% Space Free | Partition Type: NTFS
Drive J: | 882.68 Gb Total Space | 220.67 Gb Free Space | 25.00% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet004
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009/10/06 20:47:10 | 000,191,000 | ---- | M] (Logitech Inc.) [Auto] -- J:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcS64)
SRV:64bit: - [2009/08/14 10:10:25 | 000,010,752 | ---- | M] (Microsoft Corporation) [Auto] -- J:\Windows\System32\TCPSVCS.EXE -- (simptcp)
SRV:64bit: - [2009/04/11 03:10:54 | 000,049,664 | ---- | M] (Microsoft Corporation) [Auto] -- J:\Windows\System32\snmp.exe -- (SNMP)
SRV:64bit: - [2008/01/19 04:06:50 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto] -- J:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2008/01/19 04:03:24 | 000,521,216 | ---- | M] (Microsoft Corporation) [On_Demand] -- J:\Windows\System32\ntmssvc.dll -- (NtmsSvc)
SRV:64bit: - [2008/01/19 04:00:52 | 000,195,584 | ---- | M] (Microsoft Corporation) [On_Demand] -- J:\Windows\System32\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2006/11/02 11:03:04 | 000,011,776 | ---- | M] (Microsoft Corporation) [Auto] -- J:\Windows\System32\CISVC.EXE -- (CISVC)
SRV:64bit: - [2006/11/02 11:03:03 | 000,034,816 | ---- | M] (Microsoft Corporation) [Auto] -- J:\Windows\System32\iprip.dll -- (iprip)
SRV - [2012/01/31 03:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- J:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/01/31 03:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- J:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/05/24 05:33:30 | 001,840,128 | ---- | M] (MAGIX AG) [Auto] -- J:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)
SRV - [2011/05/21 01:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) [Auto] -- J:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011/04/26 08:54:12 | 002,702,848 | ---- | M] (MAGIX®) [On_Demand] -- J:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2010/11/24 16:33:26 | 000,921,600 | ---- | M] () [On_Demand] -- J:\ProgramData\TVersity\Media Server\MediaServer.exe -- (TVersityMediaServer)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand] -- J:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [Auto] -- J:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- J:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/07 19:51:02 | 000,380,928 | ---- | M] (Spigot, Inc.) [Auto] -- J:\Program Files (x86)\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2009/08/14 09:49:20 | 000,009,728 | ---- | M] (Microsoft Corporation) [Auto] -- J:\Windows\SysWOW64\TCPSVCS.EXE -- (simptcp)
SRV - [2009/04/11 02:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto] -- J:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2009/04/11 02:28:04 | 000,047,616 | ---- | M] (Microsoft Corporation) [Auto] -- J:\Windows\SysWOW64\snmp.exe -- (SNMP)
SRV - [2009/03/30 00:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled] -- J:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/01/26 09:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto] -- J:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008/01/19 04:03:51 | 000,211,968 | ---- | M] (Microsoft Corporation) [Auto] -- J:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007/04/13 02:49:00 | 000,101,528 | ---- | M] () [Auto] -- J:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2006/12/19 04:30:26 | 000,081,920 | ---- | M] (Prolific Technology Inc.) [Auto] -- J:\Windows\SysWOW64\IoctlSvc.exe -- (PLFlash DeviceIoControl Service)
SRV - [2006/11/02 07:19:10 | 000,428,544 | ---- | M] (Microsoft Corporation) [Auto] -- J:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/01/31 03:56:33 | 000,132,320 | ---- | M] (Avira GmbH) [Kernel | System] -- J:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012/01/31 03:56:33 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto] -- J:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/09/16 11:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System] -- J:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011/03/29 20:13:00 | 000,033,656 | ---- | M] (KORG INC.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\KORGUM64.SYS -- (KORGUMDS)
DRV:64bit: - [2010/09/22 19:36:48 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- J:\Windows\System32\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2009/10/07 03:49:28 | 006,379,288 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\lvuvc64.sys -- (LVUVC64) Logitech QuickCam S5500(UVC)
DRV:64bit: - [2009/10/07 03:47:46 | 000,327,704 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2009/10/06 20:45:50 | 000,030,232 | ---- | M] () [Kernel | On_Demand] -- J:\Windows\System32\drivers\LVPr2M64.sys -- (LVPr2Mon)
DRV:64bit: - [2009/10/06 20:45:50 | 000,030,232 | ---- | M] () [Kernel | On_Demand] -- J:\Windows\System32\drivers\LVPr2M64.sys -- (LVPr2M64)
DRV:64bit: - [2009/09/30 20:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- J:\Windows\System32\drivers\WpdUsb.sys -- (WpdUsb)
DRV:64bit: - [2009/09/02 05:29:06 | 000,626,688 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\emOEM64.sys -- (USB28xxOEM)
DRV:64bit: - [2009/09/01 09:31:42 | 000,649,984 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\emBDA64.sys -- (USB28xxBGA)
DRV:64bit: - [2009/03/09 05:36:56 | 000,099,680 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot] -- J:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2008/12/17 02:01:22 | 000,050,072 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\LVUSBS64.sys -- (LVUSBS64)
DRV:64bit: - [2008/09/23 12:15:00 | 000,056,832 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\L1E60x64.sys -- (L1E)
DRV:64bit: - [2008/01/23 19:56:11 | 000,631,840 | ---- | M] (DiBcom SA) [Kernel | On_Demand] -- J:\Windows\System32\drivers\mod7700.sys -- (mod7700) Cinergy DT USB XS Diversity (MKII)
DRV:64bit: - [2008/01/23 19:56:05 | 000,024,224 | ---- | M] (DiBcom S.A.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\modrc.sys -- (MODRC) Cinergy DT USB XS Diversity (MKII)
DRV:64bit: - [2008/01/19 03:09:56 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- J:\Windows\System32\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2007/12/06 03:51:00 | 000,391,680 | ---- | M] (Marvell) [Kernel | On_Demand] -- J:\Windows\System32\drivers\yk60x64.sys -- (yukonx64)
DRV:64bit: - [2007/03/12 04:00:00 | 000,362,496 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand] -- J:\Windows\System32\drivers\WMP54Gv41x64.sys -- (rt61x64)
