Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde?

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 25.03.2012, 15:43   #1
Cataracs
 
Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde? - Standard

Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde?



Hallo Leute,


also, dumm wie ich war bin ich heute morgen auf eine von Google gesperrte Seite gegangen.
Als ich dann, nachdem ich einige Zeit nicht am PC war, wieder weiter zocken wollte, hab ich gesehen dass ich tausende Meldungen von Data Recovery hatte. Zuerst dachte ich, dass es wirklich so sei und hab nach Lösungen gegoogelt, wodurch ich dann auf diese Seite gestoßen bin.

So, habe also GuRu's Guide gefunden und soweit auch befolgt.
JEDOCH beim ersten Mal nichts gefunden.
Hab also neugestartet und dann ging der SPaß von vorne los.
Bin grad wieder dabei, es auszuführen.
Mit RKill habe ich, hoffentlich - bin mir nicht sicher ob es geklappt hat, jedoch zeigts das "System Check" Symbol nichtmehr unten rechts in der Leiste, alle Prozesse eliminiert.

Nun bin ich wieder mit Malwarebytes zugange und hoffe, dass es irgendetwas findet.
Jedoch bin ich mir sicher, dass es nichts wird.

Daher meine Bitte:
Wäre irgendjemand so freundlich, mit mir über Skype/MSN in Kontakt zu setzen und das Problem via TeamViewer zu lösen?
Ich weiß nicht ob es erlaubt ist, aber ich würde demjenigen auch ein paar Euro zukommen lassen. (Ich denke da an 5€/h)


Vielen Dank.
~ Michi

Auch wenn es gegen die Regeln ist, ich muss Bumpen.
Ich hab echt Angst um meinen Pc.

Achja, was noch zusagen ist:
Wenn ich jetzt RKill ausführen will, erscheint die Meldung:
Installation fehlgeschlagen (3 Mal)

JEDOCH wird Rkill trotzdem ausgeführt, mit folgenden Logs:

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 25.03.2012 at 17:50:47.
Operating System: Windows 7 Home Premium


Processes terminated by Rkill or while it was running:

C:\Windows\SysWOW64\rundll32.exe



Rkill completed on 25.03.2012 at 17:51:00.

Zitat:
Zitat von Cataracs Beitrag anzeigen
Auch wenn es gegen die Regeln ist, ich muss Bumpen.
Ich hab echt Angst um meinen Pc.

Achja, was noch zusagen ist:
Wenn ich jetzt RKill ausführen will, erscheint die Meldung:
Installation fehlgeschlagen (3 Mal)

JEDOCH wird Rkill trotzdem ausgeführt, mit folgenden Logs:

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 25.03.2012 at 17:50:47.
Operating System: Windows 7 Home Premium


Processes terminated by Rkill or while it was running:

C:\Windows\SysWOW64\rundll32.exe



Rkill completed on 25.03.2012 at 17:51:00.

Da ich nicht weiß wo der Editieren-Button ist, muss ich leider zitieren >.<

Alt 25.03.2012, 17:43   #2
markusg
/// Malware-holic
 
Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde? - Standard

Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde?



das pushen von themen wird dir auch nicht helfen, wenn du dir selbst antworten würdest, wäre dein beitrag nicht mehr als unbeantwortet gekennzeichnet und du müsstest dann sogar noch länger warten.
und wenn du sofortige hilfe willst, geh in ein pc geschäft und bezahle dafür....
das hier ist unsere freizeit.
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Starte bitte die
    OTL.exe
    .
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere nun den Inhalt in die
    Textbox.
Code:
ATTFilter
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
         
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread
__________________

__________________

Alt 25.03.2012, 17:55   #3
Cataracs
 
Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde? - Standard

Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde?



Entschuldige..

Ok, also B2Topic
Was genau meinst du mit 'Kopiere nun den Inhalt [...]'?
Soll ich so vorgehen wie es im OTL Thread beschrieben ist oder das was in der Box die du gepostet hast kopieren und in OTL einfügen?


Nochmals danke für deine Hilfe.


Falls ich das gemacht hab was du meinst, hier:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 25.03.2012 19:10:29 - Run 2
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Michali\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,25 Gb Available Physical Memory | 56,37% Memory free
8,00 Gb Paging File | 6,44 Gb Available in Paging File | 80,50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,73 Gb Total Space | 11,20 Gb Free Space | 22,99% Space Free | Partition Type: NTFS
Drive D: | 416,92 Gb Total Space | 305,72 Gb Free Space | 73,33% Space Free | Partition Type: NTFS
Drive F: | 931,51 Gb Total Space | 587,63 Gb Free Space | 63,08% Space Free | Partition Type: NTFS
 
