Trojaner: Der Computer ist für die Verletzung der Gesetze der BRD wurde blockiert

Tueddy

Hallo,

Ich hab mir einen Trojaner eingefangen. Es erscheint der Text " Der Computer ist für die Verletzung der Gesetze der BRD wurde blockiert" und ich soll 100€ zahlen.
Wer kann mir helfen?

Der Laptop (Windows 7) läuft noch im abgesicherten Modus.
Ein erster Versuch mit dem Avira Rescue System hatte leider keinen Erfolg.

OTL und Malwarebytes hab ich ausgeführt, die Ergebnisse hier und als Anlage


OTL:

OTL logfile created on: 8/7/2012 8:03:50 AM - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Meyer\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3.98 Gb Total Physical Memory | 2.98 Gb Available Physical Memory | 74.77% Memory free
7.96 Gb Paging File | 7.15 Gb Available in Paging File | 89.88% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 120.00 Gb Total Space | 48.28 Gb Free Space | 40.23% Space Free | Partition Type: NTFS
Drive D: | 150.39 Gb Total Space | 146.24 Gb Free Space | 97.24% Space Free | Partition Type: NTFS
Drive E: | 150.39 Gb Total Space | 145.73 Gb Free Space | 96.90% Space Free | Partition Type: NTFS
Drive F: | 151.94 Gb Total Space | 151.85 Gb Free Space | 99.94% Space Free | Partition Type: NTFS

Computer Name: MEYER-PC | User Name: Meyer | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/08/06 22:06:14 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Meyer\Desktop\OTL.exe


