ok, aber ich glaube deskpins gibts nur bei softonic :-/

Unsinn

ausser chip.de woher weiß ich von wem ich noch software runterladen kann? ist pc-welt ok?

Ja was hab ich denn gepostet? chip geht, meinetwegen auch pcwelt
Wo genau solltest du dir Software am ehesten runtreladen?

ja original beim hersteller, aber bei deskpins ist der hersteller Elias Fotinis u die links die ich bisher angeklickt habe die auf seine webseite führen sollten, waren fehlerhaft. u bei chip war auch softonic als vorschlag. ok, es gibt auch andere anbieter außer softonic, aber deswegen wollte ich ja wissen woher man weiß welcher anbieter adware unterjubelt u welcher nicht.

oder gilt dieses problem nur bei dem anbieter softonic?

OTL Logfile:

OTL logfile created on: 09.04.2012 00:30:15 - Run 1
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Pariajanian Alen\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,30 Gb Available Physical Memory | 64,86% Memory free
4,24 Gb Paging File | 3,16 Gb Available in Paging File | 74,52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931,51 Gb Total Space | 458,63 Gb Free Space | 49,24% Space Free | Partition Type: NTFS
Drive J: | 232,83 Gb Total Space | 95,60 Gb Free Space | 41,06% Space Free | Partition Type: FAT32
 
Computer Name: PARIAJANIANA-PC | User Name: Pariajanian Alen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.04.09 00:27:03 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Pariajanian Alen\Downloads\OTL.exe
PRC - [2012.04.07 00:44:12 | 000,342,968 | ---- | M] () -- C:\ProgramData\IBUpdaterService\ibsvc.exe
PRC - [2012.03.03 00:07:34 | 000,172,664 | ---- | M] (hxxp://www.express-files.com/) -- C:\Programme\ExpressFiles\EFupdater.exe
PRC - [2012.01.19 12:30:04 | 000,114,992 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Programme\SweetIM\Messenger\SweetIM.exe
PRC - [2011.11.16 02:43:10 | 000,330,072 | ---- | M] () -- C:\Programme\Hotspot Shield\bin\openvpnas.exe
PRC - [2011.11.15 20:32:46 | 000,329,544 | ---- | M] () -- C:\Programme\Hotspot Shield\bin\hsswd.exe
PRC - [2011.11.15 20:32:42 | 000,363,336 | ---- | M] (AnchorFree Inc.) -- C:\Programme\Hotspot Shield\HssWPR\hsssrv.exe
PRC - [2011.09.27 19:10:37 | 001,700,752 | ---- | M] (Bandoo Media, inc) -- C:\Programme\SearchCore for Browsers\SearchCore for Browsers\datamngrUI.exe
PRC - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
PRC - [2011.07.27 22:41:08 | 000,397,992 | ---- | M] ({StringFileInfo_CompanyName}) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.05.09 05:42:04 | 000,428,200 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2011.04.21 07:53:10 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.04.21 07:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.03.07 15:33:08 | 000,089,456 | ---- | M] (Elaborate Bytes AG) -- C:\Programme\VirtualCloneDrive\VCDDaemon.exe
PRC - [2009.09.04 13:16:16 | 000,075,048 | ---- | M] (cyberlink) -- C:\Programme\CyberLink\Shared Files\brs.exe
PRC - [2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.01.21 04:24:52 | 000,012,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
PRC - [2008.01.21 04:24:13 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2004.05.02 19:02:51 | 000,062,464 | ---- | M] (Elias Fotinis) -- C:\Programme\DeskPins\DeskPins.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.07.29 01:09:42 | 000,096,112 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
MOD - [2008.06.03 05:35:17 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.04.07 00:44:12 | 000,342,968 | ---- | M] () [Auto | Running] -- C:\ProgramData\IBUpdaterService\ibsvc.exe -- (IBUpdaterService)
SRV - [2011.11.16 02:45:32 | 000,077,520 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Hotspot Shield\bin\HssTrayService.exe -- (HssTrayService)
SRV - [2011.11.16 02:43:10 | 000,330,072 | ---- | M] () [Auto | Running] -- C:\Programme\Hotspot Shield\bin\openvpnas.exe -- (hshld)
SRV - [2011.11.15 20:32:46 | 000,329,544 | ---- | M] () [Auto | Running] -- C:\Programme\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2011.11.15 20:32:42 | 000,363,336 | ---- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Programme\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.05.09 05:42:04 | 000,428,200 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService)
SRV - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.12.14 11:46:28 | 000,047,624 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\GIGABYTE\GEST\GSvr.exe -- (GEST Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lgusbmodem.sys -- (USBModem)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lgusbdiag.sys -- (UsbDiag)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lgusbbus.sys -- (usbbus)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\PDNSp50.sys -- (PDNSp50)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\PDNMp50.sys -- (PDNMp50)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | Boot | Stopped] -- system32\DRIVERS\ntcdrdrv.sys -- (ntcdrdrv)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\gtstusbser.sys -- (gtstusbser)
DRV - [2012.03.04 11:12:15 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2011.08.19 13:02:27 | 000,016,608 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\gdrv.sys -- (gdrv)
DRV - [2011.07.21 12:11:12 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.21 12:11:11 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.09.22 21:19:02 | 000,037,376 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HssDrv.sys -- (HssDrv)
DRV - [2010.09.22 21:19:02 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.09.29 08:11:22 | 000,012,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009.09.29 08:11:20 | 000,012,928 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009.09.29 08:11:20 | 000,010,496 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2009.09.01 17:51:32 | 000,087,536 | ---- | M] (CyberLink Corp.) [2010/10/25 00:24:47] [Kernel | Auto | Running] -- C:\Programme\CyberLink\PowerDVD\000.fcl -- ({95808DC4-FA4A-4C74-92FE-5B863F82066B})
DRV - [2008.06.03 08:22:55 | 003,695,104 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008.01.25 10:46:40 | 000,106,496 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008.01.23 10:19:44 | 000,501,560 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\ACEDRV11.sys -- (acedrv11)
DRV - [2007.12.13 10:58:26 | 000,024,080 | ---- | M] (DTV-DVB) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MtsHID.sys -- (MtsHID)
DRV - [2007.12.13 10:58:24 | 000,480,784 | ---- | M] (DTV-DVB Provide) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MtsBda.sys -- (MTSBDA)
DRV - [2007.10.11 11:10:52 | 000,030,008 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ET5Drv.sys -- (ET5Drv)
DRV - [2007.09.29 07:30:52 | 000,065,024 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2007.09.21 03:10:46 | 000,036,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2007.09.21 03:10:40 | 000,035,088 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2007.06.04 18:25:14 | 000,016,048 | ---- | M] (Cyberlink Co.,Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\CLBStor.sys -- (CLBStor)
DRV - [2007.01.23 22:00:00 | 000,716,160 | ---- | M] (Philips Semiconductors GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\3xHybrid.sys -- (3xHybrid)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.netcologne.de
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\prxtbHot0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://www.searchqu.com/web?src=ieb&appid=119&systemid=406&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}
 