Computer Name: MICHALI-PC | User Name: Michali | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Michali\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\ProgramData\rhExurxY9nsbJO.exe ( )
PRC - C:\Program Files (x86)\ScreenSnapr\ScreenSnapr.exe (Byteopia)
PRC - D:\VIER GESCHICHTE\4Story_DE\PrePatch.exe (Zemi Interactive Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ff30db6905f8ec024fc808ed8779c0f3\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\a09ee392fa90849f2e9313a1ebbe0279\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49f4cb0755ccc34cd35ff96dc2ef9e3\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1f14b3e1ee0847f8662f513e67f92547\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\15742b3597258ce67cbe219005c197e5\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (TeamViewer6) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (McComponentHostService) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (esgiguard) -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys File not found
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (teamviewervpn) -- C:\Windows\SysNative\drivers\teamviewervpn.sys (TeamViewer GmbH)
DRV:64bit: - (Netaapl) -- C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (MSHUSBVideo) -- C:\Windows\SysNative\drivers\nx6000.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (s1029unic) Sony Ericsson Device 1029 USB Ethernet Emulation (WDM) -- C:\Windows\SysNative\drivers\s1029unic.sys (MCCI Corporation)
DRV:64bit: - (s1029mgmt) Sony Ericsson Device 1029 USB WMC Device Management Drivers (WDM) -- C:\Windows\SysNative\drivers\s1029mgmt.sys (MCCI Corporation)
DRV:64bit: - (s1029obex) -- C:\Windows\SysNative\drivers\s1029obex.sys (MCCI Corporation)
DRV:64bit: - (s1029mdm) -- C:\Windows\SysNative\drivers\s1029mdm.sys (MCCI Corporation)
DRV:64bit: - (s1029nd5) Sony Ericsson Device 1029 USB Ethernet Emulation (NDIS) -- C:\Windows\SysNative\drivers\s1029nd5.sys (MCCI Corporation)
DRV:64bit: - (s1029mdfl) -- C:\Windows\SysNative\drivers\s1029mdfl.sys (MCCI Corporation)
DRV:64bit: - (s1029bus) Sony Ericsson Device 1029 driver (WDM) -- C:\Windows\SysNative\drivers\s1029bus.sys (MCCI Corporation)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (LGPBTDD) -- C:\Windows\SysNative\drivers\LGPBTDD.sys (Logitech Inc.)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com/?l=dis&o=101702
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F9 F4 BF 61 72 70 CB 01  [binary data]
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - No CLSID value found
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{23E8AE3B-368B-4F2D-B5A2-325B8979A9BB}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=382950&p={searchTerms}
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SKPT_de
IE - HKCU\..\SearchScopes\{A6AB4EA8-ADE4-450E-B40A-7B4AF3174A60}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=FXTV5&o=101699&src=kw&q={searchTerms}&locale=&apn_ptnrs=F4&apn_dtid=YYYYYYYYDE&apn_uid=9a6dd342-a612-4f83-88af-d3328a31b16b&apn_sauid=0A1FDA0B-78B1-4646-A6F1-917192819B6E
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaultthis.engineName: "uTorrentBar_DE Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=382950&ilc=12"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.11
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {a8864317-e18b-4292-99d9-e6e65ab905d3}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {75656794-AB59-4712-BFBC-5D816D56F3BC}:1.1.6
FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.3
FF - prefs.js..extensions.enabledItems: youtubedownloader@mybrowserbar.com:4.3
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9
FF - prefs.js..extensions.enabledItems: {c840e246-6b95-475e-9bd7-caa1c7eca9f2}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: info@djzig.com:1.2.3
FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=382950&p="
FF - prefs.js..network.proxy.type: 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll File not found
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Michali\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Michali\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.03.18 01:13:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.04.30 13:34:09 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\mozilla_cc@internetdownloadmanager.com: C:\Users\Michali\AppData\Roaming\IDM\idmmzcc5 [2012.02.18 13:54:37 | 000,000,000 | ---D | M]
 
