Wahrscheinlich Virus! Werde bei google.de auf gondorsarmeederhoffnung.de umgeleitet!

OTL logfile created on: 19.11.2010 18:50:18 - Run 2
OTL by OldTimer - Version 3.2.17.3 Folder = c:\Users\***\Downloads
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 235,00 Mb Available Physical Memory | 23,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 42,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,10 Gb Total Space | 103,42 Gb Free Space | 69,83% Space Free | Partition Type: NTFS
Drive D: | 73,07 Gb Total Space | 72,98 Gb Free Space | 99,88% Space Free | Partition Type: NTFS
 
Computer Name: ROUVEN-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - c:\Users\***\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\AntiBrowserSpy\AntiBrowserSpyBrowserMaske.exe (Microsoft)
PRC - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe (Kaspersky Lab)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
PRC - C:\Windows\PixArt\PAC207\Monitor.exe (PixArt Imaging Incorporation)
 
 
========== Modules (SafeList) ==========
 
MOD - c:\Users\Rouven\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (PostgreSQL) -- C:\Program Files\PostgreSQL\8.0-beta2-dev3\bin\pg_ctl.exe File not found
SRV - (CLTNetCnService) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe File not found
SRV - (AVP) -- C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe (Kaspersky Lab)
SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (WinHttpAutoProxySvc) -- winhttp.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Symantec Core LC) -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
SRV - (TestHandler) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
SRV - (lxcg_device) -- C:\Windows\System32\lxcgcoms.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (TSMPacket) -- C:\Windows\System32\DRIVERS\tsmpkt.sys File not found
DRV - (SCREAMINGBDRIVER) -- C:\Windows\System32\drivers\ScreamingBAudio.sys File not found
DRV - (RTHDMIAzAudService) -- C:\Windows\System32\drivers\RtHDMIV.sys File not found
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys File not found
DRV - (blbdrive) -- C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek )
DRV - (KLIF) -- C:\Windows\System32\drivers\klif.sys (Kaspersky Lab)
DRV - (AtiHdmiService) -- C:\Windows\System32\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV - (FsUsbExDisk) -- C:\Windows\System32\FsUsbExDisk.Sys ()
DRV - (klbg) -- C:\Windows\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (klmouflt) -- C:\Windows\System32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (KLIM6) -- C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab)
DRV - (kl1) -- C:\Windows\System32\drivers\kl1.sys (Kaspersky Lab)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (RTL8023xp) -- C:\Windows\System32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (AmdLLD) -- C:\Windows\System32\drivers\AmdLLD.sys (AMD, Inc.)
DRV - (JRAID) -- C:\Windows\system32\drivers\jraid.sys (JMicron Technology Corp.)
DRV - (PAC207) -- C:\Windows\System32\drivers\PFC027.SYS (PixArt Imaging Inc.)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
DRV - (nvraid) NVIDIA nForce(tm) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvatabus) -- C:\Windows\system32\drivers\nvatabus.sys (NVIDIA Corporation)
DRV - (iaStor) -- C:\Windows\system32\drivers\iastor.sys (Intel Corporation)
DRV - (JGOGO) -- C:\Windows\system32\drivers\jgogo.sys (JMicron )
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://alice.aol.de
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://searchbox.digsby.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.sweetim.com/search.asp?src=2&q="
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.partypatrol-events.de"
FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.87
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {d49175b3-3fd8-43b8-b28e-da5d47f3c398}:1.0.30
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: toolbar-ff@payback.de:1.0.3.71
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.partypatrol-events.de/"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010.03.31 16:55:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.11.19 12:47:50 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.11.19 12:47:50 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 10\THBExt [2010.05.22 19:25:16 | 000,000,000 | ---D | M]
 
[2008.09.04 16:00:11 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\mozilla\Extensions
[2010.11.19 17:08:24 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\mozilla\Firefox\Profiles\37rddmmq.default\extensions
[2010.11.16 21:38:16 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Rouven\AppData\Roaming\mozilla\Firefox\Profiles\37rddmmq.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2010.05.22 20:28:19 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Rouven\AppData\Roaming\mozilla\Firefox\Profiles\37rddmmq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.08.13 19:53:55 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\Rouven\AppData\Roaming\mozilla\Firefox\Profiles\37rddmmq.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2010.07.23 11:18:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rouven\AppData\Roaming\mozilla\Firefox\Profiles\37rddmmq.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.05.09 20:30:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rouven\AppData\Roaming\mozilla\Firefox\Profiles\37rddmmq.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.11.16 21:37:56 | 000,000,000 | ---D | M] (COMPUTERBILD-Abzockschutz) -- C:\Users\Rouven\AppData\Roaming\mozilla\Firefox\Profiles\37rddmmq.default\extensions\{d49175b3-3fd8-43b8-b28e-da5d47f3c398}
[2010.05.22 20:28:09 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Rouven\AppData\Roaming\mozilla\Firefox\Profiles\37rddmmq.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010.07.23 11:18:33 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Users\Rouven\AppData\Roaming\mozilla\Firefox\Profiles\37rddmmq.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2010.09.18 20:59:03 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\mozilla\Firefox\Profiles\37rddmmq.default\extensions\personas@christopher.beard
[2010.11.19 17:08:12 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\mozilla\Firefox\Profiles\37rddmmq.default\extensions\toolbar-ff@payback.de
[2010.11.16 21:38:16 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\mozilla\Firefox\Profiles\37rddmmq.default\extensions\webmynd@yourentirelife.com
[2008.02.19 17:19:41 | 000,001,878 | ---- | M] () -- C:\Users\Rouven\AppData\Roaming\Mozilla\FireFox\Profiles\37rddmmq.default\searchplugins\aolsearch.xml
[2008.07.30 08:35:38 | 000,002,220 | ---- | M] () -- C:\Users\Rouven\AppData\Roaming\Mozilla\FireFox\Profiles\37rddmmq.default\searchplugins\digsby.xml
[2010.11.19 12:47:28 | 000,000,950 | ---- | M] () -- C:\Users\Rouven\AppData\Roaming\Mozilla\FireFox\Profiles\37rddmmq.default\searchplugins\icqplugin-1.xml
[2008.02.08 21:45:39 | 000,000,949 | ---- | M] () -- C:\Users\Rouven\AppData\Roaming\Mozilla\FireFox\Profiles\37rddmmq.default\searchplugins\icqplugin-2.xml
[2009.01.19 02:07:00 | 000,000,950 | ---- | M] () -- C:\Users\Rouven\AppData\Roaming\Mozilla\FireFox\Profiles\37rddmmq.default\searchplugins\icqplugin-3.xml
[2009.02.06 11:57:13 | 000,000,950 | ---- | M] () -- C:\Users\Rouven\AppData\Roaming\Mozilla\FireFox\Profiles\37rddmmq.default\searchplugins\icqplugin-4.xml
[2009.03.05 22:39:57 | 000,000,950 | ---- | M] () -- C:\Users\Rouven\AppData\Roaming\Mozilla\FireFox\Profiles\37rddmmq.default\searchplugins\icqplugin-5.xml
[2009.03.30 12:16:17 | 000,000,950 | ---- | M] () -- C:\Users\Rouven\AppData\Roaming\Mozilla\FireFox\Profiles\37rddmmq.default\searchplugins\icqplugin-6.xml
[2009.04.23 19:21:49 | 000,000,950 | ---- | M] () -- C:\Users\Rouven\AppData\Roaming\Mozilla\FireFox\Profiles\37rddmmq.default\searchplugins\icqplugin-7.xml
[2009.04.30 06:58:29 | 000,000,950 | ---- | M] () -- C:\Users\Rouven\AppData\Roaming\Mozilla\FireFox\Profiles\37rddmmq.default\searchplugins\icqplugin-8.xml
[2008.12.15 15:45:18 | 000,000,944 | ---- | M] () -- C:\Users\Rouven\AppData\Roaming\Mozilla\FireFox\Profiles\37rddmmq.default\searchplugins\icqplugin.xml
[2009.01.12 11:45:40 | 000,003,915 | ---- | M] () -- C:\Users\Rouven\AppData\Roaming\Mozilla\FireFox\Profiles\37rddmmq.default\searchplugins\sweetim.xml
[2010.11.12 11:23:10 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009.01.18 19:38:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.06.05 22:22:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.21 18:42:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.11.12 10:52:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010.05.22 19:26:50 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
