Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 6537
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
09.05.2011 14:57:57
mbam-log-2011-05-09 (14-57-57).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 348465
Laufzeit: 18 Minute(n), 52 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{48184CA3-2D29-6C69-47A5-99CE5FE21551} (Trojan.ZbotR.Gen) -> Value: {48184CA3-2D29-6C69-47A5-99CE5FE21551} -> Quarantined and deleted successfully.
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
c:\program files\dvbviewer\dshow_decoder.dll (Trojan.Dropper) -> Not selected for removal. Die DLL (von haus aus keine Schadsoftware) wurde von mir nach dem Suchlauf gelöscht und von sicherer Quelle wieder hergestellt.
Im nächsten Log wird sie auch nichtmehr als gemeldet. Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 6537
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
09.05.2011 15:24:51
mbam-log-2011-05-09 (15-24-51).txt
Art des Suchlaufs: Flash-Scan
Durchsuchte Objekte: 127661
Laufzeit: 30 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden) Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 6537
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
09.05.2011 15:27:56
mbam-log-2011-05-09 (15-27-56).txt
Art des Suchlaufs: Vollständiger Suchlauf (F:\|)
Durchsuchte Objekte: 171721
Laufzeit: 41 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden) Code:
15:24:13 Nuts MESSAGE Protection started successfully
15:24:18 Nuts MESSAGE IP Protection started successfully
15:45:26 Nuts MESSAGE Protection started successfully
15:45:30 Nuts MESSAGE IP Protection started successfully
16:03:51 Nuts MESSAGE IP Protection stopped
16:03:54 Nuts MESSAGE Database updated successfully
16:03:54 Nuts MESSAGE IP Protection started successfully
17:15:00 Nuts MESSAGE Protection started successfully
17:15:04 Nuts MESSAGE IP Protection started successfully
18:09:15 Nuts MESSAGE Scheduled update executed successfully
18:09:55 Nuts MESSAGE IP Protection stopped
18:09:57 Nuts MESSAGE Database updated successfully
18:09:58 Nuts MESSAGE IP Protection started successfully Mit OTL hab ich nun auch etwas gespielt.
Das Scanschema aus diesem Thread wurde dafür verwendet: http://www.trojaner-board.de/98610-v...-schaffen.html
OTL Logfile: Code:
OTL logfile created on: 09.05.2011 16:45:30 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Nuts\Desktop
An unknown product (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 58,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 24,32 Gb Total Space | 3,50 Gb Free Space | 14,40% Space Free | Partition Type: NTFS
Drive D: | 50,11 Gb Total Space | 41,05 Gb Free Space | 81,91% Space Free | Partition Type: NTFS
Drive F: | 1009,51 Mb Total Space | 906,37 Mb Free Space | 89,78% Space Free | Partition Type: FAT32
Drive Z: | 263,90 Gb Total Space | 39,60 Gb Free Space | 15,01% Space Free | Partition Type: NTFS
Computer Name: NUTS-PC | User Name: Nuts | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011.05.09 16:44:40 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Nuts\Desktop\OTL.exe
PRC - [2011.04.27 18:06:38 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.21 20:56:16 | 001,230,704 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2011.03.17 13:14:21 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.12.20 18:08:58 | 000,363,344 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2010.12.10 03:47:00 | 000,155,232 | ---- | M] (DATEV eG) -- D:\DATEV\PROGRAMM\Install\DvInesASDSvc.Exe
PRC - [2010.12.08 03:20:00 | 000,079,872 | ---- | M] (DATEV eG) -- D:\DATEV\PROGRAMM\B0001442\PSNTServ.exe
PRC - [2010.12.01 10:06:22 | 000,549,472 | ---- | M] (DATEV eG) -- D:\DATEV\PROGRAMM\B0000150\ScWTS\DVCCSAWTSSetEntryNTE.exe
PRC - [2010.12.01 10:03:10 | 002,407,520 | ---- | M] (DATEV eG) -- D:\DATEV\PROGRAMM\B0000150\ScServer\DVckService.exe
PRC - [2010.11.26 16:53:14 | 000,878,176 | ---- | M] (DATEV eG) -- D:\DATEV\PROGRAMM\Sws\LiMaService.exe
PRC - [2010.11.04 10:51:06 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.09.22 17:47:22 | 000,292,960 | ---- | M] (DATEV eG) -- D:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardService.exe