[2010.10.20 18:26:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michali\AppData\Roaming\mozilla\Extensions
[2012.03.16 11:35:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michali\AppData\Roaming\mozilla\Firefox\Profiles\rugo9c6x.default\extensions
[2012.03.16 11:35:17 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Michali\AppData\Roaming\mozilla\Firefox\Profiles\rugo9c6x.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2011.10.10 17:44:05 | 000,002,399 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\askcom.xml
[2012.03.22 09:05:49 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-1.xml
[2011.09.28 15:20:18 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-2.xml
[2011.04.15 17:57:13 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-3.xml
[2011.04.29 11:25:53 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-4.xml
[2011.06.22 15:39:32 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-5.xml
[2011.08.06 15:21:40 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-6.xml
[2011.09.08 16:58:10 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-7.xml
[2011.09.10 07:55:30 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-8.xml
[2011.10.02 01:05:41 | 000,000,950 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin-9.xml
[2011.03.16 17:54:42 | 000,001,056 | ---- | M] () -- C:\Users\Michali\AppData\Roaming\Mozilla\Firefox\Profiles\rugo9c6x.default\searchplugins\icqplugin.xml
[2011.12.31 18:37:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.03.13 16:25:44 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
() (No name found) -- C:\USERS\MICHALI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RUGO9C6X.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\MICHALI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RUGO9C6X.DEFAULT\EXTENSIONS\ICH@MALTEGOETZ.DE.XPI
[2012.03.18 01:13:24 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.11.19 14:56:43 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.01 21:12:39 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.01 21:12:39 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.10.01 21:12:39 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.01 21:12:39 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.01 21:12:39 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.01 21:12:39 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Michali\AppData\Local\Google\Chrome\Application\17.0.963.83\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Michali\AppData\Local\Google\Chrome\Application\17.0.963.83\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Michali\AppData\Local\Google\Chrome\Application\17.0.963.83\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\Michali\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Nexon Game Controller (Enabled) = C:\ProgramData\NexonEU\NGM\npNxGameeu.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Michali\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\Michali\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Michali\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\
CHR - Extension: Skype Click to Call = C:\Users\Michali\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\
CHR - Extension: Google Mail = C:\Users\Michali\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2011.04.02 23:01:58 | 000,000,826 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Launch LCDMon] C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LgDevAgt] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [4StoryPrePatch] D:\VIER GESCHICHTE\4Story_DE\PrePatch.exe (Zemi Interactive Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ Malwarebytes Anti-Malware  (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [XCMsXSJotCWrp.exe] C:\ProgramData\XCMsXSJotCWrp.exe File not found
O4 - HKCU..\Run: [rhExurxY9nsbJO] C:\ProgramData\rhExurxY9nsbJO.exe ( )
O4 - HKCU..\Run: [ScreenSnapr] C:\Program Files (x86)\ScreenSnapr\ScreenSnapr.exe (Byteopia)
O4 - Startup: C:\Users\Michali\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Download with Xilisoft YouTube Vidéo Téléchargeur - C:\Program Files (x86)\Xilisoft\Download YouTube Video\upod_link.HTM File not found
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Download with Xilisoft YouTube Vidéo Téléchargeur - C:\Program Files (x86)\Xilisoft\Download YouTube Video\upod_link.HTM File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1C1AEC7B-DA6E-4CE0-B588-CDBD5C35133E}: DhcpNameServer = 139.7.30.125 139.7.30.126
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{58D6F2CF-A09A-403D-A41A-C8DED0025956}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O30:64bit: - LSA: Security Packages - (livessp) -  File not found
O30 - LSA: Security Packages - (livessp) -  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.10.07 20:44:13 | 000,000,000 | ---D | M] - F:\AutoMiner Pro -- [ NTFS ]
O32 - Unable to obtain root file information for disk F:\
O33 - MountPoints2\{aba02871-dced-11df-bc4c-001fd09ad884}\Shell - "" = AutoRun
O33 - MountPoints2\{aba02871-dced-11df-bc4c-001fd09ad884}\Shell\AutoRun\command - "" = G:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GamersFirst LIVE!.lnk -  - File not found
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ShortKeys Lite.lnk - C:\PROGRA~2\SHORTK~1\shklite.exe - (Insight Software Solutions)
MsConfig:64bit - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MsConfig:64bit - StartUpReg: FGbclJqUjQWpxnTOPNSDvDhItKNQIhKoZUJdULYjSRFqSoBPwO - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: KPeerNexonEU - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: MP3 Skype Recorder - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: SearchSettings - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: Sony Ericsson PC Companion - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: Steam - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: swg - hkey= - key= -  File not found
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.25 18:50:28 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\Michali\Desktop\OTL.exe
[2012.03.25 18:27:35 | 009,502,424 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Michali\Desktop\mbam-setup-1.60.1.1000.exe
[2012.03.25 18:21:14 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Users\Michali\Desktop\OTH.scr
[2012.03.25 16:28:38 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.03.25 15:13:51 | 000,000,000 | ---D | C] -- C:\sh4ldr
[2012.03.25 15:13:51 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2012.03.25 15:13:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2012.03.25 13:35:01 | 000,389,024 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\Michali\Desktop\unhide.exe
[2012.03.25 13:26:26 | 000,000,000 | ---D | C] -- C:\Users\Michali\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check
[2012.03.24 22:46:37 | 000,000,000 | ---D | C] -- C:\Users\Michali\AppData\Roaming\mIRC
[2012.03.24 22:46:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\mIRC
[2012.03.24 22:46:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\mIRC
