OTL Results bei GEMA Virus

Revanity

Hallo liebe Community,

auch ich habe mir diesen GEMA Virus eingefangen, und habe mir die verschiedenen Loesungsvorschlaege angesehen und habe sie ausprobiert. Funktioniert hat es soweit dass ich mir das OTLPE auf CD gebrannt habe und jetzt habe ich die Ergebnisse vom OTL.txt vorliegen.
Ich hoffe ihr koennt damit was anfangen und mir helfen, dass ich jedenfalls meine Dateien sichern koennte ...

Mir fehlt jedoch die extras.txt, die kann ich nicht finden?

Vielen Dank im Voraus!






OTL logfile created on: 4/5/2012 12:36:38 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 84.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = E:\Program Files
Drive C: | 127.99 Gb Total Space | 5.39 Gb Free Space | 4.21% Space Free | Partition Type: NTFS
Drive D: | 337.77 Gb Total Space | 224.21 Gb Free Space | 66.38% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand] -- -- (WinDefend)
SRV - File not found [Auto] -- -- (MSCamSvc)
SRV - [2012/03/21 06:51:31 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012/03/12 13:58:05 | 000,918,880 | ---- | M] () [Auto] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\10.2.0\ToolbarUpdater.exe -- (vToolbarUpdater10.2.0)
SRV - [2011/11/10 09:17:31 | 000,167,264 | ---- | M] () [On_Demand] -- C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe -- (AVG Security Toolbar Service)
SRV - [2011/08/03 07:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011/08/02 21:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2011/07/20 00:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010/09/22 11:33:04 | 000,051,040 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010/09/21 09:03:14 | 001,710,464 | ---- | M] (Microsoft Corp.) [Auto] -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010/07/21 05:18:14 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2010/07/17 06:04:35 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2010/02/11 07:42:32 | 000,172,328 | ---- | M] (TeamViewer GmbH) [Auto] -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2009/12/16 13:26:00 | 003,453,712 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand] -- C:\Windows\System32\GameMon.des -- (npggsvc)
SRV - [2009/09/25 21:31:58 | 000,149,336 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009/08/10 09:59:50 | 000,178,720 | ---- | M] () [Auto] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)
SRV - [2009/08/10 09:59:48 | 000,387,616 | ---- | M] () [Auto] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM)
SRV - [2009/07/28 10:07:42 | 000,073,528 | ---- | M] (AVM Berlin) [Auto] -- C:\Program Files\FRITZ!DSL\IGDCTRL.EXE -- (IGDCTRL)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2007/07/24 05:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (ManyCam)
DRV - File not found [Kernel | On_Demand] -- -- (kbeepm)
DRV - [2011/09/13 10:07:17 | 000,029,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System] -- C:\Windows\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2011/08/03 07:50:00 | 010,304,104 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2011/05/06 04:08:50 | 000,243,152 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- C:\Windows\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010/12/13 08:37:46 | 000,030,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nx6000.sys -- (MSHUSBVideo)
DRV - [2010/11/20 06:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/07/17 06:03:57 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- C:\Windows\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010/04/08 19:32:36 | 000,215,656 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2010/03/29 15:15:53 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2009/11/11 09:47:16 | 000,295,272 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2009/11/09 13:12:42 | 000,025,088 | ---- | M] (TeamViewer GmbH) [Kernel | On_Demand] -- C:\Windows\System32\drivers\teamviewervpn.sys -- (teamviewervpn)
DRV - [2009/11/02 10:29:48 | 000,281,760 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2009/11/02 10:29:48 | 000,025,888 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009/07/13 18:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2009/03/18 11:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2008/10/21 04:22:48 | 000,114,600 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s0017mdm.sys -- (s0017mdm)
DRV - [2008/10/21 04:22:48 | 000,109,736 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s0017unic.sys -- (s0017unic) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM)
DRV - [2008/10/21 04:22:48 | 000,108,328 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s0017mgmt.sys -- (s0017mgmt) Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM)
DRV - [2008/10/21 04:22:48 | 000,104,616 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s0017obex.sys -- (s0017obex)
DRV - [2008/10/21 04:22:48 | 000,086,824 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s0017bus.sys -- (s0017bus) Sony Ericsson Device 0017 driver (WDM)
DRV - [2008/10/21 04:22:48 | 000,026,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s0017nd5.sys -- (s0017nd5) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS)
DRV - [2008/10/21 04:22:48 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s0017mdfl.sys -- (s0017mdfl)
DRV - [2008/06/01 03:13:10 | 000,034,064 | ---- | M] (CACE Technologies) [Kernel | Auto] -- C:\Windows\System32\drivers\npf.sys -- (npf)
DRV - [2007/01/23 10:44:00 | 000,020,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2005/11/03 10:40:07 | 000,063,488 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\Windows\System32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV - [2005/08/10 08:44:04 | 000,050,688 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\Windows\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005/05/16 09:20:39 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\Windows\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2004/12/03 06:20:41 | 000,020,544 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\Windows\System32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x)
DRV - [2004/05/17 05:21:54 | 000,017,280 | ---- | M] (Intellon, Inc.) [Kernel | Auto] -- C:\Windows\system32\plcndis5.sys -- (PLCNDIS5)
DRV - [2003/04/18 19:32:04 | 000,004,736 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\tandpl.sys -- (tandpl)
DRV - [2003/03/02 12:44:26 | 000,007,552 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\enodpl.sys -- (enodpl)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}


IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2096149
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3B 67 DC 8B B5 81 CA 01 [binary data]
IE - HKU\Administrator_ON_C\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\Administrator_ON_C\..\URLSearchHook: {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - Reg Error: Key error. File not found
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\Mcx1-PIK-ROYAL-PC_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\Pik-Royal_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
IE - HKU\Pik-Royal_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Pik-Royal_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Pik-Royal_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 9C E6 56 10 00 EF CA 01 [binary data]
IE - HKU\Pik-Royal_ON_C\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\Pik-Royal_ON_C\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found
IE - HKU\Pik-Royal_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Pik-Royal_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local



========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..keyword.URL: "hxxp://isearch.avg.com/search?cid=%7B196608a0-1da8-4fac-85f7-0ba9c4da54d7%7D&mid=191fd291985f758639ab4cd64bc10603-d666df2a23e0ffd552c16dbf9714f8d23766b908&ds=AVG&v=10.2.0.3&lang=de&pr=fr&d=2011-12-07%2010%3A26%3A55&sap=ku&q="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\Pik-Royal\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\support@predictad.com: C:\Program Files\AutocompletePro\support@predictad.com
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\10.2.0.3\ [2012/03/12 13:58:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 2\components [2012/03/30 16:43:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 2\plugins [2012/03/30 16:43:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: E:\Program Files\Mozilla Thunderbird\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: E:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 10.0.1\extensions\\Components: E:\Program Files\Mozilla Thunderbird\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 10.0.1\extensions\\Plugins: E:\Program Files\Mozilla Thunderbird\plugins

[2009/10/23 08:14:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Extensions
[2012/03/23 12:10:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\extensions
[2011/04/18 15:48:04 | 000,002,059 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\daemon-search.xml
[2012/03/29 12:08:46 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin-2.xml
[2010/04/20 04:10:15 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin-3.xml
[2010/06/28 18:02:58 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin-4.xml
[2010/07/01 05:06:53 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin-5.xml
[2010/07/15 06:39:41 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin-6.xml
[2010/07/25 05:33:14 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin-7.xml
[2010/08/04 13:41:41 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin-8.xml
[2009/12/10 05:50:44 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin.xml
File not found (No name found) --
[2012/03/12 13:58:23 | 000,000,000 | ---D | M] (AVG Security Toolbar) -- C:\PROGRAMDATA\AVG SECURE SEARCH\10.2.0.3
() (No name found) -- C:\USERS\PIK-ROYAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GEDGZXY9.DEFAULT\EXTENSIONS\PERSONAS@CHRISTOPHER.BEARD.XPI
() (No name found) -- C:\USERS\PIK-ROYAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GEDGZXY9.DEFAULT\EXTENSIONS\TESTPILOT@LABS.MOZILLA.COM.XPI