========== Modules (No Company Name) ==========


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2012/03/26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2012/03/26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2010/10/08 02:24:16 | 000,150,016 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV:64bit: - [2010/09/22 11:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010/08/09 21:04:12 | 000,166,704 | ---- | M] (Samsung Electronics CO., LTD.) [On_Demand | Stopped] -- C:\Windows\SysNative\SUPDSvc.exe -- (Samsung UPD Service)
SRV:64bit: - [2009/07/14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012/08/02 20:09:07 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/05/08 11:59:16 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/05/08 11:59:12 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/04/30 14:19:28 | 000,192,080 | ---- | M] (Bartels Media GmbH) [Auto | Stopped] -- C:\Program Files (x86)\ShareMouse\smService.exe -- (ShareMouse Service)
SRV - [2012/02/29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/01/26 16:08:56 | 003,665,752 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe -- (Radio.fx)
SRV - [2012/01/03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/06/08 13:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010/12/21 04:30:38 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010/12/21 04:30:36 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010/10/22 13:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto | Stopped] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007/05/31 17:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 17:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/07/03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012/05/08 11:59:16 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012/05/08 11:59:16 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012/03/20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012/03/01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/10/11 17:15:52 | 000,088,480 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2011/10/11 17:15:52 | 000,046,400 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2011/10/11 15:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011/08/05 11:03:48 | 002,768,384 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2011/05/18 10:14:22 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)
DRV:64bit: - [2011/05/18 10:14:20 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev)
DRV:64bit: - [2011/05/18 10:14:16 | 000,027,136 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc)
DRV:64bit: - [2011/05/18 10:14:12 | 000,019,968 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd)
DRV:64bit: - [2011/03/11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/03/04 09:59:18 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2011/02/04 05:59:06 | 001,413,680 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011/01/27 07:35:26 | 000,425,064 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010/11/20 05:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 03:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 02:43:58 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
DRV:64bit: - [2010/11/10 01:04:14 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd)
DRV:64bit: - [2010/10/20 02:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010/10/08 02:23:38 | 000,019,192 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2010/10/07 04:59:00 | 000,013,824 | ---- | M] (SAMSUNG ELECTRONICS) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\SABI.sys -- (SABI)
DRV:64bit: - [2010/09/13 11:24:26 | 000,437,272 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009/07/14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009/06/10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008/08/28 12:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV - [2011/07/21 14:35:39 | 000,015,144 | ---- | M] (Windows (R) 2003 DDK 3790 provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\rtport.sys -- (rtport)
DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://samsung.msn.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://samsung.msn.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/09/06 17:15:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/08/02 20:09:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012/07/31 18:25:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/09/06 17:15:49 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/08/02 20:09:08 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2011/09/05 20:27:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Meyer\AppData\Roaming\mozilla\Extensions
[2012/07/30 15:38:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions
[2012/07/01 18:24:37 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2011/09/05 21:51:57 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011/09/05 21:52:01 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/07/26 10:37:18 | 000,000,000 | ---D | M] (DDBAC Plug-In) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{271A3CF5-5A54-447B-A08F-BE805F0DA60A}
[2011/09/05 21:52:03 | 000,000,000 | ---D | M] (Abaca classic) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{3713a489-0634-4472-8456-dc7abd7eba00}
[2012/03/23 13:53:43 | 000,000,000 | ---D | M] (FoxyTunes) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}
[2011/09/05 21:52:05 | 000,000,000 | ---D | M] (Denimfox) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{6032AA22-F6B2-11DC-8F07-A83F56D89593}
[2011/09/05 21:52:05 | 000,000,000 | ---D | M] (Media Converter) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{6e764c17-863a-450f-bdd0-6772bd5aaa18}
[2011/09/05 21:52:05 | 000,000,000 | ---D | M] (Fire.fm) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}
[2011/09/05 21:52:05 | 000,000,000 | ---D | M] (Context Search) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{902D2C4A-457A-4EF9-AD43-7014562929FF}
[2011/09/05 21:52:05 | 000,000,000 | ---D | M] (CookieCuller) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{99B98C2C-7274-45a3-A640-D9DF1A1C8460}
[2011/09/05 21:52:05 | 000,000,000 | ---D | M] (jDownFF) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{a3b24d40-bac4-11dc-95ff-0800200c9a66}
[2011/09/05 21:52:05 | 000,000,000 | ---D | M] (kikin plugin) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}
[2012/01/10 19:15:51 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012/03/29 18:39:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/07/07 21:18:50 | 000,000,000 | ---D | M] (FoxClocks) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
[2011/09/05 21:52:16 | 000,000,000 | ---D | M] (MidnightFoxy) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{dc961bb0-dfb2-11dc-95ff-0800200c9a66}
[2011/09/05 21:51:51 | 000,000,000 | ---D | M] (Chromifox Basic) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\chromifox@altmusictv.com
[2011/09/05 21:51:51 | 000,000,000 | ---D | M] ("DeskCam") -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\deskcam@paolo.minasi
[2011/09/05 21:51:52 | 000,000,000 | ---D | M] ("Metaswitcher") -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\metaswitcher@com.extensions.mattiasschlenker.de
[2012/02/11 09:16:46 | 000,000,000 | ---D | M] (Cooliris) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\piclens@cooliris.com
[2011/09/05 21:51:56 | 000,000,000 | ---D | M] ("Distrust") -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\trustme@gness.com
[2011/09/05 21:51:57 | 000,000,000 | ---D | M] (YouPlayer) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\youplayer@addons.mozilla.org
[2011/09/05 21:51:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\metaswitcher@com.extensions.mattiasschlenker.de\chrome
[2011/09/05 21:12:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\metaswitcher@com.extensions.mattiasschlenker.de\defaults
[2011/09/05 21:52:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{3713a489-0634-4472-8456-dc7abd7eba00}\chrome\mozapps\extensions
[2011/09/05 21:52:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{dc961bb0-dfb2-11dc-95ff-0800200c9a66}\chrome\mozapps\extensions
[2011/09/05 21:52:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Meyer\AppData\Roaming\mozilla\Firefox\Profiles\7qkubnrz.default\extensions\{dc961bb0-dfb2-11dc-95ff-0800200c9a66}\chrome\mozapps\extensions\CVS
[2012/03/10 11:25:42 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012/08/02 20:09:07 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/06/23 09:12:28 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/06/23 09:12:28 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/06/23 09:12:28 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012/06/23 09:12:28 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/06/23 09:12:28 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/06/23 09:12:28 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Samsung BHO Class) - {AA609D72-8482-4076-8991-8CDAE5B93BCB} - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll ()
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [RfxSrvTray] C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe (Tobit.Software)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Meyer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Meyer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\Meyer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Meyer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Samsung AnyWeb Print - {328ECD19-C167-40eb-A0C7-16FE7634105E} - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll ()
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4459007C-80C1-4248-B84F-DBBF4C6A789E}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E420E3BF-C2A1-4233-BA32-746E24431A49}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/08/07 07:17:46 | 000,000,000 | ---D | C] -- C:\Users\Meyer\Desktop\Neuer Ordner (2)
[2012/08/06 22:06:11 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Meyer\Desktop\OTL.exe
[2012/08/06 21:52:29 | 000,000,000 | ---D | C] -- C:\Users\Meyer\AppData\Roaming\Malwarebytes
[2012/08/06 21:52:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/08/06 21:52:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/08/06 21:52:00 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/08/06 21:52:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/08/06 21:51:12 | 010,652,120 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Meyer\Desktop\mbam-setup-1.62.0.1300.exe
[2012/08/06 21:42:38 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012/08/06 10:12:21 | 000,000,000 | ---D | C] -- C:\Users\Meyer\AppData\Roaming\hellomoto
[2012/08/03 19:42:11 | 000,466,456 | ---- | C] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll
[2012/08/03 19:42:11 | 000,444,952 | ---- | C] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll
[2012/08/02 14:44:05 | 000,000,000 | ---D | C] -- C:\Windows\WindowsMobile
[2012/08/02 11:52:21 | 000,000,000 | ---D | C] -- C:\Games
[2012/07/31 15:02:24 | 000,000,000 | -H-D | C] -- C:\Windows\AxInstSV
[2012/07/22 13:32:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012/07/22 13:32:33 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2012/07/22 13:32:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

