Windows Virus Auswertung

antikerjojo

Hallo
ich habe jetzt alle schritte von der otlpe anleitung befolgt
dort stand ich sollte nun eine datei hier reinstellen
habe ienen Trojana der mich nicht in den abgesicherten mdus rein laest
deswegen das ganze
ich hoffe auf schnelle hilfe und moechte mich schon im vorraus bedanke



[code]
OTL logfile created on: 5/25/2013 8:46:37 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Windows 7 Professional Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = D: | %SystemRoot% = D:\windows | %ProgramFiles% = D:\Program Files
Drive C: | 100.00 Mb Total Space | 74.40 Mb Free Space | 74.40% Space Free | Partition Type: NTFS
Drive D: | 465.66 Gb Total Space | 84.88 Gb Free Space | 18.23% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002

========== Win32 Services (SafeList) ==========

SRV - [2013/05/15 06:08:44 | 001,435,984 | ---- | M] (LogMeIn Inc.) [Auto] -- D:\Program Files\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2013/05/03 19:35:30 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand] -- D:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013/02/28 12:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto] -- D:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/03/19 07:38:47 | 002,666,880 | ---- | M] (TeamViewer GmbH) [Auto] -- D:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2012/03/09 18:56:41 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011/07/01 16:30:56 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- D:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/04/30 16:18:37 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- D:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009/11/04 11:45:02 | 000,172,032 | ---- | M] (AMD) [Auto] -- D:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009/10/13 03:39:04 | 000,935,208 | ---- | M] (Nero AG) [Auto] -- D:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009/09/04 03:31:42 | 000,434,176 | ---- | M] (Hauppauge Computer Works) [Auto] -- D:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe -- (HauppaugeTVServer)
SRV - [2009/07/13 21:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/09/30 04:16:40 | 000,166,520 | ---- | M] () [Auto] -- D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service)
SRV - [2007/09/30 04:16:38 | 000,051,816 | ---- | M] () [Auto] -- D:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe -- (Start BT in service)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (EagleNT)
DRV - [2012/10/09 14:31:12 | 000,064,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB)
DRV - [2012/04/06 14:15:10 | 000,033,512 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand] -- D:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2011/12/16 11:53:01 | 000,025,088 | ---- | M] (TeamViewer GmbH) [Kernel | On_Demand] -- D:\Windows\System32\drivers\teamviewervpn.sys -- (teamviewervpn)
DRV - [2011/08/17 04:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2011/07/01 16:30:57 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/07/01 16:30:57 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto] -- D:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/11/20 08:30:17 | 000,296,064 | ---- | M] (Microsoft Corporation) [Kernel | System] -- D:\Windows\System32\drivers\vpcvmm.sys -- (vpcvmm)
DRV - [2010/11/20 08:30:17 | 000,172,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\vpchbus.sys -- (vpcbus)
DRV - [2010/11/20 08:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 08:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 08:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 06:50:38 | 000,078,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\vpcusb.sys -- (vpcusb)
DRV - [2010/11/20 06:50:37 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | System] -- D:\Windows\System32\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV - [2010/11/20 06:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 05:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 05:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/07/28 19:25:02 | 000,025,112 | ---- | M] (Initio Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ivusb.sys -- (ivusb)
DRV - [2010/06/17 09:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/11/04 12:16:46 | 005,079,040 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009/10/09 06:04:00 | 000,253,480 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | On_Demand] -- D:\windows\system32\DRIVERS\mv91xx.sys -- (mv91xx)
DRV - [2009/09/30 10:33:56 | 000,104,976 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2009/09/25 10:57:40 | 000,138,240 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- D:\windows\system32\DRIVERS\nusb3xhc.sys -- (nusb3xhc)
DRV - [2009/09/25 10:57:36 | 000,056,576 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- D:\windows\system32\DRIVERS\nusb3hub.sys -- (nusb3hub)
DRV - [2009/08/06 04:35:12 | 000,321,280 | ---- | M] (Hauppauge Computer Works, Inc) [Kernel | On_Demand] -- D:\Windows\System32\drivers\hcw88tse.sys -- (HCW88TSE)
DRV - [2009/08/06 04:35:11 | 000,215,168 | ---- | M] (Hauppauge Computer Works, Inc) [Kernel | On_Demand] -- D:\Windows\System32\drivers\hcw88bda.sys -- (hcw88bda)
DRV - [2009/08/06 04:35:11 | 000,012,288 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\hcw88rc5.sys -- (hcw88rc5)
DRV - [2009/07/13 18:02:53 | 000,545,792 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\netr73.sys -- (netr73)
DRV - [2009/06/23 07:28:12 | 000,040,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\windows\system32\DRIVERS\HECI.sys -- (HECI) Intel(R)
DRV - [2009/06/03 08:57:02 | 000,006,504 | ---- | M] () [Kernel | On_Demand] -- D:\windows\system32\DRIVERS\ASACPI.sys -- (MTsensor)
DRV - [2009/03/18 12:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2007/06/24 16:56:54 | 000,038,920 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btcusb.sys -- (Btcsrusb)
DRV - [2007/06/24 16:56:40 | 000,027,656 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio)
DRV - [2007/06/24 16:56:34 | 000,034,312 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\blueletaudio.sys -- (BlueletAudio)
DRV - [2007/03/05 15:59:04 | 000,018,320 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btnetdrv.sys -- (BT)
DRV - [2007/03/05 15:56:18 | 000,035,600 | ---- | M] (IVT Corporation.) [Kernel | Boot] -- D:\Windows\System32\drivers\BtHidMgr.sys -- (BTHidMgr)
DRV - [2007/03/05 15:55:12 | 000,020,880 | ---- | M] (IVT Corporation.) [Kernel | Boot] -- D:\Windows\System32\drivers\VBTEnum.sys -- (BTHidEnum)
DRV - [2007/03/05 15:53:18 | 000,044,304 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\VCommMgr.sys -- (VcommMgr)
DRV - [2007/03/05 15:52:18 | 000,034,448 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\VComm.sys -- (VComm)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=14476185000000000000001167d6a48f&tlver=1.4.19.19&ss=1&affID=17395
IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - D:\Program Files\Winload\prxtbWinl.dll (Conduit Ltd.)


