Zurück   Trojaner-Board > Archiv - Kein Posten möglich > Mülltonne

Mülltonne: 50 Euro Trojaner

Windows 7 Beiträge, die gegen unsere Regeln verstoßen haben, solche, die die Welt nicht braucht oder sonstiger Müll landet hier in der Mülltonne...

 
Alt 01.04.2012, 17:03   #1
stefanlive
 
50 Euro Trojaner - Standard

50 Euro Trojaner



Hallo!
Habe mir leider auch den 50 euro trojaner eingefangen. System komplett gesperrt, abgesicherter modus geht auch nicht. Habe otl laufen lassen , hier die otl logfile
danke schonmal im vorraus !!!
Code:
ATTFilter
OTL logfile created on: 4/1/2012 7:28:39 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium  (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = I: | %SystemRoot% = I:\Windows | %ProgramFiles% = I:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 74.34 Mb Free Space | 74.35% Space Free | Partition Type: NTFS
Drive I: | 452.45 Gb Total Space | 184.73 Gb Free Space | 40.83% Space Free | Partition Type: NTFS
Drive J: | 452.96 Gb Total Space | 374.84 Gb Free Space | 82.75% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010/01/13 10:04:08 | 000,202,752 | ---- | M] (AMD) [Auto] -- I:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- I:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer) [Auto] -- I:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2012/01/31 03:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- I:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/01/31 03:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- I:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/06/29 08:26:06 | 000,520,216 | ---- | M] (Ant.com) [Auto] -- I:\Program Files (x86)\Ant.com\IE add-on\AntUpdaterService.exe -- (AntUpdaterService)
SRV - [2011/03/28 15:51:25 | 004,323,256 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand] -- I:\Windows\SysWow64\GameMon.des -- (npggsvc)
SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- I:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/09/10 09:42:46 | 000,305,448 | ---- | M] () [On_Demand] -- I:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)
SRV - [2009/08/28 05:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto] -- I:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- I:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/10/24 19:35:44 | 000,128,296 | ---- | M] () [Auto] -- I:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/01/31 03:56:33 | 000,132,320 | ---- | M] (Avira GmbH) [Kernel | System] -- I:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012/01/31 03:56:33 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto] -- I:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/12/26 08:15:39 | 000,530,488 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- I:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV:64bit: - [2011/09/16 11:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System] -- I:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011/08/02 11:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- I:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/06/06 18:07:00 | 000,231,440 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- I:\Windows\System32\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2010/01/13 10:26:00 | 006,327,296 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- I:\Windows\System32\drivers\atipmdag.sys -- (amdkmdag)
DRV:64bit: - [2010/01/13 09:10:56 | 000,185,344 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- I:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2009/11/05 10:15:40 | 000,291,328 | ---- | M] (Realtek                                            ) [Kernel | On_Demand] -- I:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/09/29 21:34:30 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand] -- I:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009/09/11 03:19:08 | 001,705,600 | ---- | M] (Hauppauge Computer Works) [Kernel | On_Demand] -- I:\Windows\System32\drivers\HCW85BDA.sys -- (HCW85BDA)
DRV:64bit: - [2009/07/13 20:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- I:\Windows\System32\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- I:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- I:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- I:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- I:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/02 07:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- I:\Windows\System32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009/06/02 07:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System] -- I:\Windows\System32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009/06/02 07:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- I:\Windows\System32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009/03/18 12:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- I:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2009/01/09 09:02:08 | 000,031,744 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand] -- I:\Windows\System32\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:64bit: - [2007/05/14 11:06:18 | 000,027,520 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand] -- I:\Windows\System32\drivers\RimUsb_AMD64.sys -- (RimUsb)