 
IE - HKU\.DEFAULT\..\SearchScopes\{1A3725CF-16C8-4636-87A5-9F01EF82484A}: "URL" = hxxp://www.questbrowse.com/?prt=QUESTBROWSE199&keywords={searchTerms}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes\{1A3725CF-16C8-4636-87A5-9F01EF82484A}: "URL" = hxxp://www.questbrowse.com/?prt=QUESTBROWSE199&keywords={searchTerms}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\URLSearchHook: {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\prxtbHot0.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&AF=109980&babsrc=SP_ss&mntrId=38d5687600000000000000ff9725e77f
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://www.searchqu.com/web?src=ieb&appid=119&systemid=406&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "SweetIM Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.9
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170634FE}:4.12
FF - prefs.js..extensions.enabledItems: newtaburl@sogame.cat:2.2.3
FF - prefs.js..extensions.enabledItems: smarterwiki@wikiatic.com:4.7.8
FF - prefs.js..extensions.enabledItems: elemhidehelper@adblockplus.org:1.1.4
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3
FF - prefs.js..extensions.enabledItems: {B22AD346-44DE-43D3-A69B-3AE9BF891CEA}:1.9.1
FF - prefs.js..extensions.enabledItems: {184AA5E6-741D-464a-820E-94B3ABC2F3B4}:1.0
FF - prefs.js..extensions.enabledItems: info@bflix.info:5.0
FF - prefs.js..extensions.enabledItems: info@downloadsave.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145
FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&appid=119&systemid=406&sr=0&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.448: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Pariajanian Alen\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\info@bflix.info: C:\Users\Pariajanian Alen\AppData\Roaming\Mozilla\Firefox\Profiles\yy75nt32.default\extensions\info@bflix.info [2012.03.04 11:42:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fbphotozoom@installdaddy.com: C:\Program Files\fbphotozoom\fbphotozoom15.xpi [2012.03.28 10:45:16 | 000,102,423 | ---- | M] ()
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.04.07 00:34:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2007.12.31 13:04:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2007.12.31 13:04:28 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{B22AD346-44DE-43D3-A69B-3AE9BF891CEA}: C:\Users\Pariajanian Alen\AppData\Local\{B22AD346-44DE-43D3-A69B-3AE9BF891CEA} [2011.05.04 20:50:01 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\Pariajanian Alen\AppData\Roaming\5050 [2011.11.25 21:24:23 | 000,000,000 | ---D | M]
 