PRC - [2010.09.08 17:48:12 | 000,271,456 | ---- | M] (Datev eG) -- D:\DATEV\PROGRAMM\B0000398\SiPaHostService.exe
PRC - [2010.09.06 18:56:38 | 000,247,096 | ---- | M] () -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe
PRC - [2010.09.03 15:50:22 | 000,406,112 | ---- | M] (DATEV e.G.) -- D:\DATEV\PROGRAMM\B0001364\DtvScSer.exe
PRC - [2010.08.25 08:54:06 | 000,194,144 | ---- | M] (KOBIL Systems GmbH) -- D:\DATEV\PROGRAMM\B0000404\msdisrv.exe
PRC - [2010.01.26 16:56:58 | 000,356,412 | ---- | M] (DATEV eG) -- D:\DATEV\PROGRAMM\B0000000\DFUEMNGR\DfueMan.exe
PRC - [2010.01.20 13:48:14 | 000,386,656 | ---- | M] (DATEVeG) -- D:\DATEV\PROGRAMM\B0000299\AS\as.exe
PRC - [2010.01.14 21:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.10.06 18:31:38 | 000,031,744 | ---- | M] () -- C:\Program Files\Hotkey\PowerBiosServer.exe
PRC - [2009.09.30 20:34:22 | 002,314,240 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2009.09.30 20:33:08 | 000,262,144 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009.07.14 03:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2009.05.27 16:27:00 | 000,045,056 | ---- | M] () -- D:\DATEV\PROGRAMM\A0000007\DHNC.exe
PRC - [2009.01.28 11:52:46 | 002,790,400 | ---- | M] (Aladdin Knowledge Systems Ltd.) -- C:\Windows\System32\hasplms.exe
PRC - [2008.09.22 09:47:14 | 000,176,128 | ---- | M] (DATEV eG) -- D:\DATEV\PROGRAMM\B0000000\DFUEMNGR\DcManag.exe
PRC - [2008.06.18 09:13:20 | 000,036,448 | ---- | M] (DATEV eG) -- D:\DATEV\SYSTEM\RzpjWtch.exe
PRC - [2007.07.11 03:01:00 | 001,859,584 | ---- | M] (AVM Berlin) -- C:\Program Files\avmclient\bluefritz.exe
PRC - [2007.07.11 03:01:00 | 000,491,520 | ---- | M] (AVM Berlin) -- C:\Program Files\avmclient\AvmObex.exe
PRC - [2007.07.11 03:01:00 | 000,405,504 | ---- | M] (AVM Berlin) -- C:\Program Files\avmclient\avmbtservice.exe
PRC - [2007.07.11 03:01:00 | 000,221,184 | ---- | M] (AVM Berlin) -- C:\Program Files\avmclient\AvmObexService.exe
PRC - [2007.05.31 15:00:12 | 000,098,304 | ---- | M] () -- D:\DATEV\PROGRAMM\B0000000\RZNRDAEM\RzNrDaem.exe
PRC - [2001.11.12 15:31:48 | 000,020,480 | ---- | M] (X10) -- C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
PRC - [1998.07.16 09:36:00 | 000,192,000 | ---- | M] (DATEV eG) -- D:\DATEV\PROGRAMM\B0000301\AIDA\AIDA.EXE
========== Modules (SafeList) ==========
MOD - [2011.05.09 16:44:40 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Nuts\Desktop\OTL.exe
MOD - [2010.08.21 07:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
========== Win32 Services (SafeList) ==========
SRV - [2011.04.27 18:06:38 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.17 13:14:21 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.12.20 18:08:58 | 000,363,344 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2010.12.10 03:47:00 | 000,155,232 | ---- | M] (DATEV eG) [Auto | Running] -- D:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe -- (DATEV Update-Service)
SRV - [2010.12.08 03:20:00 | 000,079,872 | ---- | M] (DATEV eG) [Auto | Running] -- D:\DATEV\PROGRAMM\B0001442\PSNTServ.exe -- (DatevPrintService)
SRV - [2010.12.01 10:03:10 | 002,407,520 | ---- | M] (DATEV eG) [Auto | Running] -- D:\DATEV\PROGRAMM\B0000150\ScServer\DVckService.exe -- (DVckService)
SRV - [2010.10.05 13:24:35 | 000,549,384 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Disabled | Stopped] -- C:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 7.0 OnlineUpdate)
SRV - [2010.09.22 17:47:22 | 000,292,960 | ---- | M] (DATEV eG) [Auto | Running] -- D:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardService.exe -- (SCardService)
SRV - [2010.09.08 17:48:12 | 000,271,456 | ---- | M] (Datev eG) [Auto | Running] -- D:\DATEV\PROGRAMM\B0000398\SiPaHostService.exe -- (Sicherheitspaket-Dienst)
SRV - [2010.09.06 18:56:38 | 000,247,096 | ---- | M] () [Auto | Running] -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010.09.03 15:50:22 | 000,406,112 | ---- | M] (DATEV e.G.) [Auto | Running] -- D:\DATEV\PROGRAMM\B0001364\DtvScSer.exe -- (DATEV Logon Service)
SRV - [2010.08.25 08:54:06 | 000,194,144 | ---- | M] (KOBIL Systems GmbH) [Auto | Running] -- D:\DATEV\PROGRAMM\B0000404\msdisrv.exe -- (KOBIL_MSDI)