========== Files - Modified Within 30 Days ==========

[2012/08/06 22:06:14 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Meyer\Desktop\OTL.exe
[2012/08/06 22:05:49 | 000,000,000 | ---- | M] () -- C:\Users\Meyer\defogger_reenable
[2012/08/06 22:04:10 | 000,050,477 | ---- | M] () -- C:\Users\Meyer\Desktop\Defogger.exe
[2012/08/06 21:52:39 | 001,505,334 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/08/06 21:52:39 | 000,656,250 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012/08/06 21:52:39 | 000,618,132 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/08/06 21:52:39 | 000,131,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012/08/06 21:52:39 | 000,107,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/08/06 21:52:01 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/08/06 21:51:33 | 010,652,120 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Meyer\Desktop\mbam-setup-1.62.0.1300.exe
[2012/08/06 21:46:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/08/06 21:46:14 | 410,232,269 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/08/06 21:46:08 | 4273,520,640 | -HS- | M] () -- C:\hiberfil.sys
[2012/08/06 20:43:29 | 000,351,640 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/08/06 10:32:04 | 000,013,936 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/06 10:32:04 | 000,013,936 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/03 19:42:11 | 000,466,456 | ---- | M] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll
[2012/08/03 19:42:11 | 000,444,952 | ---- | M] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll
[2012/08/02 14:46:04 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdRapi2_01_00_00.Wdf

========== Files Created - No Company Name ==========

[2012/08/06 22:05:49 | 000,000,000 | ---- | C] () -- C:\Users\Meyer\defogger_reenable
[2012/08/06 22:04:09 | 000,050,477 | ---- | C] () -- C:\Users\Meyer\Desktop\Defogger.exe
[2012/08/06 21:52:01 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/08/06 21:42:27 | 410,232,269 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012/08/02 14:46:04 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdRapi2_01_00_00.Wdf
[2012/08/02 14:44:13 | 000,002,419 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Mobile Device Center.lnk
[2011/11/26 14:00:42 | 000,000,607 | ---- | C] () -- C:\Windows\wiso.ini
[2011/11/13 22:41:36 | 130,456,997 | ---- | C] () -- C:\Users\Meyer\Johanna.cpr
[2011/11/08 21:10:03 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\nnr.dll
[2011/11/01 19:49:40 | 000,001,843 | ---- | C] () -- C:\Windows\hpwmdl23.dat.temp
[2011/10/25 16:02:52 | 002,681,344 | ---- | C] () -- C:\Windows\SysWow64\dvmsg.dll
[2011/09/11 12:34:26 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\VlUtils.dll
[2011/09/11 12:34:24 | 000,136,520 | ---- | C] () -- C:\Windows\SysWow64\OUTLCTL.DLL
[2011/09/11 12:34:23 | 003,702,784 | ---- | C] () -- C:\Windows\SysWow64\gsdll32.dll
[2011/09/06 17:06:38 | 000,266,120 | ---- | C] () -- C:\Windows\hpwins23.dat
[2011/09/05 14:58:04 | 001,526,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/03/18 07:52:51 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2011/03/18 07:36:45 | 000,258,864 | ---- | C] () -- C:\Windows\SUPDRun.exe
[2011/03/18 02:56:15 | 000,307,200 | ---- | C] () -- C:\Windows\SetDisplayResolution.exe
[2011/03/18 01:22:43 | 000,001,898 | ---- | C] () -- C:\Windows\HotFixList.ini
[2011/03/18 01:10:01 | 000,142,128 | ---- | C] () -- C:\Windows\wiainst64.exe

========== LOP Check ==========

[2012/01/24 15:53:14 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\Amazon
[2012/01/14 17:34:07 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\Buhl Data Service
[2011/10/05 19:10:29 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\DataDesign
[2012/01/28 18:25:02 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\DVDVideoSoft
[2012/01/10 19:15:50 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\DVDVideoSoftIEHelpers
[2012/05/26 19:07:35 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\EurekaLog
[2012/01/10 20:31:43 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\HandBrake
[2012/08/06 10:12:29 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\hellomoto
[2011/12/23 20:23:08 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\kompozer.net
[2011/10/02 09:55:43 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\Nokia
[2011/10/02 09:55:45 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\Nokia Ovi Suite
[2011/10/02 09:55:33 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\PC Suite
[2011/10/25 16:14:53 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\phonostar GmbH
[2012/07/05 09:48:18 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\ShareMouse
[2011/11/25 22:15:27 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\Stellarium
[2011/09/05 21:07:13 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\Thunderbird
[2011/10/25 16:03:19 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\Tobit
[2012/04/14 17:28:30 | 000,000,000 | ---D | M] -- C:\Users\Meyer\AppData\Roaming\www.rene-zeidler.de
[2012/05/12 15:12:23 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >