Trojaner-Board - sehr dringend tochter super verzweifelt

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - sehr dringend tochter super verzweifelt (https://www.trojaner-board.de/109934-sehr-dringend-tochter-super-verzweifelt.html)

sehr dringend tochter super verzweifelt

meine tochter hat seit 2 wochen einen neuen lappi
eben vor 1 stunde kam sie und zeigte mir ihren lappi und es ist nur noch ein schwarzer bildschirm zu sehen mit roter schrift Windowssystem wurde blockiert klicken sie und bezahlen sie
nun kann sie nur noch im abgesicherten modus starten und es geht auch überhaupt nix mehr
bitte dringen super dringend um hilfe
wenn es auch möglich wäre eine telefonische hilfe
wir zwei sind auch nur leihe am rechner

hi,
am telefon ist das schwirig, aber wir machen das schon, keine angst.
aber:
schnell gibts hier nicht, wir haben viel zu tun, deswegen aller höchstens schnellst möglich :-)
bitte im abgesicherten modus mit netzwerk im betroffenen nutzerkonto anmelden.

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

/md5start

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

explorer.exe

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\*.dll /lockedfiles

%USERPROFILE%\*.*

%USERPROFILE%\Local Settings\Temp\*.exe

%USERPROFILE%\Local Settings\Temp\*.dll

%USERPROFILE%\Application Data\*.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

dieses otl programm hatten wir schon runtergeaden aber es scannt nicht

steht nur mit netzwerktreiber

und ich schreibe von meinen rechner aus muß auch dazu sagen wir sind ziehmliche leihen an den pc

so rechner im abgesichertne netzwerkmodus ist an und das programm ist auch auf dem rechner

und wenn du einfach nur auf quick scan klickst, ohne mein script, was passiert dann?
und wir sind hier nicht in nem chat, also gewöhne dir bitte an nicht jeden satz in nem neuen beitrag zu schreiben, danke

Error: Unable to interpret <activex> in the current context!
Error: Unable to interpret <netsvcs> in the current context!
Error: Unable to interpret <msconfig> in the current context!
Error: Unable to interpret <%SYSTEMDRIVE%\*.> in the current context!
Error: Unable to interpret <%PROGRAMFILES%\*.exe> in the current context!
Error: Unable to interpret <%LOCALAPPDATA%\*.exe> in the current context!
Error: Unable to interpret <%systemroot%\*. /mp /s> in the current context!
Error: Unable to interpret </md5start> in the current context!
Error: Unable to interpret <userinit.exe> in the current context!
Error: Unable to interpret <eventlog.dll> in the current context!
Error: Unable to interpret <scecli.dll> in the current context!
Error: Unable to interpret <netlogon.dll> in the current context!
Error: Unable to interpret <cngaudit.dll> in the current context!
Error: Unable to interpret <ws2ifsl.sys> in the current context!
Error: Unable to interpret <sceclt.dll> in the current context!
Error: Unable to interpret <ntelogon.dll> in the current context!
Error: Unable to interpret <winlogon.exe> in the current context!
Error: Unable to interpret <logevent.dll> in the current context!
Error: Unable to interpret <user32.DLL> in the current context!
Error: Unable to interpret <explorer.exe> in the current context!
Error: Unable to interpret <iaStor.sys> in the current context!
Error: Unable to interpret <nvstor.sys> in the current context!
Error: Unable to interpret <atapi.sys> in the current context!
Error: Unable to interpret <IdeChnDr.sys> in the current context!
Error: Unable to interpret <viasraid.sys> in the current context!
Error: Unable to interpret <AGP440.sys> in the current context!
Error: Unable to interpret <vaxscsi.sys> in the current context!
Error: Unable to interpret <nvatabus.sys> in the current context!
Error: Unable to interpret <viamraid.sys> in the current context!
Error: Unable to interpret <nvata.sys> in the current context!
Error: Unable to interpret <nvgts.sys> in the current context!
Error: Unable to interpret <iastorv.sys> in the current context!
Error: Unable to interpret <ViPrt.sys> in the current context!
Error: Unable to interpret <eNetHook.dll> in the current context!
Error: Unable to interpret <ahcix86.sys> in the current context!
Error: Unable to interpret <KR10N.sys> in the current context!
Error: Unable to interpret <nvstor32.sys> in the current context!
Error: Unable to interpret <ahcix86s.sys> in the current context!
Error: Unable to interpret </md5stop> in the current context!
Error: Unable to interpret <%systemroot%\system32\drivers\*.sys /lockedfiles> in the current context!
Error: Unable to interpret <%systemroot%\System32\config\*.sav> in the current context!
Error: Unable to interpret <%systemroot%\system32\*.dll /lockedfiles> in the current context!
Error: Unable to interpret <%USERPROFILE%\*.*> in the current context!
Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.exe> in the current context!
Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.dll> in the current context!
Error: Unable to interpret <%USERPROFILE%\Application Data\*.exe> in the current context!
Error: Unable to interpret <HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs> in the current context!
Error: Unable to interpret <CREATERESTOREPOINT> in the current context!

OTL by OldTimer - Version 3.2.31.0 log created on 02142012_205541

Das ist dabei raus gekommen als ich es mit dem Programm gescant habe.

du hast auf fix geklickt, aber du sollst auf quick scan klicken.

da passiert nichts ..

da passiert rein garnichts ..ich habe deinen text unten eingefügt und auf quick scan geklickt...Nichts

OTL Logfile:

Code:

OTL logfile created on: 14.02.2012 21:17:40 - Run 1

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Sam\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,61 Gb Total Physical Memory | 1,01 Gb Available Physical Memory | 63,08% Memory free

3,21 Gb Paging File | 2,62 Gb Available in Paging File | 81,70% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 128,18 Gb Total Space | 67,54 Gb Free Space | 52,69% Space Free | Partition Type: NTFS

Drive D: | 144,91 Gb Total Space | 144,82 Gb Free Space | 99,94% Space Free | Partition Type: NTFS

 

Computer Name: SAM-PC | User Name: Sam | Logged in as Administrator.

Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Sam\Desktop\OTL.exe (OldTimer Tools)

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)

SRV:64bit: - (AFBAgent) -- C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)

SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)

SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SRV - (Guard.Mail.ru) -- C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe ()

SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (ICQ Service) -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe ()

SRV - (Partner Service) -- C:\ProgramData\Partner\Partner.exe (Google Inc.)

SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)

SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)

SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)

DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)

DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)

DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)

DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronics Corp.)

DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV:64bit: - (amd_xata) -- C:\Windows\SysNative\drivers\amd_xata.sys (Advanced Micro Devices)

DRV:64bit: - (amd_sata) -- C:\Windows\SysNative\drivers\amd_sata.sys (Advanced Micro Devices)

DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)

DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)

DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)

DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)

DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)

DRV:64bit: - (amdiox64) -- C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices)

DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( )

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)

DRV - (ATKWMIACPIIO) -- C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys (ASUS)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Asus | MSN

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Asus | MSN

 

IE - HKCU\..\URLSearchHook:  - No CLSID value found

IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

 

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)

FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.04 12:43:21 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.02.04 18:03:08 | 000,000,000 | ---D | M]

 

[2012.02.04 12:43:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sam\AppData\Roaming\mozilla\Extensions

[2012.02.06 19:50:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sam\AppData\Roaming\mozilla\Firefox\Profiles\iz2kyndy.default\extensions

[2012.02.06 19:50:10 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Sam\AppData\Roaming\mozilla\Firefox\Profiles\iz2kyndy.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2012.02.13 07:54:44 | 000,001,056 | ---- | M] () -- C:\Users\Sam\AppData\Roaming\Mozilla\Firefox\Profiles\iz2kyndy.default\searchplugins\icqplugin.xml

[2012.02.04 18:03:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.02.04 18:03:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2012.01.29 17:12:48 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.02.04 18:02:31 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2011.12.09 18:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll

[2012.01.29 15:02:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.01.29 14:50:55 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.01.29 15:02:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.01.29 15:02:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.01.29 15:02:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.01.29 15:02:49 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner64.dll (Google Inc.)

O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)

O2 - BHO: (ICQ Sparberater) - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - C:\Program Files (x86)\icq\Internet Explorer\icq.dll (solute gmbh)

O2 - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll (Google Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)

O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

O3 - HKLM\..\Toolbar: (Reg Error: Value error.) - Locked - Reg Error: Value error. File not found

O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)

O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found

O4 - HKLM..\Run: [ASUSPRP] C:\Program Files (x86)\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe (ecareme)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [Guard.Mail.ru.gui] C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe ()

O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)

O4 - HKLM..\Run: [Nuance PDF Reader-reminder] C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [SonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe (Virage Logic Corporation / Sonic Focus)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)

O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (ASUS)

O4 - HKCU..\Run: [ffdwnd] C:\Users\Sam\AppData\Local\Mozilla\Firefox\firefox.exe (Tomasz Pawlak)

O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.7\ICQ.exe (ICQ, LLC.)

O4 - Startup: C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sam\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sam\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files (x86)\ICQ7.7\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files (x86)\ICQ7.7\ICQ.exe (ICQ, LLC.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{96E34C3A-48B9-4311-A83E-9C1B26261830}: DhcpNameServer = 100.100.2.16

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C7253A41-BF6B-4281-9BC1-21D7BF894E7C}: DhcpNameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

 

MsConfig:64bit - StartUpReg: ASUS Screen Saver Protector - hkey= - key= - C:\Windows\AsScrPro.exe (ASUS)

MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

MsConfig:64bit - StartUpReg: ISUSPM - hkey= - key= - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)

MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

 

CREATERESTOREPOINT

Error creating restore point.