[2012.03.24 22:46:21 | 001,909,192 | ---- | C] (mIRC Co. Ltd.) -- C:\Users\Michali\Desktop\mirc722.exe
[2012.03.23 14:12:37 | 000,000,000 | ---D | C] -- C:\Users\Michali\AppData\Roaming\Hyperdesktop
[2012.03.22 20:29:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScreenSnapr
[2012.03.22 20:29:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ScreenSnapr
[2012.03.13 16:25:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.03.13 16:25:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012.03.12 20:16:57 | 000,000,000 | ---D | C] -- C:\Users\Michali\Documents\My Chat Logs
[2012.03.11 21:04:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\konami
[2012.03.09 21:02:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CamStudio
[2012.03.09 21:02:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CamStudio
[2012.02.27 17:15:05 | 000,000,000 | ---D | C] -- C:\Users\Michali\quarterx2
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.25 19:07:18 | 000,020,790 | ---- | M] () -- C:\Users\Michali\Desktop\otllog.rar
[2012.03.25 18:50:26 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Michali\Desktop\OTL.exe
[2012.03.25 18:47:00 | 000,001,128 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2411381332-2107499652-1412120219-1000UA.job
[2012.03.25 18:45:04 | 000,000,264 | ---- | M] () -- C:\ProgramData\~rhExurxY9nsbJO
[2012.03.25 18:45:04 | 000,000,176 | ---- | M] () -- C:\ProgramData\~rhExurxY9nsbJOr
[2012.03.25 18:44:52 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.25 18:44:52 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.25 18:44:35 | 000,000,653 | ---- | M] () -- C:\Users\Michali\Desktop\System Check.lnk
[2012.03.25 18:42:45 | 000,696,832 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.03.25 18:42:45 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.03.25 18:42:45 | 000,148,128 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.03.25 18:42:45 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.03.25 18:42:44 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.03.25 18:35:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.25 18:29:50 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.25 18:27:45 | 009,502,424 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Michali\Desktop\mbam-setup-1.60.1.1000.exe
[2012.03.25 18:25:59 | 000,001,584 | ---- | M] () -- C:\Users\Michali\Desktop\mbam - Verknüpfung.lnk
[2012.03.25 18:21:07 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Users\Michali\Desktop\OTH.scr
[2012.03.25 17:45:21 | 000,000,560 | ---- | M] () -- C:\ProgramData\rhExurxY9nsbJO
[2012.03.25 15:55:24 | 000,000,062 | ---- | M] () -- C:\ProgramData\rhExurxY9nsbJO.lic
[2012.03.25 13:34:20 | 000,389,024 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\Michali\Desktop\unhide.exe
[2012.03.25 13:26:13 | 000,361,472 | ---- | M] ( ) -- C:\ProgramData\rhExurxY9nsbJO.exe
[2012.03.25 12:31:48 | 000,000,046 | ---- | M] () -- C:\Users\Michali\jagex_runescape_preferences.dat
[2012.03.25 11:07:18 | 000,000,129 | ---- | M] () -- C:\Users\Michali\jagex_runescape_preferences2.dat
[2012.03.24 22:46:37 | 000,000,955 | ---- | M] () -- C:\Users\Public\Desktop\mIRC.lnk
[2012.03.24 22:45:59 | 001,909,192 | ---- | M] (mIRC Co. Ltd.) -- C:\Users\Michali\Desktop\mirc722.exe
[2012.03.24 22:21:44 | 000,000,032 | ---- | M] () -- C:\Users\Michali\jagex_cl_runescape_LIVE.dat
[2012.03.24 20:47:00 | 000,001,076 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2411381332-2107499652-1412120219-1000Core.job
[2012.03.24 12:43:21 | 000,088,202 | ---- | M] () -- C:\Users\Michali\Desktop\coolbro.jpg
[2012.03.23 14:12:37 | 000,000,921 | ---- | M] () -- C:\Users\Michali\Desktop\Hyperdesktop.lnk
[2012.03.23 09:41:47 | 000,002,413 | ---- | M] () -- C:\Users\Michali\Desktop\Google Chrome.lnk
[2012.03.22 20:29:23 | 000,001,047 | ---- | M] () -- C:\Users\Public\Desktop\ScreenSnapr.lnk
[2012.03.17 21:22:08 | 000,331,947 | ---- | M] () -- C:\Users\Michali\Desktop\3316297_700b.jpg
[2012.03.17 21:04:19 | 000,001,014 | ---- | M] () -- C:\Users\Michali\Desktop\U7O1O - Imgur.gif
[2012.03.17 21:04:15 | 000,001,136 | ---- | M] () -- C:\Users\Michali\Desktop\isF99 - Imgur.gif
[2012.03.17 21:04:10 | 000,001,279 | ---- | M] () -- C:\Users\Michali\Desktop\1yVGB - Imgur.gif
[2012.03.17 21:02:27 | 000,001,130 | ---- | M] () -- C:\Users\Michali\Desktop\WDoQA - Imgur.gif
[2012.03.17 21:02:23 | 000,001,845 | ---- | M] () -- C:\Users\Michali\Desktop\xPoFX - Imgur.gif
[2012.03.17 21:02:18 | 000,001,562 | ---- | M] () -- C:\Users\Michali\Desktop\ipNSU - Imgur.gif
[2012.03.16 17:29:39 | 001,829,531 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0081.JPG
[2012.03.15 22:54:33 | 002,335,823 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0079.JPG
[2012.03.15 20:21:08 | 000,000,047 | ---- | M] () -- C:\Users\Michali\jagex_cl_runescape_LIVE1.dat
[2012.03.15 00:44:12 | 004,853,912 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.03.13 16:25:31 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.03.11 21:04:58 | 000,001,639 | ---- | M] () -- C:\Users\Public\Desktop\Yu-Gi-Oh! ONLINE 3.lnk
[2012.03.11 20:28:31 | 000,000,191 | ---- | M] () -- C:\Users\Michali\Documents\serviceidygoo.rtf
[2012.03.11 13:04:48 | 002,585,116 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0059.JPG
[2012.03.11 12:52:49 | 000,090,869 | ---- | M] () -- C:\Users\Michali\Desktop\heavy-rain-move-edition-platinum--sony-ps3-.gif
[2012.03.11 12:44:22 | 000,025,825 | ---- | M] () -- C:\Users\Michali\Desktop\popup_images_image_10005563-UK_1.jpg
[2012.03.11 12:30:47 | 000,028,865 | ---- | M] () -- C:\Users\Michali\Desktop\1902737.jpg
[2012.03.11 11:00:45 | 001,489,811 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0058.JPG
[2012.03.11 10:06:04 | 000,005,687 | ---- | M] () -- C:\Users\Michali\Documents\ayo.rtf
[2012.03.10 21:04:37 | 002,333,392 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0057.JPG
[2012.03.10 20:46:59 | 002,478,503 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0056.JPG
[2012.03.10 19:57:52 | 002,219,464 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0049.JPG
[2012.03.10 19:57:44 | 001,831,321 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0050.JPG
[2012.03.09 21:02:08 | 000,001,018 | ---- | M] () -- C:\Users\Public\Desktop\CamStudio.lnk
[2012.03.08 21:21:02 | 001,621,750 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_0005.JPG
[2012.03.07 20:34:02 | 001,079,503 | ---- | M] () -- C:\Users\Michali\Desktop\IMG_07032012_193413.png
[2012.03.04 00:41:06 | 000,001,011 | ---- | M] () -- C:\Users\Michali\Desktop\SwiftKit.lnk
[2012.03.03 21:55:28 | 002,002,044 | ---- | M] () -- C:\Users\Michali\Desktop\ScreenShot001.png
[2012.03.01 22:58:47 | 000,024,471 | ---- | M] () -- C:\Users\Michali\Desktop\mlp_omg.jpg
[2012.03.01 21:19:18 | 000,000,193 | ---- | M] () -- C:\Windows\WORDPAD.INI
[2012.02.29 23:55:37 | 000,001,332 | ---- | M] () -- C:\Users\Michali\Desktop\tshirts.rtf
[2012.02.27 23:45:33 | 000,000,304 | ---- | M] () -- C:\Users\Michali\Desktop\Fortsetzen Download League of Legends.url
[2012.02.27 23:40:04 | 002,403,335 | ---- | M] () -- C:\Users\Michali\Desktop\electro test.mp3