O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - File not found
O2 - BHO: (no name) - {d2350351-c7d6-e908-7405-4e22016c1513} - No CLSID value found.
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - File not found
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (no name) - {69B6939F-C70D-45C5-9BBD-E2E2CC3DD8E5} - No CLSID value found.
O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\Pik-Royal_ON_C\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\Pik-Royal_ON_C\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [gema] C:\Windows\System32\gema.exe (Veoj)
O4 - HKLM..\Run: [gema.] C:\ProgramData\gema\gema.exe (Veoj)
O4 - HKLM..\Run: [LifeCam] File not found
O4 - HKLM..\Run: [ROC_roc_dec12] File not found
O4 - HKLM..\Run: [vProt] File not found
O4 - HKU\.DEFAULT..\Run: [FRITZ!protect] File not found
O4 - HKU\Administrator_ON_C..\Run: [EA Core] File not found
O4 - HKU\Administrator_ON_C..\Run: [gema] C:\Users\Administrator\AppData\Roaming\gema\gema.exe (Veoj)
O4 - HKU\Administrator_ON_C..\Run: [msnmsgr] File not found
O4 - HKU\Administrator_ON_C..\Run: [RGSC] File not found
O4 - HKU\LocalService_ON_C..\Run: [Sidebar] File not found
O4 - HKU\NetworkService_ON_C..\Run: [Sidebar] File not found
O4 - HKU\Pik-Royal_ON_C..\Run: [gema] C:\Users\Pik-Royal\AppData\Roaming\gema\gema.exe (Veoj)
O4 - HKU\Pik-Royal_ON_C..\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKU\UpdatusUser_ON_C..\Run: [Sidebar] File not found
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\Mcx1-PIK-ROYAL-PC_ON_C..\RunOnce: [avg_spchecker] C:\Program Files\AVG\AVG9\Notification\SPChecker1.exe ()
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\UpdatusUser_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 1
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - File not found
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\10.2.0\ViProtocol.dll ()
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\ProgramData\gema\gema.exe) - C:\ProgramData\gema\gema.exe (Veoj)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\gema.exe) - C:\Windows\System32\gema.exe (Veoj)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\Administrator_ON_C Winlogon: Shell - (C:\Users\Administrator\AppData\Roaming\gema\gema.exe) - C:\Users\Administrator\AppData\Roaming\gema\gema.exe (Veoj)
O20 - HKU\Administrator_ON_C Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\Pik-Royal_ON_C Winlogon: Shell - (C:\Users\Pik-Royal\AppData\Roaming\gema\gema.exe) - C:\Users\Pik-Royal\AppData\Roaming\gema\gema.exe (Veoj)
O20 - HKU\Pik-Royal_ON_C Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{13745413-c882-11de-91fe-00044b16a369}\Shell - "" = AutoRun
O33 - MountPoints2\{4f502308-df9f-11e0-aaf1-00044b16a369}\Shell - "" = AutoRun
O33 - MountPoints2\{4f502308-df9f-11e0-aaf1-00044b16a369}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{add1f55e-c98d-11e0-b00f-00044b16a369}\Shell - "" = AutoRun
O33 - MountPoints2\{add1f55e-c98d-11e0-b00f-00044b16a369}\Shell\AutoRun\command - "" = F:\aubi.exe
O33 - MountPoints2\{de006ac7-bf5b-11de-a0f3-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{de006ac7-bf5b-11de-a0f3-806e6f6e6963}\Shell\AutoRun\command - "" = D:\reatogoMenu.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/03/31 15:53:16 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\gema
[2012/03/31 15:49:43 | 000,237,568 | ---- | C] (Veoj) -- C:\Windows\System32\gema.exe
[2012/03/31 12:37:14 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Roaming\gema
[2012/03/31 12:37:14 | 000,000,000 | ---D | C] -- C:\ProgramData\gema
[2012/03/30 16:49:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/03/28 17:46:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Windows
[2012/03/14 19:51:24 | 000,000,000 | ---D | C] -- C:\c536818869ea40f56aef0e9e2f7f
[2012/03/14 19:50:01 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2012/03/14 19:50:01 | 003,913,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2012/03/14 19:44:59 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{2F4F6F6C-168E-4847-8B85-57B47A2FA6D8}
[2012/03/14 19:44:37 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{05E7B1A6-B6CD-4F8D-91C1-310D61E6294B}
[2012/03/14 15:51:53 | 002,343,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012/03/14 15:51:52 | 001,077,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012/03/14 11:50:20 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{C12441CE-6460-4621-9C49-CFE785399BB0}
[2012/03/14 11:49:39 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{B42B40CF-ABAA-4E15-9810-183D7B9443CD}
[2012/03/14 11:48:58 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{BF3EE700-B7B8-477B-A532-6FDEB2DA9C46}
[2012/03/14 11:41:25 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2012/03/14 11:41:25 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2012/03/14 11:41:25 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2012/03/14 11:40:49 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll
[2012/03/11 15:32:23 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2012/03/11 14:50:00 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{7B533C81-28B9-4CCE-9B13-E04EACB61163}
[2012/03/11 14:49:29 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{B1D7529A-670F-4D3A-A949-91587B8FCC45}