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.02.14 20:55:41 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.02.14 19:40:13 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\ElevatedDiagnostics

[2012.02.14 19:24:08 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Sam\Desktop\OTL.exe

[2012.02.10 06:40:34 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.02.09 20:43:34 | 000,000,000 | ---D | C] -- C:\Users\Sam\Desktop\Mp3

[2012.02.09 08:11:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET

[2012.02.08 14:59:01 | 000,000,000 | ---D | C] -- C:\Users\Sam\Desktop\Projektbericht

[2012.02.08 09:45:02 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Sony Corporation

[2012.02.08 09:44:51 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Sony

[2012.02.08 09:44:28 | 000,000,000 | ---D | C] -- C:\Users\Sam\Podcasts

[2012.02.08 09:44:28 | 000,000,000 | ---D | C] -- C:\Users\Sam\Documents\Media Go

[2012.02.08 09:41:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony

[2012.02.08 09:41:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Sony Shared

[2012.02.08 09:40:43 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Downloaded Installations

[2012.02.08 09:40:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony Corporation

[2012.02.08 09:40:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony

[2012.02.08 08:33:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony Media Go Install

[2012.02.08 08:33:19 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Sony

[2012.02.07 22:30:31 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\PhotoScape

[2012.02.07 22:30:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape

[2012.02.07 22:29:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PhotoScape

[2012.02.07 11:26:06 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Windows Live

[2012.02.07 11:25:37 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\{476ACEBA-0738-48C4-B984-89FABC46AA55}

[2012.02.06 20:11:41 | 000,000,000 | ---D | C] -- C:\ProgramData\VirtualizedApplications

[2012.02.06 19:51:47 | 000,000,000 | ---D | C] -- C:\Users\Sam\Desktop\Meine Musik

[2012.02.06 19:51:02 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\DVDVideoSoft

[2012.02.06 19:50:09 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\DVDVideoSoftIEHelpers

[2012.02.06 19:49:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft

[2012.02.06 19:49:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft

[2012.02.06 19:49:20 | 000,000,000 | ---D | C] -- C:\Users\Sam\Documents\DVDVideoSoft

[2012.02.06 19:49:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft

[2012.02.06 16:51:38 | 000,000,000 | RH-D | C] -- C:\MSOCache

[2012.02.06 16:46:10 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\SoftGrid Client

[2012.02.06 16:46:06 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\SoftGrid Client

[2012.02.06 16:45:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Starter (Deutsch)

[2012.02.06 16:43:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER

[2012.02.06 16:43:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office

[2012.02.06 16:43:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Application Virtualization Client

[2012.02.06 16:34:09 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\TP

[2012.02.06 07:51:28 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center

[2012.02.05 13:12:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\icq

[2012.02.05 13:12:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.7

[2012.02.05 13:12:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ6Toolbar

[2012.02.05 13:12:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Guard-ICQ

[2012.02.05 13:12:24 | 000,000,000 | ---D | C] -- C:\ProgramData\ICQ

[2012.02.05 13:11:48 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\ICQ

[2012.02.05 13:11:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ7.7

[2012.02.04 20:14:03 | 000,000,000 | ---D | C] -- C:\Users\Sam\Desktop\Sam

[2012.02.04 19:35:20 | 000,000,000 | ---D | C] -- C:\Users\Sam\Desktop\Projekt Action Painting  - Schriftliches

[2012.02.04 18:37:36 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Avira

[2012.02.04 18:11:48 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\OpenOffice.org

[2012.02.04 18:10:12 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3

[2012.02.04 18:07:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3

[2012.02.04 18:03:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun

[2012.02.04 18:03:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2012.02.04 18:02:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java

[2012.02.04 17:55:00 | 000,000,000 | ---D | C] -- C:\Users\Sam\Desktop\OpenOffice.org 3.3 (de) Installation Files

[2012.02.04 17:31:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2012.02.04 17:31:40 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys

[2012.02.04 17:31:39 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys

[2012.02.04 17:31:39 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys

[2012.02.04 17:31:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2012.02.04 17:31:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira

[2012.02.04 17:24:22 | 000,000,000 | ---D | C] -- C:\ProgramData\MumboJumbo

[2012.02.04 17:21:27 | 000,000,000 | ---D | C] -- C:\Users\Sam\Documents\ASUS

[2012.02.04 17:21:14 | 000,000,000 | ---D | C] -- C:\ProgramData\ASUS

[2012.02.04 17:21:11 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\ASUS

[2012.02.04 17:20:40 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Nuance

[2012.02.04 17:20:35 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Zeon

[2012.02.04 17:19:45 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee

[2012.02.04 17:19:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed

[2012.02.04 12:53:45 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Winamp Erkennungs-Plug-in

[2012.02.04 12:53:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp Detect

[2012.02.04 12:53:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine

[2012.02.04 12:53:26 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Winamp

[2012.02.04 12:53:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp

[2012.02.04 12:43:30 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Mozilla

[2012.02.04 12:43:30 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Mozilla

[2012.02.04 12:43:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

[2012.02.04 12:35:39 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\ASUS WebStorage

[2012.02.04 12:26:50 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Macromedia

[2012.02.04 12:26:44 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Adobe

[2012.02.04 12:26:31 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Google

[2012.02.04 12:20:12 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center

[2012.02.04 12:20:08 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\AMD

[2012.02.04 12:19:42 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\ATI

[2012.02.04 12:19:41 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\ATI

[2012.02.04 12:17:51 | 000,000,000 | R--D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

[2012.02.04 12:17:51 | 000,000,000 | R--D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

[2012.02.04 12:17:50 | 000,000,000 | R--D | C] -- C:\Users\Sam\Searches

[2012.02.04 12:17:23 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Identities

[2012.02.04 12:17:14 | 000,000,000 | R--D | C] -- C:\Users\Sam\Contacts

[2012.02.04 12:16:19 | 000,000,000 | R-SD | C] -- C:\Users\Public\Desktop\AsusTools

[2012.02.04 12:16:19 | 000,000,000 | ---D | C] -- C:\ProgramData\FolderView

[2012.02.04 12:16:17 | 000,000,000 | -H-D | C] -- C:\ASUS.DAT

[2012.02.04 12:15:56 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Power2Go

[2012.02.04 12:15:52 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\VirtualStore

[2012.02.04 12:15:50 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\FLEXnet

[2012.02.04 12:15:23 | 000,000,000 | --SD | C] -- C:\Users\Sam\AppData\Roaming\Microsoft

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Videos

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Saved Games

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Pictures

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Music

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Links

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Favorites

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Downloads

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Documents

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Desktop

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Vorlagen

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\AppData\Local\Verlauf

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\AppData\Local\Temporary Internet Files

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Startmenü

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\SendTo

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Recent

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Netzwerkumgebung

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Lokale Einstellungen

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Documents\Eigene Videos

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Documents\Eigene Musik

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Eigene Dateien

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Documents\Eigene Bilder

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Druckumgebung

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Cookies

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\AppData\Local\Anwendungsdaten

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Anwendungsdaten

[2012.02.04 12:15:23 | 000,000,000 | -H-D | C] -- C:\Users\Sam\AppData

[2012.02.04 12:15:23 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Temp

[2012.02.04 12:15:23 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Microsoft

[2012.02.04 12:15:23 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Media Center Programs

[2012.02.04 12:15:23 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink Blu-ray Disc Suite

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.02.14 21:16:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.02.14 21:15:56 | 1292,673,024 | -HS- | M] () -- C:\hiberfil.sys

[2012.02.14 20:21:03 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.02.14 19:24:24 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Sam\Desktop\OTL.exe

[2012.02.14 19:04:14 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.02.14 19:04:14 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.02.14 18:54:47 | 000,001,978 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini

[2012.02.14 18:43:01 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.02.14 17:10:37 | 007,287,162 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.02.14 17:10:37 | 000,706,286 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat

[2012.02.14 17:10:37 | 000,703,048 | ---- | M] () -- C:\Windows\SysNative\perfh013.dat

[2012.02.14 17:10:37 | 000,700,964 | ---- | M] () -- C:\Windows\SysNative\perfh010.dat

[2012.02.14 17:10:37 | 000,691,198 | ---- | M] () -- C:\Windows\SysNative\prfh0816.dat

[2012.02.14 17:10:37 | 000,687,814 | ---- | M] () -- C:\Windows\SysNative\perfh019.dat

[2012.02.14 17:10:37 | 000,666,022 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.02.14 17:10:37 | 000,627,864 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.02.14 17:10:37 | 000,563,626 | ---- | M] () -- C:\Windows\SysNative\perfh008.dat

[2012.02.14 17:10:37 | 000,397,176 | ---- | M] () -- C:\Windows\SysNative\prfh0404.dat

[2012.02.14 17:10:37 | 000,365,378 | ---- | M] () -- C:\Windows\SysNative\perfh00D.dat

[2012.02.14 17:10:37 | 000,137,690 | ---- | M] () -- C:\Windows\SysNative\prfc0816.dat

[2012.02.14 17:10:37 | 000,136,878 | ---- | M] () -- C:\Windows\SysNative\perfc013.dat