[2012.02.27 19:22:00 | 000,007,622 | ---- | M] () -- C:\Users\Michali\AppData\Local\Resmon.ResmonCfg
[2012.02.25 23:50:56 | 000,000,274 | ---- | M] () -- C:\Users\Michali\.jupload.properties
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.03.25 19:07:04 | 000,020,790 | ---- | C] () -- C:\Users\Michali\Desktop\otllog.rar
[2012.03.25 18:44:35 | 000,000,653 | ---- | C] () -- C:\Users\Michali\Desktop\System Check.lnk
[2012.03.25 18:29:50 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.25 18:25:59 | 000,001,584 | ---- | C] () -- C:\Users\Michali\Desktop\mbam - Verknüpfung.lnk
[2012.03.25 15:55:24 | 000,000,062 | ---- | C] () -- C:\ProgramData\rhExurxY9nsbJO.lic
[2012.03.25 15:17:30 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.03.25 15:17:30 | 000,002,213 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2012.03.25 15:17:30 | 000,002,193 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities 2011.lnk
[2012.03.25 15:17:30 | 000,001,866 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2012.03.25 15:17:30 | 000,001,783 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.03.25 15:17:30 | 000,001,639 | ---- | C] () -- C:\Users\Public\Desktop\Yu-Gi-Oh! ONLINE 3.lnk
[2012.03.25 15:17:30 | 000,001,166 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2012.03.25 15:17:30 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\Foxit Reader 5.0.lnk
[2012.03.25 15:17:30 | 000,001,047 | ---- | C] () -- C:\Users\Public\Desktop\ScreenSnapr.lnk
[2012.03.25 15:17:30 | 000,001,039 | ---- | C] () -- C:\Users\Public\Desktop\DiskAid.lnk
[2012.03.25 15:17:30 | 000,001,023 | ---- | C] () -- C:\Users\Public\Desktop\iExplorer.lnk
[2012.03.25 15:17:30 | 000,000,986 | ---- | C] () -- C:\Users\Public\Desktop\Gyazo.lnk
[2012.03.25 15:17:30 | 000,000,955 | ---- | C] () -- C:\Users\Public\Desktop\mIRC.lnk
[2012.03.25 15:17:29 | 000,001,246 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2012.03.25 15:17:29 | 000,001,018 | ---- | C] () -- C:\Users\Public\Desktop\CamStudio.lnk
[2012.03.25 15:17:29 | 000,000,691 | ---- | C] () -- C:\Users\Public\Desktop\4Story.lnk
[2012.03.25 15:17:28 | 000,001,547 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012.03.25 15:17:28 | 000,001,210 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2012.03.25 15:17:27 | 000,002,205 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2011.lnk
[2012.03.25 15:17:27 | 000,001,352 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2012.03.25 15:17:27 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012.03.25 15:17:24 | 000,001,864 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012.03.25 15:17:24 | 000,001,102 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk
[2012.03.25 15:17:23 | 000,001,330 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2012.03.25 15:17:19 | 000,001,150 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.03.25 15:17:18 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012.03.25 15:17:14 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2012.03.25 15:17:14 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012.03.25 13:26:26 | 000,000,264 | ---- | C] () -- C:\ProgramData\~rhExurxY9nsbJO
[2012.03.25 13:26:26 | 000,000,176 | ---- | C] () -- C:\ProgramData\~rhExurxY9nsbJOr
[2012.03.25 13:26:23 | 000,000,560 | ---- | C] () -- C:\ProgramData\rhExurxY9nsbJO
[2012.03.25 13:26:13 | 000,361,472 | ---- | C] ( ) -- C:\ProgramData\rhExurxY9nsbJO.exe
[2012.03.24 12:43:21 | 000,088,202 | ---- | C] () -- C:\Users\Michali\Desktop\coolbro.jpg
[2012.03.23 14:12:37 | 000,000,921 | ---- | C] () -- C:\Users\Michali\Desktop\Hyperdesktop.lnk
[2012.03.17 21:22:07 | 000,331,947 | ---- | C] () -- C:\Users\Michali\Desktop\3316297_700b.jpg
[2012.03.17 21:04:18 | 000,001,014 | ---- | C] () -- C:\Users\Michali\Desktop\U7O1O - Imgur.gif
[2012.03.17 21:04:14 | 000,001,136 | ---- | C] () -- C:\Users\Michali\Desktop\isF99 - Imgur.gif
[2012.03.17 21:04:10 | 000,001,279 | ---- | C] () -- C:\Users\Michali\Desktop\1yVGB - Imgur.gif
[2012.03.17 21:02:27 | 000,001,130 | ---- | C] () -- C:\Users\Michali\Desktop\WDoQA - Imgur.gif
[2012.03.17 21:02:23 | 000,001,845 | ---- | C] () -- C:\Users\Michali\Desktop\xPoFX - Imgur.gif
[2012.03.17 21:02:17 | 000,001,562 | ---- | C] () -- C:\Users\Michali\Desktop\ipNSU - Imgur.gif
[2012.03.16 17:29:30 | 001,829,531 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0081.JPG
[2012.03.15 22:56:29 | 002,335,823 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0079.JPG
[2012.03.11 20:28:31 | 000,000,191 | ---- | C] () -- C:\Users\Michali\Documents\serviceidygoo.rtf
[2012.03.11 13:09:22 | 002,585,116 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0059.JPG
[2012.03.11 13:09:18 | 001,621,750 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0005.JPG
[2012.03.11 12:52:48 | 000,090,869 | ---- | C] () -- C:\Users\Michali\Desktop\heavy-rain-move-edition-platinum--sony-ps3-.gif
[2012.03.11 12:44:22 | 000,025,825 | ---- | C] () -- C:\Users\Michali\Desktop\popup_images_image_10005563-UK_1.jpg
[2012.03.11 12:30:46 | 000,028,865 | ---- | C] () -- C:\Users\Michali\Desktop\1902737.jpg
[2012.03.11 11:00:36 | 001,489,811 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0058.JPG
[2012.03.11 10:06:04 | 000,005,687 | ---- | C] () -- C:\Users\Michali\Documents\ayo.rtf
[2012.03.10 21:04:28 | 002,333,392 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0057.JPG
[2012.03.10 20:46:51 | 002,478,503 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0056.JPG
[2012.03.10 19:57:36 | 001,831,321 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0050.JPG
[2012.03.10 19:57:29 | 002,219,464 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_0049.JPG
[2012.03.07 20:33:19 | 001,079,503 | ---- | C] () -- C:\Users\Michali\Desktop\IMG_07032012_193413.png
[2012.03.04 00:41:06 | 000,001,011 | ---- | C] () -- C:\Users\Michali\Desktop\SwiftKit.lnk
[2012.03.03 21:55:12 | 002,002,044 | ---- | C] () -- C:\Users\Michali\Desktop\ScreenShot001.png
[2012.03.01 22:58:45 | 000,024,471 | ---- | C] () -- C:\Users\Michali\Desktop\mlp_omg.jpg
[2012.03.01 21:19:18 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2012.02.29 23:55:03 | 000,001,332 | ---- | C] () -- C:\Users\Michali\Desktop\tshirts.rtf
[2012.02.27 23:45:33 | 000,000,304 | ---- | C] () -- C:\Users\Michali\Desktop\Fortsetzen Download League of Legends.url
[2012.02.27 23:39:18 | 002,403,335 | ---- | C] () -- C:\Users\Michali\Desktop\electro test.mp3
[2012.02.27 19:22:00 | 000,007,622 | ---- | C] () -- C:\Users\Michali\AppData\Local\Resmon.ResmonCfg
[2012.01.20 20:48:38 | 001,589,618 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.01.08 23:08:42 | 000,100,712 | ---- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2011.09.20 17:44:23 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2011.07.01 23:04:51 | 000,000,080 | RHS- | C] () -- C:\Windows\SysWow64\98BB2AED3C.dll
[2011.03.31 21:23:47 | 000,004,608 | ---- | C] () -- C:\Users\Michali\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.20 18:21:34 | 000,000,056 | ---- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.10.20 16:37:01 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
 