DRV - [2005/01/02 17:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand] -- I:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m3870&r=173607100506pe425v135w4551v208
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m3870&r=173607100506pe425v135w4551v208
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m3870&r=173607100506pe425v135w4551v208
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchqu.com/413
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\stefan_dotter_ON_I\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - Reg Error: Key error. File not found
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\stefan_dotter_ON_I\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: I:\Windows\System32\Macromed\Flash\NPSWF64_11_0_1.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: I:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: I:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: I:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: I:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: I:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: I:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: I:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: I:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: I:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: I:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/02/19 11:17:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012/02/14 03:53:21 | 000,000,000 | ---D | M] (No name found) -- I:\Program Files (x86)\Mozilla Firefox\extensions
[2012/02/19 11:17:21 | 000,134,104 | ---- | M] (Mozilla Foundation) -- I:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/12/21 01:08:50 | 000,001,392 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/12/21 01:02:40 | 000,002,252 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/12/21 01:08:50 | 000,001,153 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011/12/21 01:08:50 | 000,006,805 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/02/09 13:57:04 | 000,002,515 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
[2011/12/21 01:08:50 | 000,001,178 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/12/21 01:08:50 | 000,001,105 | ---- | M] () -- I:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010/09/22 16:24:44 | 000,001,023 | ---- | M]) - I:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 static3.cdn.ubi.com 
O1 - Hosts: 127.0.0.1 ubisoft-orbit.s3.amazonaws.com 
O1 - Hosts: 127.0.0.1 onlineconfigservice.ubi.com 
O1 - Hosts: 127.0.0.1 orbitservice.ubi.com 
O1 - Hosts: 127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com 
O2 - BHO: (Ant.com browser helper (video detector)) - {346FDE31-DFF9-418A-90C8-BA31DC9FF2EF} - I:\Program Files (x86)\Ant.com\IE add-on\Download.dll (Ant.com)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ant.com Video Downloader toolbar) - {2E924F4F-67F0-4BD8-9560-49F468E843D2} - I:\Program Files (x86)\Ant.com\IE add-on\AntToolbar.dll (Ant.com)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\stefan_dotter_ON_I\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\stefan_dotter_ON_I\..\Toolbar\WebBrowser: (Ant.com Video Downloader toolbar) - {2E924F4F-67F0-4BD8-9560-49F468E843D2} - I:\Program Files (x86)\Ant.com\IE add-on\AntToolbar.dll (Ant.com)
O4:64bit: - HKLM..\Run: [mwlDaemon] I:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] I:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] I:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] I:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [EgisTecLiveUpdate] I:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [Hotkey Utility] I:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe ()
O4 - HKU\.DEFAULT..\Run: [HanaConnect]  File not found
O4 - HKU\LocalService_ON_I..\Run: [Sidebar] I:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_I..\Run: [Sidebar] I:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\stefan_dotter_ON_I..\Run: [ABBYY Screenshot Reader Bonus]  File not found
O4 - HKU\stefan_dotter_ON_I..\Run: [ApplePhotoStreams] I:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.)
O4 - HKU\stefan_dotter_ON_I..\Run: [DAEMON Tools Lite] I:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\stefan_dotter_ON_I..\Run: [iCloudServices] I:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
O4 - HKU\stefan_dotter_ON_I..\Run: [RGSC]  File not found
O4 - HKU\stefan_dotter_ON_I..\Run: [SkypePM] I:\Users\stefan dotter\AppData\Local\Skype\SkypePM.exe ()
O4 - HKU\LocalService_ON_I..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_I..\RunOnce: [mctadmin]  File not found
O4 - Startup: Error locating startup folders.
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Download videos by Ant.com - {70AF6C9F-0818-4cf7-924A-BBDBB24211D3} - I:\Program Files (x86)\Ant.com\IE add-on\Download.dll (Ant.com)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - I:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - I:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - I:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - I:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - I:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - I:\Windows\System32\DreamScene.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