[2012.02.14 17:10:37 | 000,136,454 | ---- | M] () -- C:\Windows\SysNative\perfc019.dat

[2012.02.14 17:10:37 | 000,134,078 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat

[2012.02.14 17:10:37 | 000,133,944 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.02.14 17:10:37 | 000,131,082 | ---- | M] () -- C:\Windows\SysNative\perfc010.dat

[2012.02.14 17:10:37 | 000,110,326 | ---- | M] () -- C:\Windows\SysNative\prfc0404.dat

[2012.02.14 17:10:37 | 000,110,326 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.02.14 17:10:37 | 000,093,374 | ---- | M] () -- C:\Windows\SysNative\perfc008.dat

[2012.02.14 17:10:37 | 000,073,032 | ---- | M] () -- C:\Windows\SysNative\perfc00D.dat

[2012.02.13 09:31:15 | 000,022,258 | ---- | M] () -- C:\Users\Sam\Desktop\430144_309833995732744_100001184389807_795672_458190282_n.jpg

[2012.02.09 08:31:15 | 000,001,241 | ---- | M] () -- C:\Users\Sam\Desktop\DVDVideoSoft Free Studio.lnk

[2012.02.09 08:31:13 | 000,002,230 | ---- | M] () -- C:\Users\Sam\Desktop\Free Audio Converter.lnk

[2012.02.08 09:41:53 | 000,001,887 | ---- | M] () -- C:\Users\Public\Desktop\Media Go.lnk

[2012.02.08 07:48:46 | 008,095,012 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.02.07 22:30:27 | 000,001,033 | ---- | M] () -- C:\Users\Sam\Desktop\PhotoScape.lnk

[2012.02.07 08:30:44 | 000,293,616 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.02.06 19:49:49 | 000,001,400 | ---- | M] () -- C:\Users\Sam\Desktop\Free YouTube to MP3 Converter.lnk

[2012.02.06 07:52:41 | 000,001,227 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini

[2012.02.05 20:37:54 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf

[2012.02.05 13:12:35 | 000,001,826 | ---- | M] () -- C:\Users\Public\Desktop\ICQ7.7.lnk

[2012.02.05 12:34:05 | 000,001,022 | ---- | M] () -- C:\Users\Public\Desktop\LifeFrame.lnk

[2012.02.05 12:32:29 | 000,002,595 | ---- | M] () -- C:\Users\Public\Desktop\AI Recovery Burner.lnk

[2012.02.05 03:07:11 | 000,159,772 | ---- | M] () -- C:\Windows\SysWow64\license.rtf

[2012.02.05 03:07:11 | 000,159,772 | ---- | M] () -- C:\Windows\SysNative\license.rtf

[2012.02.04 18:12:12 | 000,001,237 | ---- | M] () -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk

[2012.02.04 18:10:13 | 000,001,124 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk

[2012.02.04 17:31:57 | 000,002,068 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.02.04 12:56:02 | 000,000,981 | ---- | M] () -- C:\Users\Public\Desktop\Winamp.lnk

[2012.02.04 12:43:23 | 000,001,132 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.02.04 12:16:48 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe

[2012.02.04 12:14:41 | 000,000,080 | ---- | M] () -- C:\Windows\SysNative\Defrag.ini

 
 ========== Files Created - No Company Name ==========

 

[2012.02.13 09:26:25 | 000,022,258 | ---- | C] () -- C:\Users\Sam\Desktop\430144_309833995732744_100001184389807_795672_458190282_n.jpg

[2012.02.09 08:31:13 | 000,002,230 | ---- | C] () -- C:\Users\Sam\Desktop\Free Audio Converter.lnk

[2012.02.08 09:41:53 | 000,001,887 | ---- | C] () -- C:\Users\Public\Desktop\Media Go.lnk

[2012.02.07 22:30:27 | 000,001,033 | ---- | C] () -- C:\Users\Sam\Desktop\PhotoScape.lnk

[2012.02.06 19:49:51 | 000,001,241 | ---- | C] () -- C:\Users\Sam\Desktop\DVDVideoSoft Free Studio.lnk

[2012.02.06 19:49:49 | 000,001,400 | ---- | C] () -- C:\Users\Sam\Desktop\Free YouTube to MP3 Converter.lnk

[2012.02.06 16:44:03 | 008,095,012 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.02.05 20:37:54 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf

[2012.02.05 13:12:35 | 000,001,826 | ---- | C] () -- C:\Users\Public\Desktop\ICQ7.7.lnk

[2012.02.05 12:33:58 | 000,001,022 | ---- | C] () -- C:\Users\Public\Desktop\LifeFrame.lnk

[2012.02.05 12:32:29 | 000,002,595 | ---- | C] () -- C:\Users\Public\Desktop\AI Recovery Burner.lnk

[2012.02.04 18:46:44 | 000,001,441 | ---- | C] () -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

[2012.02.04 18:12:12 | 000,001,237 | ---- | C] () -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk

[2012.02.04 18:10:13 | 000,001,124 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk

[2012.02.04 17:31:57 | 000,002,068 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.02.04 12:56:02 | 000,000,981 | ---- | C] () -- C:\Users\Public\Desktop\Winamp.lnk

[2012.02.04 12:43:23 | 000,001,144 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2012.02.04 12:43:23 | 000,001,132 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.02.04 12:19:15 | 000,001,407 | ---- | C] () -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk

[2011.11.16 05:59:53 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.11.16 05:55:29 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2011.07.14 03:55:06 | 000,053,760 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll

[2011.04.13 03:48:48 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe

[2009.07.29 06:20:40 | 000,000,010 | ---- | C] () -- C:\Windows\SysWow64\ABLKSR.ini

[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

[2009.02.26 07:50:32 | 000,000,176 | ---- | C] () -- C:\Windows\explorer.exe.config

 
 ========== LOP Check ==========

 

[2012.02.04 12:35:39 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\ASUS WebStorage

[2012.02.09 08:31:21 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\DVDVideoSoft

[2012.02.06 19:50:09 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\DVDVideoSoftIEHelpers

[2012.02.14 18:57:35 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\ICQ

[2012.02.04 17:20:40 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\Nuance

[2012.02.04 18:11:48 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\OpenOffice.org

[2012.02.13 09:28:39 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\PhotoScape

[2012.02.10 06:27:41 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\SoftGrid Client

[2012.02.08 09:44:23 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\Sony

[2012.02.06 16:46:56 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\TP

[2012.02.04 17:20:35 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\Zeon

[2009.07.14 06:08:49 | 000,010,268 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2012.02.04 12:17:11 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin

[2012.02.14 20:21:10 | 000,000,000 | -H-D | M] -- C:\ASUS.DAT

[2011.04.13 03:49:40 | 000,000,000 | ---D | M] -- C:\AsusVibeData

[2009.07.29 07:03:34 | 000,000,000 | -HSD | M] -- C:\Boot

[2012.02.10 18:13:18 | 000,000,000 | -HSD | M] -- C:\Config.Msi

[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2011.11.16 06:08:33 | 000,000,000 | ---D | M] -- C:\eSupport

[2012.02.06 16:51:38 | 000,000,000 | RH-D | M] -- C:\MSOCache

[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2012.02.06 16:43:30 | 000,000,000 | R--D | M] -- C:\Program Files

[2012.02.09 08:11:44 | 000,000,000 | R--D | M] -- C:\Program Files (x86)

[2012.02.08 09:40:06 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2012.02.04 12:12:46 | 000,000,000 | -HSD | M] -- C:\Recovery

[2012.02.14 20:37:05 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2012.02.04 12:15:22 | 000,000,000 | R--D | M] -- C:\Users

[2012.02.14 19:06:53 | 000,000,000 | ---D | M] -- C:\Windows

[2012.02.14 20:55:41 | 000,000,000 | ---D | M] -- C:\_OTL

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: EXPLORER.EXE  >

[2011.02.26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe

[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe

[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe

[2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe

[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe

[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe

[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe

[2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe

[2010.11.20 13:17:10 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe

[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe

[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe

[2010.11.20 14:24:46 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

[2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe

[2011.02.26 07:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 14:33:40 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 14:33:40 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 07:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010.11.20 14:27:24 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.20 14:27:24 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 13:20:30 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.20 13:20:30 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 07:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 14:33:50 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 14:33:50 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010.11.20 13:21:06 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.20 13:21:06 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 14:27:26 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.20 14:27:26 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.20 13:08:58 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.20 13:08:58 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010.11.20 14:27:28 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.20 14:27:28 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 13:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 13:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010.11.20 14:25:26 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 14:25:26 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.20 14:25:32 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 14:25:32 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 < %USERPROFILE%\*.* >

[2012.02.14 21:39:11 | 001,048,576 | -HS- | M] () -- C:\Users\Sam\NTUSER.DAT

[2012.02.14 21:39:11 | 000,262,144 | -HS- | M] () -- C:\Users\Sam\ntuser.dat.LOG1

[2012.02.04 12:15:23 | 000,000,000 | -HS- | M] () -- C:\Users\Sam\ntuser.dat.LOG2

[2012.02.04 12:59:28 | 000,065,536 | -HS- | M] () -- C:\Users\Sam\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf

[2012.02.04 12:59:28 | 000,524,288 | -HS- | M] () -- C:\Users\Sam\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms

[2012.02.04 12:59:28 | 000,524,288 | -HS- | M] () -- C:\Users\Sam\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms

[2012.02.04 12:15:24 | 000,000,020 | -HS- | M] () -- C:\Users\Sam\ntuser.ini

 
 < %USERPROFILE%\Local Settings\Temp\*.exe >

 
 < %USERPROFILE%\Local Settings\Temp\*.dll >

 
 < %USERPROFILE%\Application Data\*.exe >

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

 
 <           >

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:41099CE9

@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:981884E7
 

< End of report >

--- --- ---

OTL Logfile:

Code:

OTL logfile created on: 14.02.2012 21:17:40 - Run 1

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Sam\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,61 Gb Total Physical Memory | 1,01 Gb Available Physical Memory | 63,08% Memory free

3,21 Gb Paging File | 2,62 Gb Available in Paging File | 81,70% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 128,18 Gb Total Space | 67,54 Gb Free Space | 52,69% Space Free | Partition Type: NTFS

Drive D: | 144,91 Gb Total Space | 144,82 Gb Free Space | 99,94% Space Free | Partition Type: NTFS

 

Computer Name: SAM-PC | User Name: Sam | Logged in as Administrator.

Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Sam\Desktop\OTL.exe (OldTimer Tools)

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)

SRV:64bit: - (AFBAgent) -- C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)

SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)

SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SRV - (Guard.Mail.ru) -- C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe ()

SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (ICQ Service) -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe ()

SRV - (Partner Service) -- C:\ProgramData\Partner\Partner.exe (Google Inc.)

SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)

SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)

SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)

DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)

DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)

DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)

DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronics Corp.)

DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV:64bit: - (amd_xata) -- C:\Windows\SysNative\drivers\amd_xata.sys (Advanced Micro Devices)

DRV:64bit: - (amd_sata) -- C:\Windows\SysNative\drivers\amd_sata.sys (Advanced Micro Devices)

DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)

DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)

DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)

DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)

DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)

DRV:64bit: - (amdiox64) -- C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices)

DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( )

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)

DRV - (ATKWMIACPIIO) -- C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys (ASUS)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Asus | MSN

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Asus | MSN

 

IE - HKCU\..\URLSearchHook:  - No CLSID value found

IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

 

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)

FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.04 12:43:21 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.02.04 18:03:08 | 000,000,000 | ---D | M]

 

[2012.02.04 12:43:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sam\AppData\Roaming\mozilla\Extensions

[2012.02.06 19:50:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sam\AppData\Roaming\mozilla\Firefox\Profiles\iz2kyndy.default\extensions

[2012.02.06 19:50:10 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Sam\AppData\Roaming\mozilla\Firefox\Profiles\iz2kyndy.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2012.02.13 07:54:44 | 000,001,056 | ---- | M] () -- C:\Users\Sam\AppData\Roaming\Mozilla\Firefox\Profiles\iz2kyndy.default\searchplugins\icqplugin.xml

[2012.02.04 18:03:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.02.04 18:03:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2012.01.29 17:12:48 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.02.04 18:02:31 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2011.12.09 18:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll

[2012.01.29 15:02:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.01.29 14:50:55 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.01.29 15:02:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.01.29 15:02:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.01.29 15:02:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.01.29 15:02:49 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner64.dll (Google Inc.)

O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)

O2 - BHO: (ICQ Sparberater) - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - C:\Program Files (x86)\icq\Internet Explorer\icq.dll (solute gmbh)

O2 - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll (Google Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)

O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

O3 - HKLM\..\Toolbar: (Reg Error: Value error.) - Locked - Reg Error: Value error. File not found

O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)

O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found

O4 - HKLM..\Run: [ASUSPRP] C:\Program Files (x86)\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe (ecareme)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [Guard.Mail.ru.gui] C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe ()

O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)

O4 - HKLM..\Run: [Nuance PDF Reader-reminder] C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [SonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe (Virage Logic Corporation / Sonic Focus)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)

O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (ASUS)

O4 - HKCU..\Run: [ffdwnd] C:\Users\Sam\AppData\Local\Mozilla\Firefox\firefox.exe (Tomasz Pawlak)

O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.7\ICQ.exe (ICQ, LLC.)

O4 - Startup: C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sam\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sam\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files (x86)\ICQ7.7\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files (x86)\ICQ7.7\ICQ.exe (ICQ, LLC.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{96E34C3A-48B9-4311-A83E-9C1B26261830}: DhcpNameServer = 100.100.2.16

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C7253A41-BF6B-4281-9BC1-21D7BF894E7C}: DhcpNameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

 

MsConfig:64bit - StartUpReg: ASUS Screen Saver Protector - hkey= - key= - C:\Windows\AsScrPro.exe (ASUS)

MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

MsConfig:64bit - StartUpReg: ISUSPM - hkey= - key= - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)

MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

 

CREATERESTOREPOINT

Error creating restore point.

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.02.14 20:55:41 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.02.14 19:40:13 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\ElevatedDiagnostics

[2012.02.14 19:24:08 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Sam\Desktop\OTL.exe

[2012.02.10 06:40:34 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.02.09 20:43:34 | 000,000,000 | ---D | C] -- C:\Users\Sam\Desktop\Mp3

[2012.02.09 08:11:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET

[2012.02.08 14:59:01 | 000,000,000 | ---D | C] -- C:\Users\Sam\Desktop\Projektbericht

[2012.02.08 09:45:02 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Sony Corporation

[2012.02.08 09:44:51 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Sony

[2012.02.08 09:44:28 | 000,000,000 | ---D | C] -- C:\Users\Sam\Podcasts

[2012.02.08 09:44:28 | 000,000,000 | ---D | C] -- C:\Users\Sam\Documents\Media Go

[2012.02.08 09:41:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony

[2012.02.08 09:41:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Sony Shared

[2012.02.08 09:40:43 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Downloaded Installations

[2012.02.08 09:40:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony Corporation

[2012.02.08 09:40:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony

[2012.02.08 08:33:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony Media Go Install

[2012.02.08 08:33:19 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Sony

[2012.02.07 22:30:31 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\PhotoScape

[2012.02.07 22:30:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape

[2012.02.07 22:29:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PhotoScape

[2012.02.07 11:26:06 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Windows Live

[2012.02.07 11:25:37 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\{476ACEBA-0738-48C4-B984-89FABC46AA55}

[2012.02.06 20:11:41 | 000,000,000 | ---D | C] -- C:\ProgramData\VirtualizedApplications

[2012.02.06 19:51:47 | 000,000,000 | ---D | C] -- C:\Users\Sam\Desktop\Meine Musik

[2012.02.06 19:51:02 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\DVDVideoSoft

[2012.02.06 19:50:09 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\DVDVideoSoftIEHelpers

[2012.02.06 19:49:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft

[2012.02.06 19:49:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft

[2012.02.06 19:49:20 | 000,000,000 | ---D | C] -- C:\Users\Sam\Documents\DVDVideoSoft

[2012.02.06 19:49:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft

[2012.02.06 16:51:38 | 000,000,000 | RH-D | C] -- C:\MSOCache

[2012.02.06 16:46:10 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\SoftGrid Client

[2012.02.06 16:46:06 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\SoftGrid Client

[2012.02.06 16:45:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Starter (Deutsch)

[2012.02.06 16:43:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER

[2012.02.06 16:43:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office

[2012.02.06 16:43:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Application Virtualization Client

[2012.02.06 16:34:09 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\TP

[2012.02.06 07:51:28 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center

[2012.02.05 13:12:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\icq

[2012.02.05 13:12:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.7

[2012.02.05 13:12:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ6Toolbar

[2012.02.05 13:12:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Guard-ICQ

[2012.02.05 13:12:24 | 000,000,000 | ---D | C] -- C:\ProgramData\ICQ

[2012.02.05 13:11:48 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\ICQ

[2012.02.05 13:11:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ7.7

[2012.02.04 20:14:03 | 000,000,000 | ---D | C] -- C:\Users\Sam\Desktop\Sam

[2012.02.04 19:35:20 | 000,000,000 | ---D | C] -- C:\Users\Sam\Desktop\Projekt Action Painting  - Schriftliches

[2012.02.04 18:37:36 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Avira

[2012.02.04 18:11:48 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\OpenOffice.org

[2012.02.04 18:10:12 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3

[2012.02.04 18:07:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3

[2012.02.04 18:03:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun

[2012.02.04 18:03:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2012.02.04 18:02:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java

[2012.02.04 17:55:00 | 000,000,000 | ---D | C] -- C:\Users\Sam\Desktop\OpenOffice.org 3.3 (de) Installation Files

[2012.02.04 17:31:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2012.02.04 17:31:40 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys

[2012.02.04 17:31:39 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys

[2012.02.04 17:31:39 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys

[2012.02.04 17:31:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2012.02.04 17:31:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira

[2012.02.04 17:24:22 | 000,000,000 | ---D | C] -- C:\ProgramData\MumboJumbo

[2012.02.04 17:21:27 | 000,000,000 | ---D | C] -- C:\Users\Sam\Documents\ASUS

[2012.02.04 17:21:14 | 000,000,000 | ---D | C] -- C:\ProgramData\ASUS

[2012.02.04 17:21:11 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\ASUS

[2012.02.04 17:20:40 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Nuance

[2012.02.04 17:20:35 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Zeon

[2012.02.04 17:19:45 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee

[2012.02.04 17:19:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed

[2012.02.04 12:53:45 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Winamp Erkennungs-Plug-in