SRV - [2009.10.06 18:31:38 | 000,031,744 | ---- | M] () [Auto | Running] -- C:\Program Files\Hotkey\PowerBiosServer.exe -- (PowerBiosServer)
SRV - [2009.09.30 20:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009.09.30 20:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2009.01.28 11:52:46 | 002,790,400 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Auto | Running] -- C:\Windows\System32\hasplms.exe -- (hasplms)
SRV - [2008.09.22 09:47:14 | 000,176,128 | ---- | M] (DATEV eG) [Auto | Running] -- D:\DATEV\PROGRAMM\B0000000\DFUEMNGR\DcManag.exe -- (Dcmanag)
SRV - [2007.07.11 03:01:00 | 000,405,504 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files\avmclient\avmbtservice.exe -- (AVM BT Connection Service)
SRV - [2007.07.11 03:01:00 | 000,221,184 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files\avmclient\AvmObexService.exe -- (AvmObexService)
SRV - [2001.11.12 15:31:48 | 000,020,480 | ---- | M] (X10) [Auto | Running] -- C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe -- (x10nets)
========== Driver Services (SafeList) ==========
DRV - [2011.03.17 13:14:21 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.12.20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2010.11.24 10:58:13 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.07.12 13:49:18 | 000,060,104 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2010.07.12 13:48:56 | 000,073,032 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2010.07.08 12:19:22 | 000,073,072 | ---- | M] (Datev eG) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\d3_kafm.sys -- (SC_Serv3D)
DRV - [2010.04.07 16:28:12 | 000,104,768 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2010.02.10 16:01:12 | 000,132,352 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Impcd.sys -- (Impcd)
DRV - [2010.02.03 06:36:36 | 000,232,960 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV - [2010.01.13 18:36:38 | 006,755,840 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw5s32.sys -- (NETw5s32) Intel(R)
DRV - [2009.10.08 16:41:34 | 000,023,424 | ---- | M] (KOBIL Systems GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\KOBCCEX.sys -- (KOBCCEX)
DRV - [2009.10.08 16:41:10 | 000,084,352 | ---- | M] (KOBIL Systems GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\KOBCCID.sys -- (KOBCCID)
DRV - [2009.09.23 04:25:18 | 000,120,432 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR)
DRV - [2009.09.17 13:54:14 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HECI.sys -- (HECI) Intel(R)
DRV - [2009.09.08 11:55:44 | 001,180,272 | ---- | M] (Bison Electronics. Inc. ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BisonC07.sys -- (Cam5607)
DRV - [2009.08.14 23:36:06 | 000,087,152 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\JME.sys -- (JME)
DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)
DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)
DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)
DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.07.14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)
DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)
DRV - [2009.05.11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.03.27 01:16:28 | 000,012,672 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\cpuz132_x32.sys -- (cpuz132)
DRV - [2009.02.03 04:10:12 | 000,586,752 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\Windows\system32\drivers\hardlock.sys -- (Hardlock)
DRV - [2009.01.16 12:42:28 | 000,352,256 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\Windows\system32\drivers\aksfridge.sys -- (aksfridge)
DRV - [2008.10.28 16:48:24 | 000,027,160 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\x10ufx2.sys -- (XUIF)
DRV - [2008.05.02 10:58:28 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2008.05.02 10:58:14 | 000,020,864 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2008.05.02 10:58:14 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2008.05.02 10:58:12 | 000,017,536 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2007.07.11 03:01:00 | 000,851,712 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bfhubase.sys -- (bfhubase)
DRV - [2007.07.11 03:01:00 | 000,374,144 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\capi_cip.sys -- (CAPI_CIP)