MsConfig:64bit - StartUpFolder: C:^Users^stefan dotter^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk - I:\Users\stefan dotter\AppData\Roaming\Dropbox\bin\Dropbox.exe - (Dropbox, Inc.)
MsConfig:64bit - StartUpFolder: C:^Users^stefan dotter^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk - I:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig:64bit - StartUpReg: DivXUpdate - hkey= - key= - I:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MsConfig:64bit - StartUpReg: HanaConnect - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - I:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - I:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: StartCCC - hkey= - key= - I:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - I:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig:64bit - State: "startup" - 2
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/03/21 11:37:26 | 000,000,000 | ---D | C] -- I:\Users\stefan dotter\Desktop\Setcard
[2010/03/25 15:15:40 | 000,036,136 | ---- | C] (Oberon Media) -- I:\ProgramData\FullRemove.exe
[3 I:\Windows\*.tmp files -> I:\Windows\*.tmp -> ]
[1 I:\Windows\SysWow64\*.tmp files -> I:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/04/01 06:12:55 | 000,067,584 | --S- | M] () -- I:\Windows\bootstat.dat
[2012/04/01 06:12:03 | 000,001,120 | ---- | M] () -- I:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/04/01 06:11:46 | 3163,901,952 | -HS- | M] () -- I:\hiberfil.sys
[2012/04/01 06:09:50 | 000,009,696 | -H-- | M] () -- I:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/01 06:09:50 | 000,009,696 | -H-- | M] () -- I:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/01 06:07:35 | 000,708,862 | ---- | M] () -- I:\Windows\System32\perfh007.dat
[2012/04/01 06:07:35 | 000,662,414 | ---- | M] () -- I:\Windows\System32\perfh009.dat
[2012/04/01 06:07:35 | 000,154,136 | ---- | M] () -- I:\Windows\System32\perfc007.dat
[2012/04/01 06:07:35 | 000,126,292 | ---- | M] () -- I:\Windows\System32\perfc009.dat
[2012/03/31 12:42:03 | 000,001,124 | ---- | M] () -- I:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/03/30 19:12:53 | 000,339,487 | ---- | M] () -- I:\Users\stefan dotter\Desktop\007.jpg
[2012/03/26 11:49:42 | 000,079,461 | ---- | M] () -- I:\Users\stefan dotter\Desktop\ArtDepartmentTimeLapseLogo.jpg
[2012/03/26 11:48:39 | 003,190,752 | ---- | M] () -- I:\Users\stefan dotter\Desktop\artdept.jpg
[2012/03/26 11:42:40 | 000,127,688 | ---- | M] () -- I:\Users\stefan dotter\Desktop\artworks-000005912391-i61zh5-original.jpg
[2012/03/25 05:45:12 | 213,450,632 | ---- | M] () -- I:\Users\stefan dotter\Desktop\Art Department - Essential Mix (BBC Radio1) - 22-10-2011.mp3
[2012/03/22 18:24:53 | 000,227,110 | ---- | M] () -- I:\Users\stefan dotter\Desktop\6f_03.jpg
[2012/03/22 18:24:06 | 000,176,371 | ---- | M] () -- I:\Users\stefan dotter\Desktop\5f_09.jpg
[2012/03/22 18:23:58 | 000,249,010 | ---- | M] () -- I:\Users\stefan dotter\Desktop\5f_08.jpg
[2012/03/22 18:23:46 | 000,116,751 | ---- | M] () -- I:\Users\stefan dotter\Desktop\5f_05.jpg
[2012/03/22 18:23:22 | 000,095,806 | ---- | M] () -- I:\Users\stefan dotter\Desktop\5f_01.jpg
[2012/03/22 18:22:50 | 000,190,726 | ---- | M] () -- I:\Users\stefan dotter\Desktop\4f_09.jpg
[2012/03/22 18:22:26 | 000,165,684 | ---- | M] () -- I:\Users\stefan dotter\Desktop\4f_04.jpg
[2012/03/22 18:21:19 | 000,133,028 | ---- | M] () -- I:\Users\stefan dotter\Desktop\3f_11.jpg
[2012/03/22 18:21:16 | 000,098,291 | ---- | M] () -- I:\Users\stefan dotter\Desktop\3f_10.jpg
[2012/03/22 18:21:01 | 000,162,417 | ---- | M] () -- I:\Users\stefan dotter\Desktop\3f_09.jpg
[2012/03/22 18:20:26 | 000,116,894 | ---- | M] () -- I:\Users\stefan dotter\Desktop\3f_04.jpg
[2012/03/22 18:20:03 | 000,469,995 | ---- | M] () -- I:\Users\stefan dotter\Desktop\3f_01.jpg
[2012/03/22 18:19:17 | 000,113,329 | ---- | M] () -- I:\Users\stefan dotter\Desktop\2f_02.jpg
[2012/03/22 18:19:15 | 000,236,331 | ---- | M] () -- I:\Users\stefan dotter\Desktop\2f_01.jpg
[2012/03/22 12:39:10 | 000,033,699 | ---- | M] () -- I:\Users\stefan dotter\Desktop\123.JPG
[2012/03/21 15:36:42 | 000,612,851 | ---- | M] () -- I:\Users\stefan dotter\Desktop\13310470374095eff1_cfake.jpg
[2012/03/21 11:51:36 | 000,074,202 | ---- | M] () -- I:\Users\stefan dotter\Desktop\tumblr_ltjw83NQMR1qjcgic.jpg
[2012/03/21 10:56:22 | 008,326,709 | ---- | M] () -- I:\Users\stefan dotter\Desktop\colette c'est chouette.mp3
[2012/03/20 13:37:50 | 000,017,037 | ---- | M] () -- I:\Users\stefan dotter\Desktop\1000.JPG
[2012/03/20 13:36:58 | 000,074,518 | ---- | M] () -- I:\Users\stefan dotter\Desktop\kawsbearbrick-640x490.jpg
[2012/03/20 13:30:50 | 000,015,019 | ---- | M] () -- I:\Users\stefan dotter\Desktop\999.JPG
[2012/03/20 13:29:37 | 000,077,726 | ---- | M] () -- I:\Users\stefan dotter\Desktop\recapturing-reality7-550x435.jpg
[2012/03/20 13:23:11 | 000,948,295 | ---- | M] () -- I:\Users\stefan dotter\Desktop\mercedes-benz-300-sl.2000x1333.Jan-12-2012_09.00.14.213301.jpg
[2012/03/20 11:59:50 | 000,033,196 | ---- | M] () -- I:\Users\stefan dotter\Desktop\Mr_-Bathing-Ape-Spring-Summer-2012-Collection-02.jpg
[2012/03/20 11:57:36 | 000,167,261 | ---- | M] () -- I:\Users\stefan dotter\Desktop\1jaimeellicson.jpg
[2012/03/20 11:56:26 | 000,101,156 | ---- | M] () -- I:\Users\stefan dotter\Desktop\2013-mercedes-benz-sl65-amg-2-620x413.jpg
