Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Virus Fehlermeldung Failed to save all Components for the file.... (https://www.trojaner-board.de/108408-virus-fehlermeldung-failed-to-save-all-components-for-the-file.html)

Emerell 21.01.2012 18:48
Virus Fehlermeldung Failed to save all Components for the file....
 
Hallo,
seit ein paar Tagen habe ich dieses Virus... hatte mich im Internet schlau gemacht. Es sei wohl der System-Check Virus. Ich habe schon manuell ein paar Dateien gelöscht, somit kommen mittlerweile nicht mehr diese lästigen 20Fehlermeldungen aufeinmal. Dennoch kann ich bestimmte Dateien auf dem Dektop und im Menu nicht sehen (Musik, Dokumente). Wenn ich auf START gehe, steht außerdem nicht rechts, wie eig üblich "Systemsteurer" und alle anderen Unterpunkte, es steht garnichts dort. Mein Desktop Hintergrund ist schwarz und meine Registry lässt sich nicht öffnen. Bin mit meinem latein am Ende und weiß nicht mehr weiter.
Unten habe ich meine Log hochgeladen, leider konnte ich das "defogger_disable" Log nicht laden aus welchem Grund auch immer...
ich könnte aber Posten was drine steht :
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:07 on 21/01/2012 (Lena)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-


LG :dankeschoen:

OTL Logfile:
Code:
OTL logfile created on: 21.01.2012 18:10:38 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Lena\Downloads
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,39 Gb Available Physical Memory | 59,86% Memory free
7,99 Gb Paging File | 6,17 Gb Available in Paging File | 77,11% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 453,94 Gb Total Space | 86,12 Gb Free Space | 18,97% Space Free | Partition Type: NTFS
 
Computer Name: LENA-PC | User Name: Lena | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.21 18:07:32 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Lena\Downloads\OTL.exe
PRC - [2011.10.21 10:53:16 | 000,140,952 | ---- | M] (Google Inc.) -- C:\Users\Lena\AppData\Local\Google\Update\1.3.21.79\GoogleCrashHandler.exe
PRC - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
PRC - [2010.06.16 22:15:06 | 000,250,416 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
PRC - [2010.06.16 21:33:44 | 000,322,608 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
PRC - [2010.02.11 12:36:12 | 000,262,168 | ---- | M] (McAfee, Inc.) -- C:\PROGRA~2\McAfee\MSC\mcsvrcnt.exe
PRC - [2010.01.12 15:57:44 | 000,185,640 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
PRC - [2009.11.13 12:31:14 | 000,092,008 | ---- | M] (TomTom) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2009.11.04 15:59:50 | 000,606,736 | ---- | M] (McAfee, Inc.) -- C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe
PRC - [2009.10.29 06:54:44 | 001,218,008 | ---- | M] (McAfee, Inc.) -- c:\PROGRA~2\mcafee.com\agent\mcagent.exe
PRC - [2009.10.29 06:54:44 | 000,865,832 | ---- | M] (McAfee, Inc.) -- C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe
PRC - [2009.10.29 06:54:44 | 000,378,088 | ---- | M] (McAfee, Inc.) -- c:\PROGRA~2\mcafee\msc\mcupdui.exe
PRC - [2009.10.27 11:19:46 | 000,895,696 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe
PRC - [2009.10.02 13:02:56 | 000,026,640 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\MSK\MskSrver.exe
PRC - [2009.08.21 01:25:56 | 000,261,888 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
PRC - [2009.08.21 01:25:50 | 000,062,720 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2009.08.07 10:18:54 | 000,311,592 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
PRC - [2009.08.07 10:18:42 | 000,349,480 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
PRC - [2009.07.21 13:34:28 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2009.07.08 11:54:34 | 000,359,952 | ---- | M] (McAfee, Inc.) -- c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe
PRC - [2009.07.07 19:10:02 | 002,482,848 | ---- | M] (McAfee, Inc.) -- c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe
PRC - [2009.07.04 02:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2009.06.04 14:04:50 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
PRC - [2009.05.13 15:48:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2009.03.02 12:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2008.08.29 17:27:30 | 000,143,360 | ---- | M] (Vimicro Corporation) -- C:\Program Files (x86)\Vimicro Corporation\VMUVC\VMonitor.exe
PRC - [2006.11.03 11:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\Windows\PixArt\Pac207\Monitor.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.02.03 01:33:56 | 000,460,199 | ---- | M] () -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.11.09 22:08:52 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2009.07.02 19:16:06 | 000,203,264 | ---- | M] (AMD) [Disabled | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.01.16 19:27:17 | 000,040,960 | ---- | M] () [Auto | Running] -- C:\Users\Lena\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer)
SRV - [2012.01.09 20:20:26 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.08.10 10:53:46 | 000,102,608 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)
SRV - [2011.06.17 15:33:02 | 000,237,008 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe -- (McComponentHostService)
SRV - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010.11.04 11:45:14 | 000,186,368 | ---- | M] (MAGIX AG) [Auto | Stopped] -- C:\Program Files (x86)\MAGIX\PC_Check_Tuning_Free_2011\MXSAS.exe -- (MAGIX StartUp Analyze Service)
SRV - [2010.06.16 22:16:06 | 000,057,640 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE -- (HssTrayService)
SRV - [2010.06.16 22:15:06 | 000,250,416 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe -- (HotspotShieldService)
SRV - [2010.06.16 21:33:44 | 000,322,608 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.01.12 15:57:44 | 000,185,640 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2009.11.13 12:31:14 | 000,092,008 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2009.11.04 16:47:32 | 000,155,456 | ---- | M] (McAfee, Inc.) [Unknown | Stopped] -- C:\Programme\McAfee\VirusScan\Mcshield.exe -- (McShield)
SRV - [2009.11.04 15:59:50 | 000,606,736 | ---- | M] (McAfee, Inc.) [On_Demand | Running] -- C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe -- (McSysmon)
SRV - [2009.10.29 06:54:44 | 000,865,832 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc)
SRV - [2009.10.28 11:50:32 | 000,696,848 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2009.10.27 11:19:46 | 000,895,696 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe -- (MpfService)
SRV - [2009.10.02 13:02:56 | 000,026,640 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files (x86)\McAfee\MSK\MskSrver.exe -- (MSK80Service)
SRV - [2009.08.21 01:25:50 | 000,062,720 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2009.08.07 10:18:54 | 000,311,592 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)
SRV - [2009.08.05 21:30:58 | 000,844,320 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2009.07.21 13:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.07.08 11:54:34 | 000,359,952 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe -- (McProxy)
SRV - [2009.07.07 19:10:02 | 002,482,848 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe -- (McNASvc)
SRV - [2009.07.04 02:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.06.04 14:04:50 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009.05.13 15:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009.03.28 03:10:16 | 000,016,896 | ---- | M] (LSI Corporation) [Disabled | Stopped] -- C:\Programme\LSI SoftModem\agr64svc.exe -- (AgereModemAudio)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.01.15 17:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.23 13:51:26 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2010.12.23 13:51:25 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2010.12.16 23:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010.12.08 11:53:38 | 000,169,656 | ---- | M] (<Turtle Entertainment>) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\ESLWireACD.sys -- (ESLWireAC)
DRV:64bit: - [2010.02.18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2010.01.09 00:42:40 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2009.11.25 11:19:02 | 000,074,880 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2009.11.04 16:54:06 | 000,308,296 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk)
DRV:64bit: - [2009.11.04 16:54:06 | 000,102,472 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk)
DRV:64bit: - [2009.11.04 16:54:06 | 000,049,480 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfesmfk.sys -- (mfesmfk)
DRV:64bit: - [2009.11.04 16:47:38 | 000,040,904 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mferkdk.sys -- (mferkdk)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.09 02:49:16 | 001,484,800 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.07.02 19:51:30 | 006,036,480 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009.07.02 19:51:30 | 006,036,480 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2009.07.02 18:31:32 | 000,134,144 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2009.06.20 12:35:00 | 000,317,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM)
DRV:64bit: - [2009.06.20 03:09:57 | 000,054,272 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\L1E62x64.sys -- (L1E) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20)
DRV:64bit: - [2009.06.19 05:12:32 | 000,272,432 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.06.11 22:34:38 | 001,208,320 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2009.06.10 22:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009.06.10 22:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009.06.10 22:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009.06.10 21:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.06.10 21:34:38 | 001,311,232 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.05 11:20:26 | 000,114,192 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.06.05 01:46:50 | 000,216,064 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2009.06.03 04:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.03 04:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.03 04:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009.05.06 01:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009.05.06 01:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2009.05.05 06:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV:64bit: - [2009.04.28 15:03:42 | 000,067,128 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009.04.28 15:03:42 | 000,028,216 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009.04.09 22:23:02 | 000,176,144 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\Mpfp.sys -- (MPFP)
DRV:64bit: - [2008.08.29 15:30:06 | 000,197,120 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmuvc.sys -- (VMUVC)
DRV:64bit: - [2008.07.01 11:14:42 | 000,303,616 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vvftUVC.sys -- (vvftUVC)
DRV:64bit: - [2008.06.17 08:22:24 | 000,040,464 | ---- | M] (H+H Software GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vcd10bus.sys -- (vcd10bus)
DRV:64bit: - [2008.01.17 15:51:44 | 000,018,816 | ---- | M] (Razer USA Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Lycosa.sys -- (Lycosa)
DRV:64bit: - [2007.06.25 09:42:30 | 000,130,088 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s117unic.sys -- (s117unic) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (WDM)
DRV:64bit: - [2007.06.25 09:42:30 | 000,123,432 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s117obex.sys -- (s117obex)
DRV:64bit: - [2007.06.25 09:42:30 | 000,031,272 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s117nd5.sys -- (s117nd5) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (NDIS)
DRV:64bit: - [2007.06.25 09:42:24 | 000,144,424 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s117mdm.sys -- (s117mdm)
DRV:64bit: - [2007.06.25 09:42:24 | 000,125,992 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s117mgmt.sys -- (s117mgmt) Sony Ericsson Device 117 USB WMC Device Management Drivers (WDM)
DRV:64bit: - [2007.06.25 09:42:24 | 000,019,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s117mdfl.sys -- (s117mdfl)
DRV:64bit: - [2007.06.25 09:42:22 | 000,108,072 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s117bus.sys -- (s117bus) Sony Ericsson Device 117 driver (WDM)
DRV:64bit: - [2006.12.05 11:34:26 | 000,572,416 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PFC027.SYS -- (PAC207)
DRV - [2011.06.24 06:31:02 | 000,055,424 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01)
DRV - [2009.08.04 21:45:34 | 000,146,928 | ---- | M] (CyberLink Corp.) [2009/11/11 18:59:25] [Kernel | Auto | Running] -- C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7540&r=27361209i636l0318z1h5t5801a67n
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7540&r=27361209i636l0318z1h5t5801a67n
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7540&r=27361209i636l0318z1h5t5801a67n
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7540&r=27361209i636l0318z1h5t5801a67n
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.netlog.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.google.de/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.goolive.de/logout.html
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48} - C:\Program Files (x86)\Celebrity Toolbar\tbhelper.dll ()
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.facebook.com/home.php#!/?ref=logo"
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.11.3.15590
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {FD2FD708-1F6F-4B68-B141-C5778F0C19BB}:1.0.4
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1
FF - prefs.js..extensions.enabledItems: {249df6a2-e336-47d1-b6c3-ec711ad140ca}:0.5.1.00023
FF - prefs.js..extensions.enabledItems: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}:7.1.1.2
FF - prefs.js..extensions.enabledItems: plugin@yontoo.com:1.20.00
FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.91
FF - prefs.js..extensions.enabledItems: {e213bb8f-8ebd-11db-96b7-005056c00008}:3.0.0.91
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q="
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Lena\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Lena\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Lena\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Lena\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2011.11.12 13:10:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.12.09 15:05:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.06.22 18:44:16 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\firejump@firejump.net: C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\extensions\firejump@firejump.net [2012.01.16 18:07:47 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\mail@gutscheinrausch.de: C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\extensions\mail@gutscheinrausch.de [2012.01.16 18:07:56 | 000,000,000 | ---D | M]
 
[2011.06.23 15:28:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lena\AppData\Roaming\mozilla\Extensions
[2011.06.23 15:28:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lena\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2012.01.16 18:07:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions
[2010.08.16 17:19:35 | 000,000,000 | ---D | M] (Vista-aero) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}
[2011.10.15 19:11:38 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2010.08.16 17:20:35 | 000,000,000 | ---D | M] (myFireFox) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\{e213bb8f-8ebd-11db-96b7-005056c00008}
[2011.10.11 21:50:02 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2012.01.16 18:07:47 | 000,000,000 | ---D | M] (FireJump) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\firejump@firejump.net
[2012.01.16 18:07:56 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\mail@gutscheinrausch.de
[2011.04.27 21:04:11 | 000,000,000 | ---D | M] (Yontoo Layers) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\plugin@yontoo.com
[2010.08.16 17:19:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\extensions
[2010.08.16 17:20:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\{e213bb8f-8ebd-11db-96b7-005056c00008}\chrome\mozapps\extensions
[2012.01.16 18:08:07 | 000,001,081 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\11-suche.xml
[2012.01.16 18:08:07 | 000,002,416 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\englische-ergebnisse.xml
[2012.01.16 18:08:07 | 000,010,697 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\gmx-suche.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-1.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-10.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-11.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-12.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-13.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-14.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-15.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-16.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-17.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-18.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-19.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-2.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-20.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-21.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-3.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-4.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-5.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-6.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-7.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-8.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-9.xml
[2012.01.16 18:08:07 | 000,001,180 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin.xml
[2012.01.16 18:08:07 | 000,002,702 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\lastminute.xml
[2012.01.16 18:08:07 | 000,005,676 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\webde-suche.xml
[2012.01.16 18:08:08 | 000,002,182 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\{1FFEBBC1-F017-4106-815F-BDFFD6E0E11B}.xml
[2012.01.16 18:08:07 | 000,001,864 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\{7C13CB47-AFB1-4825-A0BA-9CFC2F232971}.xml
[2012.01.16 18:08:08 | 000,002,071 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\{B032303A-CD1C-49F7-8423-7CB84A09CFE1}.xml
[2012.01.16 18:26:10 | 000,001,088 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\{BDC2EB6F-3EA7-4A63-8293-3D446A145D6D}.xml
[2011.12.09 15:06:08 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.02.02 21:59:42 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files (x86)\mozilla firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.08.04 21:20:30 | 000,000,000 | ---D | M] (Celebrity Toolbar) -- C:\Program Files (x86)\mozilla firefox\extensions\{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}
() (No name found) -- C:\USERS\LENA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZFA4FARX.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\LENA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZFA4FARX.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI
[2011.12.09 15:05:08 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.13 23:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012.01.16 18:08:07 | 000,001,678 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.16 18:08:07 | 000,001,929 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.01.16 18:08:07 | 000,001,265 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.16 18:08:07 | 000,007,045 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.16 18:08:07 | 000,001,272 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.16 18:08:07 | 000,001,164 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider:  ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =
CHR - Extension: No name found = C:\Users\Lena\AppData\Local\Google\Chrome\User Data\Default\Extensions\mndpkoimnhcijdanbkehgccnadibcceg\1.0\
 