DRV - [2007.07.11 03:01:00 | 000,064,512 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avmcowan.sys -- (AVMCOWAN)
DRV - [2007.07.11 03:01:00 | 000,061,952 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avmbtpar.sys -- (AVMBTPARALLEL)
DRV - [2007.07.11 03:01:00 | 000,060,928 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avmbtser.sys -- (AVMBTSERIAL)
DRV - [2007.07.11 03:01:00 | 000,006,656 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bfhu_cfg.sys -- (BFHU_CFG)
DRV - [2006.11.17 11:31:04 | 000,013,976 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10hid.sys -- (X10Hid)
DRV - [2005.08.10 14:39:49 | 000,008,524 | ---- | M] (Otte Elektronik GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ATBUSB.sys -- (ATBUSBPrj)
DRV - [2005.05.23 10:30:36 | 000,043,737 | ---- | M] (OMNIKEY) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\cmeu0wdm.sys -- (cmeu0wdm)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3C D8 74 0A 63 B9 CA 01 [binary data]
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.5
FF - prefs.js..extensions.enabledItems: video.downloader.plugin@ffpimp.com:3.3.5
FF - prefs.js..network.proxy.type: 0
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.03 09:38:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.06 03:00:45 | 000,000,000 | ---D | M]
[2011.02.16 15:35:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nuts\AppData\Roaming\mozilla\Extensions
[2011.05.09 13:25:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nuts\AppData\Roaming\mozilla\Firefox\Profiles\mqi27sui.default\extensions
[2011.03.09 22:28:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nuts\AppData\Roaming\mozilla\Firefox\Profiles\mqi27sui.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2011.03.12 00:08:39 | 000,000,000 | ---D | M] (Download Youtube Videos +) -- C:\Users\Nuts\AppData\Roaming\mozilla\Firefox\Profiles\mqi27sui.default\extensions\video.downloader.plugin@ffpimp.com
[2011.03.09 22:28:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nuts\AppData\Roaming\mozilla\Firefox\Profiles\mqi27sui.default\extensions\{dc572301-7619-498c-a57d-39143191b318}\modules\extensions
[2011.05.03 23:47:20 | 000,001,056 | ---- | M] () -- C:\Users\Nuts\AppData\Roaming\Mozilla\Firefox\Profiles\mqi27sui.default\searchplugins\icqplugin.xml
[2011.02.16 15:35:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2010.12.03 20:14:08 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.12.03 20:14:08 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.12.03 20:14:08 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.12.03 20:14:08 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.12.03 20:14:08 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {557F4852-8868-44dd-B5E9-9890AC4B1FD5} - No CLSID value found.
O2 - BHO: (DtvIePwdSafeBHO Class) - {6EF6B546-25FB-455B-801F-FDB3B3D39F9E} - D:\DATEV\PROGRAMM\B0000397\DtvIePwdSafe.dll (DATEV eG)
O2 - BHO: (SCardBHOEvent Class) - {AF8CD625-E04A-4A8F-A90A-0C74846C2E30} - D:\DATEV\SYSTEM\DVCCSASCardBHO002.dll (DATEV eG)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVMBlueClient] C:\Program Files\avmclient\bluefritz.exe (AVM Berlin)
O4 - HKLM..\Run: [AVMBLUEOBEX] C:\Program Files\avmclient\AvmObex.exe (AVM Berlin)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [DVCCSAWTSSetEntryNTE] D:\DATEV\PROGRAMM\B0000150\ScWTS\DVCCSAWTSSetEntryNTE.exe (DATEV eG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
O4 - HKCU..\Run: [ICQ] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O12 - Plugin for: .IPC - C:\Program Files\Internet Explorer\Plugins\npideapl.dll (LINK & LINK Software)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: datev.at ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.at ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.com ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.com ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([www] http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([www] https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datevnet.de ([*.services] http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datevnet.de ([*.services] https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datevstadt.de ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datevstadt.de ([]https is out of zone range - 5)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2011.04.07 19:16:12 | 000,000,000 | ---D | M] - D:\autoitskripte -- [ NTFS ]