[2012/03/20 11:49:56 | 000,120,814 | ---- | M] () -- I:\Users\stefan dotter\Desktop\JR-NYC-Arrested-motion.jpg
[2012/03/20 11:43:16 | 000,039,235 | ---- | M] () -- I:\Users\stefan dotter\Desktop\t-f-slack-oki-ni-exclusive-shoes-2-522x540.jpg
[2012/03/19 17:14:59 | 000,139,428 | ---- | M] () -- I:\Users\stefan dotter\Desktop\Kanye1.jpg
[2012/03/19 17:10:34 | 000,132,971 | ---- | M] () -- I:\Users\stefan dotter\Desktop\wtaps-leopard-hoodie-3.jpg
[2012/03/19 17:09:58 | 000,051,804 | ---- | M] () -- I:\Users\stefan dotter\Desktop\tyler-the-creator-and-glenn-obrien-supreme-0.jpg
[2012/03/19 17:08:20 | 000,096,981 | ---- | M] () -- I:\Users\stefan dotter\Desktop\herschel-supply-co-s2012-01.jpg
[2012/03/19 12:26:26 | 000,426,971 | ---- | M] () -- I:\Users\stefan dotter\Desktop\lana-del-rey-diet-mountain-dew-urban-noize.png
[2012/03/19 12:24:55 | 000,338,373 | ---- | M] () -- I:\Users\stefan dotter\Desktop\louis-vuitton-marc-jacobs-book-02.jpg
[2012/03/19 12:17:11 | 000,042,109 | ---- | M] () -- I:\Users\stefan dotter\Desktop\deadmau-cypress-hill.jpg
[2012/03/19 12:13:46 | 000,409,617 | ---- | M] () -- I:\Users\stefan dotter\Desktop\Prometheus-2012-Movie.jpg
[2012/03/19 12:10:04 | 000,052,247 | ---- | M] () -- I:\Users\stefan dotter\Desktop\i-love-ugly-caps-1.jpg
[2012/03/19 12:09:10 | 000,092,371 | ---- | M] () -- I:\Users\stefan dotter\Desktop\frank-ocean-whip-appeal-music.jpg
[2012/03/19 12:03:04 | 000,075,808 | ---- | M] () -- I:\Users\stefan dotter\Desktop\lana-del-rey-blue-jeans-official-video.jpg
[2012/03/18 12:10:18 | 000,029,431 | ---- | M] () -- I:\Users\stefan dotter\Desktop\nike-nsw-destroyer-trench-1.jpg
[2012/03/18 12:08:38 | 000,471,295 | ---- | M] () -- I:\Users\stefan dotter\Desktop\MARKMCNAIRYSTHLMLOOKBOOK014.jpg
[2012/03/18 12:01:06 | 000,109,445 | ---- | M] () -- I:\Users\stefan dotter\Desktop\tumblr_m0cyxmNRcl1r0rwm3o1_500.jpg
[2012/03/18 12:00:30 | 000,089,655 | ---- | M] () -- I:\Users\stefan dotter\Desktop\mark-mcnairy-ss2012-caliroots-shoot-13.jpg
[2012/03/17 12:30:22 | 000,101,404 | ---- | M] () -- I:\Users\stefan dotter\Desktop\generationtoge5.jpg
[2012/03/17 08:27:01 | 000,303,028 | ---- | M] () -- I:\Users\stefan dotter\Desktop\extra-butter-reebok-pump-oxt-00.jpg
[2012/03/17 08:25:10 | 000,046,448 | ---- | M] () -- I:\Users\stefan dotter\Desktop\hiroshi-fujiwara-memories-of-green-1.jpg
[2012/03/17 08:24:24 | 000,027,031 | ---- | M] () -- I:\Users\stefan dotter\Desktop\IMG_4047-e1327965224350.jpg
[2012/03/17 08:19:47 | 000,014,293 | ---- | M] () -- I:\Users\stefan dotter\Desktop\lego-imagine-ad-campaign.jpg
[2012/03/13 22:06:38 | 001,624,720 | ---- | M] () -- I:\Windows\SysWow64\PerfStringBackup.INI
[2012/03/06 18:00:56 | 000,081,642 | ---- | M] () -- I:\Users\stefan dotter\Desktop\DarcelColette150-640x905.jpg
[3 I:\Windows\*.tmp files -> I:\Windows\*.tmp -> ]
[1 I:\Windows\SysWow64\*.tmp files -> I:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/03/30 19:12:53 | 000,339,487 | ---- | C] () -- I:\Users\stefan dotter\Desktop\007.jpg
[2012/03/26 11:49:42 | 000,079,461 | ---- | C] () -- I:\Users\stefan dotter\Desktop\ArtDepartmentTimeLapseLogo.jpg
[2012/03/26 11:48:39 | 003,190,752 | ---- | C] () -- I:\Users\stefan dotter\Desktop\artdept.jpg
[2012/03/26 11:42:40 | 000,127,688 | ---- | C] () -- I:\Users\stefan dotter\Desktop\artworks-000005912391-i61zh5-original.jpg
[2012/03/25 05:38:37 | 213,450,632 | ---- | C] () -- I:\Users\stefan dotter\Desktop\Art Department - Essential Mix (BBC Radio1) - 22-10-2011.mp3
[2012/03/22 18:24:53 | 000,227,110 | ---- | C] () -- I:\Users\stefan dotter\Desktop\6f_03.jpg
[2012/03/22 18:24:06 | 000,176,371 | ---- | C] () -- I:\Users\stefan dotter\Desktop\5f_09.jpg
[2012/03/22 18:23:58 | 000,249,010 | ---- | C] () -- I:\Users\stefan dotter\Desktop\5f_08.jpg
[2012/03/22 18:23:46 | 000,116,751 | ---- | C] () -- I:\Users\stefan dotter\Desktop\5f_05.jpg
[2012/03/22 18:23:22 | 000,095,806 | ---- | C] () -- I:\Users\stefan dotter\Desktop\5f_01.jpg
[2012/03/22 18:22:50 | 000,190,726 | ---- | C] () -- I:\Users\stefan dotter\Desktop\4f_09.jpg
[2012/03/22 18:22:26 | 000,165,684 | ---- | C] () -- I:\Users\stefan dotter\Desktop\4f_04.jpg
[2012/03/22 18:21:19 | 000,133,028 | ---- | C] () -- I:\Users\stefan dotter\Desktop\3f_11.jpg
[2012/03/22 18:21:16 | 000,098,291 | ---- | C] () -- I:\Users\stefan dotter\Desktop\3f_10.jpg
[2012/03/22 18:21:01 | 000,162,417 | ---- | C] () -- I:\Users\stefan dotter\Desktop\3f_09.jpg
[2012/03/22 18:20:26 | 000,116,894 | ---- | C] () -- I:\Users\stefan dotter\Desktop\3f_04.jpg
[2012/03/22 18:20:03 | 000,469,995 | ---- | C] () -- I:\Users\stefan dotter\Desktop\3f_01.jpg
[2012/03/22 18:19:17 | 000,113,329 | ---- | C] () -- I:\Users\stefan dotter\Desktop\2f_02.jpg
[2012/03/22 18:19:15 | 000,236,331 | ---- | C] () -- I:\Users\stefan dotter\Desktop\2f_01.jpg
[2012/03/22 12:39:07 | 000,033,699 | ---- | C] () -- I:\Users\stefan dotter\Desktop\123.JPG
[2012/03/21 15:36:41 | 000,612,851 | ---- | C] () -- I:\Users\stefan dotter\Desktop\13310470374095eff1_cfake.jpg
[2012/03/21 11:51:36 | 000,074,202 | ---- | C] () -- I:\Users\stefan dotter\Desktop\tumblr_ltjw83NQMR1qjcgic.jpg
[2012/03/21 10:56:09 | 008,326,709 | ---- | C] () -- I:\Users\stefan dotter\Desktop\colette c'est chouette.mp3