========== LOP Check ==========
 
[2012.03.23 15:02:49 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\.minecraft
[2011.05.07 21:52:06 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Auslogics
[2012.01.16 13:08:20 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Babylon
[2012.02.12 12:45:55 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\DiskAid
[2011.07.10 19:46:41 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\DMCache
[2011.09.06 22:33:23 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\DVDVideoSoft
[2012.02.10 14:20:58 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.09.09 11:10:20 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Foxit Software
[2011.06.02 16:48:26 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\FreeFLVConverter
[2011.11.12 12:24:42 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\GetRightToGo
[2011.05.28 08:40:03 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\go
[2012.02.12 22:18:51 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Gyazo
[2012.03.23 14:12:37 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Hyperdesktop
[2011.03.02 10:21:06 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\ICQ
[2012.02.18 13:55:14 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\IDM
[2011.04.01 13:39:05 | 000,000,000 | RHSD | M] -- C:\Users\Michali\AppData\Roaming\install
[2011.05.20 13:10:27 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\IObit
[2010.10.21 00:36:58 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Macro Recorder
[2010.12.22 17:41:44 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\MP3SkypeRecorder
[2011.01.22 00:54:34 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\OpenOffice.org
[2010.12.02 12:35:44 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\PhotoScape
[2012.01.20 20:29:22 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\redsn0w
[2011.10.31 14:12:05 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Sony
[2011.06.06 22:26:15 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Stu Bedore
[2011.02.25 17:18:27 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\TeamViewer
[2011.08.01 19:21:13 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\TS3Client
[2011.06.12 20:49:35 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\TuneUp Software
[2010.11.09 23:04:54 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Windows SideBar
[2011.03.12 19:05:41 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\WindSolutions
[2011.07.22 17:28:15 | 000,000,000 | ---D | M] -- C:\Users\Michali\AppData\Roaming\Xilisoft
[2012.03.05 14:35:12 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2010.10.19 16:38:57 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.04.16 22:52:27 | 000,000,000 | ---D | M] -- C:\.562_cache_32v4
[2010.12.25 16:13:32 | 000,000,000 | ---D | M] -- C:\.cache03_32
[2010.12.02 18:42:32 | 000,000,000 | ---D | M] -- C:\.jagex_cache_32
[2012.03.25 18:35:40 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2011.09.20 17:44:30 | 000,000,000 | ---D | M] -- C:\ConverterOutput
[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2010.10.19 16:38:40 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2010.11.27 18:48:36 | 000,000,000 | ---D | M] -- C:\DSPK
[2011.12.26 23:06:41 | 000,000,000 | ---D | M] -- C:\Inceptioncache81
[2010.10.19 17:05:28 | 000,000,000 | ---D | M] -- C:\Intel
[2010.12.07 20:57:24 | 000,000,000 | ---D | M] -- C:\jc-scape_cache_32
[2011.04.28 20:36:57 | 000,000,000 | ---D | M] -- C:\Nexon
[2010.10.19 17:19:11 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.03.25 15:13:51 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.03.24 22:46:37 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012.03.25 18:36:36 | 000,000,000 | ---D | M] -- C:\ProgramData
[2010.10.19 16:38:40 | 000,000,000 | -HSD | M] -- C:\Programme
[2010.10.19 16:38:40 | 000,000,000 | -HSD | M] -- C:\Recovery
[2011.04.10 09:30:08 | 000,000,000 | ---D | M] -- C:\Screenshots
[2012.03.25 16:28:39 | 000,000,000 | ---D | M] -- C:\sh4ldr
[2012.03.25 19:11:43 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.12.04 15:34:11 | 000,000,000 | R--D | M] -- C:\Users
[2012.03.25 18:35:58 | 000,000,000 | ---D | M] -- C:\Windows
[2011.09.20 17:44:38 | 000,000,000 | ---D | M] -- C:\YouTubeDownload
[2010.10.22 11:44:28 | 000,000,000 | ---D | M] -- C:\zee_store
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 08:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\explorer.exe
[2011.02.26 08:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\SysWOW64\explorer.exe
[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX0\procs\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX1\procs\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX10\procs\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX11\procs\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX12\procs\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX2\procs\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX3\procs\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX4\procs\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX5\procs\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX6\procs\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX7\procs\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX8\procs\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Michali\AppData\Local\Temp\RarSFX9\procs\explorer.exe
[2009.08.03 08:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009.10.31 08:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX0\h\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX1\h\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX10\h\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX11\h\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX12\h\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX2\h\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX3\h\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX4\h\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX5\h\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX6\h\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX7\h\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX8\h\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Michali\AppData\Local\Temp\RarSFX9\h\explorer.exe
[2009.10.31 08:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011.02.26 08:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009.08.03 08:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0033117673c16921\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\SysNative\netlogon.dll