O1 HOSTS File: ([2010.08.07 16:46:22 | 000,000,906 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 204.13.11.27
O1 - Hosts: 127.0.0.1 audio-surf.com
O1 - Hosts: 127.0.0.1 www.audio-surf.com
O2:64bit: - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~2\mcafee\msk\MSKAPB~1.DLL ()
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2:64bit: - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7227.1100\swg64.dll (Google Inc.)
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O2:64bit: - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll (AnchorFree Inc.)
O2 - BHO: (MHTBPos00 Class) - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Program Files (x86)\Celebrity Toolbar\tbcore3.dll ()
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~2\mcafee\msk\mskapbho.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O2 - BHO: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (CMySite Class) - {D62EC836-BF1E-4CAC-81BE-FB9179835D8E} - C:\Program Files (x86)\Celebrity Toolbar\mhxpcomi.dll ()
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodsTlbr.dll (facemoods.com)
O3 - HKLM\..\Toolbar: (Celebrity Toolbar) - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Program Files (x86)\Celebrity Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Celebrity Toolbar) - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Program Files (x86)\Celebrity Toolbar\tbcore3.dll ()
O4:64bit: - HKLM..\Run: [Monitor] C:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [Ocs_SM] C:\Users\Lena\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [VMonitorVMUVC] C:\Program Files (x86)\Vimicro Corporation\VMUVC\VMonitor.exe (Vimicro Corporation)
O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files (x86)\Xfire\Xfire.exe (Xfire Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - C:\Program Files (x86)\Fiddler2\Fiddler.exe (Eric Lawrence)
O9 - Extra 'Tools' menuitem : Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - C:\Program Files (x86)\Fiddler2\Fiddler.exe (Eric Lawrence)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1E577B65-D910-4B48-B4BC-AC400391C6C1}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4FD0EFB2-4D64-4009-AFA0-DE2D614DE746}: NameServer = 10.4.16.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E00B1724-1E8C-4EC3-A23B-A8BEDB943B0C}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\mhtb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mhtb {669A2A3A-F19C-452D-800D-1240299756C1} - C:\Program Files (x86)\Celebrity Toolbar\mhxpcomi.dll ()
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.01.21 16:22:54 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{1330615c-b4b9-11e0-a18d-00262d661864}\Shell - "" = AutoRun
O33 - MountPoints2\{1330615c-b4b9-11e0-a18d-00262d661864}\Shell\AutoRun\command - "" = E:\Setup.exe
O33 - MountPoints2\{5e3e63fa-94b8-11df-915e-00262d661864}\Shell - "" = AutoRun
O33 - MountPoints2\{5e3e63fa-94b8-11df-915e-00262d661864}\Shell\AutoRun\command - "" = E:\Autorun.exe
O33 - MountPoints2\{895016d5-0c4d-11e0-ad92-00262d661864}\Shell - "" = AutoRun
O33 - MountPoints2\{895016d5-0c4d-11e0-ad92-00262d661864}\Shell\AutoRun\command - "" = E:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{2B710DBD-8D9F-4CDE-8ECB-BFCF203A1A10} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} -
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk - C:\PROGRA~2\MCAFEE~1\30937D~1.207\SSSCHE~1.EXE - (McAfee, Inc.)
MsConfig:64bit - StartUpFolder: C:^Users^Lena^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CurseClientStartup.ccip -  - File not found
MsConfig:64bit - StartUpFolder: C:^Users^Lena^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk - C:\PROGRA~2\OPENOF~1.ORG\program\QUICKS~1.EXE - ()
MsConfig:64bit - StartUpReg: Acer ePower Management - hkey= - key= - C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: AdobeAAMUpdater-1.0 - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: AdobeCS5ServiceManager - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: ApnUpdater - hkey= - key= - C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
MsConfig:64bit - StartUpReg: ArcadeDeluxeAgent - hkey= - key= - C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
MsConfig:64bit - StartUpReg: EA Core - hkey= - key= - C:\Program Files (x86)\Electronic Arts\EADM\Core.exe (Electronic Arts)
MsConfig:64bit - StartUpReg: EgisTecLiveUpdate - hkey= - key= - C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
MsConfig:64bit - StartUpReg: Eraser - hkey= - key= - C:\Programme\Eraser\Eraser.exe (The Eraser Project)
MsConfig:64bit - StartUpReg: ESL Wire - hkey= - key= - C:\Program Files\EslWire\wire.exe (Turtle Entertainment GmbH)
MsConfig:64bit - StartUpReg: Facebook Update - hkey= - key= - C:\Users\Lena\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
MsConfig:64bit - StartUpReg: facemoods - hkey= - key= - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodssrv.exe (facemoods.com)
MsConfig:64bit - StartUpReg: Google Update - hkey= - key= - C:\Users\Lena\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
MsConfig:64bit - StartUpReg: Infium - hkey= - key= - C:\Program Files (x86)\QIP 2010\qip.exe (QIP)
MsConfig:64bit - StartUpReg: LManager - hkey= - key= - C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
MsConfig:64bit - StartUpReg: mcagent_exe - hkey= - key= - C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
MsConfig:64bit - StartUpReg: NortonOnlineBackupReminder - hkey= - key= - C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe (Symantec Corporation)
MsConfig:64bit - StartUpReg: PlayMovie - hkey= - key= - C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
MsConfig:64bit - StartUpReg: PLFSetI - hkey= - key= - C:\Windows\PLFSetI.exe ()
MsConfig:64bit - StartUpReg: Raptr - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: swg - hkey= - key= - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig:64bit - StartUpReg: TomTomHOME.exe - hkey= - key= - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
MsConfig:64bit - StartUpReg: VirtualCloneDrive - hkey= - key= - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
MsConfig:64bit - State: "services" - Reg Error: Key error.
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.21 16:20:28 | 000,000,000 | ---D | C] -- C:\sh4ldr
[2012.01.21 16:20:28 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2012.01.21 16:18:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2012.01.16 21:00:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.01.16 21:00:09 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.01.16 19:07:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ Contact Revealer
[2012.01.16 19:07:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ Contact Revealer
[2012.01.16 18:30:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ Away Reader
[2012.01.16 18:30:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ Away Reader
[2012.01.16 18:08:08 | 000,000,000 | ---D | C] -- C:\Users\Lena\AppData\Roaming\Opera
[2012.01.16 18:07:56 | 000,000,000 | ---D | C] -- C:\Users\Lena\AppData\Roaming\OCS
[2012.01.16 18:07:47 | 000,493,056 | ---- | C] ( datenhaus GmbH) -- C:\Windows\SysWow64\dhRichClient3.dll
[2012.01.16 18:07:45 | 000,000,000 | ---D | C] -- C:\Users\Lena\AppData\Roaming\DesktopIconForAmazon
[2012.01.13 23:41:08 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012.01.08 23:30:36 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2012.01.08 23:29:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2012.01.08 23:29:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2012.01.08 23:28:55 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2012.01.08 23:28:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2012.01.08 23:28:28 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2012.01.05 21:59:44 | 000,000,000 | ---D | C] -- C:\Users\Lena\Documents\Amnesia
[2012.01.05 21:58:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amnesia - The Dark Descent
[2012.01.05 21:51:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Amnesia - The Dark Descent
[2012.01.05 21:47:04 | 000,000,000 | ---D | C] -- C:\Users\Lena\Desktop\Amnesia.The.Dark.Descent-SKIDROW
[2011.12.22 19:08:31 | 000,000,000 | ---D | C] -- C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Raptr
[2011.12.22 19:05:17 | 000,000,000 | ---D | C] -- C:\Users\Lena\AppData\Roaming\Raptr
[2011.12.22 19:05:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Raptr
[2009.08.22 10:01:18 | 000,036,136 | ---- | C] (Oberon Media) -- C:\ProgramData\FullRemove.exe
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.21 18:09:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.01.21 18:06:46 | 000,000,000 | ---- | M] () -- C:\Users\Lena\defogger_reenable
[2012.01.21 18:03:19 | 000,085,532 | ---- | M] () -- C:\Windows\SysNative\Config.MPF
[2012.01.21 17:58:03 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2018371923-2337490450-2213972827-1001UA.job
[2012.01.21 17:48:46 | 000,017,376 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.21 17:48:46 | 000,017,376 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.21 17:05:05 | 000,000,436 | ---- | M] () -- C:\Windows\tasks\PCCT - MAGIX AG.job
[2012.01.21 17:03:17 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.01.21 16:29:37 | 000,002,388 | ---- | M] () -- C:\Users\Lena\Desktop\StrongholdLegends - Verknüpfung.lnk
[2012.01.21 16:29:28 | 000,001,163 | ---- | M] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2012.01.21 16:22:54 | 000,000,000 | ---- | M] () -- C:\autoexec.bat
[2012.01.21 15:28:00 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2018371923-2337490450-2213972827-1001UA.job
[2012.01.21 15:26:52 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2018371923-2337490450-2213972827-1001Core.job
[2012.01.21 15:26:30 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.20 23:59:16 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2018371923-2337490450-2213972827-1001Core.job
[2012.01.20 18:29:45 | 3219,935,232 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.17 20:23:58 | 000,105,379 | ---- | M] () -- C:\Users\Lena\Desktop\beispiel.jpg
[2012.01.16 21:45:57 | 000,022,306 | ---- | M] () -- C:\Users\Lena\Desktop\sicherung.reg
[2012.01.16 21:06:15 | 000,368,962 | ---- | M] () -- C:\Users\Lena\Documents\cc_20120116_210527.reg
[2012.01.16 21:00:16 | 000,000,826 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.01.16 12:40:08 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\McDefragTask.job
[2012.01.12 22:13:26 | 000,000,000 | ---- | M] () -- C:\Users\Lena\AppData\Local\{0565D610-B741-4D7A-AB91-388C147E7B5A}
[2012.01.10 21:31:14 | 000,006,262 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\wklnhst.dat
[2012.01.10 21:29:56 | 000,009,196 | ---- | M] () -- C:\Users\Lena\Desktop\facharbeit ambulante pflege.rtf
[2012.01.08 22:51:26 | 000,000,000 | ---- | M] () -- C:\Users\Lena\Documents\update.ini
[2012.01.08 22:51:24 | 008,391,152 | ---- | M] (TeamSpeak Systems GmbH) -- C:\Users\Lena\Documents\ts3client_win32.exe
[2012.01.08 22:51:24 | 000,399,344 | ---- | M] () -- C:\Users\Lena\Documents\update.exe
[2012.01.08 22:51:23 | 000,178,672 | ---- | M] () -- C:\Users\Lena\Documents\error_report.exe
[2012.01.08 22:51:23 | 000,177,648 | ---- | M] () -- C:\Users\Lena\Documents\package_inst.exe
[2012.01.05 21:58:23 | 000,002,184 | ---- | M] () -- C:\Users\Lena\Desktop\Amnesia.lnk
[2011.12.27 17:49:05 | 000,007,608 | ---- | M] () -- C:\Users\Lena\AppData\Local\Resmon.ResmonCfg
[2011.12.27 16:34:03 | 000,007,024 | ---- | M] () -- C:\Users\Lena\Desktop\Final.Destination.5-TERMi-q2bsiwl1izj.dlc
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.01.21 18:06:46 | 000,000,000 | ---- | C] () -- C:\Users\Lena\defogger_reenable
[2012.01.21 16:22:54 | 000,000,000 | ---- | C] () -- C:\autoexec.bat
[2012.01.17 20:23:57 | 000,105,379 | ---- | C] () -- C:\Users\Lena\Desktop\beispiel.jpg
[2012.01.17 15:37:36 | 000,000,826 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.01.16 21:45:55 | 000,022,306 | ---- | C] () -- C:\Users\Lena\Desktop\sicherung.reg
[2012.01.16 21:42:02 | 000,002,258 | ---- | C] () -- C:\Users\Public\Desktop\Stronghold Legends spielen.lnk
[2012.01.16 21:42:02 | 000,002,174 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2012.01.16 21:42:02 | 000,001,832 | ---- | C] () -- C:\Users\Public\Desktop\ICQ7.6.lnk
[2012.01.16 21:42:02 | 000,001,726 | ---- | C] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk
[2012.01.16 21:42:02 | 000,001,300 | ---- | C] () -- C:\Users\Public\Desktop\ZoomBrowser EX.lnk
[2012.01.16 21:42:02 | 000,001,163 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2012.01.16 21:42:02 | 000,001,146 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.01.16 21:42:02 | 000,001,140 | ---- | C] () -- C:\Users\Public\Desktop\Digital Photo Professional.lnk
[2012.01.16 21:42:02 | 000,001,075 | ---- | C] () -- C:\Users\Public\Desktop\EOS Utility.lnk
[2012.01.16 21:42:02 | 000,001,069 | ---- | C] () -- C:\Users\Public\Desktop\MAGIX PC Check & Tuning Free 2011.lnk
[2012.01.16 21:41:55 | 000,001,547 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012.01.16 21:41:55 | 000,001,342 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk
[2012.01.16 21:41:55 | 000,001,246 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2012.01.16 21:41:55 | 000,001,210 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2012.01.16 21:41:54 | 000,002,569 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office PowerPoint Viewer 2007.lnk
[2012.01.16 21:41:54 | 000,001,352 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2012.01.16 21:41:54 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012.01.16 21:41:54 | 000,001,330 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2012.01.16 21:41:54 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012.01.16 21:41:54 | 000,001,193 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works-Start.lnk
[2012.01.16 21:41:54 | 000,001,182 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 5.lnk
[2012.01.16 21:41:54 | 000,001,158 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.01.16 21:41:53 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012.01.16 21:41:53 | 000,001,932 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fiddler2.lnk
[2012.01.16 21:41:53 | 000,001,763 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Eraser.lnk
[2012.01.16 21:41:53 | 000,001,527 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.lnk
[2012.01.16 21:41:53 | 000,001,361 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS5.lnk
[2012.01.16 21:41:53 | 000,001,270 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS5.lnk
[2012.01.16 21:41:53 | 000,001,215 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5.lnk
[2012.01.16 21:41:53 | 000,001,177 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS5.lnk
[2012.01.16 21:41:53 | 000,001,151 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA Download Manager.lnk
[2012.01.16 21:41:53 | 000,001,079 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5 (64 Bit).lnk
[2012.01.16 21:41:53 | 000,001,011 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat.com.lnk
[2012.01.16 21:41:53 | 000,001,001 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2012.01.16 21:05:45 | 000,368,962 | ---- | C] () -- C:\Users\Lena\Documents\cc_20120116_210527.reg
[2012.01.16 18:07:48 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2012.01.12 22:13:26 | 000,000,000 | ---- | C] () -- C:\Users\Lena\AppData\Local\{0565D610-B741-4D7A-AB91-388C147E7B5A}
[2012.01.10 21:29:39 | 000,009,196 | ---- | C] () -- C:\Users\Lena\Desktop\facharbeit ambulante pflege.rtf
[2012.01.05 21:58:23 | 000,002,184 | ---- | C] () -- C:\Users\Lena\Desktop\Amnesia.lnk
[2011.12.28 21:34:26 | 749,541,376 | ---- | C] () -- C:\Users\Lena\Desktop\96 Hours 2.avi
[2011.12.28 21:34:03 | 748,894,208 | ---- | C] () -- C:\Users\Lena\Desktop\96 Hours 1.avi
[2011.12.27 16:34:02 | 000,007,024 | ---- | C] () -- C:\Users\Lena\Desktop\Final.Destination.5-TERMi-q2bsiwl1izj.dlc
[2011.12.15 05:39:42 | 000,042,392 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll
[2011.11.09 22:39:44 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.11.09 22:39:32 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.10.16 10:49:52 | 000,007,608 | ---- | C] () -- C:\Users\Lena\AppData\Local\Resmon.ResmonCfg
[2011.08.31 17:50:37 | 001,603,718 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.03.07 01:51:59 | 000,000,056 | ---- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.01.17 20:29:17 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.01.16 20:34:45 | 000,197,120 | ---- | C] () -- C:\Windows\patchw32.dll
[2010.01.04 18:06:29 | 001,970,176 | ---- | C] () -- C:\Windows\SysWow64\d3dx9.dll
[2009.12.31 16:35:34 | 000,006,262 | ---- | C] () -- C:\Users\Lena\AppData\Roaming\wklnhst.dat
[2009.12.29 22:42:54 | 000,002,387 | ---- | C] () -- C:\Windows\wininit.ini
[2009.11.12 03:24:33 | 000,000,481 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2009.11.12 03:10:42 | 000,001,667 | ---- | C] () -- C:\Windows\WPatchProgress.ini
[2009.11.11 19:12:20 | 000,000,033 | ---- | C] () -- C:\Windows\LaunApp.ini
[2009.11.11 18:49:54 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll
[2009.11.11 18:49:54 | 000,200,704 | ---- | C] () -- C:\Windows\PLFSetI.exe
[2009.11.11 18:49:54 | 000,020,480 | ---- | C] () -- C:\Windows\USB_VIDEO_REG.exe
[2009.11.11 18:49:54 | 000,000,323 | ---- | C] () -- C:\Windows\PidList.ini
[2009.08.22 07:01:04 | 000,872,448 | ---- | C] () -- C:\Windows\iconv.dll
[2009.08.22 07:01:04 | 000,743,424 | ---- | C] () -- C:\Windows\libxml2.dll
[2009.08.22 07:01:02 | 000,000,193 | ---- | C] () -- C:\Windows\Prelaunch.ini
[2009.08.22 07:01:02 | 000,000,168 | ---- | C] () -- C:\Windows\WisLangCode.ini
[2009.08.22 07:01:02 | 000,000,147 | ---- | C] () -- C:\Windows\WisPriority.ini
[2009.08.22 06:08:58 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:59:36 | 000,982,196 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin
[2009.07.13 22:59:36 | 000,139,824 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin
[2009.07.13 22:59:36 | 000,097,448 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
[2009.07.13 22:59:35 | 000,417,344 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2007.04.27 09:43:58 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2006.11.02 09:27:46 | 000,000,518 | ---- | C] () -- C:\Windows\SysWow64\SP207.INI
 