O32 - AutoRun File - [2009.04.01 09:18:36 | 000,000,000 | ---D | M] - F:\autoitskripte -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Hotkey.lnk - C:\PROGRA~1\Hotkey\Hotkey.exe - ()
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: BisonHK - hkey= - key= - C:\Program Files\BisonCam\BisonHK.exe (mychat)
MsConfig - StartUpReg: CloneCDTray - hkey= - key= - File not found
MsConfig - StartUpReg: DATEV Update-Monitor - hkey= - key= - File not found
MsConfig - StartUpReg: DATEV_SCardMan - hkey= - key= - D:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardManager.exe (DATEV eG)
MsConfig - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
MsConfig - StartUpReg: SiPaHost - hkey= - key= - D:\DATEV\PROGRAMM\B0000398\SiPaHost.exe (DATEV eG)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig - State: "startup" - 2
MsConfig - State: "services" - 2
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {0F1D198F-E5EA-4542-930E-2FB2B099F3F3} - LanaConfigTool_3383
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()
Drivers32: msacm.avis - C:\Windows\System32\ff_acm.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
========== Files/Folders - Created Within 30 Days ==========
[2011.05.09 16:44:38 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Nuts\Desktop\OTL.exe
[2011.05.09 16:11:46 | 001,407,280 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Nuts\Desktop\tdsskiller.exe
[2011.05.09 15:44:54 | 000,000,000 | ---D | C] -- C:\avrescue
[2011.05.09 14:34:45 | 000,000,000 | ---D | C] -- C:\Users\Nuts\AppData\Roaming\Malwarebytes
[2011.05.09 14:32:19 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.05.09 14:32:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.05.09 14:32:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.05.09 14:32:16 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.05.09 14:32:16 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.05.09 13:12:32 | 000,000,000 | ---D | C] -- C:\Users\Nuts\AppData\Roaming\Edwuy
[2011.05.06 03:00:58 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2011.05.05 19:01:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2011.05.05 19:01:29 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2011.05.05 17:38:06 | 000,000,000 | ---D | C] -- C:\Users\Nuts\.borland
[2011.05.05 17:37:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Borland Delphi 7
[2011.05.05 17:35:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Borland Shared
[2011.04.28 14:48:27 | 000,000,000 | ---D | C] -- C:\Users\Nuts\AppData\Roaming\DivX
[2011.04.28 14:47:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX Plus
[2011.04.28 14:47:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DivX Shared
[2011.04.28 14:46:51 | 000,000,000 | ---D | C] -- C:\Program Files\DivX
[2011.04.28 14:46:11 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX
[2011.04.26 19:42:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.4
[2011.04.26 19:42:12 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ6Toolbar
[2011.04.26 19:42:10 | 000,000,000 | ---D | C] -- C:\ProgramData\ICQ
[2011.04.26 19:21:04 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ7.4
[2011.04.26 17:56:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ATB_PC
[2011.04.26 17:56:06 | 000,000,000 | ---D | C] -- C:\Program Files\ATB_PC
[2011.04.18 15:54:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunebite 7
[2011.04.18 15:54:49 | 000,000,000 | ---D | C] -- C:\ProgramData\RapidSolution
[2011.04.18 15:54:49 | 000,000,000 | ---D | C] -- C:\Program Files\RapidSolution
[2011.04.18 15:48:16 | 000,000,000 | ---D | C] -- C:\Users\Nuts\AppData\Local\RapidSolution
[2010.08.25 19:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
========== Files - Modified Within 30 Days ==========
[2011.05.09 16:44:40 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Nuts\Desktop\OTL.exe
[2011.05.09 16:11:49 | 001,407,280 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Nuts\Desktop\tdsskiller.exe