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_38e464dbe521cc7f\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\SysNative\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\SysNative\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX0\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX1\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX10\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX11\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX12\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX2\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX3\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX4\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX5\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX6\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX7\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX8\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX9\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX0\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX1\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX10\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX11\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX12\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX2\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX3\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX4\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX5\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX6\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX7\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX8\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Michali\AppData\Local\Temp\RarSFX9\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
< %USERPROFILE%\*.* >
[2012.02.25 23:50:56 | 000,000,274 | ---- | M] () -- C:\Users\Michali\.jupload.properties
[2010.11.21 23:01:45 | 006,239,070 | ---- | M] () -- C:\Users\Michali\01 Alles Neu(192Kbps).mp3
[2010.11.21 23:01:51 | 005,215,816 | ---- | M] () -- C:\Users\Michali\02 Schwarz Zu Blau(192Kbps).mp3
[2010.11.21 22:55:52 | 005,225,576 | ---- | M] () -- C:\Users\Michali\03 Haus Am See(192Kbps).mp3
[2010.11.21 23:01:44 | 004,882,158 | ---- | M] () -- C:\Users\Michali\04 Kopf Verloren(192Kbps).mp3
[2010.11.21 23:00:46 | 005,642,748 | ---- | M] () -- C:\Users\Michali\05 Das Zweite Gesicht(192Kbps).mp3
[2010.11.21 22:59:51 | 004,754,454 | ---- | M] () -- C:\Users\Michali\07 Ich Steine, Du Steine(192Kbps).mp3
[2010.11.21 23:01:04 | 005,419,266 | ---- | M] () -- C:\Users\Michali\08 Lok Auf 2 Beinen(192Kbps).mp3
[2010.11.21 23:01:32 | 005,301,322 | ---- | M] () -- C:\Users\Michali\09 Stadtaffe(192Kbps).mp3
[2010.11.21 23:02:18 | 006,128,894 | ---- | M] () -- C:\Users\Michali\10 Fieber(192Kbps).mp3
[2010.11.21 22:57:43 | 004,145,982 | ---- | M] () -- C:\Users\Michali\11 Schüttel Deinen Speck(192Kbps).mp3
[2010.11.21 23:01:16 | 004,768,852 | ---- | M] () -- C:\Users\Michali\12 Zucker(192Kbps).mp3
[2011.07.06 22:12:07 | 000,916,570 | ---- | M] () -- C:\Users\Michali\2011_07_06_22_10_04_w0_Gyllian.jpg
[2011.07.06 22:12:06 | 000,894,487 | ---- | M] () -- C:\Users\Michali\2011_07_06_22_10_29_w0_Gyllian.jpg
[2011.07.11 20:46:38 | 000,845,697 | ---- | M] () -- C:\Users\Michali\2011_07_11_03_29_28_w0_xXBlueDiamondXx.jpg
[2011.07.11 20:46:45 | 000,830,580 | ---- | M] () -- C:\Users\Michali\2011_07_11_03_32_51_w0_xXBlueDiamondXx.jpg
[2011.07.23 21:46:41 | 000,971,530 | ---- | M] () -- C:\Users\Michali\2011_07_23_20_32_17_w0_Gyllian.jpg
[2011.07.23 21:46:43 | 000,968,430 | ---- | M] () -- C:\Users\Michali\2011_07_23_20_33_34_w0_Gyllian.jpg
[2011.07.23 21:46:43 | 000,948,155 | ---- | M] () -- C:\Users\Michali\2011_07_23_20_36_30_w0_Gyllian.jpg
[2011.07.23 21:46:33 | 000,927,359 | ---- | M] () -- C:\Users\Michali\2011_07_23_20_37_07_w0_Gyllian.jpg
[2011.10.04 18:48:42 | 000,922,001 | ---- | M] () -- C:\Users\Michali\2011_10_03_23_52_17_w0_Gordon.jpg
[2011.10.04 18:48:42 | 000,946,298 | ---- | M] () -- C:\Users\Michali\2011_10_03_23_52_25_w0_Gordon.jpg
[2010.12.07 20:57:24 | 000,000,000 | ---- | M] () -- C:\Users\Michali\614_preferences.dat
[2011.04.17 22:29:41 | 000,000,004 | ---- | M] () -- C:\Users\Michali\cache.dat
[2011.06.05 10:04:29 | 000,001,101 | ---- | M] () -- C:\Users\Michali\Dokumente.lnk
[2012.01.02 13:39:23 | 000,000,046 | ---- | M] () -- C:\Users\Michali\exemptionx_ExemptionX 634_preferences.dat
[2012.01.02 13:39:59 | 000,000,099 | ---- | M] () -- C:\Users\Michali\exemptionx_ExemptionX 634_preferences2.dat
[2012.01.02 13:38:58 | 000,000,000 | ---- | M] () -- C:\Users\Michali\exemptionx__preferences3.dat
[2011.02.13 00:04:05 | 000,000,000 | ---- | M] () -- C:\Users\Michali\Foto 0391.jpg
[2011.03.01 17:22:53 | 000,000,024 | ---- | M] () -- C:\Users\Michali\jagexappletviewer.preferences
[2012.03.24 22:21:44 | 000,000,032 | ---- | M] () -- C:\Users\Michali\jagex_cl_runescape_LIVE.dat
[2012.03.15 20:21:08 | 000,000,047 | ---- | M] () -- C:\Users\Michali\jagex_cl_runescape_LIVE1.dat
[2012.03.25 12:31:48 | 000,000,046 | ---- | M] () -- C:\Users\Michali\jagex_runescape_preferences.dat
[2012.03.25 11:07:18 | 000,000,129 | ---- | M] () -- C:\Users\Michali\jagex_runescape_preferences2.dat
[2010.12.07 21:15:56 | 000,000,000 | ---- | M] () -- C:\Users\Michali\jagex__preferences3.dat
[2012.03.25 19:14:52 | 002,883,584 | -HS- | M] () -- C:\Users\Michali\ntuser.dat
[2012.03.25 19:14:52 | 000,262,144 | -HS- | M] () -- C:\Users\Michali\ntuser.dat.LOG1
[2010.10.19 16:38:47 | 000,000,000 | -HS- | M] () -- C:\Users\Michali\ntuser.dat.LOG2
[2011.06.14 22:24:06 | 000,000,000 | -HS- | M] () -- C:\Users\Michali\NTUSER.DAT_tureg_new.LOG1
[2011.06.14 22:24:06 | 000,000,000 | -HS- | M] () -- C:\Users\Michali\NTUSER.DAT_tureg_new.LOG2
[2011.10.31 21:33:30 | 002,621,440 | -HS- | M] () -- C:\Users\Michali\NTUSER.DAT_tureg_old
[2010.10.19 16:39:25 | 000,065,536 | -HS- | M] () -- C:\Users\Michali\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010.10.19 16:39:25 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010.10.19 16:39:25 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2011.11.01 01:32:36 | 000,065,536 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{05f5e566-03f7-11e1-9e49-806e6f6e6963}.TM.blf
[2011.11.01 01:32:36 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{05f5e566-03f7-11e1-9e49-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
[2011.11.01 01:32:36 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{05f5e566-03f7-11e1-9e49-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms
[2011.06.14 22:59:21 | 000,065,536 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{0d74b6ee-96c4-11e0-b0b9-806e6f6e6963}.TM.blf
[2011.06.14 22:59:21 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{0d74b6ee-96c4-11e0-b0b9-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
[2011.06.14 22:59:21 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{0d74b6ee-96c4-11e0-b0b9-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms
[2011.05.29 00:21:15 | 000,065,536 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{464e8eb1-88f1-11e0-a199-001fd09ad884}.TM.blf
[2011.05.29 00:21:15 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{464e8eb1-88f1-11e0-a199-001fd09ad884}.TMContainer00000000000000000001.regtrans-ms
[2011.05.29 00:21:15 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{464e8eb1-88f1-11e0-a199-001fd09ad884}.TMContainer00000000000000000002.regtrans-ms
[2011.05.20 23:00:43 | 000,065,536 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{d62385c4-82be-11e0-ac06-001fd09ad884}.TM.blf
[2011.05.20 23:00:43 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{d62385c4-82be-11e0-ac06-001fd09ad884}.TMContainer00000000000000000001.regtrans-ms
[2011.05.20 23:00:43 | 000,524,288 | -HS- | M] () -- C:\Users\Michali\ntuser.dat{d62385c4-82be-11e0-ac06-001fd09ad884}.TMContainer00000000000000000002.regtrans-ms
[2010.10.19 16:38:47 | 000,000,020 | -HS- | M] () -- C:\Users\Michali\ntuser.ini
[2011.11.10 21:30:42 | 005,108,736 | ---- | M] () -- C:\Users\Michali\P1010112.JPG
[2011.11.10 21:30:58 | 005,467,648 | ---- | M] () -- C:\Users\Michali\P1010114.JPG
[2011.04.02 20:51:36 | 000,000,435 | ---- | M] () -- C:\Users\Michali\umbrella0.log
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