[2010.09.15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2006.09.26 13:03:14 | 000,098,304 | ---- | M] (Zylom) -- C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
[2010.11.19 12:47:41 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.11.19 12:47:41 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.11.19 12:47:42 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.11.19 12:47:42 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.11.19 12:47:43 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.06.14 12:49:52 | 000,000,934 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 81.169.180.144 www.google.de
O1 - Hosts: 81.169.180.144 google.de
O1 - Hosts: 127.0.0.1 www.google-analytics.com
O1 - Hosts: 127.0.0.1 google-analytics.com
O2 - BHO: (CBAbzockschutz.InitToolbarBHO) - {2e250b90-0e7a-42a3-9d65-e39f9f227fa4} - mscoree.dll (Microsoft Corporation)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 10\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 10\klwtbbho.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (COMPUTERBILD-Abzockschutz) - {353e2a48-6254-4bd3-88f4-3b51a0ca7870} - mscoree.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [Conime] C:\Windows\System32\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKLM..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BrowserMask] C:\Program Files\AntiBrowserSpy\AntiBrowserSpyBrowserMaske.exe (Microsoft)
O4 - HKCU..\Run: [MBPlayer] C:\Program Files\MB application\MBPlayer.exe (MusicBrigade)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Rouven\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 10\ie_banner_deny.htm ()
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 10\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 10\klwtbbho.dll (Kaspersky Lab)
O13 - gopher Prefix: missing
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} hxxp://static.ak.schuelervz.net/photouploader/ImageUploader4.cab?nocache=20071128-1 (Image Uploader Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd3.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 10\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~2\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 10\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\Windows\system32\klogon.dll - C:\Windows\System32\klogon.dll (Kaspersky Lab)
O24 - Desktop WallPaper: C:\Users\Rouven\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Rouven\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{b72dc813-7be8-11dc-a081-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{b72dc813-7be8-11dc-a081-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Start.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.11.19 18:08:46 | 000,000,000 | ---D | C] -- C:\Users\Rouven\AppData\Roaming\Malwarebytes
[2010.11.19 18:08:21 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.11.19 18:08:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.11.19 18:08:14 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.11.19 18:08:14 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.11.19 12:43:46 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
[2010.11.16 15:26:37 | 000,000,000 | ---D | C] -- C:\Users\Rouven\AppData\Local\Windows Live
[2010.11.12 18:52:25 | 000,000,000 | ---D | C] -- C:\Users\Rouven\Desktop\Sarah
[2010.11.12 11:21:27 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2010.11.11 20:30:46 | 000,000,000 | ---D | C] -- C:\ProgramData\T-DSL SpeedManager
[2010.11.11 20:30:45 | 000,000,000 | ---D | C] -- C:\Users\Rouven\AppData\Roaming\T-DSL SpeedManager
[2010.11.11 20:24:08 | 000,000,000 | ---D | C] -- C:\Users\Rouven\AppData\Roaming\COMPUTERBILD-Abzockschutz
[6 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.11.19 18:50:18 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{F2332C4A-606F-42E8-AA2C-E74D32FCB104}.job
[2010.11.19 18:16:12 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.11.19 18:16:12 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.11.19 18:08:24 | 000,000,784 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.11.19 18:00:02 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.11.19 12:33:21 | 000,115,465 | ---- | M] () -- C:\Windows\System32\drivers\klin.dat
[2010.11.19 12:33:21 | 000,097,545 | ---- | M] () -- C:\Windows\System32\drivers\klick.dat
[2010.11.12 19:57:23 | 000,000,842 | ---- | M] () -- C:\Users\Rouven\Desktop\AntiBrowserSpy.lnk
[2010.11.12 13:19:41 | 000,001,668 | ---- | M] () -- C:\Users\Public\Desktop\Defraggler.lnk
[2010.11.12 12:22:08 | 000,674,344 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.11.12 12:22:08 | 000,634,202 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.11.12 12:22:08 | 000,145,834 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.11.12 12:22:08 | 000,119,766 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.11.12 12:15:02 | 000,334,896 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.11.11 22:52:27 | 000,000,770 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2010.10.28 18:46:51 | 000,041,984 | ---- | M] () -- C:\Users\Rouven\Documents\Finanzplanung Rouven Netbook2.xlt
[2010.10.28 18:46:36 | 000,041,984 | ---- | M] () -- C:\Users\Rouven\Documents\Finanzplanung Rouven Netbook.xls
[2010.10.24 20:29:02 | 000,012,038 | ---- | M] () -- C:\Users\Rouven\Desktop\Finanzplanung Ilona.ods
[6 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.11.19 18:08:24 | 000,000,784 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.11.19 12:40:07 | 000,201,184 | ---- | C] () -- C:\Windows\System32\winrm.vbs
[2010.11.19 12:40:07 | 000,002,426 | ---- | C] () -- C:\Windows\System32\WsmTxt.xsl
[2010.11.19 12:40:06 | 000,004,675 | ---- | C] () -- C:\Windows\System32\wsmanconfig_schema.xml
[2010.11.12 13:19:41 | 000,001,668 | ---- | C] () -- C:\Users\Public\Desktop\Defraggler.lnk
[2010.11.11 22:52:21 | 000,000,770 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2010.11.11 22:50:28 | 000,001,096 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.11.11 22:50:24 | 000,001,092 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.10.28 18:46:49 | 000,041,984 | ---- | C] () -- C:\Users\Rouven\Documents\Finanzplanung Rouven Netbook2.xlt
[2010.10.28 18:46:28 | 000,041,984 | ---- | C] () -- C:\Users\Rouven\Documents\Finanzplanung Rouven Netbook.xls
[2010.09.23 22:28:23 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll
[2010.09.23 22:28:23 | 000,036,608 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys
[2009.12.03 09:27:30 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2009.09.11 10:03:26 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.02.05 17:15:51 | 000,012,288 | ---- | C] () -- C:\Windows\impborl.dll
[2009.01.15 00:47:46 | 000,000,094 | ---- | C] () -- C:\Users\Rouven\AppData\Local\fusioncache.dat
[2009.01.02 21:38:03 | 000,138,184 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2008.10.24 21:53:32 | 000,000,229 | ---- | C] () -- C:\Windows\ULEAD32.INI
[2008.07.21 20:41:32 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2008.06.09 11:27:04 | 000,000,514 | ---- | C] () -- C:\Users\Rouven\AppData\Roaming\Wimpomat.ini
[2008.04.03 13:10:41 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2008.03.27 20:15:01 | 000,408,576 | ---- | C] () -- C:\Windows\System32\Smab.dll
[2008.03.27 20:15:01 | 000,070,656 | ---- | C] () -- C:\Windows\System32\yv12vfw.dll
[2008.03.27 20:15:01 | 000,070,656 | ---- | C] () -- C:\Windows\System32\i420vfw.dll
[2008.03.27 20:15:01 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2007.12.09 16:22:28 | 000,000,023 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2007.11.13 09:32:44 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2007.10.30 02:02:48 | 000,000,463 | ---- | C] () -- C:\Windows\cdplayer.ini
[2007.10.25 16:26:10 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2007.10.20 16:38:57 | 000,000,988 | ---- | C] () -- C:\Users\Rouven\AppData\Roaming\wklnhst.dat
[2007.10.16 20:27:08 | 000,012,800 | ---- | C] () -- C:\Users\Rouven\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.10.09 10:52:58 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2007.10.09 07:36:10 | 000,135,168 | ---- | C] () -- C:\Windows\System32\property.dll
[2007.08.16 14:17:50 | 000,143,360 | ---- | C] () -- C:\Windows\System32\nsldap32v50.dll
[2006.11.02 09:27:46 | 000,000,518 | ---- | C] () -- C:\Windows\System32\SP207.INI
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.08.11 08:52:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll
[2005.12.21 15:57:04 | 000,024,576 | ---- | C] () -- C:\Windows\System32\nsldappr32v50.dll
[2005.12.21 15:54:34 | 000,040,960 | ---- | C] () -- C:\Windows\System32\nsldapssl32v50.dll
[2005.05.11 10:24:46 | 000,102,400 | ---- | C] () -- C:\Windows\System32\lxcginsr.dll
[2005.05.11 10:24:42 | 000,036,864 | ---- | C] () -- C:\Windows\System32\lxcgcur.dll