[2012/03/20 13:37:50 | 000,017,037 | ---- | C] () -- I:\Users\stefan dotter\Desktop\1000.JPG
[2012/03/20 13:36:58 | 000,074,518 | ---- | C] () -- I:\Users\stefan dotter\Desktop\kawsbearbrick-640x490.jpg
[2012/03/20 13:30:50 | 000,015,019 | ---- | C] () -- I:\Users\stefan dotter\Desktop\999.JPG
[2012/03/20 13:29:37 | 000,077,726 | ---- | C] () -- I:\Users\stefan dotter\Desktop\recapturing-reality7-550x435.jpg
[2012/03/20 13:23:11 | 000,948,295 | ---- | C] () -- I:\Users\stefan dotter\Desktop\mercedes-benz-300-sl.2000x1333.Jan-12-2012_09.00.14.213301.jpg
[2012/03/20 11:59:50 | 000,033,196 | ---- | C] () -- I:\Users\stefan dotter\Desktop\Mr_-Bathing-Ape-Spring-Summer-2012-Collection-02.jpg
[2012/03/20 11:57:36 | 000,167,261 | ---- | C] () -- I:\Users\stefan dotter\Desktop\1jaimeellicson.jpg
[2012/03/20 11:56:26 | 000,101,156 | ---- | C] () -- I:\Users\stefan dotter\Desktop\2013-mercedes-benz-sl65-amg-2-620x413.jpg
[2012/03/20 11:49:56 | 000,120,814 | ---- | C] () -- I:\Users\stefan dotter\Desktop\JR-NYC-Arrested-motion.jpg
[2012/03/20 11:43:16 | 000,039,235 | ---- | C] () -- I:\Users\stefan dotter\Desktop\t-f-slack-oki-ni-exclusive-shoes-2-522x540.jpg
[2012/03/19 17:14:59 | 000,139,428 | ---- | C] () -- I:\Users\stefan dotter\Desktop\Kanye1.jpg
[2012/03/19 17:10:34 | 000,132,971 | ---- | C] () -- I:\Users\stefan dotter\Desktop\wtaps-leopard-hoodie-3.jpg
[2012/03/19 17:09:58 | 000,051,804 | ---- | C] () -- I:\Users\stefan dotter\Desktop\tyler-the-creator-and-glenn-obrien-supreme-0.jpg
[2012/03/19 17:08:20 | 000,096,981 | ---- | C] () -- I:\Users\stefan dotter\Desktop\herschel-supply-co-s2012-01.jpg
[2012/03/19 12:26:26 | 000,426,971 | ---- | C] () -- I:\Users\stefan dotter\Desktop\lana-del-rey-diet-mountain-dew-urban-noize.png
[2012/03/19 12:24:55 | 000,338,373 | ---- | C] () -- I:\Users\stefan dotter\Desktop\louis-vuitton-marc-jacobs-book-02.jpg
[2012/03/19 12:17:11 | 000,042,109 | ---- | C] () -- I:\Users\stefan dotter\Desktop\deadmau-cypress-hill.jpg
[2012/03/19 12:13:46 | 000,409,617 | ---- | C] () -- I:\Users\stefan dotter\Desktop\Prometheus-2012-Movie.jpg
[2012/03/19 12:10:04 | 000,052,247 | ---- | C] () -- I:\Users\stefan dotter\Desktop\i-love-ugly-caps-1.jpg
[2012/03/19 12:09:10 | 000,092,371 | ---- | C] () -- I:\Users\stefan dotter\Desktop\frank-ocean-whip-appeal-music.jpg
[2012/03/19 12:03:04 | 000,075,808 | ---- | C] () -- I:\Users\stefan dotter\Desktop\lana-del-rey-blue-jeans-official-video.jpg
[2012/03/18 12:10:18 | 000,029,431 | ---- | C] () -- I:\Users\stefan dotter\Desktop\nike-nsw-destroyer-trench-1.jpg
[2012/03/18 12:08:38 | 000,471,295 | ---- | C] () -- I:\Users\stefan dotter\Desktop\MARKMCNAIRYSTHLMLOOKBOOK014.jpg
[2012/03/18 12:01:06 | 000,109,445 | ---- | C] () -- I:\Users\stefan dotter\Desktop\tumblr_m0cyxmNRcl1r0rwm3o1_500.jpg
[2012/03/18 12:00:30 | 000,089,655 | ---- | C] () -- I:\Users\stefan dotter\Desktop\mark-mcnairy-ss2012-caliroots-shoot-13.jpg
[2012/03/17 12:30:22 | 000,101,404 | ---- | C] () -- I:\Users\stefan dotter\Desktop\generationtoge5.jpg
[2012/03/17 08:27:01 | 000,303,028 | ---- | C] () -- I:\Users\stefan dotter\Desktop\extra-butter-reebok-pump-oxt-00.jpg
[2012/03/17 08:25:10 | 000,046,448 | ---- | C] () -- I:\Users\stefan dotter\Desktop\hiroshi-fujiwara-memories-of-green-1.jpg
[2012/03/17 08:24:24 | 000,027,031 | ---- | C] () -- I:\Users\stefan dotter\Desktop\IMG_4047-e1327965224350.jpg
[2012/03/17 08:19:47 | 000,014,293 | ---- | C] () -- I:\Users\stefan dotter\Desktop\lego-imagine-ad-campaign.jpg
[2012/03/06 18:00:56 | 000,081,642 | ---- | C] () -- I:\Users\stefan dotter\Desktop\DarcelColette150-640x905.jpg
[2012/02/12 15:51:07 | 000,000,481 | ---- | C] () -- I:\Users\stefan dotter\AppData\Roaming\Poladroid prefs.plist
[2011/08/27 09:17:34 | 000,000,101 | ---- | C] () -- I:\Users\stefan dotter\AppData\Local\fusioncache.dat
[2011/08/24 14:19:10 | 000,056,320 | ---- | C] () -- I:\Windows\SysWow64\OpenVideo.dll
[2011/05/28 12:28:17 | 000,009,216 | ---- | C] () -- I:\Users\stefan dotter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/15 12:13:20 | 000,000,828 | ---- | C] () -- I:\Windows\my.ini
[2010/12/29 06:34:13 | 001,624,720 | ---- | C] () -- I:\Windows\SysWow64\PerfStringBackup.INI
[2010/12/24 10:02:38 | 000,000,056 | -H-- | C] () -- I:\ProgramData\ezsidmv.dat
[2010/11/17 07:54:08 | 000,001,868 | ---- | C] () -- I:\Windows\WinInit.Ini
[2010/08/22 09:28:26 | 000,000,023 | ---- | C] () -- I:\Windows\BlendSettings.ini
[2010/07/18 03:25:40 | 000,000,000 | ---- | C] () -- I:\Windows\nsreg.dat
[2010/05/03 10:31:57 | 000,000,000 | ---- | C] () -- I:\Windows\ativpsrm.bin
[2010/03/08 02:17:43 | 000,001,035 | ---- | C] () -- I:\Windows\SysWow64\atipblag.dat
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- I:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- I:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- I:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- I:\Windows\mib.bin
[2009/07/13 20:02:54 | 000,245,248 | ---- | C] () -- I:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- I:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- I:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- I:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- I:\Windows\SysWow64\mlang.dat
[2002/03/13 08:15:06 | 000,057,344 | ---- | C] () -- I:\Windows\SysWow64\mupkernps11.dll
 