DRV:64bit: - [2006/12/27 19:00:00 | 000,460,800 | ---- | M] (AVM GmbH) [Kernel | On_Demand] -- J:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV:64bit: - [2006/12/27 19:00:00 | 000,014,120 | R--- | M] (AVM Berlin) [Kernel | On_Demand] -- J:\Windows\System32\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2006/10/31 11:23:42 | 000,015,680 | ---- | M] () [Kernel | On_Demand] -- J:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2006/10/02 22:13:44 | 000,051,200 | ---- | M] (Realtek Corporation) [Kernel | On_Demand] -- J:\Windows\System32\drivers\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2006/09/18 17:36:24 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- J:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2006/06/16 03:30:16 | 000,262,656 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand] -- J:\Windows\System32\drivers\RTL8187.sys -- (RTLWUSB)
DRV - [2009/09/01 16:32:04 | 000,002,996 | ---- | M] (Buzz) [Kernel | System] -- J:\Windows\SysWOW64\drivers\hwinterface.sys -- (hwinterface)
DRV - [2008/12/12 09:27:46 | 000,018,432 | ---- | M] () [Kernel | On_Demand] -- J:\Program Files (x86)\LG Soft India\forteManager\bin\PII2CDriver.sys -- (LGII2CDevice)
DRV - [2008/12/12 09:27:46 | 000,014,336 | ---- | M] () [Kernel | On_Demand] -- J:\Program Files (x86)\LG Soft India\forteManager\bin\I2CDriver.sys -- (LGDDCDevice)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Administrator_ON_J\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\KS_ON_J\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://mystart.incredibar.com/mb119?a=6R8j8eH3t7&i=26
IE - HKU\KS_ON_J\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\KS_ON_J\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\KS_ON_J\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - Reg Error: Key error. File not found
IE - HKU\KS_ON_J\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
 
========== FireFox ==========
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: J:\Windows\System32\Macromed\Flash\NPSWF64_11_1_102.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: J:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: J:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin: J:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: J:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: J:\Program Files (x86)\Microsoft Silverlight\4.0.50524.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: J:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: J:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: J:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WPF,version=3.5: J:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@movenetworks.com/Quantum Media Player: J:\Users\KS\AppData\Roaming\Move Networks\plugins\071802000001\npqmp071802000001.dll (Move Networks)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: J:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: J:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/03/01 14:03:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/04/30 13:00:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Thunderbird 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011/09/02 10:41:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Thunderbird 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2010/09/20 15:35:18 | 000,000,000 | ---D | M]
 
[2012/03/01 14:03:23 | 000,000,000 | ---D | M] (No name found) -- J:\Program Files (x86)\Mozilla Firefox\extensions
[2009/08/24 13:49:55 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- J:\Program Files (x86)\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012/03/01 14:03:23 | 000,000,000 | ---D | M] (No name found) -- J:\Program Files (x86)\Mozilla Firefox\distribution\extensions
[2012/03/01 14:03:23 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- J:\Program Files (x86)\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/11/05 03:10:35 | 000,134,104 | ---- | M] (Mozilla Foundation) -- J:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/02/02 15:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- J:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/11/04 23:38:54 | 000,001,392 | ---- | M] () -- J:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/11/04 23:32:18 | 000,002,252 | ---- | M] () -- J:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/11/04 23:38:54 | 000,001,153 | ---- | M] () -- J:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011/11/04 23:38:54 | 000,006,805 | ---- | M] () -- J:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/11/04 23:38:54 | 000,001,178 | ---- | M] () -- J:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/11/04 23:38:54 | 000,001,105 | ---- | M] () -- J:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011/04/22 19:13:35 | 000,432,777 | ---- | M]) - J:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 127.0.0.1	www.007guard.com
O1 - Hosts: 127.0.0.1	007guard.com
O1 - Hosts: 127.0.0.1	008i.com
O1 - Hosts: 127.0.0.1	www.008k.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	www.00hq.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	010402.com
O1 - Hosts: 127.0.0.1	www.032439.com
O1 - Hosts: 127.0.0.1	032439.com
O1 - Hosts: 127.0.0.1	www.0scan.com
O1 - Hosts: 127.0.0.1	0scan.com
O1 - Hosts: 127.0.0.1	1000gratisproben.com
O1 - Hosts: 127.0.0.1	www.1000gratisproben.com
O1 - Hosts: 127.0.0.1	1001namen.com
O1 - Hosts: 127.0.0.1	www.1001namen.com
O1 - Hosts: 127.0.0.1	100888290cs.com
O1 - Hosts: 127.0.0.1	www.100888290cs.com
O1 - Hosts: 127.0.0.1	www.1*********ks.com
O1 - Hosts: 127.0.0.1	1*********ks.com
O1 - Hosts: 127.0.0.1	10sek.com
O1 - Hosts: 127.0.0.1	www.10sek.com
O1 - Hosts: 127.0.0.1	www.1-2005-search.com
O1 - Hosts: 14896 more lines...
O2 - BHO: (BFlix Class) - {0C9F4179-6CE2-4c6a-A3E5-67FF3592A12E} - J:\Program Files (x86)\BFlix\Bflix.dll (BFlix)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - J:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (no name) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - J:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - No CLSID value found.
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - J:\Program Files (x86)\pdfforge Toolbar\SearchSettings.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (Foxit Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - J:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (&TerraTec Home Cinema) - {AD6E6555-FB2C-47D4-8339-3E2965509877} - J:\Program Files (x86)\TerraTec\TerraTec Home Cinema\THCDeskBand.dll (TerraTec Electronic GmbH)
O3 - HKLM\..\Toolbar: (no name) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - No CLSID value found.
O3 - HKU\KS_ON_J\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\KS_ON_J\..\Toolbar\WebBrowser: (Foxit Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - J:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] J:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [CanonSolutionMenu] J:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [Windows Defender] J:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Windows Mobile-based device management] J:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [WrtMon.exe] J:\Windows\System32\spool\drivers\x64\3\WrtMon.exe ()
O4 - HKLM..\Run: [avgnt] J:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DivXUpdate] J:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [JMB36X IDE Setup] J:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [K3aRyluP6SiCkoR] J:\Users\KS\AppData\Roaming\flint4ytw.exe (All Alex,Inc)
O4 - HKLM..\Run: [KORG USB-MIDI Driver] J:\Program Files (x86)\KORG\KORG USB-MIDI Driver\EsHelper2.exe (KORG Inc.)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] J:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [WinampAgent] J:\Program Files (x86)\Winamp\winampa.exe ()
O4 - HKU\KS_ON_J..\Run: [ICQ] J:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O4 - HKU\KS_ON_J..\Run: [K3aRyluP6SiCkoR] J:\Users\KS\AppData\Roaming\flint4ytw.exe (All Alex,Inc)
O4 - HKU\KS_ON_J..\Run: [Remote Control Editor] J:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe (Elgato Systems)
O4 - HKU\KS_ON_J..\Run: [SpybotSD TeaTimer] J:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\LocalService_ON_J..\Run: [Sidebar] J:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_J..\Run: [WindowsWelcomeCenter] J:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\NetworkService_ON_J..\Run: [Sidebar] J:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_J..\Run: [WindowsWelcomeCenter] J:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\UpdatusUser_ON_J..\Run: [Sidebar] J:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\UpdatusUser_ON_J..\Run: [WindowsWelcomeCenter] J:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\Administrator_ON_J\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\KS_ON_J\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O7 - HKU\KS_ON_J\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\KS_ON_J\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\KS_ON_J\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - J:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - J:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - J:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - J:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - J:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - J:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (C:\Users\KS\AppData\Roaming\flint4ytw.exe) - J:\Users\KS\AppData\Roaming\flint4ytw.exe (All Alex,Inc)
O20 - HKLM Winlogon: UserInit - (C:\Users\KS\AppData\Roaming\flint4ytw.exe) - J:\Users\KS\AppData\Roaming\flint4ytw.exe (All Alex,Inc)
O20 - HKU\KS_ON_J Winlogon: Shell - (C:\Users\KS\AppData\Roaming\flint4ytw.exe) - J:\Users\KS\AppData\Roaming\flint4ytw.exe (All Alex,Inc)
O20 - HKU\KS_ON_J Winlogon: UserInit - (C:\Users\KS\AppData\Roaming\flint4ytw.exe) - J:\Users\KS\AppData\Roaming\flint4ytw.exe (All Alex,Inc)
O24 - Desktop WallPaper: J:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: J:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs:64bit: Ntmssvc - J:\Windows\System32\ntmssvc.dll (Microsoft Corporation)
NetSvcs:64bit: AppMgmt - J:\Windows\System32\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WISO Bewerbung-Reminder.lnk - J:\Program Files (x86)\WISO\Bewerbung\KCReminder.exe - ()
MsConfig:64bit - StartUpReg: msnmsgr - hkey= - key= - J:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: NBKeyScan - hkey= - key= - J:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
MsConfig:64bit - StartUpReg: OpwareSE4 - hkey= - key= - J:\Program Files (x86)\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - J:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: SearchSettings - hkey= - key= - J:\Program Files (x86)\pdfforge Toolbar\SearchSettings.exe (Spigot, Inc.)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/03/13 17:35:10 | 000,308,224 | ---- | C] (All Alex,Inc) -- J:\Users\KS\AppData\Roaming\flint4ytw.exe
[2012/03/11 14:59:56 | 000,000,000 | ---D | C] -- J:\Users\KS\Documents\NeroVision
[2012/03/01 12:57:40 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{898FDF7E-3810-40D5-AE9A-A907A702C061}
[2012/03/01 12:57:02 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{70B90378-9D20-471B-A965-EF6D732E61CF}
[2012/03/01 02:00:56 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{BB969EC1-F50D-4BD5-92AF-E6710E6BC773}
[2012/03/01 02:00:40 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{DD14EA9D-444C-40B0-84AE-DA00812E0F6D}
[2012/03/01 01:18:53 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{65A109D7-24CD-4DA2-A414-96F28A12B41E}
[2012/03/01 01:18:30 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{1229C513-0423-46E3-A999-15CE9ECED5B6}
[2012/02/29 15:09:18 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{4942499E-8DCE-4147-B2A7-46C86C184D0B}
[2012/02/29 15:08:57 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{1FA81B1B-E341-436A-BB58-CB2CB1485CCF}
[2012/02/29 01:09:20 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{3FBD0AD6-8A11-449B-A4B5-FF6E67401D77}
[2012/02/29 01:09:08 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{8A36867A-85A8-42A7-A667-D28B34461528}
[2012/02/28 14:43:25 | 000,000,000 | ---D | C] -- J:\Users\KS\Desktop\Neuer Ordner
[2012/02/28 12:40:23 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{83D85F82-8FAD-4B05-A793-4309304006ED}
[2012/02/28 12:40:01 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{80FDC4D4-A340-49F5-9630-91FFB6F79643}
[2012/02/28 01:00:17 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{F43D4171-6BC1-4B21-B312-1B71A6C6C210}
[2012/02/28 00:59:57 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{9599016C-94C7-48D6-9879-29900CFE77DD}
[2012/02/27 12:40:20 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{B90E0048-8AFB-493A-AA8E-0BB34FE38D19}
[2012/02/27 12:39:55 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{C0FBFDE0-5982-4E14-B2F7-686458FA70E0}
[2012/02/27 01:01:31 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{2E66204D-299D-46D7-A501-1B2FCBF97005}
[2012/02/27 01:01:11 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{B80EC5B8-ACF4-44DC-8B7A-B107A29DA1CF}