[2011.10.18 13:37:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pariajanian Alen\AppData\Roaming\mozilla\Extensions
[2012.04.07 00:51:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pariajanian Alen\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions
[2011.02.01 14:30:37 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Pariajanian Alen\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.04.07 00:42:20 | 000,000,000 | ---D | M] (ImTranslator) -- C:\Users\Pariajanian Alen\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
[2012.04.07 00:42:19 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Pariajanian Alen\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.01.11 17:58:26 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Pariajanian Alen\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2012.01.11 17:58:29 | 000,000,000 | ---D | M] (Element Hiding Helper for Adblock Plus) -- C:\Users\Pariajanian Alen\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\elemhidehelper@adblockplus.org
[2012.03.04 11:42:42 | 000,000,000 | ---D | M] (TheBflix) -- C:\Users\Pariajanian Alen\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\info@bflix.info
[2012.03.05 20:04:58 | 000,000,000 | ---D | M] (DownloadnSave) -- C:\Users\Pariajanian Alen\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\info@downloadsave.com
[2011.08.19 12:35:57 | 000,000,000 | ---D | M] (NewTabURL) -- C:\Users\Pariajanian Alen\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\newtaburl@sogame.cat
[2012.04.07 00:42:22 | 000,000,000 | ---D | M] (FastestFox) -- C:\Users\Pariajanian Alen\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\smarterwiki@wikiatic.com
[2011.07.24 15:31:22 | 000,000,917 | ---- | M] () -- C:\Users\Pariajanian Alen\AppData\Roaming\Mozilla\Firefox\Profiles\yy75nt32.default\searchplugins\conduit.xml
[2011.10.18 13:37:19 | 000,002,520 | ---- | M] () -- C:\Users\Pariajanian Alen\AppData\Roaming\Mozilla\Firefox\Profiles\yy75nt32.default\searchplugins\SearchResults.xml
[2012.03.28 10:45:49 | 000,003,916 | ---- | M] () -- C:\Users\Pariajanian Alen\AppData\Roaming\Mozilla\Firefox\Profiles\yy75nt32.default\searchplugins\sweetim.xml
[2010.03.12 22:02:06 | 000,001,196 | ---- | M] () -- C:\Users\Pariajanian Alen\AppData\Roaming\Mozilla\Firefox\Profiles\yy75nt32.default\searchplugins\winamp-search.xml
[2007.12.31 13:04:30 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.04.09 15:59:57 | 000,000,000 | ---D | M] (afurladvisor) -- C:\Programme\Mozilla Firefox\extensions\afurladvisor@anchorfree.com
[2007.12.31 13:04:28 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.04.06 12:47:41 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.12 22:03:50 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2007.12.31 13:04:26 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.03.03 00:07:44 | 000,002,310 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2007.12.31 13:04:26 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2007.12.31 13:04:26 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2007.12.31 13:04:26 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.18 13:37:19 | 000,002,520 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\SearchResults.xml
[2007.12.31 13:04:26 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2007.12.31 13:04:26 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (HistoryTriggerBHO Class) - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Programme\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll (LG Electronics)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (SearchCore for Browsers) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Programme\SearchCore for Browsers\SearchCore for Browsers\BrowserConnection.dll (Bandoo Media, inc)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Programme\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (Hotspot Shield Toolbar) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\prxtbHot0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\Toolbar\WebBrowser: (Winload Toolbar) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\Toolbar\WebBrowser: (Hotspot Shield Toolbar) - {C95A4E8E-816D-4655-8C79-D736DA1ADB6D} - C:\Programme\Hotspot_Shield\prxtbHot0.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName})
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BDRegion] C:\Programme\CyberLink\Shared Files\brs.exe (cyberlink)
O4 - HKLM..\Run: [DATAMNGR] C:\Programme\SearchCore for Browsers\SearchCore for Browsers\datamngrUI.exe (Bandoo Media, inc)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [ExpressFiles] C:\Program Files\ExpressFiles\ExpressFiles.exe (hxxp://www.express-files.com/)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [VirtualCloneDrive] C:\Program Files\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000..\Run: [avupdate] 0 File not found
O4 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite virtual clone drive\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000..\Run: [defxwlogon] "C:\Users\Pariajanian Alen\AppData\Roaming\defxwlogon.exe" -autorun File not found
O4 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000..\Run: [Efeturasewi] rundll32.exe  File not found
O4 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000..\Run: [LG LinkAir]  File not found
O4 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil11f_Plugin.exe (Adobe Systems, Inc.)
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7138749B-43C3-4036-925D-F46A79F7A380}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9725E77F-403C-4458-8D25-9779CE678249}: NameServer = 10.21.8.1
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\SEARCH~1\datamngr.dll) - C:\Programme\SearchCore for Browsers\SearchCore for Browsers\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\SEARCH~1\IEBHO.dll) - C:\Programme\SearchCore for Browsers\SearchCore for Browsers\IEBHO.dll (Bandoo Media, inc)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Pariajanian Alen\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Pariajanian Alen\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - Unable to obtain root file information for disk J:\
O33 - MountPoints2\{0831a45d-c435-11e0-ab51-df72aad26c65}\Shell - "" = AutoRun
O33 - MountPoints2\{0831a45d-c435-11e0-ab51-df72aad26c65}\Shell\AutoRun\command - "" = I:\LGAutoRun.exe
O33 - MountPoints2\{2cd88e4f-1ca0-11de-a0db-001d7d090962}\Shell - "" = AutoRun
O33 - MountPoints2\{2cd88e4f-1ca0-11de-a0db-001d7d090962}\Shell\AutoRun\command - "" = I:\QsSetup.exe
O33 - MountPoints2\{51f8b6da-485c-11dd-b516-001d7d090962}\Shell\AutoRun\command - "" = I:\
O33 - MountPoints2\{51f8b6da-485c-11dd-b516-001d7d090962}\Shell\explore\Command - "" = RECYCLER\INFO.exe
O33 - MountPoints2\{51f8b6da-485c-11dd-b516-001d7d090962}\Shell\open\Command - "" = RECYCLER\INFO.exe
O33 - MountPoints2\{8ea419eb-7337-11de-92a2-001d7d090962}\Shell - "" = Autorun
O33 - MountPoints2\{8ea419eb-7337-11de-92a2-001d7d090962}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL I:\RECYCLER\S-9-2-77-100024348-100006788-100026397-9022.com d:\
O33 - MountPoints2\{8ea419eb-7337-11de-92a2-001d7d090962}\Shell\Open\command - "" = I:\RECYCLER\S-9-2-77-100024348-100006788-100026397-9022.com d:\
O33 - MountPoints2\{a226e1a0-6532-11e1-85a1-d8e8c32f116e}\Shell - "" = AutoRun
O33 - MountPoints2\{a226e1a0-6532-11e1-85a1-d8e8c32f116e}\Shell\AutoRun\command - "" = I:\setup\rsrc\Autorun.exe
O33 - MountPoints2\{a226e1a0-6532-11e1-85a1-d8e8c32f116e}\Shell\dinstall\command - "" = I:\Directx\dxsetup.exe
O33 - MountPoints2\{a226e1ca-6532-11e1-85a1-d8e8c32f116e}\Shell - "" = AutoRun
O33 - MountPoints2\{a226e1ca-6532-11e1-85a1-d8e8c32f116e}\Shell\AutoRun\command - "" = K:\setup\rsrc\Autorun.exe
O33 - MountPoints2\{a226e1ca-6532-11e1-85a1-d8e8c32f116e}\Shell\dinstall\command - "" = K:\Directx\dxsetup.exe
O33 - MountPoints2\K\Shell - "" = Autorun
O33 - MountPoints2\K\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL K:\RECYCLER\S-2-3-63-100015592-100007331-100000103-3196.com d:\
O33 - MountPoints2\K\Shell\Open\command - "" = K:\RECYCLER\S-2-3-63-100015592-100007331-100000103-3196.com d:\
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.divxa32 - C:\Windows\System32\divxa32.acm (Kristal StudioD
FileDescription)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.04.07 00:45:58 | 000,000,000 | ---D | C] -- C:\Users\Pariajanian Alen\AppData\Roaming\eType
[2012.04.07 00:45:46 | 000,000,000 | ---D | C] -- C:\ProgramData\IBUpdaterService
[2012.04.07 00:36:56 | 000,000,000 | ---D | C] -- C:\Users\Pariajanian Alen\AppData\Local\DDMSettings
[2012.04.06 12:48:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012.04.06 12:47:19 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.03.29 21:07:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime Alternative
[2012.03.29 21:07:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2012.03.29 21:06:57 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime Alternative
[2012.03.28 10:45:35 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM
[2012.03.28 10:45:35 | 000,000,000 | ---D | C] -- C:\Program Files\SweetIM
[2012.03.28 10:45:15 | 000,000,000 | ---D | C] -- C:\Program Files\fbphotozoom
[2012.03.20 14:50:31 | 000,000,000 | ---D | C] -- C:\Users\Pariajanian Alen\AppData\Roaming\Google Inc
[2012.03.19 08:46:35 | 000,000,000 | ---D | C] -- C:\Users\Pariajanian Alen\AppData\Roaming\Opera
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
[1 C:\Users\Pariajanian Alen\AppData\Roaming\*.tmp files -> C:\Users\Pariajanian Alen\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.09 00:30:21 | 000,000,440 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{BDBA4D39-C32D-43A5-9553-F1D8C290DC9C}.job
[2012.04.08 23:49:16 | 000,004,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.08 23:49:16 | 000,004,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.06 13:23:10 | 000,167,936 | ---- | M] () -- C:\Users\Pariajanian Alen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.04.06 12:49:35 | 000,000,000 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.04.05 20:46:34 | 000,252,832 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.04.05 19:13:31 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.26 19:19:48 | 000,021,434 | ---- | M] () -- C:\Users\Pariajanian Alen\Documents\Hypnose Know-How.odt
[2012.03.20 10:42:10 | 000,019,824 | ---- | M] () -- C:\Users\Pariajanian Alen\Documents\Imbis Neumarkt Analyse Beratung.odt
[2012.03.15 12:02:56 | 000,879,537 | ---- | M] () -- C:\Users\Pariajanian Alen\Documents\img022.jpg
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
[1 C:\Users\Pariajanian Alen\AppData\Roaming\*.tmp files -> C:\Users\Pariajanian Alen\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.04.06 12:49:35 | 000,000,000 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2012.04.05 20:46:24 | 2145,902,592 | -HS- | C] () -- C:\hiberfil.sys
[2012.04.05 19:13:31 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.20 10:42:08 | 000,019,824 | ---- | C] () -- C:\Users\Pariajanian Alen\Documents\Imbis Neumarkt Analyse Beratung.odt
[2012.03.15 11:54:54 | 000,879,537 | ---- | C] () -- C:\Users\Pariajanian Alen\Documents\img022.jpg
[2011.11.19 16:26:47 | 000,000,072 | ---- | C] () -- C:\Users\Pariajanian Alen\AppData\Roaming\blckdom.res
[2011.10.05 14:18:11 | 000,064,000 | ---- | C] () -- C:\Windows\System32\esfw41.bin
[2011.08.11 03:01:43 | 000,000,118 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2011.05.04 20:50:02 | 000,000,120 | ---- | C] () -- C:\Users\Pariajanian Alen\AppData\Local\Abadano.dat
[2011.05.04 20:50:02 | 000,000,000 | ---- | C] () -- C:\Users\Pariajanian Alen\AppData\Local\Mlitu.bin
[2011.04.14 12:49:19 | 000,024,227 | ---- | C] () -- C:\Users\Pariajanian Alen\AppData\Roaming\UserTile.png
[2011.02.12 04:13:01 | 000,000,000 | ---- | C] () -- C:\Windows\System32\cd.dat
[2010.10.05 01:59:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\StarOpen.sys
[2010.09.26 03:10:50 | 019,657,194 | ---- | C] () -- C:\ProgramData\vlc-1.1.4-win32.exe
[2010.05.08 16:36:18 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
 