[2012.02.04 12:53:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp Detect

[2012.02.04 12:53:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine

[2012.02.04 12:53:26 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Winamp

[2012.02.04 12:53:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp

[2012.02.04 12:43:30 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Mozilla

[2012.02.04 12:43:30 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Mozilla

[2012.02.04 12:43:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

[2012.02.04 12:35:39 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\ASUS WebStorage

[2012.02.04 12:26:50 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Macromedia

[2012.02.04 12:26:44 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Adobe

[2012.02.04 12:26:31 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Google

[2012.02.04 12:20:12 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center

[2012.02.04 12:20:08 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\AMD

[2012.02.04 12:19:42 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\ATI

[2012.02.04 12:19:41 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\ATI

[2012.02.04 12:17:51 | 000,000,000 | R--D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

[2012.02.04 12:17:51 | 000,000,000 | R--D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

[2012.02.04 12:17:50 | 000,000,000 | R--D | C] -- C:\Users\Sam\Searches

[2012.02.04 12:17:23 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Identities

[2012.02.04 12:17:14 | 000,000,000 | R--D | C] -- C:\Users\Sam\Contacts

[2012.02.04 12:16:19 | 000,000,000 | R-SD | C] -- C:\Users\Public\Desktop\AsusTools

[2012.02.04 12:16:19 | 000,000,000 | ---D | C] -- C:\ProgramData\FolderView

[2012.02.04 12:16:17 | 000,000,000 | -H-D | C] -- C:\ASUS.DAT

[2012.02.04 12:15:56 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Power2Go

[2012.02.04 12:15:52 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\VirtualStore

[2012.02.04 12:15:50 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\FLEXnet

[2012.02.04 12:15:23 | 000,000,000 | --SD | C] -- C:\Users\Sam\AppData\Roaming\Microsoft

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Videos

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Saved Games

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Pictures

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Music

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Links

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Favorites

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Downloads

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Documents

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\Desktop

[2012.02.04 12:15:23 | 000,000,000 | R--D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Vorlagen

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\AppData\Local\Verlauf

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\AppData\Local\Temporary Internet Files

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Startmenü

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\SendTo

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Recent

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Netzwerkumgebung

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Lokale Einstellungen

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Documents\Eigene Videos

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Documents\Eigene Musik

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Eigene Dateien

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Documents\Eigene Bilder

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Druckumgebung

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Cookies

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\AppData\Local\Anwendungsdaten

[2012.02.04 12:15:23 | 000,000,000 | -HSD | C] -- C:\Users\Sam\Anwendungsdaten

[2012.02.04 12:15:23 | 000,000,000 | -H-D | C] -- C:\Users\Sam\AppData

[2012.02.04 12:15:23 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Temp

[2012.02.04 12:15:23 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Local\Microsoft

[2012.02.04 12:15:23 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Media Center Programs

[2012.02.04 12:15:23 | 000,000,000 | ---D | C] -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink Blu-ray Disc Suite

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.02.14 21:16:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.02.14 21:15:56 | 1292,673,024 | -HS- | M] () -- C:\hiberfil.sys

[2012.02.14 20:21:03 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.02.14 19:24:24 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Sam\Desktop\OTL.exe

[2012.02.14 19:04:14 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.02.14 19:04:14 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.02.14 18:54:47 | 000,001,978 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini

[2012.02.14 18:43:01 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.02.14 17:10:37 | 007,287,162 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.02.14 17:10:37 | 000,706,286 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat

[2012.02.14 17:10:37 | 000,703,048 | ---- | M] () -- C:\Windows\SysNative\perfh013.dat

[2012.02.14 17:10:37 | 000,700,964 | ---- | M] () -- C:\Windows\SysNative\perfh010.dat

[2012.02.14 17:10:37 | 000,691,198 | ---- | M] () -- C:\Windows\SysNative\prfh0816.dat

[2012.02.14 17:10:37 | 000,687,814 | ---- | M] () -- C:\Windows\SysNative\perfh019.dat

[2012.02.14 17:10:37 | 000,666,022 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.02.14 17:10:37 | 000,627,864 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.02.14 17:10:37 | 000,563,626 | ---- | M] () -- C:\Windows\SysNative\perfh008.dat

[2012.02.14 17:10:37 | 000,397,176 | ---- | M] () -- C:\Windows\SysNative\prfh0404.dat

[2012.02.14 17:10:37 | 000,365,378 | ---- | M] () -- C:\Windows\SysNative\perfh00D.dat

[2012.02.14 17:10:37 | 000,137,690 | ---- | M] () -- C:\Windows\SysNative\prfc0816.dat

[2012.02.14 17:10:37 | 000,136,878 | ---- | M] () -- C:\Windows\SysNative\perfc013.dat

[2012.02.14 17:10:37 | 000,136,454 | ---- | M] () -- C:\Windows\SysNative\perfc019.dat

[2012.02.14 17:10:37 | 000,134,078 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat

[2012.02.14 17:10:37 | 000,133,944 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.02.14 17:10:37 | 000,131,082 | ---- | M] () -- C:\Windows\SysNative\perfc010.dat

[2012.02.14 17:10:37 | 000,110,326 | ---- | M] () -- C:\Windows\SysNative\prfc0404.dat

[2012.02.14 17:10:37 | 000,110,326 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.02.14 17:10:37 | 000,093,374 | ---- | M] () -- C:\Windows\SysNative\perfc008.dat

[2012.02.14 17:10:37 | 000,073,032 | ---- | M] () -- C:\Windows\SysNative\perfc00D.dat

[2012.02.13 09:31:15 | 000,022,258 | ---- | M] () -- C:\Users\Sam\Desktop\430144_309833995732744_100001184389807_795672_458190282_n.jpg

[2012.02.09 08:31:15 | 000,001,241 | ---- | M] () -- C:\Users\Sam\Desktop\DVDVideoSoft Free Studio.lnk

[2012.02.09 08:31:13 | 000,002,230 | ---- | M] () -- C:\Users\Sam\Desktop\Free Audio Converter.lnk

[2012.02.08 09:41:53 | 000,001,887 | ---- | M] () -- C:\Users\Public\Desktop\Media Go.lnk

[2012.02.08 07:48:46 | 008,095,012 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.02.07 22:30:27 | 000,001,033 | ---- | M] () -- C:\Users\Sam\Desktop\PhotoScape.lnk

[2012.02.07 08:30:44 | 000,293,616 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.02.06 19:49:49 | 000,001,400 | ---- | M] () -- C:\Users\Sam\Desktop\Free YouTube to MP3 Converter.lnk

[2012.02.06 07:52:41 | 000,001,227 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini

[2012.02.05 20:37:54 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf

[2012.02.05 13:12:35 | 000,001,826 | ---- | M] () -- C:\Users\Public\Desktop\ICQ7.7.lnk

[2012.02.05 12:34:05 | 000,001,022 | ---- | M] () -- C:\Users\Public\Desktop\LifeFrame.lnk

[2012.02.05 12:32:29 | 000,002,595 | ---- | M] () -- C:\Users\Public\Desktop\AI Recovery Burner.lnk

[2012.02.05 03:07:11 | 000,159,772 | ---- | M] () -- C:\Windows\SysWow64\license.rtf

[2012.02.05 03:07:11 | 000,159,772 | ---- | M] () -- C:\Windows\SysNative\license.rtf

[2012.02.04 18:12:12 | 000,001,237 | ---- | M] () -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk

[2012.02.04 18:10:13 | 000,001,124 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk

[2012.02.04 17:31:57 | 000,002,068 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.02.04 12:56:02 | 000,000,981 | ---- | M] () -- C:\Users\Public\Desktop\Winamp.lnk

[2012.02.04 12:43:23 | 000,001,132 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.02.04 12:16:48 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe

[2012.02.04 12:14:41 | 000,000,080 | ---- | M] () -- C:\Windows\SysNative\Defrag.ini

 
 ========== Files Created - No Company Name ==========

 

[2012.02.13 09:26:25 | 000,022,258 | ---- | C] () -- C:\Users\Sam\Desktop\430144_309833995732744_100001184389807_795672_458190282_n.jpg

[2012.02.09 08:31:13 | 000,002,230 | ---- | C] () -- C:\Users\Sam\Desktop\Free Audio Converter.lnk

[2012.02.08 09:41:53 | 000,001,887 | ---- | C] () -- C:\Users\Public\Desktop\Media Go.lnk

[2012.02.07 22:30:27 | 000,001,033 | ---- | C] () -- C:\Users\Sam\Desktop\PhotoScape.lnk

[2012.02.06 19:49:51 | 000,001,241 | ---- | C] () -- C:\Users\Sam\Desktop\DVDVideoSoft Free Studio.lnk

[2012.02.06 19:49:49 | 000,001,400 | ---- | C] () -- C:\Users\Sam\Desktop\Free YouTube to MP3 Converter.lnk

[2012.02.06 16:44:03 | 008,095,012 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.02.05 20:37:54 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf

[2012.02.05 13:12:35 | 000,001,826 | ---- | C] () -- C:\Users\Public\Desktop\ICQ7.7.lnk

[2012.02.05 12:33:58 | 000,001,022 | ---- | C] () -- C:\Users\Public\Desktop\LifeFrame.lnk

[2012.02.05 12:32:29 | 000,002,595 | ---- | C] () -- C:\Users\Public\Desktop\AI Recovery Burner.lnk