[2012/02/26 10:26:32 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{F40C50CF-B56F-43B7-B7EC-6A764BA04038}
[2012/02/26 10:26:18 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{561BFFD4-EB62-4B74-8010-65F0F60F5878}
[2012/02/26 04:49:00 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{F8B680B4-D726-4860-84C2-A6899EDB8132}
[2012/02/26 04:48:43 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{41689688-EB01-422D-A67A-FBA6CC151112}
[2012/02/25 14:38:46 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Roaming\Korg
[2012/02/25 14:35:22 | 000,000,000 | ---D | C] -- J:\ProgramData\Microsoft\Windows\Start Menu\Programs\KORG
[2012/02/25 14:35:22 | 000,000,000 | ---D | C] -- J:\Program Files (x86)\KORG
[2012/02/25 10:13:45 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{9EC6F7FB-C5A5-4D29-B005-BB5A0F766EFC}
[2012/02/25 10:13:24 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{70401AD6-03CB-4749-8F6C-FEC6559A314A}
[2012/02/25 04:36:31 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{1C094E9B-EC23-4A72-949F-84CE71E1EBCE}
[2012/02/25 04:36:08 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{8CA7568F-4B5E-4BE5-85D1-7D60DA828309}
[2012/02/24 16:20:47 | 000,000,000 | ---D | C] -- J:\Users\KS\Desktop\Korg microSampler
[2012/02/24 09:13:46 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{E2D81893-9DBB-49E5-94E4-B1055256A52B}
[2012/02/24 09:13:34 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{16161D98-C97F-425F-95AD-D0A4E3715E1C}
[2012/02/24 01:22:05 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{76911CC7-7BEE-449C-A653-A5F2DCD63DA4}
[2012/02/24 01:21:55 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{C2F64825-E512-41B5-85D0-84FF95D30600}
[2012/02/23 13:53:33 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{131A8BDA-260F-4588-9E8C-EF3B5082360A}
[2012/02/23 13:53:11 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{EFB03B41-4AD8-4E3B-AB3F-286B14166654}
[2012/02/23 01:10:29 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{A2B1C3B4-ED63-4937-9FB5-2774AA961BC8}
[2012/02/23 01:10:08 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{1EB6BA61-5055-43B1-861F-F74925F184A3}
[2012/02/22 12:37:14 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{A0E9E060-D191-46B4-900E-3CE86A9A9788}
[2012/02/22 12:37:02 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{B520A7E3-7155-4446-9E6B-7B34C0E5AF44}
[2012/02/22 01:12:55 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{E4D63FA6-22C6-43E5-8B1E-BA1F3178F760}
[2012/02/22 01:12:30 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{F816BEDE-53A2-4529-8BDF-85F694EA6F51}
[2012/02/21 12:32:20 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{03FB5A95-9EFA-484B-AAD2-AD771D695A5B}
[2012/02/21 12:32:07 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{BF936467-A6EE-41B5-BBFD-A56A4443D00A}
[2012/02/21 01:14:46 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{7D6D1709-91E0-4D0B-8953-C90AE7A49460}
[2012/02/21 01:14:23 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{DBFF3A02-6784-45B8-8AA5-A424514BF52F}
[2012/02/20 14:22:59 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{5CDF8925-F1FE-45A4-A8A0-EEB3DDF56678}
[2012/02/20 14:22:48 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{E83C5313-1F50-4B53-9CB3-C03320ACC38E}
[2012/02/20 01:18:25 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{874C39C7-E3D0-47FF-942E-32B4AA58DE00}
[2012/02/20 01:18:03 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{485EBF89-64D5-4D57-BAFA-7CB8C24E3E33}
[2012/02/19 09:37:30 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{18D25441-FE1E-474D-983A-DB1B564FAEBD}
[2012/02/19 09:37:12 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{D6F65880-76BF-4E22-ABDC-C5AFA3A9F719}
[2012/02/19 05:50:54 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{B652981D-0D34-44E2-937E-8F9F3E6040D2}
[2012/02/19 05:50:43 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{F23A6DBF-2F27-4A5D-8119-64A7C9BBE95F}
[2012/02/19 05:03:40 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{9E564FE0-9C65-40DC-A218-434DEA43D207}
[2012/02/19 05:02:56 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{95EA507C-2AAB-4AA5-B970-72D39DB5F5A2}
[2012/02/18 15:49:32 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{8F8E3274-79C9-41DB-9EBD-FD72B0AF078B}
[2012/02/18 15:49:10 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{25736C26-E7CA-43B6-AB35-C7A3FCA04654}
[2012/02/18 07:03:34 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{17448574-A2AD-4D85-97C2-7A8493F166D3}
[2012/02/18 07:02:46 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{603B7041-1D4F-4D7C-B5AC-540072F29394}
[2012/02/18 04:32:44 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Roaming\Avira
[2012/02/18 04:27:06 | 000,000,000 | ---D | C] -- J:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012/02/18 04:26:51 | 000,132,320 | ---- | C] (Avira GmbH) -- J:\Windows\System32\drivers\avipbb.sys
[2012/02/18 04:26:51 | 000,097,312 | ---- | C] (Avira GmbH) -- J:\Windows\System32\drivers\avgntflt.sys
[2012/02/18 04:26:51 | 000,027,760 | ---- | C] (Avira GmbH) -- J:\Windows\System32\drivers\avkmgr.sys
[2012/02/18 04:26:49 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{3633C677-7D47-4D30-9DB9-7FDA444CAA9C}
[2012/02/18 04:26:33 | 000,000,000 | ---D | C] -- J:\Users\KS\AppData\Local\{272A086D-7D08-4F18-AA4E-B31A0C28E510}
[2012/02/18 04:26:20 | 000,000,000 | ---D | C] -- J:\ProgramData\Avira
[2012/02/18 04:26:20 | 000,000,000 | ---D | C] -- J:\Program Files (x86)\Avira
[1 J:\Windows\*.tmp files -> J:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/03/18 13:54:53 | 000,067,584 | --S- | M] () -- J:\Windows\bootstat.dat
[2012/03/14 14:51:27 | 000,005,296 | -H-- | M] () -- J:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/03/14 14:51:26 | 000,005,296 | -H-- | M] () -- J:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/03/14 14:51:18 | 000,001,098 | ---- | M] () -- J:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/03/13 17:35:09 | 000,308,224 | ---- | M] (All Alex,Inc) -- J:\Users\KS\AppData\Roaming\flint4ytw.exe
[2012/03/13 16:45:00 | 000,001,102 | ---- | M] () -- J:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/03/12 16:22:58 | 000,037,888 | ---- | M] () -- J:\Users\KS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/03/12 16:22:03 | 000,000,091 | ---- | M] () -- J:\Users\KS\AppData\default.pls
[2012/03/12 16:22:03 | 000,000,069 | ---- | M] () -- J:\Windows\NeroDigital.ini