========== LOP Check ==========
 
[2010/03/25 15:55:59 | 000,000,000 | ---D | M] -- I:\ProgramData\AAV
[2010/03/25 16:09:22 | 000,000,000 | ---D | M] -- I:\ProgramData\Acer
[2011/01/20 19:28:57 | 000,000,000 | ---D | M] -- I:\ProgramData\Acoustica
[2011/12/19 09:28:39 | 000,000,000 | ---D | M] -- I:\ProgramData\Ant.com
[2010/07/17 09:09:36 | 000,000,000 | -HSD | M] -- I:\ProgramData\Anwendungsdaten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Application Data
[2011/10/12 08:54:10 | 000,000,000 | ---D | M] -- I:\ProgramData\Babylon
[2012/02/09 13:57:04 | 000,000,000 | ---D | M] -- I:\ProgramData\boost_interprocess
[2010/03/25 15:42:54 | 000,000,000 | ---D | M] -- I:\ProgramData\Brockhaus Multimedia
[2011/10/26 17:17:31 | 000,000,000 | ---D | M] -- I:\ProgramData\DAEMON Tools Lite
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Documents
[2010/07/17 09:09:36 | 000,000,000 | -HSD | M] -- I:\ProgramData\Dokumente
[2011/10/26 17:43:57 | 000,000,000 | ---D | M] -- I:\ProgramData\EA Core
[2010/05/03 10:33:03 | 000,000,000 | ---D | M] -- I:\ProgramData\EgisTec
[2011/12/30 12:14:05 | 000,000,000 | ---D | M] -- I:\ProgramData\Electronic Arts
[2010/08/13 12:17:55 | 000,000,000 | ---D | M] -- I:\ProgramData\eMule
[2010/03/25 16:02:11 | 000,000,000 | ---D | M] -- I:\ProgramData\eSobi
[2010/07/17 09:09:36 | 000,000,000 | -HSD | M] -- I:\ProgramData\Favoriten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Favorites
[2010/07/17 09:15:36 | 000,000,000 | ---D | M] -- I:\ProgramData\McQcModifier-5c47-a7b0
[2011/10/07 06:57:49 | 000,000,000 | ---D | M] -- I:\ProgramData\Nevercenter
[2010/07/17 09:09:48 | 000,000,000 | ---D | M] -- I:\ProgramData\OEM
[2010/10/21 11:53:33 | 000,000,000 | ---D | M] -- I:\ProgramData\Partner
[2012/02/10 05:30:32 | 000,000,000 | ---D | M] -- I:\ProgramData\PMB Files
[2011/05/29 12:47:39 | 000,000,000 | ---D | M] -- I:\ProgramData\regid.1986-12.com.adobe
[2011/12/26 08:38:03 | 000,000,000 | ---D | M] -- I:\ProgramData\Solidshield
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Start Menu
[2010/07/17 09:26:47 | 000,000,000 | ---D | M] -- I:\ProgramData\Temp
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\ProgramData\Templates
[2011/04/06 13:19:30 | 000,000,000 | ---D | M] -- I:\ProgramData\Ubisoft
[2010/07/17 09:09:36 | 000,000,000 | -HSD | M] -- I:\ProgramData\Vorlagen
[2010/08/13 17:39:53 | 000,000,000 | ---D | M] -- I:\ProgramData\WinZip
[2010/07/18 06:15:59 | 000,000,000 | ---D | M] -- I:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2012/02/23 04:37:58 | 000,032,632 | ---- | M] () -- I:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2010/07/18 06:42:17 | 000,000,000 | -HSD | M] -- I:\$Recycle.Bin
[2010/05/03 10:55:57 | 000,000,000 | -H-D | M] -- I:\AcerSW
[2011/09/05 08:25:52 | 000,000,000 | ---D | M] -- I:\AMD
[2011/09/05 08:30:17 | 000,000,000 | ---D | M] -- I:\ATI
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- I:\Documents and Settings
[2010/07/17 09:09:36 | 000,000,000 | -HSD | M] -- I:\Dokumente und Einstellungen
[2010/03/25 15:07:03 | 000,000,000 | ---D | M] -- I:\Intel
[2010/03/25 16:03:33 | 000,000,000 | RH-D | M] -- I:\MSOCache
[2010/07/17 09:12:54 | 000,000,000 | -H-D | M] -- I:\OEM
[2009/07/13 23:20:08 | 000,000,000 | ---D | M] -- I:\PerfLogs
[2012/03/02 03:30:45 | 000,000,000 | R--D | M] -- I:\Program Files
[2012/03/22 04:37:17 | 000,000,000 | ---D | M] -- I:\Program Files (x86)
[2012/03/02 03:33:54 | 000,000,000 | -H-D | M] -- I:\ProgramData
[2010/07/17 09:09:36 | 000,000,000 | -HSD | M] -- I:\Programme
[2010/07/17 09:09:36 | 000,000,000 | -HSD | M] -- I:\Recovery
[2012/03/31 22:18:07 | 000,000,000 | -HSD | M] -- I:\System Volume Information
[2010/07/17 09:09:39 | 000,000,000 | R--D | M] -- I:\Users
[2012/03/31 22:20:34 | 000,000,000 | ---D | M] -- I:\Windows
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- I:\Windows\System32\drivers\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- I:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- I:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- I:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- I:\Windows\System32\drivers\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- I:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- I:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- I:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- I:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- I:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- I:\Windows\System32\cngaudit.dll
[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- I:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2009/10/06 02:06:36 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_b8b0208ee0ce1889\explorer.exe
[2011/02/26 02:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- I:\Windows\explorer.exe
[2011/02/26 02:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 01:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 21:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 01:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009/10/31 01:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- I:\Windows\SysWOW64\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 02:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 08:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009/10/06 02:35:29 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=6D4F9E4B640B413C6F73414327484C80 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_addea9f19345cd81\explorer.exe
[2010/02/04 06:49:48 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009/10/31 02:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2010/02/04 06:49:48 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 09:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/10/31 02:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2010/02/04 06:49:48 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 21:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 02:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2009/10/06 02:31:09 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=CA17F8620815267DC838E30B68CB5052 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_ae5b763cac6d568e\explorer.exe