========== LOP Check ==========
 
[2010.02.13 20:25:28 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\Ashampoo
[2010.01.16 20:37:33 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\Atari
[2010.06.23 16:19:20 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\Avnex
[2011.04.19 14:14:37 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\Canon
[2012.01.16 18:07:45 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\DesktopIconForAmazon
[2011.08.14 01:11:46 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\facemoods.com
[2010.02.01 14:49:12 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\GetRightToGo
[2012.01.17 20:18:22 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\ICQ
[2011.08.04 00:09:50 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\LolClient
[2011.10.15 16:32:21 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\MAGIX
[2010.12.29 00:42:23 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\Mumble
[2010.08.04 00:20:10 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\Need for Speed World
[2012.01.16 18:07:56 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\OCS
[2009.12.30 15:28:25 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\OpenOffice.org
[2012.01.16 18:08:08 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\Opera
[2010.05.26 12:34:17 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\PhotoScape
[2010.01.29 13:48:42 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\pokerth
[2010.01.01 01:54:11 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\PowerCinema
[2011.05.04 15:21:58 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\QIP
[2012.01.17 15:00:06 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\Raptr
[2010.06.23 16:31:00 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\Screaming Bee
[2010.01.01 01:54:36 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\SoftDMA
[2011.01.30 14:49:04 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012.01.16 21:14:24 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\TeamViewer
[2010.01.31 18:28:17 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\Template
[2011.06.23 15:28:53 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\TomTom
[2012.01.09 19:01:40 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\TS3Client
[2010.12.25 15:01:26 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\Ubisoft
[2010.07.12 21:06:06 | 000,000,000 | ---D | M] -- C:\Users\Lena\AppData\Roaming\Youtube Downloader HD
[2012.01.20 23:59:16 | 000,000,902 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2018371923-2337490450-2213972827-1001Core.job
[2012.01.21 15:28:00 | 000,000,924 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2018371923-2337490450-2213972827-1001UA.job
[2012.01.16 12:40:08 | 000,000,342 | ---- | M] () -- C:\Windows\Tasks\McDefragTask.job
[2011.12.01 11:53:46 | 000,000,320 | ---- | M] () -- C:\Windows\Tasks\McQcTask.job
[2012.01.21 17:05:05 | 000,000,436 | ---- | M] () -- C:\Windows\Tasks\PCCT - MAGIX AG.job
[2010.09.18 11:04:13 | 000,032,624 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.08.17 16:44:21 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2010.06.26 01:41:01 | 000,000,000 | ---D | M] -- C:\13fa1465fe7fc8faab9fc570
[2011.04.19 10:06:18 | 000,000,000 | ---D | M] -- C:\ab7f0c47cf7051036f918325
[2010.09.07 14:31:43 | 000,000,000 | ---D | M] -- C:\AMD
[2011.01.28 22:35:45 | 000,000,000 | ---D | M] -- C:\ATI
[2010.06.23 16:23:09 | 000,000,000 | ---D | M] -- C:\AV_LOGS
[2009.11.11 19:00:10 | 000,000,000 | ---D | M] -- C:\BOOK
[2011.10.15 17:30:45 | 000,000,000 | -HSD | M] -- C:\Boot
[2011.04.02 10:02:01 | 000,000,000 | ---D | M] -- C:\Casino
[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2009.12.29 11:21:13 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2010.04.07 23:05:46 | 000,000,000 | ---D | M] -- C:\DVDVideoSoft
[2009.12.29 11:28:02 | 000,000,000 | ---D | M] -- C:\elements
[2010.03.28 20:31:11 | 000,000,000 | ---D | M] -- C:\Hotspot Shield
[2009.08.22 09:48:14 | 000,000,000 | R--D | M] -- C:\MSOCache
[2009.12.29 11:33:08 | 000,000,000 | ---D | M] -- C:\oem
[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.01.21 16:20:28 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.01.16 19:07:53 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012.01.19 19:18:14 | 000,000,000 | ---D | M] -- C:\ProgramData
[2009.12.29 11:21:13 | 000,000,000 | -HSD | M] -- C:\Programme
[2009.12.29 11:21:13 | 000,000,000 | -HSD | M] -- C:\Recovery
[2011.08.03 20:50:28 | 000,000,000 | ---D | M] -- C:\Riot Games
[2012.01.21 16:22:46 | 000,000,000 | ---D | M] -- C:\sh4ldr
[2012.01.21 18:12:24 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.08.17 16:43:53 | 000,000,000 | R--D | M] -- C:\Users
[2012.01.21 16:18:23 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.manifest /3 >
 
 
< MD5 for: AFD.SYS  >
[2009.07.14 00:21:42 | 000,500,224 | ---- | M] (Microsoft Corporation) MD5=B9384E03479D2506BC924C16A3DB87BC -- C:\Windows\SysNative\drivers\afd.sys
[2009.07.14 00:21:42 | 000,500,224 | ---- | M] (Microsoft Corporation) MD5=B9384E03479D2506BC924C16A3DB87BC -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16385_none_33dd3439781e25f7\afd.sys
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\explorer.exe
[2011.02.26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\SysWOW64\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Lena\AppData\Local\Temp\RarSFX0\procs\explorer.exe
[2009.08.03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Lena\AppData\Local\Temp\RarSFX0\h\explorer.exe
[2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011.02.26 07:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009.08.03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Users\Lena\Desktop\regedit.exe
[2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Lena\AppData\Local\Temp\RarSFX0\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Lena\AppData\Local\Temp\RarSFX0\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
 
<          >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:E3C56885

< End of report >
--- --- ---

Larusso 22.01.2012 03:08
:hallo:

Adobe Photoshop CS5
legale Version ?

Emerell 22.01.2012 13:14
Jap, eine Textversion

Larusso 22.01.2012 21:10
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Emerell 23.01.2012 19:51
Habe Combofix geladen, nur das Problem ist das McAfee immer wieder von alleine angeht und Combofix als unerwünschtes Programm anzeigt. Habe schon 10 mal den McAfee Prozess beendet aber wie gesagt geht immer wieder automatisch an. Wie kann ich es abstellen?

LG

Larusso 23.01.2012 21:21
Deinstalliere McAfee

Emerell 23.01.2012 22:59
So habe ComboFix durchlaufen lassen... ich habe schonmal festgestellt das ich, wenn ich auch START gehe rechts wieder Bilder etc und Systemsteuerung sehe. Hier ist das Logfile:

Code:
ComboFix 12-01-23.02 - Lena 23.01.2012  21:58:15.1.2 - x64
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.4094.2665 [GMT 1:00]
ausgeführt von:: c:\users\Lena\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\program files (x86)\Common Files\Acer GameZone online.ico
c:\program files (x86)\facemoods.com
c:\program files (x86)\facemoods.com\facemoods\1.4.17.4\bh\facemoods.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.4\facemoods.crx
c:\program files (x86)\facemoods.com\facemoods\1.4.17.4\facemoods.png
c:\program files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodsApp.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodsEng.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodssrv.exe
c:\program files (x86)\facemoods.com\facemoods\1.4.17.4\faCEmoodstlbr.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.4\uninstall.exe
c:\program files (x86)\FLV Direct Player
c:\program files (x86)\FLV Direct Player\downloading.swf
c:\program files (x86)\FLV Direct Player\dskinliteu.dll
c:\program files (x86)\FLV Direct Player\FLVPlayer.exe
c:\program files (x86)\FLV Direct Player\player.dat
c:\program files (x86)\FLV Direct Player\preload.swf
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin.xml
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Button\button_default.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Button\button_disable.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Button\button_down.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Button\button_hot.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Button\button_normal.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\ComboBox\combobox_buttonDown.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\ComboBox\combobox_buttonHot.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\ComboBox\combobox_buttonNor.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\ComboBox\edit_back.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Menu\menubg.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Menu\menuItem_arrow.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Menu\menuItem_check.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Menu\menuitem_select.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Menu\menuItem_seperator.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\SysButton\sys_close_down.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\SysButton\sys_close_hot.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\SysButton\sys_close_nor.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\SysButton\sys_max_down.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\SysButton\sys_max_hot.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\SysButton\sys_max_nor.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\SysButton\sys_min_down.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\SysButton\sys_min_hot.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\SysButton\sys_min_nor.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\SysButton\sys_restore_down.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\SysButton\sys_restore_hot.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\SysButton\sys_restore_nor.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Window\BottomBorder.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Window\downarrow.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Window\LeftBorder.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Window\Logo.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Window\main.ico
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Window\RightBorder.bmp
c:\program files (x86)\FLV Direct Player\SkinDirectFLV\skin\Window\TitlePattern.bmp
c:\program files (x86)\FLV Direct Player\uninstall.exe
c:\program files (x86)\Hotspot Shield\HssIE\HsSIe.dll
c:\program files\Internet Explorer\UpDate.exe
c:\programdata\Tarma Installer
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico
c:\users\Lena\AppData\Local\Microsoft\Windows\Temporary Internet Files\flZ---Il_uAP_rs
c:\users\Lena\AppData\Local\Microsoft\Windows\Temporary Internet Files\HQo_t6171_H
c:\users\Lena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Ieh-60D_Ej38D2
c:\users\Lena\AppData\Local\Microsoft\Windows\Temporary Internet Files\xAxm-8C7xP51-M
c:\users\Lena\AppData\Roaming\facemoods.com
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-23 bis 2012-01-23  ))))))))))))))))))))))))))))))
.
.
2012-01-23 21:09 . 2012-01-23 21:09        --------        d-----w-        c:\users\Haus\AppData\Local\temp
2012-01-23 21:09 . 2012-01-23 21:09        --------        d-----w-        c:\users\Gast\AppData\Local\temp
2012-01-23 21:09 . 2012-01-23 21:09        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-01-21 17:38 . 2012-01-21 17:38        --------        d-----w-        c:\program files (x86)\7-Zip
2012-01-21 16:46 . 2012-01-21 16:46        --------        d-----w-        c:\users\Haus\AppData\Local\Apps
2012-01-21 15:20 . 2012-01-21 15:20        110080        ----a-r-        c:\users\Haus\AppData\Roaming\Microsoft\Installer\{89A07279-1DB3-485A-B1DF-584DF86774B9}\IconF7A21AF7.exe
2012-01-21 15:20 . 2012-01-21 15:20        110080        ----a-r-        c:\users\Haus\AppData\Roaming\Microsoft\Installer\{89A07279-1DB3-485A-B1DF-584DF86774B9}\IconD7F16134.exe
2012-01-21 15:20 . 2012-01-21 15:20        110080        ----a-r-        c:\users\Haus\AppData\Roaming\Microsoft\Installer\{89A07279-1DB3-485A-B1DF-584DF86774B9}\Icon1226A4C5.exe
2012-01-21 15:20 . 2012-01-21 15:22        --------        d-----w-        C:\sh4ldr
2012-01-21 15:20 . 2012-01-21 15:20        --------        d-----w-        c:\program files\Enigma Software Group
2012-01-21 15:18 . 2012-01-21 15:20        --------        d-----w-        c:\windows\89A072791DB3485AB1DF584DF86774B9.TMP
2012-01-21 15:18 . 2012-01-21 15:18        --------        d-----w-        c:\program files (x86)\Common Files\Wise Installation Wizard
2012-01-18 22:21 . 2012-01-18 22:21        --------        d-----w-        c:\users\Haus\AppData\Roaming\OpenOffice.org
2012-01-18 17:54 . 2012-01-23 18:31        --------        d-----w-        c:\users\Haus\AppData\Roaming\ICQ
2012-01-18 17:47 . 2012-01-18 17:47        --------        d-----w-        c:\users\Haus\AppData\Local\Diagnostics
2012-01-17 13:29 . 2012-01-17 13:29        --------        d-----w-        c:\users\Haus\AppData\Roaming\MAGIX
2012-01-17 13:27 . 2012-01-17 13:27        --------        d-----w-        c:\users\Haus\AppData\Local\AMD
2012-01-17 13:26 . 2012-01-17 13:26        --------        d-----w-        c:\users\Haus\AppData\Roaming\ATI
2012-01-17 13:26 . 2012-01-17 13:26        --------        d-----w-        c:\users\Haus\AppData\Local\ATI
2012-01-16 20:00 . 2012-01-16 20:00        --------        d-----w-        c:\program files\CCleaner
2012-01-16 18:07 . 2012-01-16 18:09        --------        d-----w-        c:\program files (x86)\ICQ Contact Revealer
2012-01-16 17:30 . 2012-01-16 17:34        --------        d-----w-        c:\program files (x86)\ICQ Away Reader
2012-01-16 17:08 . 2009-03-12 00:59        124688        ----a-w-        c:\windows\SysWow64\MSWINSCK.OCX
2012-01-16 17:07 . 2012-01-16 17:07        --------        d-----w-        c:\users\Lena\AppData\Roaming\OCS
2012-01-16 17:07 . 2011-03-25 20:42        338432        ----a-w-        c:\windows\SysWow64\sqlite36_engine.dll
2012-01-16 17:07 . 2011-05-13 12:16        493056        ----a-w-        c:\windows\SysWow64\dhRichClient3.dll
2012-01-16 17:07 . 2012-01-16 17:07        --------        d-----w-        c:\users\Lena\AppData\Roaming\DesktopIconForAmazon
2012-01-13 22:41 . 2012-01-13 22:41        --------        d-----w-        c:\windows\system32\Macromed
2012-01-10 17:15 . 2012-01-10 17:15        --------        d-----w-        c:\users\Gast\AppData\Local\AMD
2012-01-08 22:30 . 2012-01-08 22:30        --------        d-----w-        c:\programdata\ATI
2012-01-08 22:29 . 2012-01-08 22:29        --------        d-----w-        c:\program files (x86)\AMD APP
2012-01-08 22:28 . 2012-01-08 22:28        --------        d-----w-        c:\program files\ATI
2012-01-08 22:28 . 2012-01-08 22:28        --------        d-----w-        c:\program files (x86)\ATI Technologies
2012-01-08 22:28 . 2012-01-08 22:29        --------        d-----w-        c:\program files\ATI Technologies
2012-01-05 20:51 . 2012-01-05 20:58        --------        d-----w-        c:\program files (x86)\Amnesia - The Dark Descent
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-21 14:51 . 2011-06-23 14:21        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-01-06 05:15 . 2012-01-19 17:59        8602168        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{8A343F7F-D811-4639-9FD7-404706C521CA}\mpengine.dll
2011-12-15 04:39 . 2011-12-15 04:39        42392        ----a-w-        c:\windows\SysWow64\xfcodec.dll
2011-12-15 04:39 . 2011-12-15 04:39        28056        ----a-w-        c:\windows\system32\xfcodec64.dll
2011-11-09 21:39 . 2011-11-09 21:39        69632        ----a-w-        c:\windows\system32\OpenVideo64.dll
2011-11-09 21:39 . 2011-11-09 21:39        59904        ----a-w-        c:\windows\SysWow64\OpenVideo.dll
2011-11-09 21:39 . 2011-11-09 21:39        61952        ----a-w-        c:\windows\system32\OVDecode64.dll
2011-11-09 21:39 . 2011-11-09 21:39        54784        ----a-w-        c:\windows\SysWow64\OVDecode.dll
2011-11-09 21:39 . 2011-11-09 21:39        17442304        ----a-w-        c:\windows\system32\amdocl64.dll
2011-11-09 21:38 . 2011-11-09 21:38        14375936        ----a-w-        c:\windows\SysWow64\amdocl.dll
2011-11-09 21:37 . 2011-11-09 21:37        51200        ----a-w-        c:\windows\system32\OpenCL.dll
2011-11-09 21:37 . 2011-11-09 21:37        44032        ----a-w-        c:\windows\SysWow64\OpenCL.dll
2010-03-09 05:20 . 2010-03-09 05:20        374472        ----a-w-        c:\program files\internet explorer\plugins\lua_plugin.dll
2010-03-09 05:20 . 2010-03-09 05:20        68808        ----a-w-        c:\program files\internet explorer\plugins\test_plugin.dll
2010-03-09 05:20 . 2010-03-09 05:20        83456        ----a-w-        c:\program files\internet explorer\plugins\ts3g15.dll
2010-03-09 05:20 . 2010-03-09 05:20        121032        ----a-w-        c:\program files\internet explorer\plugins\volumecontrol_plugin.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48}"= "c:\program files (x86)\Celebrity Toolbar\tbhelper.dll" [2009-05-07 355840]
.
[HKEY_CLASSES_ROOT\clsid\{1c4ab6a5-595f-4e86-b15f-f93cce2bbd48}]
[HKEY_CLASSES_ROOT\URLSearchHook.MHURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{1EA6B471-CAD2-419a-9539-0586EEFE2D09}]
[HKEY_CLASSES_ROOT\URLSearchHook.MHURLSearchHook]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{0C37B053-FD68-456a-82E1-D788EE342E6F}]
2009-05-07 21:46        2642432        ----a-w-        c:\program files (x86)\Celebrity Toolbar\tbcore3.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-05-17 11:29        1490312        ----a-w-        c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D62EC836-BF1E-4CAC-81BE-FB9179835D8E}]
2010-02-18 07:37        221184        ----a-w-        c:\program files (x86)\Celebrity Toolbar\mhxpcomi.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}"= "c:\program files (x86)\Celebrity Toolbar\tbcore3.dll" [2009-05-07 2642432]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]
.
[HKEY_CLASSES_ROOT\clsid\{fd2fd708-1f6f-4b68-b141-c5778f0c19bb}]
[HKEY_CLASSES_ROOT\MHToolbar.MHToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\MHToolbar.MHToolbar]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-08-07 09:18        120104        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2011-08-08 1242448]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-08-21 261888]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"VMonitorVMUVC"="c:\program files (x86)\Vimicro Corporation\VMUVC\VMonitor.exe" [2008-08-29 143360]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-11-09 343168]
.
c:\users\Lena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Xfire.lnk - c:\program files (x86)\Xfire\Xfire.exe [2011-12-15 3527576]
.
c:\users\Haus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 0211291327351699mcinstcleanup;McAfee Application Installer Cleanup (0211291327351699);c:\users\Lena\AppData\Local\Temp\021129~1.EXE [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-17 135664]
R2 MAGIX StartUp Analyze Service;MAGIX StartUp Analyze Service;c:\program files (x86)\MAGIX\PC_Check_Tuning_Free_2011\MXSAS.exe [2010-11-04 186368]
R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-17 135664]
R3 Lycosa;Lycosa Keyboard;c:\windows\system32\drivers\Lycosa.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-06-17 237008]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432]
R3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 vcd10bus;Virtual CD v10 Bus Enumerator;c:\windows\system32\DRIVERS\vcd10bus.sys [x]
R3 VMUVC;Vimicro Camera Service VMUVC;c:\windows\system32\Drivers\VMUVC.sys [x]
R3 vvftUVC;Vimicro Camera Filter Service VMUVC;c:\windows\system32\drivers\vvftUVC.sys [x]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};Power Control [2009/11/11 18:59];c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl [2009-08-04 20:45 146928]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-11-09 361984]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2011-06-24 55424]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-08-05 844320]
S2 ESLWireAC;ESLWireAC;c:\windows\system32\drivers\ESLWireACD.sys [x]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-06-04 1150496]
S2 HssWd;Hotspot Shield Monitoring Service;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe [2010-06-16 322608]
S2 ICQ Service;ICQ Service;c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe [2010-11-21 247608]
S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-08-07 311592]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-21 62720]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640]
S2 SearchAnonymizer;SearchAnonymizer;c:\users\Lena\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [2012-01-16 40960]
S2 TeamViewer5;TeamViewer 5;c:\program files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-01-12 185640]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2009-11-13 92008]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2018371923-2337490450-2213972827-1001Core.job
- c:\users\Lena\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-06 19:23]
.
2012-01-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2018371923-2337490450-2213972827-1001UA.job
- c:\users\Lena\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-06 19:23]
.
2012-01-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-17 15:49]
.
2012-01-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-17 15:49]
.
2012-01-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2018371923-2337490450-2213972827-1001Core.job
- c:\users\Lena\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-26 16:32]
.
2012-01-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2018371923-2337490450-2213972827-1001UA.job
- c:\users\Lena\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-26 16:32]
.
2012-01-23 c:\windows\Tasks\PCCT - MAGIX AG.job
- c:\program files (x86)\MAGIX\PC_Check_Tuning_Free_2011\MxTray.exe [2010-11-08 16:08]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2010-06-16 20:34        284208        ----a-w-        c:\program files (x86)\Hotspot Shield\hssie\HssIE_64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-08-07 09:19        137512        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-08-07 349480]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-06 8060960]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"Ocs_SM"="c:\users\Lena\AppData\Roaming\OCS\SM\SearchAnonymizer.exe" [2012-01-16 106496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.goolive.de/logout.html
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7540&r=27361209i636l0318z1h5t5801a67n
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files (x86)\ICQ7.6\ICQ.exe
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{4FD0EFB2-4D64-4009-AFA0-DE2D614DE746}: NameServer = 10.4.16.1
Handler: mhtb - {669A2A3A-F19C-452D-800D-1240299756C1} - c:\program files (x86)\Celebrity Toolbar\mhxpcomi.dll
FF - ProfilePath - c:\users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\dhuj9pc4.Lena\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
Toolbar-Locked - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.4\uninstall.exe
AddRemove-Fussion Dekaron - c:\program files\Fussion Dekaron\Uninstal.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Hotspot Shield\bin\openvpnas.exe
c:\program files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-01-23  22:23:40 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-01-23 21:23
.
Vor Suchlauf: 21 Verzeichnis(se), 90.713.726.976 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 90.443.288.576 Bytes frei
.
- - End Of File - - FC4673FB317424A749CE959742E64E7F