[2012/03/10 07:23:07 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\Desktop\Deutsch
[2012/03/09 15:24:03 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Logs
[2012/03/09 15:21:32 | 000,000,000 | -H-D | C] -- C:\Program Files\Common Files\EAInstaller
[2012/03/09 15:21:31 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_7.dll
[2012/03/09 15:21:31 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_7.dll
[2012/03/09 15:21:31 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_5.dll
[2012/03/09 15:21:30 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_43.dll
[2012/03/09 15:21:30 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_43.dll
[2012/03/09 15:21:30 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_43.dll
[2012/03/09 15:21:30 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_43.dll
[2012/03/09 15:21:29 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_43.dll
[2012/03/09 14:26:31 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\Origin
[2012/03/09 14:24:51 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Roaming\Origin
[2012/03/09 13:57:06 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{1979B9D0-E361-4E8F-804A-4DC68D616F05}
[2012/03/09 13:56:39 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{E55A1E54-470E-47B8-B861-307765FC41EC}
[2012/03/08 11:40:32 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{063C97A0-60EA-491F-AA3B-D42F6B0199A2}
[2012/03/08 11:40:07 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{76A797B8-54FE-4ECB-9060-FC11331AF2E6}
[2012/03/07 16:24:29 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{E684F488-70BE-46BB-9F35-E4F10F944EDB}
[6 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/05 05:04:30 | 000,013,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/05 05:04:30 | 000,013,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/05 05:04:00 | 002,770,278 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012/04/05 05:04:00 | 000,796,418 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012/04/05 05:04:00 | 000,299,742 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/04/05 05:04:00 | 000,037,606 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/04/05 04:56:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/04/05 04:56:40 | 1609,461,760 | -HS- | M] () -- C:\hiberfil.sys
[2012/04/01 16:33:08 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2012/03/31 12:41:14 | 000,001,053 | ---- | M] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/03/31 12:37:13 | 000,237,568 | ---- | M] (Veoj) -- C:\Windows\System32\gema.exe
[2012/03/31 11:31:45 | 000,413,216 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/03/31 09:28:12 | 000,210,166 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\3-Semester_Reflexion_über_Sprache_und_Sprachgebrauch.pdf
[2012/03/31 09:28:12 | 000,210,166 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\3-Semester_Reflexion_über_Sprache_und_Sprachgebrauch - Kopie.pdf
[2012/03/31 09:28:03 | 000,140,422 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\Die_Geschichte_der_DDR_-_1._Semster.pdf
[2012/03/31 09:28:03 | 000,140,422 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\Die_Geschichte_der_DDR_-_1._Semster - Kopie.pdf
[2012/03/31 09:27:55 | 000,181,444 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\3.-Semester_Literatur_und_Sprache_von_1945_bis_zur_Gegenwartdocx.pdf
[2012/03/31 09:27:55 | 000,181,444 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\3.-Semester_Literatur_und_Sprache_von_1945_bis_zur_Gegenwartdocx - Kopie.pdf
[2012/03/31 09:27:43 | 000,419,467 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\2-Semester_Literatur_und_Sprache_um_1900.pdf
[2012/03/31 09:27:43 | 000,419,467 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\2-Semester_Literatur_und_Sprache_um_1900 - Kopie.pdf
[2012/03/31 09:27:41 | 000,465,370 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Literatur_und_Sprache_um_1800.pdf
[2012/03/31 09:27:41 | 000,465,370 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Literatur_und_Sprache_um_1800 - Kopie.pdf
[2012/03/31 09:27:03 | 000,323,277 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Drama_und_Kommunikation.pdf
[2012/03/31 09:27:03 | 000,323,277 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Drama_und_Kommunikation - Kopie.pdf
[2012/03/31 05:44:19 | 076,426,081 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm
[2012/03/30 16:49:09 | 000,001,672 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/03/30 16:49:09 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/03/22 13:59:22 | 000,673,894 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\Einschulung II 001.jpg
[2012/03/11 15:26:16 | 000,001,099 | ---- | M] () -- C:\Users\Public\Desktop\Mass Effect 3.lnk
[2012/03/11 15:26:03 | 000,000,000 | R--D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
[2012/03/09 14:24:50 | 000,000,821 | ---- | M] () -- C:\Users\Public\Desktop\Origin.lnk
[6 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/03/31 11:31:31 | 000,413,216 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/03/31 09:33:00 | 000,465,370 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Literatur_und_Sprache_um_1800 - Kopie.pdf