========== LOP Check ==========
 
[2011.11.19 16:26:52 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\5043
[2011.11.20 15:15:54 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\5044
[2011.11.21 13:40:07 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\5045
[2011.11.22 18:02:01 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\5047
[2011.11.23 11:45:36 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\5048
[2011.11.24 16:44:04 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\5049
[2011.11.25 21:24:23 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\5050
[2010.10.04 20:19:20 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\AnvSoft
[2008.12.20 15:20:51 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Ashampoo
[2012.03.03 00:07:42 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Babylon
[2012.03.04 11:14:55 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\DAEMON Tools Lite
[2011.10.11 12:22:26 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\EPSON
[2011.12.14 02:58:07 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Eqxaa
[2012.04.07 00:48:49 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\eType
[2012.04.05 21:48:27 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\ExpressFiles
[2012.03.02 23:30:48 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Giude
[2012.03.03 01:30:57 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Ipixym
[2011.11.19 16:26:25 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\kock
[2008.07.04 17:41:17 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Leadertech
[2011.09.30 16:47:57 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\LG Electronics
[2011.10.18 14:32:18 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Media Get LLC
[2011.10.23 20:39:48 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\mp3DirectCut
[2011.09.23 11:36:49 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Ongai
[2010.07.24 22:18:48 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\OpenOffice.org
[2012.03.19 08:46:35 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Opera
[2011.04.14 12:49:18 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\PeerNetworking
[2011.09.23 09:16:59 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Qaemw
[2011.12.12 21:11:10 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Qeavwu
[2012.03.15 00:54:44 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\TeamViewer
[2009.03.07 23:17:44 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\TerraTec
[2011.09.08 07:28:23 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Unity
[2011.11.23 13:01:21 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\xmldm
[2010.05.22 22:39:59 | 000,000,386 | ---- | M] () -- C:\Windows\Tasks\Install_NSS.job
[2012.04.05 19:07:05 | 000,032,584 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.04.09 00:30:21 | 000,000,440 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{BDBA4D39-C32D-43A5-9553-F1D8C290DC9C}.job
[2008.01.01 00:09:35 | 000,000,330 | ---- | M] () -- C:\Windows\Tasks\WinMaximizer-Pariajanian Alen-Startup.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.11.19 16:26:52 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\5043
[2011.11.20 15:15:54 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\5044
[2011.11.21 13:40:07 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\5045
[2011.11.22 18:02:01 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\5047
[2011.11.23 11:45:36 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\5048
[2011.11.24 16:44:04 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\5049
[2011.11.25 21:24:23 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\5050
[2012.03.20 09:52:32 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Adobe
[2008.11.23 18:53:44 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Ahead
[2010.10.04 20:19:20 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\AnvSoft
[2010.09.28 20:41:53 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Apple Computer
[2008.12.20 15:20:51 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Ashampoo
[2008.06.23 14:14:04 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\ATI
[2011.08.19 13:05:12 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Avira
[2012.03.03 00:07:42 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Babylon
[2010.11.17 10:43:58 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\CyberLink
[2012.03.04 11:14:55 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\DAEMON Tools Lite
[2010.05.23 14:42:54 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\DivX
[2011.08.08 22:34:49 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\dvdcss
[2011.10.11 12:22:26 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\EPSON
[2011.12.14 02:58:07 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Eqxaa
[2012.04.07 00:48:49 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\eType
[2012.04.05 21:48:27 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\ExpressFiles
[2012.03.02 23:30:48 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Giude
[2012.03.20 14:50:31 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Google Inc
[2011.11.27 23:30:48 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Help
[2012.03.22 09:34:22 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Identities
[2008.06.23 14:01:57 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\InstallShield
[2012.03.03 01:30:57 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Ipixym
[2011.11.19 16:26:25 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\kock
[2008.07.04 17:41:17 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Leadertech
[2011.09.30 16:47:57 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\LG Electronics
[2008.06.24 08:53:38 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Macromedia
[2011.11.27 22:25:09 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Malwarebytes
[2012.03.07 22:46:31 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Media Center Programs
[2011.10.18 14:32:18 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Media Get LLC
[2011.09.18 16:35:16 | 000,000,000 | --SD | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Microsoft
[2012.03.17 11:48:13 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Microsoft Corporation
[2009.04.19 09:38:58 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Mozilla
[2011.10.23 20:39:48 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\mp3DirectCut
[2011.09.23 11:36:49 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Ongai
[2010.07.24 22:18:48 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\OpenOffice.org
[2012.03.19 08:46:35 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Opera
[2011.04.14 12:49:18 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\PeerNetworking
[2011.09.23 09:16:59 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Qaemw
[2011.12.12 21:11:10 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Qeavwu
[2010.03.04 20:05:41 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Real
[2012.03.15 00:54:44 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\TeamViewer
[2009.03.07 23:17:44 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\TerraTec
[2011.09.08 07:28:23 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Unity
[2012.03.22 10:08:24 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\vlc
[2010.10.07 18:38:55 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\Winamp
[2008.07.11 00:38:38 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\WinRAR
[2011.11.23 13:01:21 | 000,000,000 | ---D | M] -- C:\Users\Pariajanian Alen\AppData\Roaming\xmldm
 
< %APPDATA%\*.exe /s >
[2011.12.11 10:43:00 | 000,281,960 | ---- | M] (DSNR Labs) -- C:\Users\Pariajanian Alen\AppData\Roaming\eType\eTypeUninstall.exe
[2012.02.16 18:18:12 | 000,017,776 | ---- | M] () -- C:\Users\Pariajanian Alen\AppData\Roaming\eType\Launchx64.exe
[2010.09.19 14:13:22 | 000,083,968 | ---- | M] () -- C:\Users\Pariajanian Alen\AppData\Roaming\eType\lzma.exe
[2010.11.30 23:14:41 | 002,827,728 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Pariajanian Alen\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
[2011.09.21 16:37:09 | 003,088,032 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Pariajanian Alen\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2008.06.23 14:10:15 | 000,010,134 | R--- | M] () -- C:\Users\Pariajanian Alen\AppData\Roaming\Microsoft\Installer\{236479EE-1E63-59DC-8E6B-293A393A135F}\ARPPRODUCTICON.exe
[2010.05.24 19:53:20 | 000,443,912 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Pariajanian Alen\AppData\Roaming\Real\Update\setup3.10\setup.exe
[2011.11.19 17:59:49 | 000,317,048 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Pariajanian Alen\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\9.00\rnupgagent.exe
[2011.11.19 21:01:08 | 026,533,840 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Pariajanian Alen\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\9.00\stub_data\RealPlayer_de.exe
[2011.11.19 20:59:57 | 000,676,624 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Pariajanian Alen\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\9.00\stub_exe\RealPlayer_de.exe
 
< %SYSTEMDRIVE%\*.exe >
[2008.04.11 09:03:48 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe
 
< MD5 for: AGP440.SYS  >
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: AHCIX86S.SYS  >
[2008.04.02 21:40:48 | 000,175,632 | ---- | M] (AMD Technologies Inc.) MD5=844A6734E8BB3530FB1444ED698087BD -- C:\ATI\SUPPORT\8-6_vista32_dd_ccc_wdm_enu_64789\Packages\Drivers\SBDrv\SB7xx\RAID\LH\ahcix86s.sys
[2007.04.17 00:16:34 | 000,119,296 | ---- | M] (ATI Technologies Inc.) MD5=A5AC7B705166BF7CD07BB054BEEA8D03 -- C:\ATI\SUPPORT\8-6_vista32_dd_ccc_wdm_enu_64789\Packages\Drivers\SBDrv\SB6xx\RAID\LH64A\ahcix86s.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[1 C:\Windows\system32\drivers\*.tmp files -> C:\Windows\system32\drivers\*.tmp -> ]
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<           >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 24 bytes -> C:\Windows:668720410975202A

< End of report >
         

--- --- ---

[/code]


nach dem scan sind 2 txt dateien ausgegeben worden. einmal otl.txt u extras.txt. ist extra.txt unnötig?

bei dem otl scan ist kein ok button. soll ich es einfach über das kreuz eichen schließen?

oder gilt dieses problem nur bei dem anbieter softonic?

Soweit ich weiß packt besodners Softonic gerne seinen Toolbar-Müll in die Setups rein

O2 - BHO: (DivX Plus Web Player HTML5 <video>)

Sagmal gehörst du auch zur der Fraktion, die sich Serien und Kinofilme über dubiose Portale anschaut?
Wenn ja: in Zukunft Finger weg, diese illegalen Portale verbreiten Malware und wenn du in Zukunft malwarefrei sein wilst, musst du auf legale Alternativen ausweichen und auf solche riskanten Streamingseiten verzichten!
Gerade solche Streamingseiten sind für die aktuelle Welle der Erpresserschädlinge verantwortlich, die Windows blockieren und 50 oder 100 EUR erpressen wollen!!

okay. sind wir jetzt in unsere sache soweit fertig? oder muß noch wsa gemacht werden?