[2012/03/10 12:53:47 | 000,502,230 | ---- | M] () -- J:\Users\KS\Desktop\ab*****g 1.jpg
[2012/03/10 12:53:30 | 000,455,860 | ---- | M] () -- J:\Users\KS\Desktop\ab*****g.jpg
[2012/03/09 13:11:52 | 000,103,105 | ---- | M] () -- J:\Users\KS\Desktop\Bewe********d neu.jpg
[2012/03/07 14:11:15 | 000,007,068 | ---- | M] () -- J:\Users\KS\Desktop\Bes***o NEU - Vers. 01.odt
[2012/03/07 13:24:46 | 000,145,835 | R--- | M] () -- J:\Users\KS\Documents\zeichentabelle.pdf
[2012/03/05 14:35:10 | 011,875,512 | ---- | M] () -- J:\Windows\System32\perfh007.dat
[2012/03/05 14:35:10 | 004,072,968 | ---- | M] () -- J:\Windows\System32\perfh009.dat
[2012/03/05 14:35:10 | 003,751,696 | ---- | M] () -- J:\Windows\System32\perfc007.dat
[2012/03/05 14:35:10 | 003,310,634 | ---- | M] () -- J:\Windows\System32\perfc009.dat
[2012/03/05 14:25:17 | 000,038,314 | ---- | M] () -- J:\Users\KS\Desktop\Kon******************************.pdf
[2012/03/04 16:41:12 | 000,354,269 | ---- | M] () -- J:\Users\KS\Desktop\P1010125.JPG
[2012/03/04 16:19:26 | 000,000,000 | ---- | M] () -- J:\Windows\System32\drivers\lvuvc.hs
[2012/03/04 12:50:11 | 000,128,752 | R--- | M] () -- J:\Users\KS\Desktop\ze*****b.pdf
[2012/03/02 09:57:42 | 653,339,348 | ---- | M] () -- J:\Windows\MEMORY.DMP
[2012/03/01 14:03:26 | 000,000,922 | ---- | M] () -- J:\Users\KS\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/03/01 14:03:26 | 000,000,910 | ---- | M] () -- J:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/03/01 14:03:26 | 000,000,898 | ---- | M] () -- J:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/02/25 15:29:10 | 000,000,000 | ---D | M] -- J:\ProgramData\Microsoft\Windows\Start Menu\Programs\KORG
[2012/02/25 11:58:34 | 000,002,341 | ---- | M] () -- J:\Users\KS\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2012/02/18 04:27:06 | 000,001,911 | ---- | M] () -- J:\Users\Public\Desktop\Avira Control Center.lnk
[2012/02/18 04:27:06 | 000,000,000 | ---D | M] -- J:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[1 J:\Windows\*.tmp files -> J:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/03/10 12:53:17 | 000,502,230 | ---- | C] () -- J:\Users\KS\Desktop\ab*****g 1.jpg
[2012/03/10 12:53:12 | 000,455,860 | ---- | C] () -- J:\Users\KS\Desktop\ab*****g.jpg
[2012/03/09 13:09:17 | 000,103,105 | ---- | C] () -- J:\Users\KS\Desktop\Bewe*******d neu.jpg
[2012/03/07 13:24:51 | 000,145,835 | R--- | C] () -- J:\Users\KS\Documents\zeichentabelle.pdf
[2012/03/07 00:59:00 | 000,007,068 | ---- | C] () -- J:\Users\KS\Desktop\Be**** NEU - Vers. 01.odt
[2012/03/05 14:25:16 | 000,038,314 | ---- | C] () -- J:\Users\KS\Desktop\Kon******************************.pdf
[2012/03/04 16:39:33 | 000,354,269 | ---- | C] () -- J:\Users\KS\Desktop\P1010125.JPG
[2012/03/04 12:50:14 | 000,128,752 | R--- | C] () -- J:\Users\KS\Desktop\ze**********b.pdf
[2012/03/02 09:57:42 | 653,339,348 | ---- | C] () -- J:\Windows\MEMORY.DMP
[2012/02/18 04:27:06 | 000,001,911 | ---- | C] () -- J:\Users\Public\Desktop\Avira Control Center.lnk
[2010/10/20 11:06:46 | 000,011,776 | ---- | C] () -- J:\Windows\SysWow64\pmsbfn32.dll
[2010/10/20 11:02:58 | 000,000,424 | ---- | C] () -- J:\Windows\MAXLINK.INI
[2010/08/08 15:06:35 | 000,063,488 | ---- | C] () -- J:\Windows\SysWow64\Eztw32.dll
[2010/05/15 15:38:39 | 000,000,091 | ---- | C] () -- J:\Users\KS\AppData\default.pls
[2010/01/22 11:50:02 | 000,000,035 | ---- | C] () -- J:\Windows\Ulead32.INI
[2009/11/09 17:17:27 | 000,027,648 | ---- | C] () -- J:\Windows\SysWow64\AVSredirect.dll
[2009/10/27 04:00:38 | 000,285,216 | ---- | C] () -- J:\Windows\SysWow64\drivers\Onsio.sys
[2009/10/27 04:00:38 | 000,007,680 | ---- | C] () -- J:\Windows\SysWow64\drivers\Onsreged.sys
[2009/10/24 08:15:32 | 000,001,746 | ---- | C] () -- J:\Windows\Language_trs.ini
[2009/10/24 08:15:18 | 000,034,371 | ---- | C] () -- J:\Windows\Ascd_tmp.ini
[2009/10/24 08:02:51 | 000,000,921 | ---- | C] () -- J:\Windows\SysWow64\WLAN.INI
[2009/10/15 13:44:17 | 000,001,356 | ---- | C] () -- J:\Users\KS\AppData\Local\d3d9caps.dat
[2009/10/13 16:10:08 | 000,000,112 | ---- | C] () -- J:\Users\KS\AppData\Roaming\default.pls
[2009/09/20 12:18:50 | 000,000,056 | -H-- | C] () -- J:\Windows\SysWow64\ezsidmv.dat
[2009/09/05 07:55:28 | 000,000,247 | ---- | C] () -- J:\Windows\BUHL.INI
[2009/09/01 13:34:42 | 001,537,462 | ---- | C] () -- J:\Windows\SysWow64\PerfStringBackup.INI
[2009/08/29 10:05:22 | 000,000,137 | ---- | C] () -- J:\Users\KS\AppData\Roaming\default.rss
[2009/08/29 10:03:29 | 000,000,069 | ---- | C] () -- J:\Windows\NeroDigital.ini
[2009/08/27 17:06:53 | 000,004,767 | ---- | C] () -- J:\Windows\Irremote.ini
[2009/08/24 15:48:52 | 000,117,248 | ---- | C] () -- J:\Windows\SysWow64\EhStorAuthn.dll
[2009/08/24 15:48:50 | 000,056,880 | ---- | C] () -- J:\Windows\SysWow64\scvideo.dll
[2009/08/24 15:48:25 | 000,107,612 | ---- | C] () -- J:\Windows\SysWow64\StructuredQuerySchema.bin
[2009/08/24 15:47:58 | 000,368,640 | ---- | C] () -- J:\Windows\SysWow64\msjetoledb40.dll
[2009/08/24 14:58:04 | 000,018,904 | ---- | C] () -- J:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2009/08/24 13:41:02 | 000,060,124 | ---- | C] () -- J:\Windows\SysWow64\tcpmon.ini
[2009/08/23 16:11:20 | 000,000,000 | ---- | C] () -- J:\Windows\nsreg.dat
[2009/08/23 14:29:25 | 000,037,888 | ---- | C] () -- J:\Users\KS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/23 12:20:30 | 000,001,460 | ---- | C] () -- J:\Users\KS\AppData\Local\d3d9caps64.dat
[2007/04/27 05:43:58 | 000,120,200 | ---- | C] () -- J:\Windows\SysWow64\DLLDEV32i.dll
[2006/11/02 11:34:20 | 000,067,584 | --S- | C] () -- J:\Windows\bootstat.dat
[2006/11/02 11:00:34 | 000,197,632 | ---- | C] () -- J:\Windows\SysWow64\ir32_32.dll
[2006/11/02 08:37:14 | 000,215,943 | ---- | C] () -- J:\Windows\SysWow64\dssec.dat
[2006/11/02 08:24:17 | 000,000,741 | ---- | C] () -- J:\Windows\SysWow64\NOISE.DAT
[2006/11/02 08:18:17 | 000,673,088 | ---- | C] () -- J:\Windows\SysWow64\mlang.dat
[2006/11/02 05:47:54 | 000,043,131 | ---- | C] () -- J:\Windows\mib.bin
[2005/05/12 03:05:40 | 000,004,748 | -H-- | C] () -- J:\Windows\SysWow64\database.dat
[2005/04/06 11:27:14 | 000,180,224 | ---- | C] () -- J:\Windows\SysWow64\xvidvfw.dll
[2005/04/06 11:24:40 | 000,819,200 | ---- | C] () -- J:\Windows\SysWow64\xvidcore.dll
[2004/04/27 11:26:48 | 000,005,824 | ---- | C] () -- J:\Windows\SysWow64\drivers\ASUSHWIO.SYS
 
========== LOP Check ==========
 
[2009/08/23 12:18:48 | 000,000,000 | -HSD | M] -- J:\ProgramData\Anwendungsdaten
[2006/11/02 11:39:21 | 000,000,000 | -HSD | M] -- J:\ProgramData\Application Data