[2012.02.04 18:46:44 | 000,001,441 | ---- | C] () -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

[2012.02.04 18:12:12 | 000,001,237 | ---- | C] () -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk

[2012.02.04 18:10:13 | 000,001,124 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk

[2012.02.04 17:31:57 | 000,002,068 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.02.04 12:56:02 | 000,000,981 | ---- | C] () -- C:\Users\Public\Desktop\Winamp.lnk

[2012.02.04 12:43:23 | 000,001,144 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2012.02.04 12:43:23 | 000,001,132 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.02.04 12:19:15 | 000,001,407 | ---- | C] () -- C:\Users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk

[2011.11.16 05:59:53 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.11.16 05:55:29 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2011.07.14 03:55:06 | 000,053,760 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll

[2011.04.13 03:48:48 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe

[2009.07.29 06:20:40 | 000,000,010 | ---- | C] () -- C:\Windows\SysWow64\ABLKSR.ini

[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

[2009.02.26 07:50:32 | 000,000,176 | ---- | C] () -- C:\Windows\explorer.exe.config

 
 ========== LOP Check ==========

 

[2012.02.04 12:35:39 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\ASUS WebStorage

[2012.02.09 08:31:21 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\DVDVideoSoft

[2012.02.06 19:50:09 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\DVDVideoSoftIEHelpers

[2012.02.14 18:57:35 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\ICQ

[2012.02.04 17:20:40 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\Nuance

[2012.02.04 18:11:48 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\OpenOffice.org

[2012.02.13 09:28:39 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\PhotoScape

[2012.02.10 06:27:41 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\SoftGrid Client

[2012.02.08 09:44:23 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\Sony

[2012.02.06 16:46:56 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\TP

[2012.02.04 17:20:35 | 000,000,000 | ---D | M] -- C:\Users\Sam\AppData\Roaming\Zeon

[2009.07.14 06:08:49 | 000,010,268 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2012.02.04 12:17:11 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin

[2012.02.14 20:21:10 | 000,000,000 | -H-D | M] -- C:\ASUS.DAT

[2011.04.13 03:49:40 | 000,000,000 | ---D | M] -- C:\AsusVibeData

[2009.07.29 07:03:34 | 000,000,000 | -HSD | M] -- C:\Boot

[2012.02.10 18:13:18 | 000,000,000 | -HSD | M] -- C:\Config.Msi

[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2011.11.16 06:08:33 | 000,000,000 | ---D | M] -- C:\eSupport

[2012.02.06 16:51:38 | 000,000,000 | RH-D | M] -- C:\MSOCache

[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2012.02.06 16:43:30 | 000,000,000 | R--D | M] -- C:\Program Files

[2012.02.09 08:11:44 | 000,000,000 | R--D | M] -- C:\Program Files (x86)

[2012.02.08 09:40:06 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2012.02.04 12:12:46 | 000,000,000 | -HSD | M] -- C:\Recovery

[2012.02.14 20:37:05 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2012.02.04 12:15:22 | 000,000,000 | R--D | M] -- C:\Users

[2012.02.14 19:06:53 | 000,000,000 | ---D | M] -- C:\Windows

[2012.02.14 20:55:41 | 000,000,000 | ---D | M] -- C:\_OTL

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: EXPLORER.EXE  >

[2011.02.26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe

[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe

[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe

[2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe

[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe

[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe

[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe

[2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe

[2010.11.20 13:17:10 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe

[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe

[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe

[2010.11.20 14:24:46 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

[2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe

[2011.02.26 07:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 14:33:40 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 14:33:40 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 07:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010.11.20 14:27:24 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.20 14:27:24 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 13:20:30 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.20 13:20:30 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 07:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 14:33:50 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 14:33:50 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010.11.20 13:21:06 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.20 13:21:06 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 14:27:26 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.20 14:27:26 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.20 13:08:58 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.20 13:08:58 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010.11.20 14:27:28 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.20 14:27:28 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 13:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 13:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010.11.20 14:25:26 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 14:25:26 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.20 14:25:32 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 14:25:32 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 < %USERPROFILE%\*.* >

[2012.02.14 21:39:11 | 001,048,576 | -HS- | M] () -- C:\Users\Sam\NTUSER.DAT

[2012.02.14 21:39:11 | 000,262,144 | -HS- | M] () -- C:\Users\Sam\ntuser.dat.LOG1

[2012.02.04 12:15:23 | 000,000,000 | -HS- | M] () -- C:\Users\Sam\ntuser.dat.LOG2

[2012.02.04 12:59:28 | 000,065,536 | -HS- | M] () -- C:\Users\Sam\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf

[2012.02.04 12:59:28 | 000,524,288 | -HS- | M] () -- C:\Users\Sam\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms

[2012.02.04 12:59:28 | 000,524,288 | -HS- | M] () -- C:\Users\Sam\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms

[2012.02.04 12:15:24 | 000,000,020 | -HS- | M] () -- C:\Users\Sam\ntuser.ini

 
 < %USERPROFILE%\Local Settings\Temp\*.exe >

 
 < %USERPROFILE%\Local Settings\Temp\*.dll >

 
 < %USERPROFILE%\Application Data\*.exe >

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

 
 <           >

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:41099CE9

@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:981884E7
 

< End of report >

--- --- ---

hi
was man doch mit nem bischen abwarten erreichen kann :-)

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

:OTL

O4 - HKCU..\Run: [ffdwnd] C:\Users\Sam\AppData\Local\Mozilla\Firefox\firefox.exe (Tomasz Pawlak)

 :Files

C:\Users\Sam\AppData\Local\Mozilla\Firefox\firefox.exe

:Commands

[purity]

[EMPTYFLASH] 

[emptytemp]

[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ffdwnd deleted successfully.
C:\Users\Sam\AppData\Local\Mozilla\Firefox\firefox.exe moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Public

User: Sam
->Flash cache emptied: 3717 bytes

Total Flash Files Cleaned = 0,00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Sam
->Temp folder emptied: 130449734 bytes
->Temporary Internet Files folder emptied: 22372737 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 58472063 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 255698599 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 18691657 bytes

Total Files Cleaned = 463,00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 02152012_173515

Files\Folders moved on Reboot...
C:\Users\Sam\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

ok weiter mit dem upload, danach haben wir noch n bissel arbeit.
surft also mit dem teil nicht im netz, außer auf den von mir genannten seiten

So ich habe den Ordner hochgeladen, ich hoffe das ich es richtig gemacht habe.

wunderbar, passt.

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
Tool

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Hinweis:
Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

das programm ist durch aber wir finden die combofix.txt nicht

Combofix Logfile:

Code:

ComboFix 12-02-15.01 - Sam 15.02.2012  18:15:37.1.2 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.1644.674 [GMT 1:00]

ausgeführt von:: c:\users\Sam\Downloads\ComboFix.exe

AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\FullRemove.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-01-15 bis 2012-02-15  ))))))))))))))))))))))))))))))

.

.

2012-02-15 17:28 . 2012-02-15 17:28        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-02-15 17:02 . 2012-02-15 17:02        --------        d-----w-        c:\program files\Babylon

2012-02-15 17:02 . 2012-02-15 17:02        --------        d-----w-        c:\program files (x86)\Babylon

2012-02-15 17:01 . 2012-02-15 17:06        --------        d-----w-        c:\programdata\Babylon

2012-02-15 16:49 . 2012-02-15 16:49        --------        d-----w-        c:\program files (x86)\Common Files\Java

2012-02-15 16:48 . 2012-02-15 16:48        --------        d-----w-        c:\program files (x86)\Java

2012-02-14 19:55 . 2012-02-15 16:47        --------        d-----w-        C:\_OTL

2012-02-14 16:25 . 2012-01-17 03:39        8602168        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{5ADABB2A-2D40-4395-B6D5-4A46A3B87724}\mpengine.dll

2012-02-09 07:11 . 2012-02-09 07:11        --------        d-----w-        c:\program files (x86)\Microsoft.NET

2012-02-08 08:41 . 2012-02-08 08:41        --------        d-----w-        c:\program files (x86)\Common Files\Sony Shared

2012-02-08 08:40 . 2012-02-08 08:45        --------        d-----w-        c:\programdata\Sony Corporation

2012-02-08 08:40 . 2012-02-08 08:41        --------        d-----w-        c:\program files (x86)\Sony

2012-02-08 07:33 . 2012-02-08 08:40        --------        d-----w-        c:\program files (x86)\Sony Media Go Install

2012-02-07 21:29 . 2012-02-07 21:30        --------        d-----w-        c:\program files (x86)\PhotoScape

2012-02-06 19:11 . 2012-02-06 19:37        --------        d-----w-        c:\programdata\VirtualizedApplications

2012-02-06 18:49 . 2012-02-09 07:31        --------        d-----w-        c:\program files (x86)\Common Files\DVDVideoSoft

2012-02-06 18:49 . 2012-02-09 07:30        --------        d-----w-        c:\program files (x86)\DVDVideoSoft

2012-02-06 15:51 . 2012-02-06 15:51        --------        d-----r-        C:\MSOCache

2012-02-06 15:43 . 2012-02-08 06:48        --------        d-----w-        c:\program files (x86)\Microsoft Application Virtualization Client

2012-02-05 12:12 . 2012-02-05 12:12        --------        d-----w-        c:\program files (x86)\icq