[2005.05.11 10:24:26 | 000,126,976 | ---- | C] () -- C:\Windows\System32\lxcgjswr.dll
[2005.04.15 22:24:38 | 001,191,936 | ---- | C] () -- C:\Windows\System32\lxcgserv.dll
[2005.04.15 22:18:30 | 000,483,328 | ---- | C] () -- C:\Windows\System32\lxcglmpm.dll
[2005.04.15 22:18:00 | 000,413,696 | ---- | C] () -- C:\Windows\System32\lxcgcomm.dll
[2005.04.15 22:15:42 | 000,114,688 | ---- | C] () -- C:\Windows\System32\lxcgpplc.dll
[2005.04.15 22:14:42 | 000,708,608 | ---- | C] () -- C:\Windows\System32\lxcgcomc.dll
[2005.04.15 22:13:56 | 000,155,648 | ---- | C] () -- C:\Windows\System32\lxcgprox.dll
[2005.04.15 22:06:40 | 001,134,592 | ---- | C] () -- C:\Windows\System32\lxcgusb1.dll
[2005.03.14 10:45:20 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxcgvs.dll
[2005.01.25 15:15:42 | 000,010,240 | ---- | C] () -- C:\Windows\System32\PA207USD.DLL
[2004.09.28 05:38:30 | 000,114,688 | ---- | C] () -- C:\Windows\System32\wmatimer.dll
 
========== LOP Check ==========
 
[2008.03.27 18:01:05 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\AceBIT
[2009.07.25 00:25:26 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\AntiBrowserSpy 2009
[2010.06.14 12:04:01 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\Ashampoo
[2010.05.09 20:59:21 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\Atari
[2007.11.17 12:55:50 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\BayHunter
[2009.03.23 15:38:34 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\BeachPartyCraze
[2010.04.13 18:20:15 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\Blumentals
[2010.03.26 18:37:29 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\BOM
[2007.12.09 17:05:37 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\BonkEnc
[2010.11.11 22:49:59 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\COMPUTERBILD-Abzockschutz
[2008.01.21 12:42:54 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\DA-HtAccess
[2010.05.09 20:30:03 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.08.10 11:04:48 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\FireShot
[2010.05.18 19:24:57 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\gtk-2.0
[2010.11.16 21:42:21 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\ICQ
[2007.10.17 17:09:19 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\ICQ Toolbar
[2009.01.02 21:29:25 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\Leadertech
[2008.10.07 17:05:55 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\Metaversum
[2009.11.09 21:29:05 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\NCH Swift Sound
[2008.12.23 11:10:35 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\Nimbuzz
[2008.01.03 22:35:43 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\Nokia
[2010.03.26 20:23:11 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\OpenOffice.org
[2007.12.27 12:27:06 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\PC Suite
[2008.11.04 16:57:15 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\PlayFirst
[2008.03.07 20:42:45 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\S.A.D
[2010.11.12 11:45:14 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\Samsung
[2007.11.27 23:34:20 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\Screaming Bee
[2008.02.06 19:29:17 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\SecondLife
[2009.07.25 00:07:43 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\Steganos
[2010.11.11 20:30:45 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\T-DSL SpeedManager
[2008.04.16 16:08:07 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\TeamViewer
[2010.11.12 11:45:59 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\Temp
[2007.10.20 16:41:55 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\Template
[2008.08.20 20:19:04 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\WEB.DE
[2010.09.12 17:31:56 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\Wimpomat2
[2008.11.04 17:09:20 | 000,000,000 | ---D | M] -- C:\Users\Rouven\AppData\Roaming\Zylom
[2010.07.25 11:01:12 | 000,000,402 | ---- | M] () -- C:\Windows\Tasks\EasyShare Registration Task.job
[2010.11.17 19:17:42 | 000,032,562 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.11.19 18:50:18 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{F2332C4A-606F-42E8-AA2C-E74D32FCB104}.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 91 bytes -> C:\Windows\System32:lol
 
< End of report >