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Johannes_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Johannes_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Johannes_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = FD 6B 59 D7 BB 83 CA 01 [binary data]
IE - HKU\Johannes_ON_D\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - D:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\Johannes_ON_D\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - D:\Program Files\Winload\prxtbWinl.dll (Conduit Ltd.)
IE - HKU\Johannes_ON_D\..\URLSearchHook: {c95a4e8e-816d-4655-8c79-d736da1adb6d} - Reg Error: Key error. File not found
IE - HKU\Johannes_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Johannes_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local




========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.startup.homepage: "hxxp://de.ask.com/?l=dis&o=14597"
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.12
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}:1.0
FF - prefs.js..extensions.enabledItems: ShopperReports@ShopperReports.com:3.0.517.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.3.0.7280
FF - prefs.js..extensions.enabledItems: software@loadtubes.com:1.01
FF - prefs.js..extensions.enabledItems: adblockpopups@jessehakanen.net:0.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}:6.0.35
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}:6.0.37
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.15.9.100013
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=FF&o=14594&locale=de_DE&apn_uid=4e1c2369-8037-45f8-b393-e67c920c2fd2&apn_ptnrs=^FV&apn_sauid=207C1E8C-56C4-4D4D-8AAA-8633635CA8C7&apn_dtid=^YYYYYY^YY^DE&&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Winload Customized Web Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.com/ig|hxxp://www.youtube.com/?gl=DE&hl=de|hxxp://www.facebook.com/"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=14476185000000000000001167d6a48f&tlver=1.4.19.19&instlRef=sst&ss=1&affID=17395&q="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: D:\Windows\System32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: D:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: D:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: D:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: D:\Users\Johannes\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: D:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ShopperReports@ShopperReports.com: C:\Program Files\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions [2010/12/23 15:28:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/14 14:42:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/12/14 14:42:28 | 000,000,000 | ---D | M]