LG

Larusso 24.01.2012 00:18
Deinstalliere bitte
Celebrety Toolbar
ASK Toolbar



Downloade Dir bitte Malwarebytes
  • Installiere das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte poste in deiner nächsten Antwort
MBAM log
log.txt

Emerell 24.01.2012 21:22
So haben beides laufen lassen. Im Anhang beide Logs. Zudem muss ich sagen, dass der Scann von ESET ca.4,5 Stunden gedauert hat, ob das Normal ist ?

LG :abklatsch:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=df499c55dabead40ad4f89223b1fe800
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-24 07:30:51
# local_time=2012-01-24 08:30:51 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=1797 16775165 100 94 69130 102933946 71704 0
# compatibility_mode=5121 16777214 0 3 69130 69130 0 0
# compatibility_mode=5893 16776573 100 94 68083 79048489 0 0
# compatibility_mode=8192 67108863 100 0 3718 3718 0 0
# scanned=523048
# found=9
# cleaned=0
# scan_time=14813
C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe a variant of Win32/HotSpotShield application (unable to clean) 00000000000000000000000000000000 I
C:\Program Files (x86)\ICQ Away Reader\ICQ Away Reader.exe probably a variant of Win32/VB.NPY trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll.vir a variant of Win32/Adware.Yontoo.B application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Lena\Downloads\Facemoods.exe a variant of Win32/SweetIM.B application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Lena\Downloads\HSS-1.37-install-anchorfree-76-conduit.exe a variant of Win32/HotSpotShield application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Lena\Downloads\MsgPlusLive-483.exe a variant of Win32/Adware.CiDHelp application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Lena\Downloads\MsgPlusLive-483_376.exe a variant of Win32/Adware.CiDHelp application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Lena\Downloads\SoftonicDownloader_fuer_anno-1404.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Lena\Downloads\SoftonicDownloader_fuer_curse-client.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I


Malwarebytes Anti-Malware (Test) 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.24.03

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Lena :: LENA-PC [Administrator]

Schutz: Deaktiviert

24.01.2012 14:28:23
mbam-log-2012-01-24 (14-28-23).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 216840
Laufzeit: 9 Minute(n), 42 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\Lena\Downloads\SetupCasino_8b527a_de.exe (PUP.Casino) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Larusso 24.01.2012 21:46
Starte bitte OTL.exe.
Wähle unter
Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.
Poste die OTL.txt und die Extras.txt hier in deinen Thread.



Bitte poste in deiner nächsten Antwort
OTL.txt
Extras.txt

Emerell 24.01.2012 22:11
Hier die beiden Logs

Larusso 24.01.2012 22:12
Poste die Logfiles in dein Thema. Ich lese keine angehängten Logfiles

Emerell 24.01.2012 22:17
Achso ;) Kein Problem


Extras:
Code:
OTL Extras logfile created on: 24.01.2012 22:01:21 - Run 2
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Lena\Downloads
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,26 Gb Available Physical Memory | 56,51% Memory free
7,99 Gb Paging File | 6,37 Gb Available in Paging File | 79,64% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 453,94 Gb Total Space | 74,08 Gb Free Space | 16,32% Space Free | Partition Type: NTFS
 
Computer Name: LENA-PC | User Name: Lena | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files (x86)\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Fotoschau] -- "C:\Program Files (x86)\Pixum\Pixum Fotobuch\Fotoschau.exe" -d "%1" ()
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~3\Office12\ONENOTE.EXE "%L"
Directory [Pixum Fotobuch] -- "C:\Program Files (x86)\Pixum\Pixum Fotobuch\Pixum Fotobuch.exe" "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files (x86)\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Fotoschau] -- "C:\Program Files (x86)\Pixum\Pixum Fotobuch\Fotoschau.exe" -d "%1" ()
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~3\Office12\ONENOTE.EXE "%L"
Directory [Pixum Fotobuch] -- "C:\Program Files (x86)\Pixum\Pixum Fotobuch\Pixum Fotobuch.exe" "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0BD776F3-057D-4C11-020C-4FA9B13D04F9}" = AMD Catalyst Install Manager
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{463FB535-67FB-17C9-6FD6-164BC60462F6}" = ccc-utility64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{69FDD045-DA24-CA41-8FD2-6B3A91F4EDEE}" = AMD Fuel
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo Layers 1.10.01
"{89A07279-1DB3-485A-B1DF-584DF86774B9}" = SpyHunter
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96F70DF8-160F-4F9C-9B9E-2A9B439B4EB9}" = Broadcom Gigabit NetLink Controller
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID-Anmelde-Assistent
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{A7EEF79E-06B2-4382-9D2E-39DBA0F72D50}" = Eraser 6.0.8.2273
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"CCleaner" = CCleaner
"DesktopIconAmazon" = Desktop Icon für Amazon
"ESL Wire_is1" = ESL Wire 1.9.4
"LSI Soft Modem" = LSI HDA Modem
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"SearchAnonymizer" = SearchAnonymizer
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 26
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2B11BA9C-7F97-4C16-970F-1491FD77969B}_is1" = GutscheinRausch.de - AddOn für Firefox
"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding
"{3055CB72-68BC-4D81-9561-5F33AEC1EC12}" = MAGIX PC Check & Tuning Free 2011
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{347151C4-7F16-B275-8865-CC6B64056D3F}" = Catalyst Control Center Graphics Previews Common
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404 - Königsedition
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{44EAFE3D-09A9-4478-A2BF-0EED22F4E49F}" = Die Sims™ 3 Erstelle ein Muster-Tool
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54B7A3C7-0940-4C16-A509-FC3C3758D22A}_is1" = Amnesia - The Dark Descent
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5C209D68-1411-4725-8CDE-1676A85E083E}_is1" = ICQ Contact Revealer 1.1
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F407B2A-F5D0-4E9E-AD3B-575BF07F46E7}" = EliteDekaron
"{62F7DA7E-CCCB-439C-A760-00C3926E761F}" = Microsoft Works
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{65761BAE-11E8-48FE-B30F-1F01011AB906}" = Die Sims™ 3 "Erstelle eine Welt"-Tool - Beta
"{66A405D2-BA14-4594-BF36-B3B544F0754E}" = Stronghold Legends
"{68301905-2DEA-41CE-A4D4-E8B443B099BA}" = MyWinLocker
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71A51A91-E7D3-11DB-A386-005056C00008}" = Vimicro USB2.0 UVC PC Camera
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7760D94E-B1B5-40A0-9AA0-ABF942108755}" = Acer Crystal Eye Webcam
"{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}" = Chicken Invaders 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}" = Granny In Paradise
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112662477}" = Merriam Websters Spell Jam
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}" = Amazonia
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}" = Heroes of Hellas
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}" = Dream Day First Home
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114803710}" = Star Defender 4
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}" = Dairy Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}" = Farm Frenzy 2
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1" = Acer GameZone Console
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0017-0407-0000-0000000FF1CE}" = Microsoft Office SharePoint Designer MUI (German) 2007
"{90120000-0017-0407-0000-0000000FF1CE}_OMUI.de-de_{0B9EAEAC-F271-45DC-BDCB-06ABEEF19825}" = Microsoft Office SharePoint Designer 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_OMUI.de-de_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_OMUI.de-de_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_PROR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0407-1000-0000000FF1CE}_OMUI.de-de_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_OMUI.de-de_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0100-0407-0000-0000000FF1CE}" = Microsoft Office O MUI (German) 2007
"{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0101-0407-0000-0000000FF1CE}" = Microsoft Office X MUI (German) 2007
"{90120000-0101-0407-0000-0000000FF1CE}_OMUI.de-de_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{907B4640-266B-4A21-92FB-CD1A86CD0F63}" = RollerCoaster Tycoon 3
"{910F4A29-1134-49E0-AD8B-56E4A3152BD1}" = Die Sims™ 3 Traumkarrieren
"{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{918A9082-6287-4D25-9002-5E5D5E4971CB}" = League of Legends
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AAF89271-2594-468D-B578-96B2E30C41C4}" = eBay Worldwide
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.1 MUI
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar
"{B4750ECE-3B5F-462F-8950-614D1E0B2204}" = Facebook Video Calling 1.1.0.13
"{B63DFA23-5C10-44B4-881D-45EFBF4A4761}" = MAGIX Screenshare
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}" = Die Sims™ 3 Reiseabenteuer
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C01AE05C-3C8C-75B3-C9F0-1B525DD3697C}" = Catalyst Control Center InstallProxy
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C1A80F67-656F-4DF3-A6C4-DE18A47477C5}_is1" = ICQ Away Reader 1.4
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}" = Norton Online Backup
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CD0F9E16-4E3F-2369-9D67-9A0B84362D0A}" = Catalyst Control Center InstallProxy
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D765F1CE-5AE5-4C47-B134-AE58AC474740}" = OpenOffice.org 3.1
"{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1" = FireJump 1.0.1.8
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{EA926717-CE5A-4CB4-AB21-9E6E9565A458}" = RCT3 Soaked
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F865B0B5-0D43-2704-0B22-35C5F721374B}" = AMD VISION Engine Control Center
"7-Zip" = 7-Zip 9.20
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Airline Tycoon - Deluxe" = Airline Tycoon - Deluxe
"Ashampoo Burning Studio 6 FREE_is1" = Ashampoo Burning Studio 6 FREE
"Audiosurf_is1" = Audiosurf Beta
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"Canon MOV Decoder" = Canon MOV Decoder
"Canon MOV Encoder" = Canon MOV Encoder
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"Cheat Engine 5.5_is1" = Cheat Engine 5.5
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"DPP" = Canon Utilities Digital Photo Professional 3.9
"EADM" = EA Download Manager
"EOS Utility" = Canon Utilities EOS Utility
"ESET Online Scanner" = ESET Online Scanner v3
"facemoods" = Facemoods Toolbar
"Fiddler2" = Fiddler2 (remove only)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free Studio_is1" = Free Studio version 4.2
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.3
"GildenIdent 1½ V4.3" = GildenIdent 1½ V4.3
"GridVista" = Acer GridVista
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HotspotShield" = Hotspot Shield 1.47
"ICQToolbar" = ICQ Toolbar
"Identity Card" = Identity Card
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"JDownloader" = JDownloader
"LManager" = Launch Manager
"MAGIX_MSI_PC_Check_Tuning_Free_2011" = MAGIX PC Check & Tuning Free 2011
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.0.1800
"McAfee Security Scan" = McAfee Security Scan Plus
"Messenger Plus! Live" = Messenger Plus! Live
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox 8.0.1 (x86 de)" = Mozilla Firefox 8.0.1 (x86 de)
"Mumble" = Mumble and Murmur
"MyCamera Download Plugin" = CANON iMAGE GATEWAY MyCamera Download Plugin
"OMUI.de-de" = Microsoft Office Language Pack 2007 - German/Deutsch
"PhotoScape" = PhotoScape
"PhotoStitch" = Canon Utilities PhotoStitch
"Picasa 3" = Picasa 3
"Picture Style Editor" = Canon Utilities Picture Style Editor
"Pixum Fotobuch" = Pixum Fotobuch
"PokerStars.net" = PokerStars.net
"PokerTH 0.7.1" = PokerTH
"PROR" = Microsoft Office Professional 2007-Testversion
"Raptr" = Raptr
"Sony Ericsson Themes Creator" = Sony Ericsson Themes Creator 4.16.2.6
"Sony Ericsson W800" = Sony Ericsson W800 Software
"Steam App 240" = Counter-Strike: Source
"Steam App 24780" = SimCity 4 Deluxe
"Steam App 42700" = Call of Duty: Black Ops
"Steam App 42710" = Call of Duty: Black Ops - Multiplayer
"Steam App 4460" = City Life 2008
"Steam App 500" = Left 4 Dead
"Steam App 550" = Left 4 Dead 2
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 5" = TeamViewer 5
"TomTom HOME" = TomTom HOME 2.7.3.1894
"Uninstall_is1" = Uninstall 1.0.0.1
"VirtualCloneDrive" = VirtualCloneDrive
"WFTK" = Canon Utilities WFT Utility
"WinLiveSuite_Wave3" = Windows Live Essentials
"World of Warcraft" = World of Warcraft
"Xfire" = Xfire (remove only)
"Youtube Downloader HD_is1" = Youtube Downloader HD v. 1.9
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"090215de958f1060" = Curse Client
"EuroGrand Casino" = EuroGrand Casino
"Google Chrome" = Google Chrome
"QIP 2010" = QIP 2010 3.1.5890
"UnityWebPlayer" = Unity Web Player
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 21.01.2012 12:26:09 | Computer Name = Lena-PC | Source = McLogEvent | ID = 5051
Description = Ein Thread in Vorgang C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe brauchte
 länger als 90000 ms, um eine Anfrage auszuführen.    Der Vorgang wird beendet.  Thread-ID:
 5548 (0x15ac)    Thread-Adresse: 0x000000001204C81D    Thread-Nachricht:      Build VSCORE.14.0.0.435
 / 5301.4018  Object being scanned = \Device\HarddiskVolume3\Program Files (x86)\Hotspot
 Shield\bin\openvpnas.exe  by C:\Windows\system32\taskmgr.exe  4(0)(0)  4(0)(0)  7200(0)(0)