[2011.05.09 15:50:30 | 000,014,272 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.05.09 15:50:30 | 000,014,272 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.05.09 15:48:28 | 000,711,014 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.05.09 15:48:28 | 000,151,260 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.05.09 15:48:28 | 000,144,258 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.05.09 15:48:28 | 000,061,106 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.05.09 15:43:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.05.09 15:43:10 | 2356,576,256 | -HS- | M] () -- C:\hiberfil.sys
[2011.05.09 15:37:55 | 000,000,630 | ---- | M] () -- C:\Windows\ODBC.INI
[2011.05.09 15:35:26 | 000,001,847 | ---- | M] () -- C:\Users\Public\Desktop\DVBViewer.lnk
[2011.05.09 15:22:10 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.05.08 12:53:35 | 000,001,238 | ---- | M] () -- C:\Users\Nuts\SciTE.session
[2011.05.07 03:43:34 | 000,001,103 | ---- | M] () -- C:\Users\Nuts\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook starten.lnk
[2011.05.06 03:18:54 | 000,299,808 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.04.26 19:42:24 | 000,001,794 | ---- | M] () -- C:\Users\Nuts\Application Data\Microsoft\Internet Explorer\Quick Launch\ICQ7.4.lnk
[2011.04.26 19:42:24 | 000,001,770 | ---- | M] () -- C:\Users\Public\Desktop\ICQ7.4.lnk
[2011.04.26 19:18:14 | 000,000,403 | ---- | M] () -- C:\Windows\ATB_Prec.Ini
[2011.04.26 18:40:02 | 000,032,201 | ---- | M] () -- C:\Users\Nuts\unknown_card.cardcorr
[2011.04.26 18:06:37 | 000,012,000 | ---- | M] () -- C:\Users\Nuts\CAR&HIFI.miccorr
[2011.04.26 17:56:06 | 000,000,911 | ---- | M] () -- C:\Users\Nuts\Desktop\ATB_PC.lnk
[2011.04.18 15:54:51 | 000,001,075 | ---- | M] () -- C:\Users\Public\Desktop\Tunebite 7.lnk
========== Files Created - No Company Name ==========
[2011.05.09 14:32:19 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.26 19:42:24 | 000,001,794 | ---- | C] () -- C:\Users\Nuts\Application Data\Microsoft\Internet Explorer\Quick Launch\ICQ7.4.lnk
[2011.04.26 19:42:24 | 000,001,770 | ---- | C] () -- C:\Users\Public\Desktop\ICQ7.4.lnk
[2011.04.26 18:29:43 | 000,032,201 | ---- | C] () -- C:\Users\Nuts\unknown_card.cardcorr
[2011.04.26 18:06:37 | 000,012,000 | ---- | C] () -- C:\Users\Nuts\CAR&HIFI.miccorr
[2011.04.26 17:57:17 | 000,000,403 | ---- | C] () -- C:\Windows\ATB_Prec.Ini
[2011.04.26 17:56:06 | 000,000,911 | ---- | C] () -- C:\Users\Nuts\Desktop\ATB_PC.lnk
[2011.04.18 15:54:51 | 000,001,075 | ---- | C] () -- C:\Users\Public\Desktop\Tunebite 7.lnk
[2011.03.21 15:50:05 | 000,000,215 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2011.02.16 15:35:41 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.02.10 17:09:45 | 000,000,008 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011.01.13 23:38:27 | 000,000,295 | ---- | C] () -- C:\ProgramData\ci_reset.ini
[2010.11.11 21:43:58 | 000,000,611 | ---- | C] () -- C:\ProgramData\DVB-Tools.ini
[2010.11.08 15:40:01 | 000,000,071 | ---- | C] () -- C:\ProgramData\test_RS_API.ini
[2010.10.07 21:28:37 | 000,698,000 | ---- | C] () -- C:\Windows\unins000.exe
[2010.10.07 21:28:37 | 000,001,615 | ---- | C] () -- C:\Windows\unins000.dat
[2010.09.22 17:48:26 | 000,032,352 | ---- | C] () -- C:\Windows\System32\JNILibrary.dll
[2010.09.22 17:48:06 | 000,114,272 | ---- | C] () -- C:\Windows\System32\INetCert.dll
[2010.09.17 10:40:10 | 000,151,260 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2010.09.17 10:40:10 | 000,061,106 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2010.09.02 19:43:56 | 000,000,095 | ---- | C] () -- C:\ProgramData\keepalive.ini
[2010.08.25 20:30:02 | 000,127,868 | ---- | C] () -- C:\Windows\System32\igcompkrng575.bin
[2010.08.25 20:30:00 | 000,104,796 | ---- | C] () -- C:\Windows\System32\igfcg575m.bin
[2010.07.20 14:12:59 | 000,080,896 | ---- | C] () -- C:\Windows\cadkasdeinst01.exe
[2010.05.30 11:56:50 | 000,000,132 | ---- | C] () -- C:\Users\Nuts\AppData\Roaming\ci_reset.ini
[2010.04.01 00:43:32 | 000,000,076 | ---- | C] () -- C:\Windows\konstantinopel.ini
[2010.03.23 15:42:51 | 000,000,081 | -HS- | C] () -- C:\ProgramData\.zreglib
[2010.03.20 22:25:14 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe
[2010.03.03 18:22:25 | 000,000,175 | ---- | C] () -- C:\Windows\DEINSTAL.INI
[2010.03.03 17:51:44 | 000,015,128 | ---- | C] () -- C:\Windows\System32\skypdfmonpro.dll
[2010.03.03 17:51:44 | 000,013,080 | ---- | C] () -- C:\Windows\System32\skypdfmonuipro.dll
[2010.03.03 17:45:01 | 000,000,092 | ---- | C] () -- C:\Users\Nuts\AppData\Local\fusioncache.dat
[2010.03.03 17:44:05 | 000,000,021 | ---- | C] () -- C:\Windows\DvInesKurusOleServer003.INI
[2010.03.03 17:43:50 | 000,000,099 | ---- | C] () -- C:\Windows\dvinesinstart001.INI
[2010.03.03 17:43:50 | 000,000,099 | ---- | C] () -- C:\Windows\dvinesinstalllocation001.INI
[2010.03.03 17:42:53 | 000,000,113 | ---- | C] () -- C:\Windows\Startup.INI
[2010.03.03 15:38:26 | 000,000,137 | ---- | C] () -- C:\Windows\hbcikrnl.ini
[2010.03.03 10:40:40 | 000,000,630 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.03.01 15:58:15 | 000,015,190 | ---- | C] () -- C:\Windows\M3000Twn.ini
[2010.03.01 15:58:15 | 000,000,227 | R--- | C] () -- C:\Windows\OEM.ini
[2010.03.01 15:50:38 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2010.03.01 15:32:13 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010.02.20 09:16:08 | 000,870,560 | ---- | C] () -- C:\Windows\System32\igkrng575.bin
[2010.02.20 08:27:38 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010.02.20 08:27:38 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2009.11.25 13:40:50 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,299,808 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,711,014 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,144,258 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 02:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2007.08.16 16:17:50 | 000,143,360 | ---- | C] () -- C:\Windows\System32\nsldap32v50.dll
[2007.01.15 09:19:16 | 000,016,473 | ---- | C] () -- C:\Windows\System32\SELF32.INI
[2005.12.21 17:57:04 | 000,024,576 | ---- | C] () -- C:\Windows\System32\nsldappr32v50.dll
[2005.12.21 17:54:34 | 000,040,960 | ---- | C] () -- C:\Windows\System32\nsldapssl32v50.dll
[2005.04.25 10:08:44 | 000,009,823 | ---- | C] () -- C:\Windows\System32\cmdiag.ini
[2005.03.15 12:40:56 | 000,000,143 | ---- | C] () -- C:\Windows\System32\cmabout.ini
[2004.09.20 11:19:14 | 000,057,344 | ---- | C] () -- C:\Windows\System32\chksvrn.dll
[2003.09.24 12:42:12 | 000,000,093 | ---- | C] () -- C:\Windows\tm.ini
[2003.09.24 12:42:00 | 000,000,093 | ---- | C] () -- C:\Windows\System32\tm.ini
[2003.09.16 19:11:42 | 000,163,840 | ---- | C] () -- C:\Windows\System32\cmabout.dll
[2003.02.20 18:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[1999.01.19 16:18:30 | 000,110,080 | ---- | C] () -- C:\Windows\System32\LFPNG60N.DLL
[1999.01.19 16:18:30 | 000,046,080 | ---- | C] () -- C:\Windows\System32\LFTIF60N.DLL
[1999.01.19 16:18:30 | 000,043,008 | ---- | C] () -- C:\Windows\System32\LTFIL60N.DLL
[1999.01.19 16:18:30 | 000,020,480 | ---- | C] () -- C:\Windows\System32\LFPSD60N.DLL
[1999.01.19 16:18:30 | 000,019,968 | ---- | C] () -- C:\Windows\System32\LFTGA60N.DLL
[1999.01.19 16:18:30 | 000,019,456 | ---- | C] () -- C:\Windows\System32\LFWPG60N.DLL
[1999.01.19 16:18:30 | 000,019,456 | ---- | C] () -- C:\Windows\System32\LFWMF60N.DLL
[1999.01.19 16:18:28 | 000,176,128 | ---- | C] () -- C:\Windows\System32\LFFAX60N.DLL
[1999.01.19 16:18:28 | 000,141,824 | ---- | C] () -- C:\Windows\System32\LFCMP60N.DLL
[1999.01.19 16:18:28 | 000,023,552 | ---- | C] () -- C:\Windows\System32\LFPCX60N.DLL
[1999.01.19 16:18:28 | 000,022,528 | ---- | C] () -- C:\Windows\System32\LFPCT60N.DLL
[1999.01.19 16:18:28 | 000,022,528 | ---- | C] () -- C:\Windows\System32\LFEPS60N.DLL
[1999.01.19 16:18:28 | 000,022,016 | ---- | C] () -- C:\Windows\System32\LFBMP60N.DLL
[1999.01.19 16:18:28 | 000,018,432 | ---- | C] () -- C:\Windows\System32\LFMSP60N.DLL
[1999.01.19 16:18:28 | 000,017,920 | ---- | C] () -- C:\Windows\System32\LFMAC60N.DLL
[1995.05.19 12:13:00 | 000,005,440 | ---- | C] () -- C:\Windows\System32\WINDVS16.DLL
[1995.02.15 01:11:00 | 000,017,920 | ---- | C] () -- C:\Windows\System32\IMPLODE.DLL
========== LOP Check ==========