Nein! Beantworte bitte meine Frage oder gib ein kurzes Feedback zu meinem Hinweis!

achso sorry, ja. doch, aber ich war mir diesem risiko bewußt. mein hintergedanke war immer, dass wenn ich meinen rechner endlich mal von grundauf neu konfiguriere u partitioniere u nicht mehr im admin modus surfe, wird nicht mehr sooooo viel zu befürchten sein.

aber da ich bis dahin, meinen rechner erstmal nicht für berufliche zwecke mit sensibelen daten nutze, nahm ich das risiko im kauf

Ja lass sowas in Zukunft einfach sein.
Deinstalliere DivX - für sowas wie Youtube brauchst du das eh nicht

Mach danach ein neues OTL-Log

hi, ich habe eine frage. um den OTL-log zu machen stand, dass man alle progs schliessen soll. galt das auch für antivir? ich war mir nicht sicher, da ich bei dem anderen scann wegen antivir explizit dazu aufgefordert wurde.

falls nicht, ist hier schon mal die log-datei:
OTL Logfile:
OTL Logfile:

OTL logfile created on: 11.04.2012 11:03:25 - Run 2
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\xxxxxxxxx xxxxxxxxx\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,36 Gb Available Physical Memory | 68,11% Memory free
4,24 Gb Paging File | 3,18 Gb Available in Paging File | 75,03% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931,51 Gb Total Space | 482,00 Gb Free Space | 51,74% Space Free | Partition Type: NTFS
Drive J: | 3,69 Gb Total Space | 3,61 Gb Free Space | 98,09% Space Free | Partition Type: FAT32
Drive N: | 232,83 Gb Total Space | 95,60 Gb Free Space | 41,06% Space Free | Partition Type: FAT32
 
Computer Name: xxxxxxxxxA-PC | User Name: xxxxxxxxx xxxxxxxxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.04.09 00:27:03 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\xxxxxxxxx xxxxxxxxx\Desktop\OTL.exe
PRC - [2012.04.07 00:44:12 | 000,342,968 | ---- | M] () -- C:\ProgramData\IBUpdaterService\ibsvc.exe
PRC - [2012.03.03 00:07:34 | 000,172,664 | ---- | M] (hxxp://www.express-files.com/) -- C:\Programme\ExpressFiles\EFupdater.exe
PRC - [2012.01.19 12:30:04 | 000,114,992 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Programme\SweetIM\Messenger\SweetIM.exe
PRC - [2011.11.16 02:43:10 | 000,330,072 | ---- | M] () -- C:\Programme\Hotspot Shield\bin\openvpnas.exe
PRC - [2011.11.15 20:32:46 | 000,329,544 | ---- | M] () -- C:\Programme\Hotspot Shield\bin\hsswd.exe
PRC - [2011.11.15 20:32:42 | 000,363,336 | ---- | M] (AnchorFree Inc.) -- C:\Programme\Hotspot Shield\HssWPR\hsssrv.exe
PRC - [2011.09.27 19:10:37 | 001,700,752 | ---- | M] (Bandoo Media, inc) -- C:\Programme\SearchCore for Browsers\SearchCore for Browsers\datamngrUI.exe
PRC - [2011.07.27 22:41:08 | 000,397,992 | ---- | M] ({StringFileInfo_CompanyName}) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.05.09 05:42:04 | 000,428,200 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2011.04.21 07:53:10 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.04.21 07:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.03.07 15:33:08 | 000,089,456 | ---- | M] (Elaborate Bytes AG) -- C:\Programme\VirtualCloneDrive\VCDDaemon.exe
PRC - [2009.09.04 13:16:16 | 000,075,048 | ---- | M] (cyberlink) -- C:\Programme\CyberLink\Shared Files\brs.exe
PRC - [2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2008.06.03 05:35:17 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
MOD - [2008.02.12 12:50:40 | 000,688,128 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
MOD - [2007.09.20 18:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.04.07 00:44:12 | 000,342,968 | ---- | M] () [Auto | Running] -- C:\ProgramData\IBUpdaterService\ibsvc.exe -- (IBUpdaterService)
SRV - [2011.11.16 02:45:32 | 000,077,520 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Hotspot Shield\bin\HssTrayService.exe -- (HssTrayService)
SRV - [2011.11.16 02:43:10 | 000,330,072 | ---- | M] () [Auto | Running] -- C:\Programme\Hotspot Shield\bin\openvpnas.exe -- (hshld)
SRV - [2011.11.15 20:32:46 | 000,329,544 | ---- | M] () [Auto | Running] -- C:\Programme\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2011.11.15 20:32:42 | 000,363,336 | ---- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Programme\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.05.09 05:42:04 | 000,428,200 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService)
SRV - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.12.14 11:46:28 | 000,047,624 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\GIGABYTE\GEST\GSvr.exe -- (GEST Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lgusbmodem.sys -- (USBModem)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lgusbdiag.sys -- (UsbDiag)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lgusbbus.sys -- (usbbus)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\PDNSp50.sys -- (PDNSp50)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\PDNMp50.sys -- (PDNMp50)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | Boot | Stopped] -- system32\DRIVERS\ntcdrdrv.sys -- (ntcdrdrv)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\gtstusbser.sys -- (gtstusbser)
DRV - [2012.03.04 11:12:15 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2011.08.19 13:02:27 | 000,016,608 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\gdrv.sys -- (gdrv)
DRV - [2011.07.21 12:11:12 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.21 12:11:11 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.09.22 21:19:02 | 000,037,376 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HssDrv.sys -- (HssDrv)
DRV - [2010.09.22 21:19:02 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.09.29 08:11:22 | 000,012,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009.09.29 08:11:20 | 000,012,928 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009.09.29 08:11:20 | 000,010,496 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2009.09.01 17:51:32 | 000,087,536 | ---- | M] (CyberLink Corp.) [2010/10/25 00:24:47] [Kernel | Auto | Running] -- C:\Programme\CyberLink\PowerDVD\000.fcl -- ({95808DC4-FA4A-4C74-92FE-5B863F82066B})
DRV - [2008.06.03 08:22:55 | 003,695,104 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008.01.25 10:46:40 | 000,106,496 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008.01.23 10:19:44 | 000,501,560 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\ACEDRV11.sys -- (acedrv11)
DRV - [2007.12.13 10:58:26 | 000,024,080 | ---- | M] (DTV-DVB) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MtsHID.sys -- (MtsHID)
DRV - [2007.12.13 10:58:24 | 000,480,784 | ---- | M] (DTV-DVB Provide) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MtsBda.sys -- (MTSBDA)
DRV - [2007.10.11 11:10:52 | 000,030,008 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ET5Drv.sys -- (ET5Drv)
DRV - [2007.09.29 07:30:52 | 000,065,024 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2007.09.21 03:10:46 | 000,036,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2007.09.21 03:10:40 | 000,035,088 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2007.06.04 18:25:14 | 000,016,048 | ---- | M] (Cyberlink Co.,Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\CLBStor.sys -- (CLBStor)
DRV - [2007.01.23 22:00:00 | 000,716,160 | ---- | M] (Philips Semiconductors GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\3xHybrid.sys -- (3xHybrid)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.netcologne.de
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\prxtbHot0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://www.searchqu.com/web?src=ieb&appid=119&systemid=406&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}
 