 7595(0)(0)  7005(0)(0)  7004(0)(0)  5006(0)(0)  5004(0)(0) 
 
Error - 21.01.2012 12:33:08 | Computer Name = Lena-PC | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Windows Live\Photo Gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
 "C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile  8.  Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
 überein.  Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
 WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".  Verwenden Sie
 das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 
Error - 21.01.2012 12:33:09 | Computer Name = Lena-PC | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Windows Live\Photo Gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
 "C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile  8.  Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
 überein.  Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
 WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".  Verwenden Sie
 das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 
Error - 21.01.2012 13:06:15 | Computer Name = Lena-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Lena\Downloads\SoftonicDownloader_fuer_curse-client.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
 
Error - 21.01.2012 13:07:41 | Computer Name = Lena-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Lena\Downloads\SoftonicDownloader_fuer_curse-client.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
 
Error - 21.01.2012 13:09:48 | Computer Name = Lena-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Lena\Downloads\SoftonicDownloader_fuer_curse-client.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
 
Error - 23.01.2012 14:32:08 | Computer Name = Lena-PC | Source = EventSystem | ID = 4622
Description =
 
Error - 23.01.2012 14:34:49 | Computer Name = Lena-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Lena\Downloads\SoftonicDownloader_fuer_curse-client.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
 
Error - 23.01.2012 14:40:50 | Computer Name = Lena-PC | Source = McLogEvent | ID = 5051
Description = Ein Thread in Vorgang C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe brauchte
 länger als 90000 ms, um eine Anfrage auszuführen.    Der Vorgang wird beendet.  Thread-ID:
 476 (0x1dc)    Thread-Adresse: 0x000000001204C483    Thread-Nachricht:      Build VSCORE.14.0.0.435
 / 5301.4018  Object being scanned = \Device\HarddiskVolume3\Program Files (x86)\Hotspot
 Shield\bin\openvpnas.exe  by C:\ComboFix\PV.3XE  4(0)(0)  4(0)(0)  7200(0)(0)  7595(0)(0)

 7005(0)(0)  7004(0)(0)  5006(0)(0)  5004(0)(0) 
 
Error - 23.01.2012 14:52:51 | Computer Name = Lena-PC | Source = McLogEvent | ID = 5051
Description = Ein Thread in Vorgang C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe brauchte
 länger als 90000 ms, um eine Anfrage auszuführen.    Der Vorgang wird beendet.  Thread-ID:
 3128 (0xc38)    Thread-Adresse: 0x000000001204C808    Thread-Nachricht:      Build VSCORE.14.0.0.435
 / 5301.4018  Object being scanned = \Device\HarddiskVolume3\Program Files (x86)\Hotspot
 Shield\bin\openvpnas.exe  by C:\ComboFix\PV.3XE  4(0)(0)  4(0)(0)  7200(0)(0)  7595(0)(0)

 7005(0)(0)  7004(0)(0)  5006(0)(0)  5004(0)(0) 
 
[ System Events ]
Error - 23.01.2012 14:52:51 | Computer Name = Lena-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "McAfee Real-time Scanner" wurde unerwartet beendet. Dies
 ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
 durchgeführt: Neustart des Diensts.
 
Error - 23.01.2012 16:58:13 | Computer Name = Lena-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Hotspot Shield Service" wurde unerwartet beendet. Dies
 ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden
 durchgeführt: Neustart des Diensts.
 
Error - 23.01.2012 16:58:13 | Computer Name = Lena-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "Hotspot Shield Monitoring Service" wurde unerwartet beendet.
 Dies ist bereits 1 Mal passiert.
 
Error - 23.01.2012 17:00:17 | Computer Name = Lena-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Hotspot Shield Service" wurde unerwartet beendet. Dies
 ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden
 durchgeführt: Neustart des Diensts.
 
Error - 23.01.2012 17:05:01 | Computer Name = Lena-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet.
 Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
 sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
 
Error - 23.01.2012 17:06:49 | Computer Name = Lena-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Hotspot Shield Service" wurde unerwartet beendet. Dies
 ist bereits 3 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden
 durchgeführt: Neustart des Diensts.
 
Error - 23.01.2012 17:08:33 | Computer Name = Lena-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Hotspot Shield Service" wurde unerwartet beendet. Dies
 ist bereits 4 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden
 durchgeführt: Neustart des Diensts.
 
Error - 23.01.2012 17:09:05 | Computer Name = Lena-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 23.01.2012 17:10:43 | Computer Name = Lena-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet.
 Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
 sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
 
Error - 23.01.2012 17:18:54 | Computer Name = Lena-PC | Source = Service Control Manager | ID = 7022
Description = Der Dienst "Windows Update" wurde nicht richtig gestartet.
 
 
< End of report >
LG

Emerell 24.01.2012 22:18
OTL
Code:
OTL logfile created on: 24.01.2012 22:01:21 - Run 2
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Lena\Downloads
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,26 Gb Available Physical Memory | 56,51% Memory free
7,99 Gb Paging File | 6,37 Gb Available in Paging File | 79,64% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 453,94 Gb Total Space | 74,08 Gb Free Space | 16,32% Space Free | Partition Type: NTFS
 
Computer Name: LENA-PC | User Name: Lena | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.21 18:07:32 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Lena\Downloads\OTL.exe
PRC - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011.10.13 17:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
PRC - [2010.06.16 22:15:06 | 000,250,416 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
PRC - [2010.06.16 21:33:44 | 000,322,608 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
PRC - [2010.01.12 15:57:44 | 000,185,640 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
PRC - [2009.11.13 12:31:14 | 000,092,008 | ---- | M] (TomTom) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2009.08.21 01:25:56 | 000,261,888 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
PRC - [2009.08.21 01:25:50 | 000,062,720 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2009.08.07 10:18:54 | 000,311,592 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
PRC - [2009.08.07 10:18:42 | 000,349,480 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
PRC - [2009.07.21 13:34:28 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2009.07.04 02:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2009.06.04 14:04:50 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
PRC - [2009.05.13 15:48:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2009.03.02 12:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2008.08.29 17:27:30 | 000,143,360 | ---- | M] (Vimicro Corporation) -- C:\Program Files (x86)\Vimicro Corporation\VMUVC\VMonitor.exe
PRC - [2006.11.03 11:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\Windows\PixArt\Pac207\Monitor.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.02.03 01:33:56 | 000,460,199 | ---- | M] () -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.11.09 22:08:52 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2009.07.02 19:16:06 | 000,203,264 | ---- | M] (AMD) [Disabled | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.01.16 19:27:17 | 000,040,960 | ---- | M] () [Auto | Running] -- C:\Users\Lena\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer)
SRV - [2012.01.09 20:20:26 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.10.21 15:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.10.13 17:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011.06.17 15:33:02 | 000,237,008 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe -- (McComponentHostService)
SRV - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010.11.04 11:45:14 | 000,186,368 | ---- | M] (MAGIX AG) [Auto | Stopped] -- C:\Program Files (x86)\MAGIX\PC_Check_Tuning_Free_2011\MXSAS.exe -- (MAGIX StartUp Analyze Service)
SRV - [2010.06.16 22:16:06 | 000,057,640 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE -- (HssTrayService)
SRV - [2010.06.16 22:15:06 | 000,250,416 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe -- (HotspotShieldService)
SRV - [2010.06.16 21:33:44 | 000,322,608 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.01.12 15:57:44 | 000,185,640 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2009.11.13 12:31:14 | 000,092,008 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2009.08.21 01:25:50 | 000,062,720 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2009.08.07 10:18:54 | 000,311,592 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)
SRV - [2009.08.05 21:30:58 | 000,844,320 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2009.07.21 13:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.07.04 02:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.06.04 14:04:50 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009.05.13 15:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009.03.28 03:10:16 | 000,016,896 | ---- | M] (LSI Corporation) [Disabled | Stopped] -- C:\Programme\LSI SoftModem\agr64svc.exe -- (AgereModemAudio)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.12.10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011.01.15 17:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.23 13:51:26 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2010.12.23 13:51:25 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2010.12.16 23:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010.12.08 11:53:38 | 000,169,656 | ---- | M] (<Turtle Entertainment>) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\ESLWireACD.sys -- (ESLWireAC)
DRV:64bit: - [2010.02.18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2010.01.09 00:42:40 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2009.11.25 11:19:02 | 000,074,880 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2009.11.04 16:54:06 | 000,308,296 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk)
DRV:64bit: - [2009.11.04 16:54:06 | 000,102,472 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk)
DRV:64bit: - [2009.11.04 16:54:06 | 000,049,480 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mfesmfk.sys -- (mfesmfk)
DRV:64bit: - [2009.11.04 16:47:38 | 000,040,904 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mferkdk.sys -- (mferkdk)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.09 02:49:16 | 001,484,800 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.07.02 19:51:30 | 006,036,480 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009.07.02 19:51:30 | 006,036,480 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2009.07.02 18:31:32 | 000,134,144 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2009.06.20 12:35:00 | 000,317,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM)
DRV:64bit: - [2009.06.20 03:09:57 | 000,054,272 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\L1E62x64.sys -- (L1E) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20)
DRV:64bit: - [2009.06.19 05:12:32 | 000,272,432 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.06.11 22:34:38 | 001,208,320 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2009.06.10 22:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009.06.10 22:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009.06.10 22:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009.06.10 21:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.06.10 21:34:38 | 001,311,232 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.05 11:20:26 | 000,114,192 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.06.05 01:46:50 | 000,216,064 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2009.06.03 04:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.03 04:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.03 04:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009.05.06 01:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009.05.06 01:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2009.05.05 06:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV:64bit: - [2009.04.28 15:03:42 | 000,067,128 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009.04.28 15:03:42 | 000,028,216 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2008.08.29 15:30:06 | 000,197,120 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmuvc.sys -- (VMUVC)
DRV:64bit: - [2008.07.01 11:14:42 | 000,303,616 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vvftUVC.sys -- (vvftUVC)
DRV:64bit: - [2008.06.17 08:22:24 | 000,040,464 | ---- | M] (H+H Software GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vcd10bus.sys -- (vcd10bus)
DRV:64bit: - [2008.01.17 15:51:44 | 000,018,816 | ---- | M] (Razer USA Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Lycosa.sys -- (Lycosa)
DRV:64bit: - [2007.06.25 09:42:30 | 000,130,088 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s117unic.sys -- (s117unic) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (WDM)
DRV:64bit: - [2007.06.25 09:42:30 | 000,123,432 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s117obex.sys -- (s117obex)
DRV:64bit: - [2007.06.25 09:42:30 | 000,031,272 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s117nd5.sys -- (s117nd5) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (NDIS)
DRV:64bit: - [2007.06.25 09:42:24 | 000,144,424 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s117mdm.sys -- (s117mdm)
DRV:64bit: - [2007.06.25 09:42:24 | 000,125,992 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s117mgmt.sys -- (s117mgmt) Sony Ericsson Device 117 USB WMC Device Management Drivers (WDM)
DRV:64bit: - [2007.06.25 09:42:24 | 000,019,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s117mdfl.sys -- (s117mdfl)
DRV:64bit: - [2007.06.25 09:42:22 | 000,108,072 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s117bus.sys -- (s117bus) Sony Ericsson Device 117 driver (WDM)
DRV:64bit: - [2006.12.05 11:34:26 | 000,572,416 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PFC027.SYS -- (PAC207)
DRV - [2011.06.24 06:31:02 | 000,055,424 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01)
DRV - [2009.08.04 21:45:34 | 000,146,928 | ---- | M] (CyberLink Corp.) [2009/11/11 18:59:25] [Kernel | Auto | Running] -- C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7540&r=27361209i636l0318z1h5t5801a67n
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7540&r=27361209i636l0318z1h5t5801a67n
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.google.de/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.goolive.de/logout.html
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.facebook.com/home.php#!/?ref=logo"
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q="
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Lena\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Lena\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Lena\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Lena\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.12.09 15:05:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.06.22 18:44:16 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\firejump@firejump.net: C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\extensions\firejump@firejump.net [2012.01.16 18:07:47 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\mail@gutscheinrausch.de: C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\extensions\mail@gutscheinrausch.de [2012.01.16 18:07:56 | 000,000,000 | ---D | M]
 