[2009/08/24 11:52:00 | 000,000,000 | -H-D | M] -- J:\ProgramData\CanonBJ
[2012/01/15 16:08:24 | 000,000,000 | ---D | M] -- J:\ProgramData\CanonIJPLM
[2006/11/02 11:39:21 | 000,000,000 | -HSD | M] -- J:\ProgramData\Desktop
[2006/11/02 11:39:21 | 000,000,000 | -HSD | M] -- J:\ProgramData\Documents
[2009/08/23 12:18:48 | 000,000,000 | -HSD | M] -- J:\ProgramData\Dokumente
[2012/01/18 14:44:26 | 000,000,000 | ---D | M] -- J:\ProgramData\Easy Driver Pro
[2011/11/02 13:39:58 | 000,000,000 | ---D | M] -- J:\ProgramData\Easybits GO
[2009/08/23 12:18:48 | 000,000,000 | -HSD | M] -- J:\ProgramData\Favoriten
[2006/11/02 11:39:21 | 000,000,000 | -HSD | M] -- J:\ProgramData\Favorites
[2010/10/28 10:47:36 | 000,000,000 | ---D | M] -- J:\ProgramData\ICQ
[2012/02/06 14:01:02 | 000,000,000 | ---D | M] -- J:\ProgramData\InstallMate
[2010/09/19 14:13:52 | 000,000,000 | ---D | M] -- J:\ProgramData\LightScribe
[2012/01/22 13:17:41 | 000,000,000 | ---D | M] -- J:\ProgramData\MAGIX
[2009/09/01 14:57:50 | 000,000,000 | ---D | M] -- J:\ProgramData\OfficeRecovery
[2009/10/18 15:16:35 | 000,000,000 | ---D | M] -- J:\ProgramData\PC Drivers HeadQuarters
[2012/02/06 13:59:56 | 000,000,000 | ---D | M] -- J:\ProgramData\Premium
[2010/10/20 11:02:44 | 000,000,000 | ---D | M] -- J:\ProgramData\ScanSoft
[2006/11/02 11:39:21 | 000,000,000 | -HSD | M] -- J:\ProgramData\Start Menu
[2009/08/23 12:18:48 | 000,000,000 | -HSD | M] -- J:\ProgramData\Startmenü
[2006/11/02 11:39:21 | 000,000,000 | -HSD | M] -- J:\ProgramData\Templates
[2009/09/24 12:14:07 | 000,000,000 | ---D | M] -- J:\ProgramData\TerraTec
[2011/03/20 16:13:52 | 000,000,000 | ---D | M] -- J:\ProgramData\tmp
[2011/02/06 13:35:05 | 000,000,000 | ---D | M] -- J:\ProgramData\TVersity
[2012/01/18 14:46:20 | 000,000,000 | ---D | M] -- J:\ProgramData\UAB
[2012/01/20 11:55:06 | 000,000,000 | ---D | M] -- J:\ProgramData\Ulead Systems
[2009/08/23 12:18:48 | 000,000,000 | -HSD | M] -- J:\ProgramData\Vorlagen
[2010/09/20 15:42:05 | 000,000,000 | ---D | M] -- J:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2012/03/14 14:48:25 | 000,032,632 | ---- | M] () -- J:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2009/08/25 14:16:52 | 000,000,000 | -HSD | M] -- J:\$Recycle.Bin
[2006/11/02 11:39:21 | 000,000,000 | -HSD | M] -- J:\Documents and Settings
[2009/08/23 12:18:48 | 000,000,000 | -HSD | M] -- J:\Dokumente und Einstellungen
[2009/08/27 16:59:57 | 000,000,000 | ---D | M] -- J:\inetpub
[2009/10/24 08:15:33 | 000,000,000 | ---D | M] -- J:\Intel
[2009/10/27 04:00:37 | 000,000,000 | ---D | M] -- J:\Kpcms
[2010/11/21 13:37:45 | 000,000,000 | ---D | M] -- J:\MP3
[2009/08/24 12:38:33 | 000,000,000 | RH-D | M] -- J:\MSOCache
[2009/08/24 14:26:01 | 000,000,000 | ---D | M] -- J:\PerfLogs
[2011/04/30 13:14:59 | 000,000,000 | R--D | M] -- J:\Program Files
[2012/02/25 14:35:22 | 000,000,000 | R--D | M] -- J:\Program Files (x86)
[2012/02/18 04:26:20 | 000,000,000 | -H-D | M] -- J:\ProgramData
[2009/08/23 12:18:48 | 000,000,000 | -HSD | M] -- J:\Programme
[2009/10/24 09:41:44 | 000,000,000 | ---D | M] -- J:\RaidTool
[2012/03/14 14:55:02 | 000,000,000 | -HSD | M] -- J:\System Volume Information
[2012/01/18 15:25:07 | 000,000,000 | R--D | M] -- J:\Users
[2012/03/13 17:39:52 | 000,000,000 | ---D | M] -- J:\Windows
[2009/08/23 11:59:42 | 000,000,000 | ---D | M] -- J:\Windows.old
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2006/11/02 08:03:16 | 000,062,056 | ---- | M] (Microsoft Corporation) MD5=5CCDD13BC602AE33CD8B62D33C29AB72 -- J:\Windows\System32\drivers\AGP440.sys
[2006/11/02 08:03:16 | 000,062,056 | ---- | M] (Microsoft Corporation) MD5=5CCDD13BC602AE33CD8B62D33C29AB72 -- J:\Windows\System32\DriverStore\FileRepository\machine.inf_c41411ff\AGP440.sys
[2008/01/19 04:09:09 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- J:\Windows\System32\DriverStore\FileRepository\machine.inf_986ce78a\AGP440.sys
[2008/01/19 04:09:09 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- J:\Windows\System32\DriverStore\FileRepository\machine.inf_eee87d92\AGP440.sys
[2008/01/19 04:09:09 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- J:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_163188bf770e4ab0\AGP440.sys
[2008/01/19 04:09:09 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- J:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_181d01cb743015fc\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/08/23 18:10:26 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=05001E1FACCE49DB895B8526B05C7302 -- J:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_37cb142cf6008bc1\atapi.sys
[2008/01/19 04:07:46 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=1898FAE8E07D97F2F6C2D5326C633FAC -- J:\Windows\System32\DriverStore\FileRepository\mshdc.inf_1d87dda2\atapi.sys
[2008/01/19 04:07:46 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=1898FAE8E07D97F2F6C2D5326C633FAC -- J:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_3956c39dd9e73fd2\atapi.sys
[2009/08/23 18:10:26 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=BB55C79E0595D8CFBE4A80A3C9EB77EA -- J:\Windows\System32\DriverStore\FileRepository\mshdc.inf_800fd020\atapi.sys
[2009/08/23 18:10:26 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=BB55C79E0595D8CFBE4A80A3C9EB77EA -- J:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_375215c7dcd73562\atapi.sys
[2006/11/02 08:01:02 | 000,020,072 | ---- | M] (Microsoft Corporation) MD5=DF96CF8885724430024B7522E5C95722 -- J:\Windows\System32\DriverStore\FileRepository\mshdc.inf_f8cccc79\atapi.sys
[2009/04/11 03:15:00 | 000,020,952 | ---- | M] (Microsoft Corporation) MD5=E68D9B3A3905619732F7FE039466A623 -- J:\Windows\System32\drivers\atapi.sys
[2009/04/11 03:15:00 | 000,020,952 | ---- | M] (Microsoft Corporation) MD5=E68D9B3A3905619732F7FE039466A623 -- J:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b6d20d6f\atapi.sys
[2009/04/11 03:15:00 | 000,020,952 | ---- | M] (Microsoft Corporation) MD5=E68D9B3A3905619732F7FE039466A623 -- J:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_3b423ca9d7090b1e\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006/11/02 07:16:48 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 -- J:\Windows\System32\cngaudit.dll
[2006/11/02 07:16:48 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 -- J:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_424bc4aceb06de1c\cngaudit.dll
[2006/11/02 05:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- J:\Windows\SysWOW64\cngaudit.dll
[2006/11/02 05:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- J:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2009/08/23 15:52:24 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- J:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_b5f700fe698beb14\explorer.exe
[2009/08/23 15:52:23 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- J:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_b7eb106e66a7ac19\explorer.exe
[2009/08/23 15:52:23 | 003,087,360 | ---- | M] (Microsoft Corporation) MD5=50514057C28A74BAC2BD04B7B990D615 -- J:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_aba256ac352b2919\explorer.exe
[2009/08/23 15:52:22 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- J:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_b8583e9d7fda0512\explorer.exe
[2006/11/02 07:15:52 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=5D768BEB711FF67ADC8FAD4E2F6ABB02 -- J:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_ab9c809a352ecf21\explorer.exe
[2009/04/11 03:10:17 | 003,079,168 | ---- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 -- J:\Windows\explorer.exe
[2009/04/11 03:10:17 | 003,079,168 | ---- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 -- J:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_afbebba22f3bab41\explorer.exe
[2009/08/23 15:51:36 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- J:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_b61f6f46696c67ab\explorer.exe
[2009/08/23 15:52:23 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=72B9990E45C25AA3C75C4FB50A9D6CE0 -- J:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_ac5266dd4e2b0a41\explorer.exe
[2009/08/23 15:51:36 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=819D88EC82C2C44B556DC32ED22044DE -- J:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_ac3dc19d4e3a6405\explorer.exe
[2009/08/23 15:52:22 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=BBD8E74F23D7605CB0CDB57A1B25D826 -- J:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_ad96661c3246ea1e\explorer.exe
[2009/08/23 15:51:36 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- J:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_b6926bef829b2600\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- J:\Windows\SysWOW64\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- J:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_ba1365f4639c6d3c\explorer.exe
[2009/08/23 15:52:22 | 003,081,216 | ---- | M] (Microsoft Corporation) MD5=E404A65EF890140410E9F3D405841C95 -- J:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_ae03944b4b794317\explorer.exe
[2009/08/23 15:52:23 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- J:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_b6a7112f828bcc3c\explorer.exe
[2008/01/19 04:00:15 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=F6D765FB6B457542D954682F50C26E4F -- J:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_add342963219dff5\explorer.exe
[2009/08/23 15:51:36 | 003,087,360 | ---- | M] (Microsoft Corporation) MD5=FCBF8AC1855EF986CDEC2387760F71C6 -- J:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_abcac4f4350ba5b0\explorer.exe
[2006/11/02 05:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- J:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_b5f12aec698f911c\explorer.exe
[2008/01/19 03:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- J:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_b827ece8667aa1f0\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2008/01/19 04:11:31 | 000,290,872 | ---- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 -- J:\Windows\System32\DriverStore\FileRepository\iastorv.inf_fbe95c71\iaStorV.sys
[2008/01/19 04:11:31 | 000,290,872 | ---- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 -- J:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_0b2fedfc40256bc5\iaStorV.sys
[2006/11/02 07:51:48 | 000,280,680 | ---- | M] (Intel Corporation) MD5=72C3EE7EA3CD75A772E62AE0E5DF8B8C -- J:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 07:51:48 | 000,280,680 | ---- | M] (Intel Corporation) MD5=72C3EE7EA3CD75A772E62AE0E5DF8B8C -- J:\Windows\System32\DriverStore\FileRepository\iastorv.inf_69d79584\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2008/01/19 04:03:01 | 000,716,800 | ---- | M] (Microsoft Corporation) MD5=5D0A4891F8CD0E9E64FF57A6A34044F5 -- J:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_59d652c6f057598d\netlogon.dll
[2006/11/02 05:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- J:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_61f43b1d27cd0ab4\netlogon.dll
[2009/04/11 02:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- J:\Windows\SysWOW64\netlogon.dll
[2009/04/11 02:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- J:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_6616762521d9e6d4\netlogon.dll
[2009/04/11 03:11:16 | 000,717,312 | ---- | M] (Microsoft Corporation) MD5=A3F1B171702CA04744EE514243B45BFB -- J:\Windows\System32\netlogon.dll
[2009/04/11 03:11:16 | 000,717,312 | ---- | M] (Microsoft Corporation) MD5=A3F1B171702CA04744EE514243B45BFB -- J:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_5bc1cbd2ed7924d9\netlogon.dll
[2008/01/19 03:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- J:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_642afd1924b81b88\netlogon.dll
[2006/11/02 07:18:47 | 000,684,032 | ---- | M] (Microsoft Corporation) MD5=BFAB28B54DF41208CF3490FF26E53FD9 -- J:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_579f90caf36c48b9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006/11/02 08:02:51 | 000,048,232 | ---- | M] (NVIDIA Corporation) MD5=94C5334040A5D500897F4C5FD12AEEDE -- J:\Windows\System32\drivers\nvstor.sys
[2006/11/02 08:02:51 | 000,048,232 | ---- | M] (NVIDIA Corporation) MD5=94C5334040A5D500897F4C5FD12AEEDE -- J:\Windows\System32\DriverStore\FileRepository\nvraid.inf_a5403adf\nvstor.sys
[2008/01/19 04:08:50 | 000,054,328 | ---- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA -- J:\Windows\System32\DriverStore\FileRepository\nvraid.inf_63cdbcfd\nvstor.sys
[2008/01/19 04:08:50 | 000,054,328 | ---- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA -- J:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_95f95eab775c159d\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008/01/19 03:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- J:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_9e812831c5d9a243\scecli.dll