2012-02-05 12:12 . 2012-02-05 12:12        --------        d-----w-        c:\program files (x86)\ICQ6Toolbar

2012-02-05 12:12 . 2012-02-05 12:12        --------        d-----w-        c:\program files (x86)\Guard-ICQ

2012-02-05 12:12 . 2012-02-05 12:12        --------        d-----w-        c:\programdata\ICQ

2012-02-05 12:11 . 2012-02-05 12:17        --------        d-----w-        c:\program files (x86)\ICQ7.7

2012-02-05 09:04 . 2011-10-26 05:25        1572864        ----a-w-        c:\windows\system32\quartz.dll

2012-02-05 09:03 . 2011-04-25 02:34        499200        ----a-w-        c:\windows\system32\drivers\afd.sys

2012-02-05 09:03 . 2011-09-29 16:29        1923952        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2012-02-05 09:03 . 2011-03-12 12:08        1465344        ----a-w-        c:\windows\system32\XpsPrint.dll

2012-02-05 09:03 . 2011-03-12 11:23        870912        ----a-w-        c:\windows\SysWow64\XpsPrint.dll

2012-02-05 09:03 . 2011-04-22 22:15        27520        ----a-w-        c:\windows\system32\drivers\Diskdump.sys

2012-02-05 09:03 . 2011-04-29 03:05        410112        ----a-w-        c:\windows\system32\drivers\srv2.sys

2012-02-05 09:03 . 2011-04-29 03:06        467456        ----a-w-        c:\windows\system32\drivers\srv.sys

2012-02-05 09:03 . 2011-04-29 03:05        168448        ----a-w-        c:\windows\system32\drivers\srvnet.sys

2012-02-05 09:02 . 2011-08-17 05:26        613888        ----a-w-        c:\windows\system32\psisdecd.dll

2012-02-05 09:02 . 2011-08-17 04:24        465408        ----a-w-        c:\windows\SysWow64\psisdecd.dll

2012-02-05 09:02 . 2011-08-17 04:19        75776        ----a-w-        c:\windows\SysWow64\psisrndr.ax

2012-02-05 09:02 . 2011-08-17 05:25        108032        ----a-w-        c:\windows\system32\psisrndr.ax

2012-02-05 09:00 . 2011-11-05 05:32        2048        ----a-w-        c:\windows\system32\tzres.dll

2012-02-05 09:00 . 2011-11-05 04:26        2048        ----a-w-        c:\windows\SysWow64\tzres.dll

2012-02-05 09:00 . 2011-08-27 05:37        861696        ----a-w-        c:\windows\system32\oleaut32.dll

2012-02-05 09:00 . 2011-08-27 05:37        331776        ----a-w-        c:\windows\system32\oleacc.dll

2012-02-05 09:00 . 2011-08-27 04:26        233472        ----a-w-        c:\windows\SysWow64\oleacc.dll

2012-02-05 09:00 . 2011-08-27 04:26        571904        ----a-w-        c:\windows\SysWow64\oleaut32.dll

2012-02-05 09:00 . 2011-11-24 04:52        3145216        ----a-w-        c:\windows\system32\win32k.sys

2012-02-05 09:00 . 2011-11-17 06:41        1731920        ----a-w-        c:\windows\system32\ntdll.dll

2012-02-05 09:00 . 2011-11-17 05:38        1292080        ----a-w-        c:\windows\SysWow64\ntdll.dll

2012-02-05 08:59 . 2011-06-23 04:33        3912576        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2012-02-05 08:59 . 2011-06-23 05:43        5561216        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-02-05 08:59 . 2011-06-23 04:33        3967872        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2012-02-05 08:40 . 2011-11-19 14:58        77312        ----a-w-        c:\windows\system32\packager.dll

2012-02-05 08:40 . 2011-11-19 14:01        67072        ----a-w-        c:\windows\SysWow64\packager.dll

2012-02-04 17:07 . 2012-02-04 17:07        --------        d-----w-        c:\program files (x86)\OpenOffice.org 3

2012-02-04 17:03 . 2012-01-26 23:52        279656        ------w-        c:\windows\system32\MpSigStub.exe

2012-02-04 17:03 . 2012-02-15 16:48        472808        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2012-02-04 16:31 . 2011-12-15 14:00        27760        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2012-02-04 16:31 . 2011-12-15 13:59        97312        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2012-02-04 16:31 . 2011-12-15 13:59        130760        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2012-02-04 16:31 . 2012-02-04 16:31        --------        d-----w-        c:\programdata\Avira

2012-02-04 16:31 . 2012-02-04 16:31        --------        d-----w-        c:\program files (x86)\Avira

2012-02-04 16:29 . 2012-02-08 08:39        404640        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-02-04 16:24 . 2012-02-04 16:24        --------        d-----w-        c:\programdata\MumboJumbo

2012-02-04 16:21 . 2012-02-04 16:21        --------        d-----w-        c:\programdata\ASUS

2012-02-04 16:19 . 2012-02-04 16:19        --------        d-----w-        c:\programdata\McAfee

2012-02-04 16:19 . 2012-02-04 16:19        --------        d-----w-        c:\windows\system32\Macromed

2012-02-04 11:56 . 2009-09-04 16:29        1892184        ----a-w-        c:\windows\SysWow64\D3DX9_42.dll

2012-02-04 11:55 . 2006-09-28 15:05        2414360        ----a-w-        c:\windows\SysWow64\d3dx9_31.dll

2012-02-04 11:53 . 2012-02-04 11:53        --------        d-----w-        c:\program files (x86)\Winamp Detect

2012-02-04 11:53 . 2012-02-04 11:53        --------        d-----w-        c:\program files (x86)\Common Files\PX Storage Engine

2012-02-04 11:53 . 2012-02-04 11:56        --------        d-----w-        c:\program files (x86)\Winamp

2012-02-04 11:16 . 2012-02-04 11:16        --------        d-----w-        c:\programdata\FolderView

2012-02-04 11:16 . 2012-02-15 16:41        --------        d-----w-        C:\ASUS.DAT

2012-02-04 11:15 . 2012-02-10 05:06        --------        d-----w-        c:\users\Sam

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-02-04 15:49 . 2010-06-24 18:33        18328        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2012-02-04 11:16 . 2011-11-16 05:10        45056        ----a-w-        c:\windows\system32\acovcnt.exe

2011-11-21 17:21 . 2011-11-21 17:21        348160        ----a-w-        c:\windows\msvcr71.dll

2011-11-21 17:21 . 2011-11-21 17:21        434252        ----a-w-        c:\windows\MSVCRTD.DLL

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD}]

2011-12-28 13:21        128064        ----a-w-        c:\program files (x86)\icq\Internet Explorer\icq.dll

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]

2011-04-13 02:33        433648        ----a-w-        c:\programdata\Partner\Partner.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ICQ"="c:\program files (x86)\ICQ7.7\ICQ.exe" [2012-02-05 127040]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992]

"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2011-04-13 2018032]

"ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe" [2011-02-23 731472]

"SonicMasterTray"="c:\program files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-10 984400]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-14 336384]

"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]

"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]

"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]

"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2011-06-10 2255360]

"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]

"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]

"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2011-12-09 74752]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-12-15 258512]

"Guard.Mail.ru.gui"="c:\program files (x86)\Guard-ICQ\GuardICQ.exe" [2012-02-05 1564368]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"Babylon Client"="c:\program files (x86)\Babylon\Babylon-Pro\Babylon.exe" [2012-01-24 3189360]

.

c:\users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-4-13 548528]

FancyStart daemon.lnk - c:\windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_94E3CE3704FE82FBF49A6A.exe [2011-11-16 12862]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-13 135664]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-13 135664]

R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [x]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

R3 Partner Service;Partner Service;c:\programdata\Partner\Partner.exe [2011-04-13 332272]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]

R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [x]

S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [x]

S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-05-26 17536]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-07-14 361984]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-12-15 86224]

S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]

S2 Guard.Mail.ru;Guard.Mail.ru;c:\program files (x86)\Guard-ICQ\GuardICQ.exe [2012-02-05 1564368]

S2 ICQ Service;ICQ Service;c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe [2011-08-17 247872]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]

S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]

S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

2012-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-13 02:33]

.

2012-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-13 02:33]

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]

2011-04-13 02:33        750064        ----a-w-        c:\programdata\Partner\Partner64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

2010-09-02 08:41        220160        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

@="{64174815-8D98-4CE6-8646-4C039977D808}"

[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

2010-09-02 08:41        220160        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-07-28 2264168]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

mStart Page = hxxp://asus.msn.com

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Free YouTube to MP3 Converter - c:\users\Sam\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Translate this web page with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm

IE: Translate with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm

IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files (x86)\ICQ7.7\ICQ.exe

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Sam\AppData\Roaming\Mozilla\Firefox\Profiles\iz2kyndy.default\

pref('extensions.shownSelectionUI',true);

pref('extensions.autoDisableScopes',0);

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

Toolbar-Locked - (no file)

HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe

HKLM-Run-Setwallpaper - c:\programdata\SetWallpaper.cmd

AddRemove-ASUS_Screensaver - c:\windows\system32\ASUS_Screensaver.scr

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10t_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10t_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-02-15  18:36:06

ComboFix-quarantined-files.txt  2012-02-15 17:36

.

Vor Suchlauf: 9 Verzeichnis(se), 73.485.910.016 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 73.100.550.144 Bytes frei

.