[2010/04/28 13:58:28 | 000,000,000 | -H-D | M] (No name found) -- D:\Users\Johannes\AppData\Roaming\Mozilla\Extensions
[2013/01/29 13:23:13 | 000,000,000 | -H-D | M] (No name found) -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\extensions
[2012/12/16 08:34:13 | 000,000,000 | ---D | M] (DownloadHelper) -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/06/22 14:21:19 | 000,000,000 | ---D | M] (Adblock Plus Pop-up Addon) -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\extensions\adblockpopups@jessehakanen.net
[2011/03/13 07:02:00 | 000,000,000 | -H-D | M] (Personas) -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\extensions\personas@christopher.beard
[2012/05/06 04:45:34 | 000,000,000 | -H-D | M] (loadtbs) -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\extensions\software@loadtubes.com
[2013/01/29 13:22:10 | 000,000,000 | ---D | M] ("Ask Toolbar") -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\extensions\toolbar@ask.com
[2013/01/29 13:22:22 | 000,002,403 | ---- | M] () -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\searchplugins\askcom.xml
[2012/05/06 11:03:35 | 000,000,937 | -H-- | M] () -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\searchplugins\conduit.xml
[2012/05/06 06:52:36 | 000,004,108 | -H-- | M] () -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\searchplugins\SweetIM Search.xml
[2012/01/22 14:36:21 | 000,003,915 | -H-- | M] () -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\searchplugins\sweetim.xml
[2012/12/08 15:59:09 | 000,000,000 | ---D | M] (No name found) -- D:\Program Files\Mozilla Firefox\extensions
[2012/05/13 10:50:48 | 000,000,000 | ---D | M] (Skype Click to Call) -- D:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/10/23 15:00:33 | 000,000,000 | ---D | M] (Java Console) -- D:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2012/08/31 12:40:48 | 000,000,000 | ---D | M] (Java Console) -- D:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2012/12/08 15:59:09 | 000,000,000 | ---D | M] (Java Console) -- D:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2010/12/23 15:29:46 | 000,000,000 | ---D | M] (QuestBrowse) -- D:\Program Files\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}
[2010/12/23 15:28:31 | 000,000,000 | ---D | M] (ShopperReports) -- D:\PROGRAM FILES\SHOPPERREPORTS3\BIN\3.0.517.0\FIREFOX\FIREFOXTOOLBAR\EXTENSIONS
[2012/05/06 04:45:31 | 000,378,880 | ---- | M] (InfiniAd GmbH) -- D:\Program Files\mozilla firefox\plugins\npmieze.dll
[2010/04/01 12:54:38 | 000,001,392 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/06/13 16:12:52 | 000,002,428 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2010/04/01 12:54:38 | 000,002,344 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010/04/01 12:54:38 | 000,006,805 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010/04/01 12:54:38 | 000,001,178 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010/04/01 12:54:38 | 000,001,105 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2 - BHO: (ShopperReports) - {100EB1FD-D03E-47fd-81F3-EE91287F9465} - File not found
O2 - BHO: (Shopping Assistant Plugin) - {1631550F-191D-4826-B069-D9439253D926} - D:\Program Files\PriceGong\2.5.4\PriceGongIE.dll (PriceGong)
O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} - D:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - D:\Program Files\Winload\prxtbWinl.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - D:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - D:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - D:\Program Files\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - D:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - D:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (loadtbs) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - D:\Users\Johannes\AppData\Roaming\loadtbs\toolbar.dll (InfiniAd GmbH)
O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - D:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\Johannes_ON_D\..\Toolbar\WebBrowser: (Winload Toolbar) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - D:\Program Files\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKU\Johannes_ON_D\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - D:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] D:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] D:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] D:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BabylonToolbar] D:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe (Babylon Ltd.)