[2006/11/02 07:19:09 | 000,239,616 | ---- | M] (Microsoft Corporation) MD5=32EF13F20B28966D29DE5EABE036431D -- J:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_91f5bbe3948dcf74\scecli.dll
[2008/01/19 04:03:55 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=35F1DD99F9903BC267C2AF16B09F9BF7 -- J:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_942c7ddf9178e048\scecli.dll
[2006/11/02 05:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- J:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_9c4a6635c8ee916f\scecli.dll
[2009/04/11 02:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- J:\Windows\SysWOW64\scecli.dll
[2009/04/11 02:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- J:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_a06ca13dc2fb6d8f\scecli.dll
[2009/04/11 03:11:23 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=9922ADB6DCA8F0F5EA038BEFF339C08B -- J:\Windows\System32\scecli.dll
[2009/04/11 03:11:23 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=9922ADB6DCA8F0F5EA038BEFF339C08B -- J:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_9617f6eb8e9aab94\scecli.dll
 
< MD5 for: USER32.DLL  >
[2006/11/02 05:44:25 | 000,646,656 | ---- | M] (Microsoft Corporation) MD5=00B53DCA0408CCD8F6BAF13994F6E3A0 -- J:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_3174f01b5d2fa18f\user32.dll
[2009/08/23 18:03:22 | 000,646,656 | ---- | M] (Microsoft Corporation) MD5=296BA70E2A302E639CBD9E2A32DC65C4 -- J:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_31ad02315d0545af\user32.dll
[2008/01/19 04:04:23 | 000,820,224 | ---- | M] (Microsoft Corporation) MD5=32B87D215905F648EBE36A621978442C -- J:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_295707c525b9f068\user32.dll
[2008/01/19 03:32:19 | 000,648,192 | ---- | M] (Microsoft Corporation) MD5=3D691030DBD3BD75DE1501BE54F0D425 -- J:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_33abb2175a1ab263\user32.dll
[2009/08/23 18:03:22 | 000,646,656 | ---- | M] (Microsoft Corporation) MD5=437C1C0CB2A42EA20083F21E9CAEF461 -- J:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_32359eb27623cc22\user32.dll
[2009/08/23 18:03:22 | 000,810,496 | ---- | M] (Microsoft Corporation) MD5=707CD582A4F93DB789336A5CE9527970 -- J:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_275857df28a483b4\user32.dll
[2006/11/02 07:19:10 | 000,810,496 | ---- | M] (Microsoft Corporation) MD5=95D5555CC7BD8F520996E35D36491EEF -- J:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_272045c928cedf94\user32.dll
[2009/04/11 02:26:45 | 000,648,704 | ---- | M] (Microsoft Corporation) MD5=D29FDB5DEDBDC1BD882164DC6DC4DD53 -- J:\Windows\SysWOW64\user32.dll
[2009/04/11 02:26:45 | 000,648,704 | ---- | M] (Microsoft Corporation) MD5=D29FDB5DEDBDC1BD882164DC6DC4DD53 -- J:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_35972b23573c7daf\user32.dll
[2009/08/23 18:03:22 | 000,810,496 | ---- | M] (Microsoft Corporation) MD5=E4E3ED1E0D1D8C33A9C94ABEA1C8BC96 -- J:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_27e0f46041c30a27\user32.dll
[2009/04/11 03:11:27 | 000,820,224 | ---- | M] (Microsoft Corporation) MD5=F3F5549E69AE8509342E67E4F972CA1C -- J:\Windows\System32\user32.dll
[2009/04/11 03:11:27 | 000,820,224 | ---- | M] (Microsoft Corporation) MD5=F3F5549E69AE8509342E67E4F972CA1C -- J:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_2b4280d122dbbbb4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008/01/19 03:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- J:\Windows\SysWOW64\userinit.exe
[2008/01/19 03:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- J:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006/11/02 05:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- J:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
[2006/11/02 07:16:15 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=46D5B6B80E4A5997F508F938F96B7628 -- J:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_3610939d8d22586d\userinit.exe
[2008/01/19 04:00:41 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- J:\Windows\System32\userinit.exe
[2008/01/19 04:00:41 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- J:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_384755998a0d6941\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009/04/11 03:11:08 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A -- J:\Windows\System32\winlogon.exe
[2009/04/11 03:11:08 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A -- J:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_cdcd15a68a70b877\winlogon.exe
[2008/01/19 04:00:45 | 000,406,016 | ---- | M] (Microsoft Corporation) MD5=856491FCED98093D824B9EB2892F564A -- J:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_cbe19c9a8d4eed2b\winlogon.exe
[2009/04/11 02:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- J:\Windows\SysWOW64\winlogon.exe
[2009/04/11 02:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- J:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006/11/02 07:16:20 | 000,397,312 | ---- | M] (Microsoft Corporation) MD5=9642EED809219A2F914DD8E40A09C48B -- J:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_c9aada9e9063dc57\winlogon.exe
[2006/11/02 05:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- J:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008/01/19 03:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- J:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008/01/19 02:37:47 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=8A900348370E359B6BFF6A550E4649E1 -- J:\Windows\System32\drivers\ws2ifsl.sys
[2008/01/19 02:37:47 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=8A900348370E359B6BFF6A550E4649E1 -- J:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_aba53c58802b1777\ws2ifsl.sys
[2006/11/02 05:47:52 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=C4EE49DB7EADC812DBC0ECCF2E7FB929 -- J:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_a96e7a5c834006a3\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006/11/02 08:50:41 | 000,008,192 | ---- | M] () -- J:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 08:50:41 | 000,028,672 | ---- | M] () -- J:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 08:50:41 | 000,008,192 | ---- | M] () -- J:\Windows\System32\config\SECURITY.SAV
[2006/11/02 08:50:51 | 019,435,520 | ---- | M] () -- J:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 08:50:51 | 001,806,336 | ---- | M] () -- J:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\*.dll /lockedfiles >
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
< End of report >