< End of report >
         
--- --- ---
__________________

Geändert von Cataracs (25.03.2012 um 18:24 Uhr)

Antwort

Themen zu Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde?
check, data, erlaubt, euro, freundlich, funde, gen, google, heute, hoffe, kontakt, leute, malwarebytes, meldungen, morgen, nicht sicher, nichts, problem, prozesse, rechts, recovery, seite, setzen, symbol, system, windows 7 home, windows 7 home premium, wirklich, würde




Ähnliche Themen: Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde?


  1. Amazon-Icon, GIGA-Android-Startseite und Amazon.de.Url nach Download einer Datei(jedoch keine erkennbarne Probleme)
    Log-Analyse und Auswertung - 13.08.2014 (11)
  2. Laut Telekom: Torpig/Mebroot - aber keine Funde
    Log-Analyse und Auswertung - 31.10.2012 (5)
  3. GUV Virus weiterhin auf dem Rechner? Malewarebytes = keine Funde/ Antivir = 2 Funde
    Plagegeister aller Art und deren Bekämpfung - 24.09.2012 (3)
  4. Data Recovery, S.M.A.R.T Repair
    Plagegeister aller Art und deren Bekämpfung - 17.07.2012 (13)
  5. Data Recovery Problem
    Plagegeister aller Art und deren Bekämpfung - 10.07.2012 (13)
  6. aolupdate.exe / S.M.A.R.T. Data Recovery die Zweite
    Plagegeister aller Art und deren Bekämpfung - 06.07.2012 (14)
  7. aolupdate.exe / S.M.A.R.T. Data Recovery
    Plagegeister aller Art und deren Bekämpfung - 30.06.2012 (1)
  8. Data Recovery - Entfernung fehlerhaft?
    Plagegeister aller Art und deren Bekämpfung - 25.03.2012 (1)
  9. Data Recovery-Trojaner?
    Log-Analyse und Auswertung - 18.03.2012 (1)
  10. Data Recovery - Bin ich jetzt clean?
    Log-Analyse und Auswertung - 20.12.2011 (22)
  11. Habe ich den ''Data Recovery'' hinter mir ?
    Log-Analyse und Auswertung - 30.11.2011 (22)
  12. Data Recovery Problem keine Programme mehr unter "Start"
    Log-Analyse und Auswertung - 27.09.2011 (18)
  13. Data Recovery entfernen
    Anleitungen, FAQs & Links - 10.09.2011 (2)
  14. Windows Recovery Fake Trojaner entfernt - Jedoch nichts sichtbar
    Plagegeister aller Art und deren Bekämpfung - 03.05.2011 (3)
  15. Windows Recovery Problem: Nach Problembehebung zeigt Festplatte keine Ordner an
    Log-Analyse und Auswertung - 28.04.2011 (21)
  16. Windows Recovery Trojaner entfernt, Dateien jedoch weg
    Log-Analyse und Auswertung - 27.04.2011 (1)
  17. Windows Recovery auf C:\ nach Befall von JAVA Agent.M.1 (laut Antivir). Reicht das?
    Plagegeister aller Art und deren Bekämpfung - 03.09.2010 (6)

Zum Thema Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde? - Hallo Leute, also, dumm wie ich war bin ich heute morgen auf eine von Google gesperrte Seite gegangen. Als ich dann, nachdem ich einige Zeit nicht am PC war, wieder - Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde?...
Archiv
Du betrachtest: Data Recovery ~ Vorgegangen nach Guru's Guide jedoch laut MWB keine Funde? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.