- - End Of File - - C63922F7763A17EE85DA0B12AC957DB4

--- --- ---

malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Malwarebytes Anti-Malware 1.60.1.1000
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.02.15.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Sam :: SAM-PC [Administrator]

15.02.2012 19:06:43
mbam-log-2012-02-15 (19-06-43).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 308883
Laufzeit: 50 Minute(n), 45 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

sehr gut.
lade den CCleaner standard:
CCleaner Download - CCleaner 3.15.1643
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 07.02.2012 2,96MB 10.3.181.26 Notwendig
Adobe Flash Player 11 Plugin 64-bit Adobe Systems Incorporated 03.02.2012 6,00MB 11.1.102.55 Notwenidig
AMD Catalyst Install Manager Advanced Micro Devices, Inc. 14.11.2011 22,7MB 3.0.838.0 Unbekannt
ASUS AI Recovery ASUS 04.02.2012 7,22MB 1.0.19 Notwendig
ASUS FancyStart ASUSTeK Computer Inc. 14.11.2011 12,1MB 1.1.0 Notwendig
ASUS LifeFrame3 ASUS 04.02.2012 37,2MB 3.0.27Notwendig
ASUS Live Update ASUS 03.02.2012 3,99MB 3.0.8 Notwendig
ASUS Power4Gear Hybrid ASUS 14.11.2011 13,3MB 1.1.44 Notwendig
ASUS SmartLogon ASUS 14.11.2011 11,2MB 1.0.0011 notwendig
ASUS Virtual Camera asus 14.11.2011 3,13MB 1.0.21 Notwendig
ASUS WebStorage eCareme Technologies, Inc. 15.11.2011 3.0.84.161 Unbekannt
ASUS_Screensaver 15.11.2011 Unbekannt
AsusVibe2.0 ASUSTEK 15.11.2011 2.0.4.617 Unbekannt
Atheros Client Installation Program Atheros 14.11.2011 7.0 Unbekannt
ATK Package ASUS 14.11.2011 12,0MB 1.0.0010 Unbekannt
Avira Free Antivirus Avira 12.02.2012 108,9MB 12.0.0.883 Notwendig
Babylon Babylon 14.02.2012 Unnötig
Bookworm Deluxe Oberon Media Inc. 15.11.2011 Unötig
CCleaner Piriform 14.02.2012 3.15
Control ActiveX de Windows Live Mesh para conexiones remotas Microsoft Corporation 11.04.2011 5,38MB 15.4.5722.2
Controlo ActiveX do Windows Live Mesh para Ligações Remotas Microsoft Corporation 11.04.2011 5,38MB 15.4.5722.2
Contrôle ActiveX Windows Live Mesh pour connexions à distance Microsoft Corporation 11.04.2011 5,38MB 15.4.5722.2
Cooking Dash Oberon Media Inc. 15.11.2011
CyberLink LabelPrint CyberLink Corp. 14.11.2011 137,6MB 2.5.1908 Unbekannt
CyberLink Power2Go CyberLink Corp. 14.11.2011 110,4MB 6.1.3602c Unekannt
ETDWare PS/2-X64 8.0.5.1_WHQL ELAN Microelectronic Corp. 15.11.2011 8.0.5.1 Unbekannt
Fast Boot ASUS 14.11.2011 1,47MB 1.0.9 Unbekannt
Free Audio Converter version 5.0.4.1228 DVDVideoSoft Ltd. 08.02.2012 57,3MB Notwendig
Free YouTube to MP3 Converter version 3.10.15.1228 DVDVideoSoft Ltd. 05.02.2012 85,6MB Notwendig
Game Park Console Oberon Media, Inc. 11.04.2011 29,5MB 6.2.1.1 Unötig
Google Chrome Google Inc. 11.04.2011 16.0.912.77 Unötg
Google Toolbar for Internet Explorer Google Inc. 15.11.2011 Unötig
Governor of Poker Oberon Media Inc. 15.11.2011 Unötig
Guard.ICQ Mail.ru 04.02.2012 Unötig
Hotel Dash Suite Success Oberon Media Inc. 15.11.2011 Unötig
ICQ Sparberater solute gmbh 04.02.2012 0,46MB 1.3.671 Unötig
ICQ Toolbar ICQ 04.02.2012 3.0.0 unötig
ICQ7.7 ICQ 04.02.2012 7.7 Notwendig
Java(TM) 6 Update 31 Oracle 14.02.2012 95,1MB 6.0.310 Notwendig
Jewel Quest 3 Oberon Media Inc. 15.11.2011 Notwendig
Malwarebytes Anti-Malware Version 1.60.1.1000 Malwarebytes Corporation 14.02.2012 17,4MB 1.60.1.1000 Notwendig
Media Go Sony 07.02.2012 99,8MB 2.0.317 Notwendig
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 08.02.2012 38,8MB 4.0.30319 Unbekannt
Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 08.02.2012 2,94MB 4.0.30319 Unbekannt
Microsoft Office 2010 Microsoft Corporation 11.04.2011 6,31MB 14.0.4763.1000 Unbekannt
Microsoft Office Klick-und-Los 2010 Microsoft Corporation 05.02.2012 14.0.4763.1000 Unbekannt
Microsoft Office Starter 2010 - Deutsch Microsoft Corporation 05.02.2012 14.0.4763.1000 Unbekannt
Microsoft Silverlight Microsoft Corporation 05.02.2012 40,4MB 4.0.60831.0 Unbekannt
Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 11.04.2011 1,70MB 3.1.0000 Unbekannt
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 05.02.2012 0,29MB 8.0.59193 Unbekannt
Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 11.04.2011 0,61MB 8.0.61000 Unbekannt
Microsoft Visual C++ 2005 Redistributable - KB2467175 Microsoft Corporation 07.02.2012 2,65MB 8.0.51011
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 03.02.2012 0,77MB 9.0.30729.4148 Unbekannt
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 05.02.2012 0,77MB 9.0.30729.6161 Unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 03.02.2012 0,58MB 9.0.30729.4148 Unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 05.02.2012 0,59MB 9.0.30729.6161 Unbekannt
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 Microsoft Corporation 14.11.2011 13,7MB 10.0.30319 Unbekannt
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 05.02.2012 16,5MB 10.0.40219 Unbekannt
Mozilla Firefox 10.0.1 (x86 de) Mozilla 14.02.2012 36,0MB 10.0.1
Nuance PDF Reader Nuance Communications, Inc. 11.04.2011 47,8MB 6.00.0041 Notwendig
OpenOffice.org 3.3 OpenOffice.org 03.02.2012 415MB 3.3.9567 Notwendig
PhotoScape 06.02.2012 Ntwendig
Plants vs Zombies Oberon Media Inc. 15.11.2011 Notwendig
PlayStation(R)Network Downloader Sony Computer Entertainment Inc. 07.02.2012 0,81MB 2.07.00849 Notwendig
PlayStation(R)Store Sony Computer Entertainment Inc. 07.02.2012 5,54MB 4.5.16.13625
Realtek Ethernet Controller Driver Realtek 14.11.2011 7.42.304.2011 Unbekannt
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 14.11.2011 6.0.1.6418 Unbekannt
Realtek USB 2.0 Card Reader Realtek Semiconductor Corp. 14.11.2011 6.1.7600.30127 Unbekannt
Sonic Focus Synopsys 14.11.2011 4,32MB 1.0.0.4 Unbekannt
syncables desktop SE syncables 11.04.2011 163,5MB 5.5.746.11492 Unbekannt
Winamp Nullsoft, Inc 03.02.2012 5.623 Ntwendig
Winamp Erkennungs-Plug-in Nullsoft, Inc 03.02.2012 75,00KB 1.0.0.1 Notwendig
Windows Live Essentials Microsoft Corporation 12.04.2011 15.4.3508.1109 Unötig
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen Microsoft Corporation 11.04.2011 5,38MB 15.4.5722.2 Unötig
Windows Live Mesh ActiveX Control for Remote Connections Microsoft Corporation 11.04.2011 5,38MB 15.4.5722.2 Unötig
Windows Live Mesh ActiveX control for remote connections Microsoft Corporation 11.04.2011 5,38MB 15.4.5722.2 Unötig
WinFlash ASUS 14.11.2011 0,84MB 2.31.1 Unötig
Wireless Console 3 ASUS 14.11.2011 9,05MB 3.0.21 Unötig
World of Goo Oberon Media Inc. 15.11.2011 Unötig
Элемент управления Windows Live Mesh ActiveX для удаленных подключений Microsoft Corporation 11.04.2011 5,38MB 15.4.5722.2 Unbkannt
פקד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים Microsoft Corporation 11.04.2011 5,38MB 15.4.5722.2 Unbekannt
適用遠端連線的 Windows Live Mesh ActiveX 控制項 Microsoft Corporation 11.04.2011 5,57MB 15.4.5722.2 Unbekannt

deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
deinstaliere:
Babylon
Bookworm
Control
Controlo
Contrôle
Cooking Dash
CyberLink : beide
ETDWare
Game Park
Google : beide
Governor
Guard
Hotel
ICQ Sparberater
ICQ Toolbar
Java
Download der kostenlosen Java-Software
downloade java jre, instalieren

deinstaliere:
syncables
Windows Live : alle unnötigen
World of Goo
פקד ActiveX

öffne otl, bereinigen neustartn
öffne ccleaner, analysieren, bereinigen neustarten, testen ob alles nach wunsch läuft