 
IE - HKU\.DEFAULT\..\SearchScopes\{1A3725CF-16C8-4636-87A5-9F01EF82484A}: "URL" = hxxp://www.questbrowse.com/?prt=QUESTBROWSE199&keywords={searchTerms}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes\{1A3725CF-16C8-4636-87A5-9F01EF82484A}: "URL" = hxxp://www.questbrowse.com/?prt=QUESTBROWSE199&keywords={searchTerms}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\URLSearchHook: {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\prxtbHot0.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&AF=109980&babsrc=SP_ss&mntrId=38d5687600000000000000ff9725e77f
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://www.searchqu.com/web?src=ieb&appid=119&systemid=406&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "SweetIM Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.9
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170634FE}:4.12
FF - prefs.js..extensions.enabledItems: newtaburl@sogame.cat:2.2.3
FF - prefs.js..extensions.enabledItems: smarterwiki@wikiatic.com:4.7.8
FF - prefs.js..extensions.enabledItems: elemhidehelper@adblockplus.org:1.1.4
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3
FF - prefs.js..extensions.enabledItems: {B22AD346-44DE-43D3-A69B-3AE9BF891CEA}:1.9.1
FF - prefs.js..extensions.enabledItems: {184AA5E6-741D-464a-820E-94B3ABC2F3B4}:1.0
FF - prefs.js..extensions.enabledItems: info@bflix.info:5.0
FF - prefs.js..extensions.enabledItems: info@downloadsave.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145
FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&appid=119&systemid=406&sr=0&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.448: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\xxxxxxxxx xxxxxxxxx\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\info@bflix.info: C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yy75nt32.default\extensions\info@bflix.info [2012.03.04 11:42:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fbphotozoom@installdaddy.com: C:\Program Files\fbphotozoom\fbphotozoom15.xpi [2012.03.28 10:45:16 | 000,102,423 | ---- | M] ()
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2007.12.31 13:04:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2007.12.31 13:04:28 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{B22AD346-44DE-43D3-A69B-3AE9BF891CEA}: C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Local\{B22AD346-44DE-43D3-A69B-3AE9BF891CEA} [2011.05.04 20:50:01 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5050 [2011.11.25 21:24:23 | 000,000,000 | ---D | M]
 
[2011.10.18 13:37:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\mozilla\Extensions
[2012.04.09 14:14:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions
[2011.02.01 14:30:37 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.04.07 00:42:20 | 000,000,000 | ---D | M] (ImTranslator) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
[2012.04.07 00:42:19 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.01.11 17:58:26 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2012.03.04 11:42:42 | 000,000,000 | ---D | M] (TheBflix) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\info@bflix.info
[2012.03.05 20:04:58 | 000,000,000 | ---D | M] (DownloadnSave) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\info@downloadsave.com
[2011.08.19 12:35:57 | 000,000,000 | ---D | M] (NewTabURL) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\newtaburl@sogame.cat
[2012.04.07 00:42:22 | 000,000,000 | ---D | M] (FastestFox) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yy75nt32.default\extensions\smarterwiki@wikiatic.com
[2011.07.24 15:31:22 | 000,000,917 | ---- | M] () -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yy75nt32.default\searchplugins\conduit.xml
[2011.10.18 13:37:19 | 000,002,520 | ---- | M] () -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yy75nt32.default\searchplugins\SearchResults.xml
[2012.03.28 10:45:49 | 000,003,916 | ---- | M] () -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yy75nt32.default\searchplugins\sweetim.xml
[2010.03.12 22:02:06 | 000,001,196 | ---- | M] () -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yy75nt32.default\searchplugins\winamp-search.xml
[2007.12.31 13:04:30 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.04.09 15:59:57 | 000,000,000 | ---D | M] (afurladvisor) -- C:\Programme\Mozilla Firefox\extensions\afurladvisor@anchorfree.com
File not found (No name found) -- C:\USERS\xxxxxxxxx xxxxxxxxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YY75NT32.DEFAULT\EXTENSIONS\ELEMHIDEHELPER@ADBLOCKPLUS.ORG
[2007.12.31 13:04:28 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.04.06 12:47:41 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.12 22:03:50 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2007.12.31 13:04:26 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.03.03 00:07:44 | 000,002,310 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2007.12.31 13:04:26 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2007.12.31 13:04:26 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2007.12.31 13:04:26 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.18 13:37:19 | 000,002,520 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\SearchResults.xml
[2007.12.31 13:04:26 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2007.12.31 13:04:26 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (HistoryTriggerBHO Class) - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Programme\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll (LG Electronics)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (SearchCore for Browsers) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Programme\SearchCore for Browsers\SearchCore for Browsers\BrowserConnection.dll (Bandoo Media, inc)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Programme\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (Hotspot Shield Toolbar) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\prxtbHot0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\Toolbar\WebBrowser: (Winload Toolbar) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\Toolbar\WebBrowser: (Hotspot Shield Toolbar) - {C95A4E8E-816D-4655-8C79-D736DA1ADB6D} - C:\Programme\Hotspot_Shield\prxtbHot0.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName})
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BDRegion] C:\Programme\CyberLink\Shared Files\brs.exe (cyberlink)
O4 - HKLM..\Run: [DATAMNGR] C:\Programme\SearchCore for Browsers\SearchCore for Browsers\datamngrUI.exe (Bandoo Media, inc)
O4 - HKLM..\Run: [ExpressFiles] C:\Program Files\ExpressFiles\ExpressFiles.exe (hxxp://www.express-files.com/)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [VirtualCloneDrive] C:\Program Files\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000..\Run: [avupdate] 0 File not found
O4 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite virtual clone drive\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000..\Run: [defxwlogon] "C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\defxwlogon.exe" -autorun File not found
O4 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000..\Run: [Efeturasewi] rundll32.exe  File not found
O4 - HKU\S-1-5-21-1301049439-2782468571-4059665605-1000..\Run: [LG LinkAir]  File not found
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7138749B-43C3-4036-925D-F46A79F7A380}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9725E77F-403C-4458-8D25-9779CE678249}: NameServer = 10.21.8.1
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\SEARCH~1\datamngr.dll) - C:\Programme\SearchCore for Browsers\SearchCore for Browsers\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\SEARCH~1\IEBHO.dll) - C:\Programme\SearchCore for Browsers\SearchCore for Browsers\IEBHO.dll (Bandoo Media, inc)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - Unable to obtain root file information for disk N:\
O33 - MountPoints2\{0831a45d-c435-11e0-ab51-df72aad26c65}\Shell - "" = AutoRun
O33 - MountPoints2\{0831a45d-c435-11e0-ab51-df72aad26c65}\Shell\AutoRun\command - "" = I:\LGAutoRun.exe
O33 - MountPoints2\{2cd88e4f-1ca0-11de-a0db-001d7d090962}\Shell - "" = AutoRun
O33 - MountPoints2\{2cd88e4f-1ca0-11de-a0db-001d7d090962}\Shell\AutoRun\command - "" = I:\QsSetup.exe
O33 - MountPoints2\{51f8b6da-485c-11dd-b516-001d7d090962}\Shell\AutoRun\command - "" = I:\
O33 - MountPoints2\{51f8b6da-485c-11dd-b516-001d7d090962}\Shell\explore\Command - "" = RECYCLER\INFO.exe
O33 - MountPoints2\{51f8b6da-485c-11dd-b516-001d7d090962}\Shell\open\Command - "" = RECYCLER\INFO.exe
O33 - MountPoints2\{8ea419eb-7337-11de-92a2-001d7d090962}\Shell - "" = Autorun
O33 - MountPoints2\{8ea419eb-7337-11de-92a2-001d7d090962}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL I:\RECYCLER\S-9-2-77-100024348-100006788-100026397-9022.com d:\
O33 - MountPoints2\{8ea419eb-7337-11de-92a2-001d7d090962}\Shell\Open\command - "" = I:\RECYCLER\S-9-2-77-100024348-100006788-100026397-9022.com d:\
O33 - MountPoints2\{a226e1a0-6532-11e1-85a1-d8e8c32f116e}\Shell - "" = AutoRun
O33 - MountPoints2\{a226e1a0-6532-11e1-85a1-d8e8c32f116e}\Shell\AutoRun\command - "" = I:\setup\rsrc\Autorun.exe
O33 - MountPoints2\{a226e1a0-6532-11e1-85a1-d8e8c32f116e}\Shell\dinstall\command - "" = I:\Directx\dxsetup.exe
O33 - MountPoints2\{a226e1ca-6532-11e1-85a1-d8e8c32f116e}\Shell - "" = AutoRun
O33 - MountPoints2\{a226e1ca-6532-11e1-85a1-d8e8c32f116e}\Shell\AutoRun\command - "" = K:\setup\rsrc\Autorun.exe
O33 - MountPoints2\{a226e1ca-6532-11e1-85a1-d8e8c32f116e}\Shell\dinstall\command - "" = K:\Directx\dxsetup.exe
O33 - MountPoints2\K\Shell - "" = Autorun
O33 - MountPoints2\K\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL K:\RECYCLER\S-2-3-63-100015592-100007331-100000103-3196.com d:\
O33 - MountPoints2\K\Shell\Open\command - "" = K:\RECYCLER\S-2-3-63-100015592-100007331-100000103-3196.com d:\
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.divxa32 - C:\Windows\System32\divxa32.acm (Kristal StudioD
FileDescription)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.04.09 14:11:30 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
[2012.04.09 00:27:02 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\xxxxxxxxx xxxxxxxxx\Desktop\OTL.exe
[2012.04.07 00:45:58 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\eType
[2012.04.07 00:45:46 | 000,000,000 | ---D | C] -- C:\ProgramData\IBUpdaterService
[2012.04.06 12:48:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012.04.06 12:47:19 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.03.29 21:07:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime Alternative
[2012.03.29 21:07:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2012.03.29 21:06:57 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime Alternative
[2012.03.28 10:45:35 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM
[2012.03.28 10:45:35 | 000,000,000 | ---D | C] -- C:\Program Files\SweetIM
[2012.03.28 10:45:15 | 000,000,000 | ---D | C] -- C:\Program Files\fbphotozoom
[2012.03.20 14:50:31 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Google Inc
[2012.03.19 08:46:35 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Opera
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
[1 C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\*.tmp files -> C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.11 11:07:00 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.04.11 11:07:00 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.04.11 11:07:00 | 000,126,248 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.04.11 11:07:00 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.04.11 10:55:19 | 000,000,440 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{BDBA4D39-C32D-43A5-9553-F1D8C290DC9C}.job
[2012.04.11 10:39:00 | 000,004,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.11 10:39:00 | 000,004,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.11 10:38:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.09 14:11:29 | 000,000,330 | ---- | M] () -- C:\Windows\tasks\WinMaximizer-xxxxxxxxx xxxxxxxxx-Startup.job
[2012.04.09 14:11:11 | 2143,830,016 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.09 13:10:17 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.04.09 00:27:03 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\xxxxxxxxx xxxxxxxxx\Desktop\OTL.exe
[2012.04.06 13:23:10 | 000,167,936 | ---- | M] () -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.04.05 20:46:34 | 000,252,832 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.04.05 19:13:31 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.26 19:19:48 | 000,021,434 | ---- | M] () -- C:\Users\xxxxxxxxx xxxxxxxxx\Documents\Hypnose Know-How.odt
[2012.03.20 10:42:10 | 000,019,824 | ---- | M] () -- C:\Users\xxxxxxxxx xxxxxxxxx\Documents\Imbis Neumarkt Analyse Beratung.odt
[2012.03.15 12:02:56 | 000,879,537 | ---- | M] () -- C:\Users\xxxxxxxxx xxxxxxxxx\Documents\img022.jpg
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
[1 C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\*.tmp files -> C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.04.06 12:49:35 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2012.04.05 20:46:24 | 2143,830,016 | -HS- | C] () -- C:\hiberfil.sys
[2012.04.05 19:13:31 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.20 10:42:08 | 000,019,824 | ---- | C] () -- C:\Users\xxxxxxxxx xxxxxxxxx\Documents\Imbis Neumarkt Analyse Beratung.odt
[2012.03.15 11:54:54 | 000,879,537 | ---- | C] () -- C:\Users\xxxxxxxxx xxxxxxxxx\Documents\img022.jpg
[2011.11.19 16:26:47 | 000,000,072 | ---- | C] () -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\blckdom.res
[2011.10.05 14:18:11 | 000,064,000 | ---- | C] () -- C:\Windows\System32\esfw41.bin
[2011.08.11 03:01:43 | 000,000,118 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2011.05.04 20:50:02 | 000,000,120 | ---- | C] () -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Local\Abadano.dat
[2011.05.04 20:50:02 | 000,000,000 | ---- | C] () -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Local\Mlitu.bin
[2011.04.14 12:49:19 | 000,024,227 | ---- | C] () -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\UserTile.png
[2011.02.12 04:13:01 | 000,000,000 | ---- | C] () -- C:\Windows\System32\cd.dat
[2010.10.05 01:59:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\StarOpen.sys
[2010.09.26 03:10:50 | 019,657,194 | ---- | C] () -- C:\ProgramData\vlc-1.1.4-win32.exe
[2010.05.08 16:36:18 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
 