[2012/03/31 09:33:00 | 000,419,467 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\2-Semester_Literatur_und_Sprache_um_1900 - Kopie.pdf
[2012/03/31 09:33:00 | 000,323,277 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Drama_und_Kommunikation - Kopie.pdf
[2012/03/31 09:33:00 | 000,210,166 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\3-Semester_Reflexion_über_Sprache_und_Sprachgebrauch - Kopie.pdf
[2012/03/31 09:33:00 | 000,181,444 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\3.-Semester_Literatur_und_Sprache_von_1945_bis_zur_Gegenwartdocx - Kopie.pdf
[2012/03/31 09:33:00 | 000,140,422 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\Die_Geschichte_der_DDR_-_1._Semster - Kopie.pdf
[2012/03/31 09:28:09 | 000,210,166 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\3-Semester_Reflexion_über_Sprache_und_Sprachgebrauch.pdf
[2012/03/31 09:27:59 | 000,140,422 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\Die_Geschichte_der_DDR_-_1._Semster.pdf
[2012/03/31 09:27:53 | 000,181,444 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\3.-Semester_Literatur_und_Sprache_von_1945_bis_zur_Gegenwartdocx.pdf
[2012/03/31 09:27:39 | 000,419,467 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\2-Semester_Literatur_und_Sprache_um_1900.pdf
[2012/03/31 09:27:36 | 000,465,370 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Literatur_und_Sprache_um_1800.pdf
[2012/03/31 09:26:58 | 000,323,277 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Drama_und_Kommunikation.pdf
[2012/03/30 16:49:09 | 000,001,672 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/03/23 08:45:26 | 002,276,746 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\CIMG9023.JPG
[2012/03/23 08:42:48 | 001,438,900 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\DSC_1888.JPG
[2012/03/22 14:08:08 | 000,673,894 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\Einschulung II 001.jpg
[2012/03/11 15:26:16 | 000,001,099 | ---- | C] () -- C:\Users\Public\Desktop\Mass Effect 3.lnk
[2012/03/09 14:24:50 | 000,000,821 | ---- | C] () -- C:\Users\Public\Desktop\Origin.lnk
[2011/08/02 21:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe
[2011/06/21 05:52:56 | 000,252,928 | ---- | C] () -- C:\Windows\System32\DShowRdpFilter.dll
[2011/06/01 11:27:54 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
[2011/04/09 12:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2011/02/18 11:09:27 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2011/02/13 14:02:21 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011/01/10 04:05:59 | 001,474,832 | ---- | C] () -- C:\Windows\System32\drivers\sfi.dat
[2010/07/28 15:25:58 | 000,036,864 | ---- | C] () -- C:\Windows\System32\LckFldService.exe
[2010/05/07 09:17:17 | 000,053,248 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2010/04/27 12:28:10 | 000,000,008 | RHS- | C] () -- C:\ProgramData\72735B0F81.sys
[2010/04/27 12:28:09 | 000,002,516 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2010/03/31 12:22:22 | 002,434,856 | ---- | C] () -- C:\Windows\System32\pbsvc_bc2.exe
[2010/03/21 12:36:16 | 000,007,552 | ---- | C] () -- C:\Windows\System32\drivers\enodpl.sys
[2010/03/21 12:36:16 | 000,004,736 | ---- | C] () -- C:\Windows\System32\drivers\tandpl.sys
[2010/02/01 10:47:04 | 000,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll
[2010/02/01 10:47:04 | 000,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll
[2010/01/29 16:21:22 | 000,003,584 | ---- | C] () -- C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/05 15:48:02 | 000,006,656 | ---- | C] () -- C:\Users\Pik-Royal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/14 08:22:35 | 000,001,210 | ---- | C] () -- C:\Windows\eReg.dat
[2009/12/12 13:12:09 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2009/12/07 12:23:48 | 000,009,548 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2009/11/09 03:07:26 | 000,000,097 | ---- | C] () -- C:\Users\Pik-Royal\AppData\Local\fusioncache.dat
[2009/10/24 09:35:38 | 000,000,017 | ---- | C] () -- C:\Users\Pik-Royal\AppData\Local\resmon.resmoncfg
[2009/10/24 08:59:14 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2009/10/24 08:59:13 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2009/10/23 15:33:03 | 000,022,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009/10/23 15:33:03 | 000,022,328 | ---- | C] () -- C:\Users\Pik-Royal\AppData\Roaming\PnkBstrK.sys
[2009/10/23 15:32:40 | 000,107,832 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2009/10/23 15:32:37 | 002,337,865 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2009/10/23 15:32:37 | 000,066,872 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2009/10/23 08:46:43 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009/07/14 04:47:43 | 002,770,278 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009/07/14 04:47:43 | 000,796,418 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009/07/14 04:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009/07/14 04:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 22:05:48 | 000,299,742 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,037,606 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2008/06/01 03:13:10 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2004/01/26 11:15:29 | 000,233,472 | R--- | C] () -- C:\Windows\System32\MafiaSetup.exe

========== LOP Check ==========

[2012/03/31 15:53:16 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\gema
[2010/01/29 15:45:40 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\ICQ
[2011/06/05 12:30:26 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\.minecraft
[2011/07/25 16:59:45 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\Advanced Chemistry Development
[2011/08/13 11:21:21 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\Audacity
[2010/03/06 10:21:38 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\Facebook
[2010/09/28 14:00:12 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\FreeAudioPack
[2011/07/23 13:03:19 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\FRITZ!
[2012/03/31 12:37:14 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\gema
[2010/01/23 10:40:58 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\gnupg
[2011/06/26 18:15:26 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\gtk-2.0
[2011/12/05 13:58:41 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\ICQ
[2011/06/13 09:54:49 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\Opera
[2012/03/09 14:26:33 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\Origin
[2011/04/18 10:06:22 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\PunkBuster
[2010/03/14 13:21:00 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\TeamViewer
[2011/12/13 14:40:01 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\Thunderbird
[2011/08/24 09:25:00 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\TS3Client
[2009/12/06 08:14:44 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\Windows Live Writer
[2010/06/29 17:33:29 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\XRay Engine
[2010/10/29 09:58:13 | 000,000,000 | ---D | M] -- C:\ProgramData\Advanced Chemistry Development
[2009/10/22 18:50:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2012/03/12 13:58:23 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG Secure Search
[2010/10/26 03:22:24 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG Security Toolbar
[2009/12/22 07:24:46 | 000,000,000 | ---D | M] -- C:\ProgramData\avg9
[2010/04/27 12:32:32 | 000,000,000 | ---D | M] -- C:\ProgramData\Bitstream
[2010/03/10 02:58:38 | 000,000,000 | ---D | M] -- C:\ProgramData\BVRP Software
[2011/07/25 07:15:58 | 000,000,000 | ---D | M] -- C:\ProgramData\Caphyon
[2011/03/15 05:18:08 | 000,000,000 | -H-D | M] -- C:\ProgramData\Common Files
[2011/04/18 15:49:51 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Lite
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2009/10/22 18:50:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2012/03/11 15:32:23 | 000,000,000 | ---D | M] -- C:\ProgramData\EA Core
[2012/03/13 08:49:23 | 000,000,000 | ---D | M] -- C:\ProgramData\EA Logs
[2012/03/11 15:32:36 | 000,000,000 | ---D | M] -- C:\ProgramData\Electronic Arts
[2009/10/22 18:50:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2012/03/31 12:37:14 | 000,000,000 | ---D | M] -- C:\ProgramData\gema
[2010/01/05 11:15:32 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ
[2011/07/25 06:30:36 | 000,000,000 | ---D | M] -- C:\ProgramData\IObit
[2010/12/25 08:01:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MFAData
[2012/03/09 15:24:13 | 000,000,000 | ---D | M] -- C:\ProgramData\Origin
[2010/05/18 05:52:29 | 000,000,000 | ---D | M] -- C:\ProgramData\PIXELA
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2009/10/22 18:50:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2010/04/05 09:58:45 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011/08/06 13:08:51 | 000,000,000 | ---D | M] -- C:\ProgramData\Ubisoft
[2009/10/22 18:50:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2012/03/30 08:39:18 | 000,000,000 | ---D | M] -- C:\ProgramData\Windows
[2010/10/23 12:40:03 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/03/02 14:03:55 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010/02/28 10:52:19 | 000,000,472 | ---- | M] () -- C:\Windows\Tasks\Wise Registry Cleaner 4.job
[2009/12/21 18:22:07 | 000,000,248 | -H-- | M] () -- C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2009/12/21 18:23:29 | 000,000,296 | -H-- | M] () -- C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:05EE1EEF
< End of report >