O4 - HKLM..\Run: [IntelliPoint] D:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Microsoft Corporation)
O4 - HKLM..\Run: [IntelliType Pro] D:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] D:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] D:\Program Files\CyberLink\PowerDVD8\Language\Language.exe ()
O4 - HKLM..\Run: [SweetIM] D:\Program Files\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKU\Johannes_ON_D..\Run: [EADM] D:\Program Files\Origin\Origin.exe (Electronic Arts)
O4 - HKU\Johannes_ON_D..\Run: [MobileDocuments] File not found
O4 - HKU\Johannes_ON_D..\Run: [Spotify Web Helper] D:\Users\Johannes\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - HKU\Johannes_ON_D..\Run: [Steam] D:\Program Files\Steam\steam.exe (Valve Corporation)
O4 - HKU\.DEFAULT..\RunOnce: [SPReview] D:\windows\System32\SPReview\SPReview.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: D:\Users\Johannes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Web-Suche - D:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\MenuExt.html ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - File not found
O9 - Extra Button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - D:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\Johannes_ON_D Winlogon: Shell - (explorer.exe) - D:\windows\explorer.exe (Microsoft Corporation)
O20 - HKU\Johannes_ON_D Winlogon: Shell - (C:\Users\Johannes\AppData\Roaming\skype.dat) - D:\Users\Johannes\AppData\Roaming\skype.dat ()
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2013/05/25 10:52:22 | 000,000,000 | ---D | C] -- D:\windows\Minidump
[2013/05/24 12:12:17 | 000,000,000 | ---D | C] -- D:\Users\Johannes\Desktop\A
[2013/05/23 15:14:24 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2013/05/23 15:14:23 | 000,000,000 | ---D | C] -- D:\Program Files\LogMeIn Hamachi
[2013/05/18 08:08:22 | 000,420,864 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\vbscript.dll
[2013/05/18 08:08:22 | 000,065,024 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\jsproxy.dll
[2013/05/18 08:08:21 | 000,717,824 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\jscript.dll
[2013/05/18 08:08:21 | 000,607,744 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\msfeeds.dll
[2013/05/18 08:08:21 | 000,176,640 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\ieui.dll
[2013/05/18 08:08:21 | 000,142,848 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\ieUnatt.exe
[2013/05/18 08:08:20 | 001,800,704 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\jscript9.dll
[2013/05/18 08:08:20 | 001,427,968 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\inetcpl.cpl
[2013/05/18 08:08:20 | 000,231,936 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\url.dll
[2013/05/18 08:06:14 | 002,382,848 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\mshtml.tlb
[2013/05/18 07:38:22 | 000,040,960 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\wwanprotdim.dll
[2013/05/18 07:38:21 | 002,347,520 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\win32k.sys
[2013/05/18 07:38:16 | 000,218,984 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\drivers\dxgmms1.sys
[2013/05/18 07:38:08 | 001,796,096 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\authui.dll
[2013/05/18 07:38:08 | 000,101,720 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\consent.exe
[1 D:\windows\*.tmp files -> D:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/25 13:30:28 | 000,067,584 | --S- | M] () -- D:\windows\bootstat.dat
[2013/05/25 13:23:35 | 000,010,256 | -H-- | M] () -- D:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/25 13:23:35 | 000,010,256 | -H-- | M] () -- D:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/25 13:22:03 | 000,709,194 | ---- | M] () -- D:\windows\System32\perfh007.dat
[2013/05/25 13:22:03 | 000,661,476 | ---- | M] () -- D:\windows\System32\perfh009.dat
[2013/05/25 13:22:03 | 000,153,546 | ---- | M] () -- D:\windows\System32\perfc007.dat
[2013/05/25 13:22:03 | 000,125,666 | ---- | M] () -- D:\windows\System32\perfc009.dat
[2013/05/25 13:16:19 | 000,000,004 | ---- | M] () -- D:\Users\Johannes\AppData\Roaming\skype.ini
[2013/05/25 13:15:16 | 000,001,098 | ---- | M] () -- D:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/25 13:14:35 | 2817,384,448 | -HS- | M] () -- D:\hiberfil.sys
[2013/05/25 12:34:00 | 000,001,102 | ---- | M] () -- D:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/25 10:52:20 | 342,842,563 | ---- | M] () -- D:\windows\MEMORY.DMP
[2013/05/24 13:53:21 | 000,000,213 | ---- | M] () -- D:\Users\Johannes\Desktop\Dota 2.url