[2010.12.07 15:49:56 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\Cuttermaran
[2011.02.16 15:34:08 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\DATEV
[2011.05.09 13:35:25 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\Edwuy
[2011.05.03 18:34:08 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\EventGhost
[2010.07.20 14:19:57 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\FreeFLVConverter
[2011.05.09 14:11:45 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\ICQ
[2010.04.20 15:12:33 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\SQLite Administrator
[2010.07.12 21:27:27 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\StarplayerV3
[2011.02.16 10:59:38 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %ALLUSERSPROFILE%\Application Data\*. >
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
< %APPDATA%\*. >
[2010.03.03 15:45:12 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\Adobe
[2010.03.23 15:39:42 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\ArcSoft
[2010.04.26 21:01:09 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\Avira
[2010.12.02 14:58:34 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\codeblocks
[2010.12.07 15:49:56 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\Cuttermaran
[2011.02.16 15:34:08 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\DATEV
[2011.04.28 14:48:27 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\DivX
[2011.05.09 13:35:25 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\Edwuy
[2011.05.03 18:34:08 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\EventGhost
[2010.07.20 14:19:57 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\FreeFLVConverter
[2010.03.04 15:19:53 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\Help
[2011.05.09 14:11:45 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\ICQ
[2010.03.01 15:27:57 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\Identities
[2010.03.01 15:58:06 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\InstallShield
[2010.03.01 19:18:53 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\Macromedia
[2011.05.09 14:34:45 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\Malwarebytes
[2009.07.14 09:49:10 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\Media Center Programs
[2010.09.14 15:53:32 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\Media Player Classic
[2011.05.09 13:15:59 | 000,000,000 | --SD | M] -- C:\Users\Nuts\AppData\Roaming\Microsoft
[2011.02.16 15:35:51 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\Mozilla
[2010.04.20 15:12:33 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\SQLite Administrator
[2010.07.12 21:27:27 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\StarplayerV3
[2010.08.12 00:12:50 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\vlc
[2010.04.19 18:27:17 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\Winamp
[2010.03.01 16:04:00 | 000,000,000 | ---D | M] -- C:\Users\Nuts\AppData\Roaming\WinRAR
< %APPDATA%\*.exe /s >
< %SYSTEMDRIVE%\*.exe >
< MD5 for: AGP440.SYS >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
< MD5 for: ATAPI.SYS >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
< MD5 for: CNGAUDIT.DLL >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
< MD5 for: IASTORV.SYS >
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
< MD5 for: NETLOGON.DLL >
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
< MD5 for: NVSTOR.SYS >
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
< MD5 for: SCECLI.DLL >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
< MD5 for: USER32.DLL >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
< MD5 for: USERINIT.EXE >
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
< MD5 for: WININIT.EXE >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
< MD5 for: WINLOGON.EXE >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
< MD5 for: WS2IFSL.SYS >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
< %systemroot%\system32\drivers\*.sys /lockedfiles >
< %systemroot%\System32\config\*.sav >
< %systemroot%\*. /mp /s >
< %systemroot%\system32\*.dll /lockedfiles >
< End of report > --- --- --- |