[2011/02/26 02:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2010/02/04 06:49:48 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- I:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[2009/10/06 01:53:03 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 -- I:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_b8335443c7a68f7c\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2009/12/09 05:20:44 | 000,432,664 | ---- | M] (Intel Corporation) MD5=5A6C5876FB84418D08D67B8CAED5EFCF -- I:\OEM\Preload\4K\X86\iaStor.sys
[2009/12/09 05:20:44 | 000,432,664 | ---- | M] (Intel Corporation) MD5=5A6C5876FB84418D08D67B8CAED5EFCF -- I:\OEM\Preload\4KD\X86\iaStor.sys
[2009/10/02 00:58:58 | 000,537,112 | ---- | M] (Intel Corporation) MD5=631FA8935163B01FC0C02966CB3ADB92 -- I:\OEM\Preload\Autorun\DRV\Intel Storage Generic Driver\iaStor.sys
[2009/10/02 00:58:58 | 000,537,112 | ---- | M] (Intel Corporation) MD5=631FA8935163B01FC0C02966CB3ADB92 -- I:\Windows\System32\DriverStore\FileRepository\iaahci.inf_amd64_neutral_b03f80929ac23556\iaStor.sys
[2009/10/02 00:58:58 | 000,537,112 | ---- | M] (Intel Corporation) MD5=631FA8935163B01FC0C02966CB3ADB92 -- I:\Windows\System32\DriverStore\FileRepository\iastor.inf_amd64_neutral_093f326ff5f9285e\iaStor.sys
[2009/12/09 05:39:52 | 000,537,624 | ---- | M] (Intel Corporation) MD5=BF5442DC14608D18949DC83DE37E667A -- I:\OEM\Preload\4K\X64\iaStor.sys
[2009/12/09 05:39:52 | 000,537,624 | ---- | M] (Intel Corporation) MD5=BF5442DC14608D18949DC83DE37E667A -- I:\OEM\Preload\4KD\X64\iaStor.sys
[2009/12/09 05:39:52 | 000,537,624 | ---- | M] (Intel Corporation) MD5=BF5442DC14608D18949DC83DE37E667A -- I:\Windows\System32\drivers\iaStor.sys
[2009/12/09 05:39:52 | 000,537,624 | ---- | M] (Intel Corporation) MD5=BF5442DC14608D18949DC83DE37E667A -- I:\Windows\System32\DriverStore\FileRepository\iaahci.inf_amd64_neutral_a850f9740f1a3db7\iaStor.sys
[2009/12/09 05:39:52 | 000,537,624 | ---- | M] (Intel Corporation) MD5=BF5442DC14608D18949DC83DE37E667A -- I:\Windows\System32\DriverStore\FileRepository\iastor.inf_amd64_neutral_c102f5ecab1a70a7\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010/11/20 09:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011/03/11 02:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011/03/11 02:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- I:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 02:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- I:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0033117673c16921\iaStorV.sys
[2011/03/11 02:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011/03/11 02:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009/07/13 21:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- I:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/13 21:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- I:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009/07/13 21:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- I:\Windows\System32\netlogon.dll
[2009/07/13 21:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- I:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010/11/20 09:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010/11/20 08:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009/07/13 21:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- I:\Windows\SysWOW64\netlogon.dll
[2009/07/13 21:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- I:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009/07/13 21:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- I:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/13 21:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011/03/11 02:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- I:\Windows\System32\drivers\nvstor.sys
[2011/03/11 02:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- I:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_38e464dbe521cc7f\nvstor.sys
[2011/03/11 02:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011/03/11 02:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011/03/11 02:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- I:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010/11/20 09:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/13 21:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- I:\Windows\SysWOW64\scecli.dll
[2009/07/13 21:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- I:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 21:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- I:\Windows\System32\scecli.dll
[2009/07/13 21:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- I:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010/11/20 08:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010/11/20 09:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010/11/20 08:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009/07/13 21:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- I:\Windows\System32\user32.dll
[2009/07/13 21:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- I:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009/07/13 21:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- I:\Windows\SysWOW64\user32.dll
[2009/07/13 21:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- I:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010/11/20 09:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 08:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- I:\Windows\SysWOW64\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- I:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 21:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- I:\Windows\System32\userinit.exe
[2009/07/13 21:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- I:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 09:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010/11/20 09:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- I:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 21:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- I:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009/10/28 03:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- I:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009/10/28 02:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- I:\Windows\System32\winlogon.exe
[2009/10/28 02:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- I:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- I:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- I:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 147 bytes -> I:\ProgramData\Temp:4D066AD2
< End of report >
         