[2013/05/23 15:14:24 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2013/05/18 10:40:40 | 000,326,928 | ---- | M] () -- D:\windows\System32\FNTCACHE.DAT
[2013/05/05 15:12:55 | 002,382,848 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\mshtml.tlb
[2013/05/01 20:06:08 | 000,238,872 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\MpSigStub.exe
[1 D:\windows\*.tmp files -> D:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/25 12:53:04 | 000,000,004 | ---- | C] () -- D:\Users\Johannes\AppData\Roaming\skype.ini
[2013/05/24 13:53:21 | 000,000,213 | ---- | C] () -- D:\Users\Johannes\Desktop\Dota 2.url
[2012/08/27 15:28:36 | 000,000,868 | ---- | C] () -- D:\Users\Johannes\AppData\Local\recently-used.xbel
[2012/04/21 10:38:30 | 000,003,584 | ---- | C] () -- D:\Users\Johannes\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/03/17 14:32:03 | 000,139,048 | ---- | C] () -- D:\windows\System32\drivers\PnkBstrK.sys
[2012/03/17 14:31:50 | 000,282,296 | ---- | C] () -- D:\windows\System32\PnkBstrB.exe
[2012/03/17 14:31:28 | 000,076,888 | ---- | C] () -- D:\windows\System32\PnkBstrA.exe
[2012/01/11 14:19:07 | 000,059,392 | ---- | C] () -- D:\Users\Johannes\AppData\Roaming\skype.dat
[2011/09/17 04:35:39 | 000,000,127 | ---- | C] () -- D:\windows\System32\MRT.INI
[2011/07/01 16:56:34 | 000,138,904 | -H-- | C] () -- D:\Users\Johannes\AppData\Roaming\PnkBstrK.sys
[2011/07/01 16:56:03 | 002,434,856 | ---- | C] () -- D:\windows\System32\pbsvc_bc2.exe
[2011/06/22 15:17:15 | 000,252,928 | ---- | C] () -- D:\windows\System32\DShowRdpFilter.dll
[2011/06/22 15:16:19 | 000,066,048 | ---- | C] () -- D:\windows\System32\PrintBrmUi.exe
[2011/05/09 08:33:14 | 000,000,096 | ---- | C] () -- D:\Users\Johannes\AppData\Local\fusioncache.dat
[2011/04/08 12:39:10 | 000,000,056 | -H-- | C] () -- D:\ProgramData\ezsidmv.dat
[2010/12/23 15:30:07 | 000,815,104 | ---- | C] () -- D:\windows\System32\xvidcore.dll
[2010/12/23 15:30:07 | 000,180,224 | ---- | C] () -- D:\windows\System32\xvidvfw.dll
[2010/10/20 10:18:31 | 000,001,940 | ---- | C] () -- D:\Users\Johannes\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/02/07 13:02:24 | 000,000,332 | ---- | C] () -- D:\windows\desctemp.dat
[2009/12/23 07:42:12 | 000,033,877 | ---- | C] () -- D:\windows\Irremote.ini
[2009/12/23 07:41:19 | 000,000,209 | ---- | C] () -- D:\windows\ODBCINST.INI
[2009/12/23 07:41:19 | 000,000,135 | ---- | C] () -- D:\windows\ODBC.INI
[2009/12/23 07:41:09 | 000,142,337 | ---- | C] () -- D:\windows\System32\Wait.exe
[2009/12/23 07:40:28 | 000,002,507 | ---- | C] () -- D:\windows\HCWPNP.INI
[2009/12/23 07:39:21 | 000,040,960 | ---- | C] () -- D:\windows\System32\hcwxds.dll
[2009/12/22 13:53:11 | 000,146,432 | ---- | C] () -- D:\windows\System32\APOMngr.DLL
[2009/12/22 13:53:11 | 000,072,704 | ---- | C] () -- D:\windows\System32\CmdRtr.DLL
[2009/12/22 13:52:37 | 000,000,000 | ---- | C] () -- D:\windows\ativpsrm.bin
[2009/12/11 09:50:29 | 000,295,922 | ---- | C] () -- D:\windows\System32\perfi007.dat
[2009/12/11 09:50:28 | 000,709,194 | ---- | C] () -- D:\windows\System32\perfh007.dat
[2009/12/11 09:50:28 | 000,153,546 | ---- | C] () -- D:\windows\System32\perfc007.dat
[2009/12/11 09:50:28 | 000,038,104 | ---- | C] () -- D:\windows\System32\perfd007.dat
[2009/09/01 16:55:54 | 000,195,855 | ---- | C] () -- D:\windows\System32\atiicdxx.dat
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- D:\windows\bootstat.dat
[2009/07/14 00:33:53 | 000,326,928 | ---- | C] () -- D:\windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,661,476 | ---- | C] () -- D:\windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- D:\windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,125,666 | ---- | C] () -- D:\windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- D:\windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- D:\windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- D:\windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- D:\windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- D:\windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- D:\windows\System32\BWContextHandler.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- D:\windows\System32\mlang.dat
[2009/06/03 08:57:02 | 000,006,504 | ---- | C] () -- D:\windows\System32\drivers\ASACPI.sys
[2009/03/05 09:54:58 | 000,073,728 | ---- | C] () -- D:\windows\System32\RtNicProp32.dll
[2009/02/18 14:55:20 | 000,294,912 | ---- | C] () -- D:\windows\System32\ATIODE.exe
[2009/02/03 17:52:02 | 000,045,056 | ---- | C] () -- D:\windows\System32\ATIODCLI.exe
[2007/10/12 17:20:06 | 000,151,417 | ---- | C] () -- D:\windows\System32\xlive.dll.cat

========== LOP Check ==========

[2012/12/14 14:46:49 | 000,000,000 | ---D | M] -- D:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data
[2012/12/08 16:00:44 | 000,000,000 | ---D | M] -- D:\ProgramData\Ask
[2012/06/15 12:18:39 | 000,000,000 | ---D | M] -- D:\ProgramData\Battle.net
[2010/01/24 08:41:40 | 000,000,000 | ---D | M] -- D:\ProgramData\Bluetooth
[2012/09/09 16:26:42 | 000,000,000 | ---D | M] -- D:\ProgramData\Civilization III
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2012/03/18 11:59:09 | 000,000,000 | ---D | M] -- D:\ProgramData\Divinity 2
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents
[2013/02/01 18:04:10 | 000,000,000 | ---D | M] -- D:\ProgramData\EA Core
[2013/02/01 18:04:09 | 000,000,000 | ---D | M] -- D:\ProgramData\EA Logs
[2013/02/01 18:04:13 | 000,000,000 | ---D | M] -- D:\ProgramData\Electronic Arts
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites
[2010/01/16 14:08:03 | 000,000,000 | ---D | M] -- D:\ProgramData\Firefly Studios
[2011/12/05 15:06:27 | 000,000,000 | ---D | M] -- D:\ProgramData\National Instruments
[2013/01/28 10:06:05 | 000,000,000 | ---D | M] -- D:\ProgramData\Origin
[2013/05/20 07:21:57 | 000,000,000 | ---D | M] -- D:\ProgramData\PMB Files
[2009/12/24 16:50:51 | 000,000,000 | ---D | M] -- D:\ProgramData\Solidshield
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu
[2012/01/22 14:36:16 | 000,000,000 | ---D | M] -- D:\ProgramData\SweetIM
[2009/12/23 07:53:05 | 000,000,000 | ---D | M] -- D:\ProgramData\Temp
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates
[2011/08/03 09:39:32 | 000,000,000 | ---D | M] -- D:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/04/07 12:11:26 | 000,000,000 | ---D | M] -- D:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
[2013/04/03 11:37:10 | 000,032,632 | ---- | M] () -- D:\windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========


< End of report >
[\code]