========== LOP Check ==========
 
[2011.11.19 16:26:52 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5043
[2011.11.20 15:15:54 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5044
[2011.11.21 13:40:07 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5045
[2011.11.22 18:02:01 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5047
[2011.11.23 11:45:36 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5048
[2011.11.24 16:44:04 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5049
[2011.11.25 21:24:23 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5050
[2010.10.04 20:19:20 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\AnvSoft
[2008.12.20 15:20:51 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Ashampoo
[2012.03.03 00:07:42 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Babylon
[2012.03.04 11:14:55 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\DAEMON Tools Lite
[2011.10.11 12:22:26 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\EPSON
[2011.12.14 02:58:07 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Eqxaa
[2012.04.07 00:48:49 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\eType
[2012.04.09 21:33:09 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\ExpressFiles
[2012.03.02 23:30:48 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Giude
[2012.03.03 01:30:57 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Ipixym
[2011.11.19 16:26:25 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\kock
[2008.07.04 17:41:17 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Leadertech
[2011.09.30 16:47:57 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\LG Electronics
[2011.10.18 14:32:18 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Media Get LLC
[2011.10.23 20:39:48 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\mp3DirectCut
[2011.09.23 11:36:49 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Ongai
[2010.07.24 22:18:48 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\OpenOffice.org
[2012.03.19 08:46:35 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Opera
[2011.04.14 12:49:18 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\PeerNetworking
[2011.09.23 09:16:59 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Qaemw
[2011.12.12 21:11:10 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Qeavwu
[2012.03.15 00:54:44 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\TeamViewer
[2009.03.07 23:17:44 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\TerraTec
[2011.09.08 07:28:23 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Unity
[2011.11.23 13:01:21 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\xmldm
[2010.05.22 22:39:59 | 000,000,386 | ---- | M] () -- C:\Windows\Tasks\Install_NSS.job
[2012.04.09 13:10:20 | 000,032,584 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.04.11 10:55:19 | 000,000,440 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{BDBA4D39-C32D-43A5-9553-F1D8C290DC9C}.job
[2012.04.09 14:11:29 | 000,000,330 | ---- | M] () -- C:\Windows\Tasks\WinMaximizer-xxxxxxxxx xxxxxxxxx-Startup.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.11.19 16:26:52 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5043
[2011.11.20 15:15:54 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5044
[2011.11.21 13:40:07 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5045
[2011.11.22 18:02:01 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5047
[2011.11.23 11:45:36 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5048
[2011.11.24 16:44:04 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5049
[2011.11.25 21:24:23 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\5050
[2012.03.20 09:52:32 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Adobe
[2008.11.23 18:53:44 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Ahead
[2010.10.04 20:19:20 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\AnvSoft
[2010.09.28 20:41:53 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Apple Computer
[2008.12.20 15:20:51 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Ashampoo
[2008.06.23 14:14:04 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\ATI
[2011.08.19 13:05:12 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Avira
[2012.03.03 00:07:42 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Babylon
[2010.11.17 10:43:58 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\CyberLink
[2012.03.04 11:14:55 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\DAEMON Tools Lite
[2010.05.23 14:42:54 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\DivX
[2011.08.08 22:34:49 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\dvdcss
[2011.10.11 12:22:26 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\EPSON
[2011.12.14 02:58:07 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Eqxaa
[2012.04.07 00:48:49 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\eType
[2012.04.09 21:33:09 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\ExpressFiles
[2012.03.02 23:30:48 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Giude
[2012.03.20 14:50:31 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Google Inc
[2011.11.27 23:30:48 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Help
[2012.03.22 09:34:22 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Identities
[2008.06.23 14:01:57 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\InstallShield
[2012.03.03 01:30:57 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Ipixym
[2011.11.19 16:26:25 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\kock
[2008.07.04 17:41:17 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Leadertech
[2011.09.30 16:47:57 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\LG Electronics
[2008.06.24 08:53:38 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Macromedia
[2011.11.27 22:25:09 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Malwarebytes
[2012.03.07 22:46:31 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Media Center Programs
[2011.10.18 14:32:18 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Media Get LLC
[2011.09.18 16:35:16 | 000,000,000 | --SD | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Microsoft
[2012.03.17 11:48:13 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Microsoft Corporation
[2009.04.19 09:38:58 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Mozilla
[2011.10.23 20:39:48 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\mp3DirectCut
[2011.09.23 11:36:49 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Ongai
[2010.07.24 22:18:48 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\OpenOffice.org
[2012.03.19 08:46:35 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Opera
[2011.04.14 12:49:18 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\PeerNetworking
[2011.09.23 09:16:59 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Qaemw
[2011.12.12 21:11:10 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Qeavwu
[2010.03.04 20:05:41 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Real
[2012.03.15 00:54:44 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\TeamViewer
[2009.03.07 23:17:44 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\TerraTec
[2011.09.08 07:28:23 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Unity
[2012.03.22 10:08:24 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\vlc
[2010.10.07 18:38:55 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Winamp
[2008.07.11 00:38:38 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\WinRAR
[2011.11.23 13:01:21 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\xmldm
 
< %APPDATA%\*.exe /s >
[2011.12.11 10:43:00 | 000,281,960 | ---- | M] (DSNR Labs) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\eType\eTypeUninstall.exe
[2012.02.16 18:18:12 | 000,017,776 | ---- | M] () -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\eType\Launchx64.exe
[2010.09.19 14:13:22 | 000,083,968 | ---- | M] () -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\eType\lzma.exe
[2010.11.30 23:14:41 | 002,827,728 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
[2011.09.21 16:37:09 | 003,088,032 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2008.06.23 14:10:15 | 000,010,134 | R--- | M] () -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Microsoft\Installer\{236479EE-1E63-59DC-8E6B-293A393A135F}\ARPPRODUCTICON.exe
[2010.05.24 19:53:20 | 000,443,912 | ---- | M] (RealNetworks, Inc.) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Real\Update\setup3.10\setup.exe
[2011.11.19 17:59:49 | 000,317,048 | ---- | M] (RealNetworks, Inc.) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\9.00\rnupgagent.exe
[2011.11.19 21:01:08 | 026,533,840 | ---- | M] (RealNetworks, Inc.) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\9.00\stub_data\RealPlayer_de.exe
[2011.11.19 20:59:57 | 000,676,624 | ---- | M] (RealNetworks, Inc.) -- C:\Users\xxxxxxxxx xxxxxxxxx\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\9.00\stub_exe\RealPlayer_de.exe
 
< %SYSTEMDRIVE%\*.exe >
[2008.04.11 09:03:48 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe
 
< MD5 for: AGP440.SYS  >
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: AHCIX86S.SYS  >
[2008.04.02 21:40:48 | 000,175,632 | ---- | M] (AMD Technologies Inc.) MD5=844A6734E8BB3530FB1444ED698087BD -- C:\ATI\SUPPORT\8-6_vista32_dd_ccc_wdm_enu_64789\Packages\Drivers\SBDrv\SB7xx\RAID\LH\ahcix86s.sys
[2007.04.17 00:16:34 | 000,119,296 | ---- | M] (ATI Technologies Inc.) MD5=A5AC7B705166BF7CD07BB054BEEA8D03 -- C:\ATI\SUPPORT\8-6_vista32_dd_ccc_wdm_enu_64789\Packages\Drivers\SBDrv\SB6xx\RAID\LH64A\ahcix86s.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[1 C:\Windows\system32\drivers\*.tmp files -> C:\Windows\system32\drivers\*.tmp -> ]
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<           >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 24 bytes -> C:\Windows:668720410975202A

< End of report >
         

--- --- ---


[/code]

O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (Hotspot Shield Toolbar) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\prxtbHot0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)

Auman was kleisterst du dir dein System mit diesem schwachsinnigen Toolbars zu?
Deinstalliere über Systemsteuerung unter Software bzw. Programme und Funktionen alles wo Toolbar zu sehen ist. Bei zukünftigen Programminstallation immer die benutzerdefinierte Methode anklicken, damit man bei der Installation mögliche Toolbars abwählen kann.
Deinstalliere bei der Gelegenheit auch alle anderen unnötigen Programme über die Systemsteuerung.

hey man du hast ja vollkommen recht. diese toolbars nerven mich auch total. aber damals hatte ich leider keine ahnung was für haufen müll mitinstalliert wird.

jetzt habe ich eine frage. ich werde sowiso mein system neu installieren u alles so einstellen u installieren wie es sich in einem sicheren system gehört. diese toolbars sind ja auch nicht gerade wenige. u so wie ichs verstanden habe muß ich wohl das ganze programm deinstallieren u da ich sie brauche später wieder installieren, nur ohne toolbar.
die toolbars habe ich ja z.b. über firefox deaktiviert. muß ich die trotzdem deinstallieren weil sie sicherheitsrelevant sind oder nur weil sie resourcen kosten?
denn dann würde ich sie erst mal lieber so lassen u bei einer neuauflage meines systems alles benutzerdefiniert installieren.

muß ich die trotzdem deinstallieren weil sie sicherheitsrelevant sind oder nur weil sie resourcen kosten?

Toolbars sind idR sinnlose Platzverschwender.
Wenn du nicht gerade ein Messi bist bringst du den Müll doch auch ab und zu mal draußen oder verstopfst du dir damit die Wohnung? Nein? Also.

dass es um ordnung geht habe ich verstanden. u wie schon erwähnt, werde ich beim neuaufspielen des betriebssytems die programme auch neu installieren, nur ohne toolbars. deswegen finde ich, dass es doppelte arbeit wäre, wenn ich sie jetzt schon deinstalliere u neuinstalliere, wenn ichs sowieso beim neuaufspielen u partitionieren machen werde.

außer es bestünde die möglichkeit dass ich garnicht erst mein system neu aufspielen muß. aber wenn ich das betriebssystem auf eine separate partition installieren will, muß ich nicht alles neu installieren? vor allem ich meine ich habe irgendwo gelesen, dass wenn man mal trojaner oder malware mal hatte, man sowieso alles neu aufspielen sollte. stimmt das nicht so?

dass es doppelte arbeit wäre, wenn ich sie jetzt schon deinstalliere u neuinstalliere, wenn ichs sowieso beim neuaufspielen u partitionieren machen werde.

Richtig erkannt!
Aber was willst du jetzt eigentlich - Neuinstallation oder Bereinigung?

okay, auftrag erledigt. ich habe jetzt erst gecheckt, dass man auch allein die toolbar deinstallieren kann. aslo alles erledigt.

was soll ich jetzt machen?

was soll ich jetzt machen?

Ich warte immer noch auf eine Antwort meiner Frage