Alt 01.04.2012, 21:02   #2
markusg
/// Malware-holic
 
50 Euro Trojaner - Standard

50 Euro Trojaner



warum eröffnest du noch nen thema, dadurch wirds nicht schneller gehen :-)
__________________

__________________

 

Themen zu 50 Euro Trojaner
.com, alternate, antivir, autorun, avira, bho, bonjour, browser, defender, department, desktop, downloader, error, euro, firefox, format, gesperrt, helper, home, locker, logfile, mywinlocker, nvstor.sys, realtek, registry, rundll, scan, software, static, system, trojane, trojaner



Ähnliche Themen: 50 Euro Trojaner


  1. 100 Euro Trojaner WIN xp 64 bit
    Log-Analyse und Auswertung - 28.06.2012 (1)
  2. Windows/Verschluesselungstrojaner WinXP *100 Euro Paysafe / 50 Euro Ucash
    Log-Analyse und Auswertung - 03.05.2012 (11)
  3. 5O euro Trojaner
    Log-Analyse und Auswertung - 22.04.2012 (48)
  4. 50 euro trojaner
    Plagegeister aller Art und deren Bekämpfung - 20.04.2012 (6)
  5. 50 Euro Trojaner
    Log-Analyse und Auswertung - 04.04.2012 (3)
  6. 50 euro trojaner
    Log-Analyse und Auswertung - 03.04.2012 (21)
  7. 50 Euro Trojaner
    Plagegeister aller Art und deren Bekämpfung - 31.03.2012 (4)
  8. 50 Euro Trojaner
    Log-Analyse und Auswertung - 27.03.2012 (10)
  9. 50 Euro Trojaner
    Log-Analyse und Auswertung - 20.03.2012 (21)
  10. AKM Trojaner 50 Euro
    Plagegeister aller Art und deren Bekämpfung - 13.03.2012 (16)
  11. 50 euro trojaner
    Log-Analyse und Auswertung - 10.03.2012 (1)
  12. 50 Euro Sperre, 50 Euro Virus
    Log-Analyse und Auswertung - 12.02.2012 (14)
  13. 50 euro trojaner
    Plagegeister aller Art und deren Bekämpfung - 12.02.2012 (1)
  14. 50 Euro Trojaner
    Plagegeister aller Art und deren Bekämpfung - 16.01.2012 (1)
  15. 50 Euro Trojaner
    Log-Analyse und Auswertung - 04.01.2012 (9)
  16. 50 Euro Trojaner
    Log-Analyse und Auswertung - 03.01.2012 (1)
  17. BKA-Trojaner 100 Euro
    Log-Analyse und Auswertung - 27.07.2011 (5)

Zum Thema 50 Euro Trojaner - Hallo! Habe mir leider auch den 50 euro trojaner eingefangen. System komplett gesperrt, abgesicherter modus geht auch nicht. Habe otl laufen lassen , hier die otl logfile danke schonmal im - 50 Euro Trojaner...
Archiv
Du betrachtest: 50 Euro Trojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.