[2011.06.23 15:28:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lena\AppData\Roaming\mozilla\Extensions
[2011.06.23 15:28:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lena\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2012.01.16 18:07:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions
[2010.08.16 17:19:35 | 000,000,000 | ---D | M] (Vista-aero) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}
[2011.10.15 19:11:38 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2010.08.16 17:20:35 | 000,000,000 | ---D | M] (myFireFox) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\{e213bb8f-8ebd-11db-96b7-005056c00008}
[2011.10.11 21:50:02 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2012.01.16 18:07:47 | 000,000,000 | ---D | M] (FireJump) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\firejump@firejump.net
[2012.01.16 18:07:56 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\mail@gutscheinrausch.de
[2011.04.27 21:04:11 | 000,000,000 | ---D | M] (Yontoo Layers) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\plugin@yontoo.com
[2010.08.16 17:19:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\extensions
[2010.08.16 17:20:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lena\AppData\Roaming\mozilla\Firefox\Profiles\zfa4farx.default\extensions\{e213bb8f-8ebd-11db-96b7-005056c00008}\chrome\mozapps\extensions
[2012.01.16 18:08:07 | 000,001,081 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\11-suche.xml
[2012.01.16 18:08:07 | 000,002,416 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\englische-ergebnisse.xml
[2012.01.16 18:08:07 | 000,010,697 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\gmx-suche.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-1.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-10.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-11.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-12.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-13.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-14.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-15.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-16.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-17.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-18.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-19.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-2.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-20.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-21.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-3.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-4.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-5.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-6.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-7.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-8.xml
[2012.01.16 18:08:07 | 000,001,097 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin-9.xml
[2012.01.16 18:08:07 | 000,001,180 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\icqplugin.xml
[2012.01.16 18:08:07 | 000,002,702 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\lastminute.xml
[2012.01.16 18:08:07 | 000,005,676 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\webde-suche.xml
[2012.01.16 18:08:08 | 000,002,182 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\{1FFEBBC1-F017-4106-815F-BDFFD6E0E11B}.xml
[2012.01.16 18:08:07 | 000,001,864 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\{7C13CB47-AFB1-4825-A0BA-9CFC2F232971}.xml
[2012.01.16 18:08:08 | 000,002,071 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\{B032303A-CD1C-49F7-8423-7CB84A09CFE1}.xml
[2012.01.16 18:26:10 | 000,001,088 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\searchplugins\{BDC2EB6F-3EA7-4A63-8293-3D446A145D6D}.xml
[2011.12.09 15:06:08 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.02.02 21:59:42 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files (x86)\mozilla firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.01.24 14:19:52 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions\{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}
() (No name found) -- C:\USERS\LENA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZFA4FARX.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\LENA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZFA4FARX.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI
[2011.12.09 15:05:08 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.13 23:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012.01.16 18:08:07 | 000,001,678 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.16 18:08:07 | 000,001,929 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.01.16 18:08:07 | 000,001,265 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.16 18:08:07 | 000,007,045 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.16 18:08:07 | 000,001,272 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.16 18:08:07 | 000,001,164 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider:  ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =
CHR - Extension: No name found = C:\Users\Lena\AppData\Local\Google\Chrome\User Data\Default\Extensions\mndpkoimnhcijdanbkehgccnadibcceg\1.0\
 
O1 HOSTS File: ([2012.01.23 22:14:49 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2:64bit: - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7227.1100\swg64.dll (Google Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4:64bit: - HKLM..\Run: [Monitor] C:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [Ocs_SM] C:\Users\Lena\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [VMonitorVMUVC] C:\Program Files (x86)\Vimicro Corporation\VMUVC\VMonitor.exe (Vimicro Corporation)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files (x86)\Xfire\Xfire.exe (Xfire Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - C:\Program Files (x86)\Fiddler2\Fiddler.exe (Eric Lawrence)
O9 - Extra 'Tools' menuitem : Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - C:\Program Files (x86)\Fiddler2\Fiddler.exe (Eric Lawrence)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1E577B65-D910-4B48-B4BC-AC400391C6C1}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4FD0EFB2-4D64-4009-AFA0-DE2D614DE746}: NameServer = 10.4.16.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E00B1724-1E8C-4EC3-A23B-A8BEDB943B0C}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.01.21 16:22:54 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.24 16:22:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.01.24 16:21:14 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Lena\Desktop\esetsmartinstaller_enu.exe
[2012.01.24 14:26:48 | 000,000,000 | ---D | C] -- C:\Users\Lena\AppData\Roaming\Malwarebytes
[2012.01.24 14:26:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.01.24 14:26:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.01.24 14:26:27 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.01.24 14:26:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.01.23 22:41:06 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.01.23 22:41:05 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2012.01.23 22:41:05 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2012.01.23 22:41:05 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.01.23 22:41:05 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.01.23 22:41:05 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.01.23 22:41:05 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.01.23 22:41:05 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2012.01.23 22:41:05 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2012.01.23 22:41:04 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2012.01.23 22:41:04 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2012.01.23 22:41:04 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.01.23 22:41:04 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.01.23 22:41:04 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2012.01.23 22:41:04 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2012.01.23 22:40:48 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xmllite.dll
[2012.01.23 22:40:33 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccu32.dll
[2012.01.23 22:40:33 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccr32.dll
[2012.01.23 22:40:32 | 000,319,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbcjt32.dll
[2012.01.23 22:40:32 | 000,212,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbctrac.dll
[2012.01.23 22:40:32 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbctrac.dll
[2012.01.23 22:40:32 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccp32.dll
[2012.01.23 22:40:32 | 000,122,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccp32.dll
[2012.01.23 22:40:32 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccu32.dll
[2012.01.23 22:40:32 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccr32.dll
[2012.01.23 22:40:28 | 001,572,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll
[2012.01.23 22:40:28 | 001,328,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll
[2012.01.23 22:40:28 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll
[2012.01.23 22:40:28 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll
[2012.01.23 22:40:25 | 002,326,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tquery.dll
[2012.01.23 22:40:25 | 002,228,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssrch.dll
[2012.01.23 22:40:25 | 001,553,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tquery.dll
[2012.01.23 22:40:25 | 001,401,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssrch.dll
[2012.01.23 22:40:24 | 000,779,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssvp.dll
[2012.01.23 22:40:24 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssvp.dll
[2012.01.23 22:40:24 | 000,491,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssph.dll
[2012.01.23 22:40:24 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssph.dll
[2012.01.23 22:40:24 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssphtb.dll
[2012.01.23 22:40:24 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SearchProtocolHost.exe
[2012.01.23 22:40:24 | 000,113,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SearchFilterHost.exe
[2012.01.23 22:40:24 | 000,075,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msscntrs.dll
[2012.01.23 22:40:24 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msscntrs.dll
[2012.01.23 22:40:19 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2012.01.23 22:39:53 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2012.01.23 22:39:51 | 000,852,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.01.23 22:39:51 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.01.23 22:39:50 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisdecd.dll
[2012.01.23 22:39:50 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll
[2012.01.23 22:39:50 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSNP.ax
[2012.01.23 22:39:50 | 000,108,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisrndr.ax
[2012.01.23 22:39:50 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisrndr.ax
[2012.01.23 22:39:49 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSNP.ax
[2012.01.23 22:39:49 | 000,104,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Mpeg2Data.ax
[2012.01.23 22:39:49 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSDvbNP.ax
[2012.01.23 22:39:49 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Mpeg2Data.ax
[2012.01.23 22:39:49 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSDvbNP.ax
[2012.01.23 22:38:17 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2012.01.23 22:38:17 | 000,422,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2012.01.23 22:38:16 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2012.01.23 22:38:16 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2012.01.23 22:38:16 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2012.01.23 22:38:16 | 000,214,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2012.01.23 22:38:16 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2012.01.23 22:38:16 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2012.01.23 22:38:16 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2012.01.23 22:38:16 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2012.01.23 22:38:16 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2012.01.23 22:38:16 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2012.01.23 22:38:16 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.01.23 22:38:16 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.01.23 22:38:15 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012.01.23 22:38:15 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012.01.23 22:38:15 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012.01.23 22:38:15 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012.01.23 22:38:15 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012.01.23 22:38:15 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012.01.23 22:38:15 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012.01.23 22:38:15 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012.01.23 22:38:15 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.01.23 22:38:15 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.01.23 22:38:15 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012.01.23 22:38:15 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012.01.23 22:38:15 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012.01.23 22:38:15 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012.01.23 22:38:15 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012.01.23 22:38:15 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012.01.23 22:38:15 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012.01.23 22:38:15 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012.01.23 22:38:15 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2012.01.23 22:38:10 | 000,252,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drvinst.exe
[2012.01.23 22:38:10 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\devrtl.dll
[2012.01.23 22:38:05 | 000,861,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
[2012.01.23 22:38:05 | 000,331,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleacc.dll
[2012.01.23 22:38:03 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2012.01.23 22:38:03 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2012.01.23 22:37:46 | 001,739,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2012.01.23 22:37:44 | 005,507,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.01.23 22:37:43 | 003,957,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.01.23 22:37:42 | 003,902,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.01.23 22:32:19 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\packager.dll
[2012.01.23 22:32:19 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\packager.dll
[2012.01.23 22:15:06 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.01.23 21:51:47 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.01.23 21:51:47 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.01.23 21:51:47 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.01.23 19:39:19 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.01.23 19:37:45 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.01.23 19:33:34 | 004,388,468 | R--- | C] (Swearware) -- C:\Users\Lena\Desktop\ComboFix.exe
[2012.01.21 18:38:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.01.21 18:38:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7-Zip
[2012.01.21 16:20:28 | 000,000,000 | ---D | C] -- C:\sh4ldr
[2012.01.21 16:20:28 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2012.01.21 16:18:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2012.01.16 21:00:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.01.16 21:00:09 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.01.16 19:07:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ Contact Revealer
[2012.01.16 19:07:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ Contact Revealer
[2012.01.16 18:30:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ Away Reader
[2012.01.16 18:30:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ Away Reader
[2012.01.16 18:08:29 | 000,124,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSWINSCK.OCX
[2012.01.16 18:08:08 | 000,000,000 | ---D | C] -- C:\Users\Lena\AppData\Roaming\Opera
[2012.01.16 18:07:56 | 000,000,000 | ---D | C] -- C:\Users\Lena\AppData\Roaming\OCS
[2012.01.16 18:07:47 | 000,493,056 | ---- | C] ( datenhaus GmbH) -- C:\Windows\SysWow64\dhRichClient3.dll
[2012.01.16 18:07:45 | 000,000,000 | ---D | C] -- C:\Users\Lena\AppData\Roaming\DesktopIconForAmazon
[2012.01.13 23:41:08 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012.01.08 23:30:36 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2012.01.08 23:29:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2012.01.08 23:29:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2012.01.08 23:28:55 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2012.01.08 23:28:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2012.01.08 23:28:28 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2012.01.05 21:59:44 | 000,000,000 | ---D | C] -- C:\Users\Lena\Documents\Amnesia
[2012.01.05 21:58:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amnesia - The Dark Descent
[2012.01.05 21:51:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Amnesia - The Dark Descent
[2012.01.05 21:47:04 | 000,000,000 | ---D | C] -- C:\Users\Lena\Desktop\Amnesia.The.Dark.Descent-SKIDROW
[2009.08.22 10:01:18 | 000,036,136 | ---- | C] (Oberon Media) -- C:\ProgramData\FullRemove.exe
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.24 23:01:48 | 002,344,871 | ---- | M] () -- C:\Users\Lena\Desktop\IMG_2380.JPG
[2012.01.24 23:00:48 | 002,124,734 | ---- | M] () -- C:\Users\Lena\Desktop\IMG_2377.JPG
[2012.01.24 21:58:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2018371923-2337490450-2213972827-1001UA.job
[2012.01.24 21:28:36 | 000,005,232 | ---- | M] () -- C:\Users\Lena\Desktop\relink.us__Ziemlich.beste.Freunde.DVDRip.LD.German.XviD.iNTERNAL-OCM_a72f9c51af6ca632c6a9bdae8cb1da.dlc
[2012.01.24 21:28:04 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2018371923-2337490450-2213972827-1001UA.job
[2012.01.24 21:28:01 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2018371923-2337490450-2213972827-1001Core.job
[2012.01.24 21:09:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.01.24 17:14:23 | 000,000,436 | ---- | M] () -- C:\Windows\tasks\PCCT - MAGIX AG.job
[2012.01.24 16:21:17 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Lena\Desktop\esetsmartinstaller_enu.exe
[2012.01.24 16:12:40 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.01.24 15:33:10 | 000,017,376 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.24 15:33:10 | 000,017,376 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.24 15:26:21 | 004,995,560 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.01.24 15:23:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.24 15:23:16 | 3219,935,232 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.24 15:08:59 | 001,604,910 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.01.24 15:08:59 | 000,701,920 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.01.24 15:08:59 | 000,656,502 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.01.24 15:08:59 | 000,150,882 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.01.24 15:08:59 | 000,123,236 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.01.24 15:08:49 | 001,604,910 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.01.24 14:26:29 | 000,001,117 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.01.24 14:14:32 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2018371923-2337490450-2213972827-1001Core.job
[2012.01.23 22:14:49 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.01.23 19:33:54 | 004,388,468 | R--- | M] (Swearware) -- C:\Users\Lena\Desktop\ComboFix.exe
[2012.01.21 18:43:03 | 000,038,537 | ---- | M] () -- C:\Users\Lena\Desktop\Extras+OTL.zip
[2012.01.21 18:40:20 | 000,024,071 | ---- | M] () -- C:\Users\Lena\Desktop\OTL.zip
[2012.01.21 18:06:46 | 000,000,000 | ---- | M] () -- C:\Users\Lena\defogger_reenable
[2012.01.21 16:29:37 | 000,002,388 | ---- | M] () -- C:\Users\Lena\Desktop\StrongholdLegends - Verknüpfung.lnk
[2012.01.21 16:29:28 | 000,001,163 | ---- | M] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2012.01.21 16:22:54 | 000,000,000 | ---- | M] () -- C:\autoexec.bat
[2012.01.21 15:51:48 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.01.17 20:23:58 | 000,105,379 | ---- | M] () -- C:\Users\Lena\Desktop\beispiel.jpg
[2012.01.16 21:45:57 | 000,022,306 | ---- | M] () -- C:\Users\Lena\Desktop\sicherung.reg
[2012.01.16 21:06:15 | 000,368,962 | ---- | M] () -- C:\Users\Lena\Documents\cc_20120116_210527.reg
[2012.01.16 21:00:16 | 000,000,826 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.01.12 22:13:26 | 000,000,000 | ---- | M] () -- C:\Users\Lena\AppData\Local\{0565D610-B741-4D7A-AB91-388C147E7B5A}
[2012.01.10 21:31:14 | 000,006,262 | ---- | M] () -- C:\Users\Lena\AppData\Roaming\wklnhst.dat
[2012.01.10 21:29:56 | 000,009,196 | ---- | M] () -- C:\Users\Lena\Desktop\facharbeit ambulante pflege.rtf
[2012.01.08 22:51:26 | 000,000,000 | ---- | M] () -- C:\Users\Lena\Documents\update.ini
[2012.01.08 22:51:24 | 008,391,152 | ---- | M] (TeamSpeak Systems GmbH) -- C:\Users\Lena\Documents\ts3client_win32.exe
[2012.01.08 22:51:24 | 000,399,344 | ---- | M] () -- C:\Users\Lena\Documents\update.exe
[2012.01.08 22:51:23 | 000,178,672 | ---- | M] () -- C:\Users\Lena\Documents\error_report.exe
[2012.01.08 22:51:23 | 000,177,648 | ---- | M] () -- C:\Users\Lena\Documents\package_inst.exe
[2012.01.05 21:58:23 | 000,002,184 | ---- | M] () -- C:\Users\Lena\Desktop\Amnesia.lnk
[2011.12.27 17:49:05 | 000,007,608 | ---- | M] () -- C:\Users\Lena\AppData\Local\Resmon.ResmonCfg
[2011.12.27 16:34:03 | 000,007,024 | ---- | M] () -- C:\Users\Lena\Desktop\Final.Destination.5-TERMi-q2bsiwl1izj.dlc
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.01.24 21:54:27 | 002,344,871 | ---- | C] () -- C:\Users\Lena\Desktop\IMG_2380.JPG
[2012.01.24 21:54:13 | 002,124,734 | ---- | C] () -- C:\Users\Lena\Desktop\IMG_2377.JPG
[2012.01.24 21:28:31 | 000,005,232 | ---- | C] () -- C:\Users\Lena\Desktop\relink.us__Ziemlich.beste.Freunde.DVDRip.LD.German.XviD.iNTERNAL-OCM_a72f9c51af6ca632c6a9bdae8cb1da.dlc
[2012.01.24 14:26:29 | 000,001,117 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.01.23 21:51:47 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.01.23 21:51:47 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.01.23 21:51:47 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.01.23 21:51:47 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.01.23 21:51:47 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.01.21 18:43:03 | 000,038,537 | ---- | C] () -- C:\Users\Lena\Desktop\Extras+OTL.zip
[2012.01.21 18:40:20 | 000,024,071 | ---- | C] () -- C:\Users\Lena\Desktop\OTL.zip
[2012.01.21 18:06:46 | 000,000,000 | ---- | C] () -- C:\Users\Lena\defogger_reenable
[2012.01.21 16:22:54 | 000,000,000 | ---- | C] () -- C:\autoexec.bat
[2012.01.17 20:23:57 | 000,105,379 | ---- | C] () -- C:\Users\Lena\Desktop\beispiel.jpg
[2012.01.17 15:37:36 | 000,000,826 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.01.16 21:45:55 | 000,022,306 | ---- | C] () -- C:\Users\Lena\Desktop\sicherung.reg
[2012.01.16 21:42:02 | 000,002,258 | ---- | C] () -- C:\Users\Public\Desktop\Stronghold Legends spielen.lnk
[2012.01.16 21:42:02 | 000,002,174 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2012.01.16 21:42:02 | 000,001,832 | ---- | C] () -- C:\Users\Public\Desktop\ICQ7.6.lnk
[2012.01.16 21:42:02 | 000,001,726 | ---- | C] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk
[2012.01.16 21:42:02 | 000,001,300 | ---- | C] () -- C:\Users\Public\Desktop\ZoomBrowser EX.lnk
[2012.01.16 21:42:02 | 000,001,163 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2012.01.16 21:42:02 | 000,001,146 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.01.16 21:42:02 | 000,001,140 | ---- | C] () -- C:\Users\Public\Desktop\Digital Photo Professional.lnk
[2012.01.16 21:42:02 | 000,001,075 | ---- | C] () -- C:\Users\Public\Desktop\EOS Utility.lnk
[2012.01.16 21:42:02 | 000,001,069 | ---- | C] () -- C:\Users\Public\Desktop\MAGIX PC Check & Tuning Free 2011.lnk
[2012.01.16 21:41:55 | 000,001,547 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012.01.16 21:41:55 | 000,001,342 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk
[2012.01.16 21:41:55 | 000,001,246 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2012.01.16 21:41:55 | 000,001,210 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2012.01.16 21:41:54 | 000,002,569 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office PowerPoint Viewer 2007.lnk
[2012.01.16 21:41:54 | 000,001,352 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2012.01.16 21:41:54 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012.01.16 21:41:54 | 000,001,330 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2012.01.16 21:41:54 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012.01.16 21:41:54 | 000,001,193 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works-Start.lnk
[2012.01.16 21:41:54 | 000,001,182 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 5.lnk
[2012.01.16 21:41:54 | 000,001,158 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.01.16 21:41:53 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012.01.16 21:41:53 | 000,001,932 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fiddler2.lnk
[2012.01.16 21:41:53 | 000,001,763 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Eraser.lnk
[2012.01.16 21:41:53 | 000,001,527 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.lnk
[2012.01.16 21:41:53 | 000,001,361 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS5.lnk
[2012.01.16 21:41:53 | 000,001,270 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS5.lnk
[2012.01.16 21:41:53 | 000,001,215 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5.lnk
[2012.01.16 21:41:53 | 000,001,177 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS5.lnk
[2012.01.16 21:41:53 | 000,001,151 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA Download Manager.lnk
[2012.01.16 21:41:53 | 000,001,079 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5 (64 Bit).lnk
[2012.01.16 21:41:53 | 000,001,011 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat.com.lnk
[2012.01.16 21:41:53 | 000,001,001 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2012.01.16 21:05:45 | 000,368,962 | ---- | C] () -- C:\Users\Lena\Documents\cc_20120116_210527.reg
[2012.01.16 18:07:48 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2012.01.12 22:13:26 | 000,000,000 | ---- | C] () -- C:\Users\Lena\AppData\Local\{0565D610-B741-4D7A-AB91-388C147E7B5A}
[2012.01.10 21:29:39 | 000,009,196 | ---- | C] () -- C:\Users\Lena\Desktop\facharbeit ambulante pflege.rtf
[2012.01.05 21:58:23 | 000,002,184 | ---- | C] () -- C:\Users\Lena\Desktop\Amnesia.lnk
[2011.12.28 21:34:26 | 749,541,376 | ---- | C] () -- C:\Users\Lena\Desktop\96 Hours 2.avi
[2011.12.28 21:34:03 | 748,894,208 | ---- | C] () -- C:\Users\Lena\Desktop\96 Hours 1.avi
[2011.12.27 16:34:02 | 000,007,024 | ---- | C] () -- C:\Users\Lena\Desktop\Final.Destination.5-TERMi-q2bsiwl1izj.dlc
[2011.12.15 05:39:42 | 000,042,392 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll
[2011.11.09 22:39:44 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.11.09 22:39:32 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.10.16 10:49:52 | 000,007,608 | ---- | C] () -- C:\Users\Lena\AppData\Local\Resmon.ResmonCfg
[2011.08.31 17:50:37 | 001,604,910 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.03.07 01:51:59 | 000,000,056 | ---- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.01.17 20:29:17 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.01.16 20:34:45 | 000,197,120 | ---- | C] () -- C:\Windows\patchw32.dll
[2010.01.04 18:06:29 | 001,970,176 | ---- | C] () -- C:\Windows\SysWow64\d3dx9.dll
[2009.12.31 16:35:34 | 000,006,262 | ---- | C] () -- C:\Users\Lena\AppData\Roaming\wklnhst.dat
[2009.12.29 22:42:54 | 000,002,387 | ---- | C] () -- C:\Windows\wininit.ini
[2009.11.12 03:24:33 | 000,000,481 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2009.11.12 03:10:42 | 000,001,667 | ---- | C] () -- C:\Windows\WPatchProgress.ini
[2009.11.11 19:12:20 | 000,000,033 | ---- | C] () -- C:\Windows\LaunApp.ini
[2009.11.11 18:49:54 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll
[2009.11.11 18:49:54 | 000,200,704 | ---- | C] () -- C:\Windows\PLFSetI.exe
[2009.11.11 18:49:54 | 000,020,480 | ---- | C] () -- C:\Windows\USB_VIDEO_REG.exe
[2009.11.11 18:49:54 | 000,000,323 | ---- | C] () -- C:\Windows\PidList.ini
[2009.08.22 07:01:04 | 000,872,448 | ---- | C] () -- C:\Windows\iconv.dll
[2009.08.22 07:01:04 | 000,743,424 | ---- | C] () -- C:\Windows\libxml2.dll
[2009.08.22 07:01:02 | 000,000,193 | ---- | C] () -- C:\Windows\Prelaunch.ini
[2009.08.22 07:01:02 | 000,000,168 | ---- | C] () -- C:\Windows\WisLangCode.ini
[2009.08.22 07:01:02 | 000,000,147 | ---- | C] () -- C:\Windows\WisPriority.ini
[2009.08.22 06:08:58 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:59:36 | 000,982,196 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin
[2009.07.13 22:59:36 | 000,139,824 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin
[2009.07.13 22:59:36 | 000,097,448 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
[2009.07.13 22:59:35 | 000,417,344 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2007.04.27 09:43:58 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2006.11.02 09:27:46 | 000,000,518 | ---- | C] () -- C:\Windows\SysWow64\SP207.INI
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:E3C56885

< End of report >
LG

Larusso 25.01.2012 07:51
Deinstalliere bitte
Spyhunter ( braucht kein Mensch )
Ask Toolbar
Facemoods Toolbar



Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 6 Update 30 ) herunter laden.
  • Wenn die installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
  • Klicke erneut OK.



Ich sehe das Du sogenannte Registry Cleaner am System hast.
In deinem Fall CCleaner.

Wir empfehlen auf keinen Fall jegliche Art von Registry Cleaner.

Der Grund ist ganz einfach:

Die Registry ist das Hirn des Systems. Funktioniert das Hirn nicht, funktioniert der Rest nicht mehr wirklich.
Wir lesen oft genug von Hilfesuchenden, dass deren System nach der Nutzung von Registry Cleanern nicht mehr booted.
  • Wie soll der Cleaner zu 100% wissen ob der Eintrag benötigt wird oder nicht ?
  • Es ist vollkommen egal ob ein paar verwaiste Registry Einträge am System sind oder nicht.
  • Auch die dauernd angepriesene Beschleunigung des Systems ist nur bedingt wahr. Du würdest es nicht merken.
Ein sogenanntes False Positive von einem Cleaner kann auch dein System unbootbar machen.
Zerstörst Du die Registry, zerstörst Du Windows.

Ich empfehle Dir hiermit die oben genannte Software zu deinstallieren und in Zukunft auf solche Art von Software zu verzichten.



Wenn du keine weiteren Probleme mehr hast, sind wir hier fertig. Bitte folge den letzten paar Schritten.



Bitte vor der folgenden Aktion wieder temporär Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.

Windows-Taste + R drücke. Kopiere nun folgende Zeile in die Kommandozeile und klicke OK.
Code:
Combofix /Uninstall
http://larusso.trojaner-board.de/Images/CFuninstall.jpg

Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert, damit auch aus dieser die Schädlinge verschwinden.

Nun die eben deaktivierten Programme wieder aktivieren.



Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.



Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.


Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Emerell 25.01.2012 18:35
So Habe habe die Programme gelöscht. Nur zu Ask & Facemoods Toolbar finde ich nichts zum löschen bei meinen FireFox PlugIns sind sie drin.
Meine Probleme, die ich ganz am Anfang von diesem Thema hatte, sind alle behoben.
Deswegen möchte ich mich Bedanken !!! Alleine hätte ich das nicht geschafft!


LG

Larusso 25.01.2012 22:38
Gib mal bitte in die Adresszeile about: plugins ein. ( ohne Leerzeichen, Forum wandelt es sonst in :p um )

Suche Facemoods und poste mir mal den Pfad zur Datei:


Drücke bitte die Windows + R Taste, kopiere folgendes in die Zeile und klicke OK

msiexec /x "Facemoods"


Sag mir mal, ob sich eine Deinstallationsroutine öffnet

Emerell 25.01.2012 22:55
Bei Plugis steht nirgendswo etwas dazu...

Wenn ich msiexec /x "Facemoods" eingeben, erscheint eine Meldung, ob ich es deinstallieren möchte. Ich drücke auf ja und dann kommt eine Meldung dass das System das Paket oder die Datei wohl nicht findet.

Larusso 26.01.2012 08:22
Dann anders.


Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
@echo off
cd \
dir /s /a /b *Facemoods* > "%temp%\look.txt"
notepad "%temp%\look.txt"
del %0
  • Wähle Datei --> Speichern unter
  • Dateiname: file.bat
  • Dateityp: Wähle Alle Dateien (*.*)
  • Speichere die Datei auf deinem Desktop.

    Es sollte nun ungefähr so aussehen http://larusso.trojaner-board.de/Images/bat.jpg
  • Starte die file.bat.
Vista und Win7 User: Mit Rechtsklick "als Administrator starten"


Es sollte sich ein Textdokument öffnen. Poste den Inhalt bitte hier

Emerell 26.01.2012 22:21
Oki, das File ist auf dem Desktop, dennnoch öffnet sich das cmd Fenster wo nichts drin steht.

Larusso 27.01.2012 17:01
Sind diese PlugIns immer noch vorhanden ?


Scan mit SystemLook

Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop.

Download Mirror #1 - Download Mirror #2
  • Doppelklick auf die SystemLook.exe, um das Tool zu starten.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

    Code:
    :filefind
    *facemoods*
    ASK*
    :regfind
    facemoods
  • Klicke nun auf den Button Look, um den Scan zu starten.
  • Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, diese hier in den Thread posten.
  • Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.


Bitte poste in deiner nächsten Antwort
Systemlook.txt

Emerell 28.01.2012 19:57
Code:
SystemLook 30.07.11 by jpshortstuff
Log created at 19:40 on 28/01/2012 by Lena
Administrator - Elevation successful
WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.

========== filefind ==========

Searching for "*facemoods*"
C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Cookies\Low\gast@cnfg.facemoods[1].txt        --a---- 484 bytes        [09:11 26/12/2011]        [09:11 26/12/2011] 48FFA5C89DBA66F7CC564B1A0438D8C6
C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Cookies\Low\gast@facemoods[2].txt        --a---- 98 bytes        [09:12 26/12/2011]        [09:12 26/12/2011] 90551264C3B8361E203ECFB893666B3B
C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Cookies\Low\gast@x.tlbron.facemoods[2].txt        --a---- 362 bytes        [09:41 26/12/2011]        [09:41 26/12/2011] 76065EC8E353E0537F72A180351A4CCE
C:\Users\Haus\AppData\Roaming\Microsoft\Windows\Cookies\Low\haus@cnfg.facemoods[2].txt        --a---- 575 bytes        [00:03 22/01/2012]        [00:03 22/01/2012] D17DAB861510DEABEED878732D01EA20
C:\Users\Haus\AppData\Roaming\Microsoft\Windows\Cookies\Low\haus@facemoods[1].txt        --a---- 99 bytes        [15:47 17/08/2011]        [15:47 17/08/2011] 4D827CCACA4D0321E99FCC2F223D9FDD
C:\Users\Haus\AppData\Roaming\Microsoft\Windows\Cookies\Low\haus@facemoods[2].txt        --a---- 140 bytes        [15:47 17/08/2011]        [15:47 17/08/2011] FCF6B7BB7108D5D4C77E71CF1E8EA972
C:\Users\Haus\AppData\Roaming\Microsoft\Windows\Cookies\Low\haus@smart.facemoods[1].txt        --a---- 145 bytes        [15:47 17/08/2011]        [15:47 17/08/2011] 429809506A077C5BEAC1E458FFC44719
C:\Users\Haus\AppData\Roaming\Microsoft\Windows\Cookies\Low\haus@x.tlbron.facemoods[1].txt        --a---- 279 bytes        [16:01 19/01/2012]        [16:01 19/01/2012] E13F2AAA8D965F09D981DE1BB095DBC4
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@cnfg.facemoods[1].txt        --a---- 346 bytes        [20:50 28/10/2011]        [20:50 28/10/2011] 249926EA939A8DEF9ACE69C4F094A765
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@cnfg.facemoods[2].txt        --a---- 140 bytes        [09:09 02/04/2011]        [09:09 02/04/2011] E62F39684626B4E3DC0EB36F377C6D50
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@cnfg.facemoods[3].txt        --a---- 342 bytes        [17:42 12/08/2011]        [17:42 12/08/2011] D7CBF9AB9C7F5D1DD0C66D76714CF654
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@cnfg.facemoods[4].txt        --a---- 346 bytes        [15:07 26/09/2011]        [15:07 26/09/2011] 6EB137683E88367E746DE8037945AFB3
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@cnfg.facemoods[5].txt        --a---- 346 bytes        [22:40 15/10/2011]        [22:40 15/10/2011] 453F5F17D87C8F785E5EDEDC425612FB
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@cnfg.facemoods[6].txt        --a---- 449 bytes        [16:10 06/12/2011]        [16:10 06/12/2011] A1C58EFD14352AD2FD3365D419F2296A
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@facemoods[1].txt        --a---- 99 bytes        [16:10 06/12/2011]        [16:10 06/12/2011] 4291988573D547FBC5F881DB3349152C
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@facemoods[2].txt        --a---- 99 bytes        [17:34 14/10/2011]        [17:34 14/10/2011] F6EE463AC25B8472C1D3431D055EC685
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@facemoods[3].txt        --a---- 98 bytes        [08:46 25/09/2011]        [15:07 26/09/2011] 015DA792F7346814C97CCC3305B86CB9
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@facemoods[5].txt        --a---- 98 bytes        [15:12 26/10/2011]        [20:51 28/10/2011] 6DD3CC16E3DD3AE55B274DFD851AD36F
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@smart.facemoods[2].txt        --a---- 145 bytes        [21:27 13/10/2011]        [21:27 13/10/2011] 421E984FBE802D24B2714DCC14D14007
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@smart.facemoods[3].txt        --a---- 146 bytes        [20:39 02/11/2011]        [20:39 02/11/2011] 0E120A3E16608539A83825B8ED707EAF
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@tlbron.facemoods[1].txt        --a---- 278 bytes        [21:38 07/08/2011]        [21:38 07/08/2011] D2242D906C0B0260B47467D1BEE230BF
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@x.tlbron.facemoods[1].txt        --a---- 546 bytes        [15:12 26/10/2011]        [20:51 28/10/2011] E52CF4D29A8845F2B76A22AFBF4F84F7
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@x.tlbron.facemoods[2].txt        --a---- 547 bytes        [13:43 11/08/2011]        [23:52 12/08/2011] F0C9E9ED6DF95A23EBD0A0D3182D7613
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@x.tlbron.facemoods[3].txt        --a---- 548 bytes        [18:48 12/10/2011]        [17:34 14/10/2011] 3EE85E8FAB9B8E8C91237AAF3AB74F86
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@x.tlbron.facemoods[4].txt        --a---- 465 bytes        [16:10 06/12/2011]        [16:10 06/12/2011] 7510762F137D461BFD5F86DDFCD0992A
C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Cookies\lena@x.tlbron.facemoods[5].txt        --a---- 464 bytes        [22:20 10/01/2012]        [22:20 10/01/2012] 24D62A1F8BAF5B9C1009DCAADD5B1B18
C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\extensions\ffxtlbr@Facemoods.com.xpi        --a---- 25939 bytes        [15:38 18/08/2011]        [15:38 18/08/2011] ABAD66994FA4E927AFB7D830649C5167
C:\Users\Lena\Downloads\Facemoods.exe        --a---- 388824 bytes        [21:04 01/03/2011]        [21:04 01/03/2011] 59543527521275B13AB6AFD6AA350CA7

Searching for "ASK*"
C:\Program Files (x86)\Airline Tycoon - Deluxe\Gli\AskBrick.GLI        --a---- 570607 bytes        [14:18 19/11/2011]        [12:31 03/04/2002] 7F341C981D790CA3C8A39576A6349BDD
C:\Program Files (x86)\ICQ7.6\Xtraz\zlango7\theme\zlango_popup_xtra\ask.png        --a---- 1769 bytes        [16:16 10/11/2011]        [16:16 10/11/2011] 1AC4273239B2BC7672F78F362CD632CD
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\resource\askconnectpanel.res        --a---- 1523 bytes        [15:36 29/12/2009]        [15:36 29/12/2009] BF5EC33CC1CB349F85216CD7EC0D262D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Biker\AskReady01.vcd        --a---- 1027 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 11E8BA43F26E6CA5F4146AC24FE7C73E
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Biker\AskReady02.vcd        --a---- 1027 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 3BDA3A4416E69E2CD5E25F84EC063AC0
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Biker\AskReady03.vcd        --a---- 1027 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 9CFB65B52AA8C47701A2F3401C7C3FAA
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Biker\AskReady04.vcd        --a---- 1027 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 4C065A9EC6E7C52AA4218777A30440A9
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Biker\AskReady05.vcd        --a---- 1027 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] B3D131485C9DC5AA3E4E08A13569E911
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Biker\AskReady06.vcd        --a---- 1027 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] A403E8DBE0B10F2E08D30A4DEFE4350A
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Biker\AskReady07.vcd        --a---- 1027 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] D373D29F8D5F517B41EB712CFB5713F2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Biker\AskReady08.vcd        --a---- 1027 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 2BDA341FE0016EBE0E73D25E20C5BACB
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Biker\AskReady09.vcd        --a---- 1027 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 374E4ED46C1E3B48E87C5385D64F66C2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Biker\AskReady10.vcd        --a---- 954 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 54DDFCACEF4F7549D82C2E0F84D29964
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Manager\AskReady01.vcd        --a---- 1544 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 99F1240CBF3CEB17CBB5750EF0263117
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Manager\AskReady02.vcd        --a---- 1544 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 69698DC304FF016BB229FE44D69C4197
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Manager\AskReady03.vcd        --a---- 1382 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 60C9E6CA26AA062CB493D59C1C78E568
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Manager\AskReady04.vcd        --a---- 1382 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] F5163F2AAC8827EB5078309029386DC2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Manager\AskReady05.vcd        --a---- 1544 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] F98FFC8C4371080C06EA5275BA442EEF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Manager\AskReady06.vcd        --a---- 1470 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 642CEFC37EA5F6501EDD6ADA451BF1E5
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Manager\AskReady07.vcd        --a---- 1544 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] A509E90F9960116E8615C5AD08461F0B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Manager\AskReady08.vcd        --a---- 1503 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 5839F6BC435404C4D27CE15F2E1533A3
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\Manager\AskReady09.vcd        --a---- 1544 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 9C6AAADEC562F993BAB5EC17BC5E7EBC
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\NamVet\AskReady01.vcd        --a---- 1425 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] CF505192B8FDC7B4D2B3826D6CE5503E
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\NamVet\AskReady02.vcd        --a---- 1425 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 1FC22B067D22666659E837AD592234B3
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\NamVet\AskReady03.vcd        --a---- 1425 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] D08B88B94E06D809EEF906C36A4B2BFF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\NamVet\AskReady04.vcd        --a---- 1425 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] BE48B27C9231CE8FFA1502559B3E568D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\NamVet\AskReady05.vcd        --a---- 1425 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 15C34CC09B02789E8109AB3B304143CD
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\NamVet\AskReady09.vcd        --a---- 1425 bytes        [15:37 29/12/2009]        [15:37 29/12/2009] 0E783066AA46FF58E04E0CCDFE72B333
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\TeenGirl\AskReady03.vcd        --a---- 1711 bytes        [15:38 29/12/2009]        [15:38 29/12/2009] 7C0BDCF087062283D66DA55474B30BAF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\TeenGirl\askready11.vcd        --a---- 1711 bytes        [15:38 29/12/2009]        [15:38 29/12/2009] C44F35D2F4329C3092A65F1C70370AC2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\TeenGirl\askready12.vcd        --a---- 1711 bytes        [15:38 29/12/2009]        [15:38 29/12/2009] 3225EB482499DBFF54E682CD17A5E640
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\TeenGirl\askready13.vcd        --a---- 1711 bytes        [15:38 29/12/2009]        [15:38 29/12/2009] 60C011D2CD907C97FB9AB70F7B7F299E
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\TeenGirl\askready14.vcd        --a---- 1711 bytes        [15:38 29/12/2009]        [15:38 29/12/2009] D667FE87A3166795D9A402EF6D335011
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\TeenGirl\askready15.vcd        --a---- 1711 bytes        [15:38 29/12/2009]        [15:38 29/12/2009] 4870FAC3F4722A52EAB37F6B2926138C
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\TeenGirl\askready17.vcd        --a---- 1711 bytes        [15:38 29/12/2009]        [15:38 29/12/2009] C337CB7CC4CE5FA796146F2E64B13F62
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\TeenGirl\askready18.vcd        --a---- 1711 bytes        [15:38 29/12/2009]        [15:38 29/12/2009] 3A4B46FAFE1FCA47553CBE59D1CB054A
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\TeenGirl\askready19.vcd        --a---- 1711 bytes        [15:38 29/12/2009]        [15:38 29/12/2009] CE6EF2FB50781541A770E7F4B7687B1A
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\scenes\TeenGirl\askready21.vcd        --a---- 1656 bytes        [15:38 29/12/2009]        [15:38 29/12/2009] D55B6741CEF6E6145F0FF0BFEA4C59F0
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Biker\AskReady01.wav        --a---- 112613 bytes        [13:36 30/12/2009]        [13:36 30/12/2009] 3B1EC71796F267B3023A530785C58172
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Biker\AskReady02.wav        --a---- 93951 bytes        [13:47 30/12/2009]        [13:47 30/12/2009] 90D06E556D0B50ACA6BD8113FD26671B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Biker\AskReady03.wav        --a---- 54690 bytes        [13:30 30/12/2009]        [13:31 30/12/2009] 1FD2314FB3B59848A32893AA92F7F42C
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Biker\AskReady04.wav        --a---- 80500 bytes        [13:48 30/12/2009]        [13:49 30/12/2009] FAEB07F389209219F22A352398ED48F5
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Biker\AskReady05.wav        --a---- 138152 bytes        [13:26 30/12/2009]        [13:26 30/12/2009] 83837B6B97137A9E64957FC2480444DF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Biker\AskReady06.wav        --a---- 102434 bytes        [13:17 30/12/2009]        [13:17 30/12/2009] 36346A470DE79F325DDAA10CC3192E6B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Biker\AskReady07.wav        --a---- 129460 bytes        [13:43 30/12/2009]        [13:43 30/12/2009] D323461C8E9020188FBFF1BC931EBAB0
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Biker\AskReady08.wav        --a---- 59774 bytes        [13:48 30/12/2009]        [13:48 30/12/2009] 0A2E1853CAA204D99533BED1EAC63449
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Biker\AskReady09.wav        --a---- 108160 bytes        [13:44 30/12/2009]        [13:44 30/12/2009] 548D5DBEBC4264E69A437C19382F1B27
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Biker\AskReady10.wav        --a---- 167754 bytes        [13:33 30/12/2009]        [13:33 30/12/2009] 710E5B404747DA87B024CE8989D13283
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Manager\AskReady01.wav        --a---- 33318 bytes        [13:23 30/12/2009]        [13:23 30/12/2009] F902A92EA288A9D706F1AB1597DAD415
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Manager\AskReady02.wav        --a---- 40814 bytes        [13:31 30/12/2009]        [13:32 30/12/2009] 16ECC9DCE7A86E49675156AFAF239E3D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Manager\AskReady03.wav        --a---- 65953 bytes        [13:45 30/12/2009]        [13:45 30/12/2009] AF9032EFAC69668FFB308A55F1974FAC
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Manager\AskReady04.wav        --a---- 93785 bytes        [13:18 30/12/2009]        [13:18 30/12/2009] 5738C6D0FDE106A57831318CD6CD2FE9
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Manager\AskReady05.wav        --a---- 94193 bytes        [13:26 30/12/2009]        [13:26 30/12/2009] 0D54F66619AF4A637EEB45F47060EF79
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Manager\AskReady06.wav        --a---- 97837 bytes        [13:11 30/12/2009]        [13:11 30/12/2009] 83CFCCC7F196D3E76710FB4FEF1476A7
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Manager\AskReady07.wav        --a---- 59564 bytes        [13:28 30/12/2009]        [13:28 30/12/2009] 6DA4166FDB4DEBA54EBED6C054862751
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Manager\AskReady08.wav        --a---- 106884 bytes        [13:35 30/12/2009]        [13:35 30/12/2009] FA5A0677BA537BB0BB83AC014D430F20
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\Manager\AskReady09.wav        --a---- 103896 bytes        [13:40 30/12/2009]        [13:40 30/12/2009] 3A4CBEB6B551A0D03C74DB0BB51322C1
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\NamVet\AskReady01.wav        --a---- 58422 bytes        [13:18 30/12/2009]        [13:18 30/12/2009] A0D99A36FE19ED84F2516333F69F8267
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\NamVet\AskReady02.wav        --a---- 50418 bytes        [13:42 30/12/2009]        [13:42 30/12/2009] C7A78CF71E19CDE054037A5A7A483999
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\NamVet\AskReady03.wav        --a---- 66181 bytes        [13:36 30/12/2009]        [13:36 30/12/2009] 3B936855339B7982B5DF5920512E32FC
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\NamVet\AskReady04.wav        --a---- 122436 bytes        [13:36 30/12/2009]        [13:36 30/12/2009] D415852030278723AA91A371FA25FFDC
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\NamVet\AskReady05.wav        --a---- 77881 bytes        [13:41 30/12/2009]        [13:41 30/12/2009] 881F13A60288FFE7DB71A6623B474390
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\NamVet\AskReady09.wav        --a---- 95117 bytes        [13:22 30/12/2009]        [13:22 30/12/2009] 29DF88A238E0687074354C2103E1A33C
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\TeenGirl\AskReady03.wav        --a---- 103456 bytes        [13:21 30/12/2009]        [13:21 30/12/2009] 761C1ED44CE597E4C14CD263483F95D2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\TeenGirl\AskReady11.wav        --a---- 59618 bytes        [13:23 30/12/2009]        [13:23 30/12/2009] 1F92136344D2B5922A662F37B318CAEA
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\TeenGirl\AskReady12.wav        --a---- 173893 bytes        [13:16 30/12/2009]        [13:16 30/12/2009] 74708AAF32CA10A6A02900FB82AAC197
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\TeenGirl\AskReady13.wav        --a---- 93626 bytes        [13:32 30/12/2009]        [13:32 30/12/2009] 63C2C735233E32F60F12D0B60CBF3859
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\TeenGirl\AskReady14.wav        --a---- 89535 bytes        [13:23 30/12/2009]        [13:23 30/12/2009] 5DD05CD17B14119FA1E094E058ADEF26
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\TeenGirl\AskReady15.wav        --a---- 92216 bytes        [13:49 30/12/2009]        [13:49 30/12/2009] 12582D0D8F4D78D435D2501A74A60F89
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\TeenGirl\AskReady17.wav        --a---- 90874 bytes        [13:48 30/12/2009]        [13:48 30/12/2009] 5C54FB271D170883192FDA8717079DA1
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\TeenGirl\AskReady18.wav        --a---- 86284 bytes        [13:50 30/12/2009]        [13:50 30/12/2009] 4C964FEAB8259CFD64D80B5DA0E533B8
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\TeenGirl\AskReady19.wav        --a---- 89412 bytes        [13:25 30/12/2009]        [13:25 30/12/2009] B116A2927094939759DE797A9E2F800B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead\left4dead\sound\player\survivor\voice\TeenGirl\AskReady21.wav        --a---- 83726 bytes        [13:21 30/12/2009]        [13:21 30/12/2009] 913FD68348B708C0990F55B37D1CDBC2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\coach\askready01.vcd        --a---- 1757 bytes        [17:27 08/01/2012]        [17:27 08/01/2012] 570ADD68E5BEC8C87F24628E6E9F4963
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\coach\askready02.vcd        --a---- 1757 bytes        [17:52 08/01/2012]        [17:52 08/01/2012] CD7F4C412DEE1C7B5FC8FCFB2EEACA4D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\coach\askready03.vcd        --a---- 1757 bytes        [16:57 08/01/2012]        [16:57 08/01/2012] 3BB462EB68E7BD2DF0A00E4D01971D0D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\coach\askready04.vcd        --a---- 1757 bytes        [17:28 08/01/2012]        [17:28 08/01/2012] D83325B619B37D81903382A63EC71F92
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\coach\askready05.vcd        --a---- 1757 bytes        [20:29 08/01/2012]        [20:29 08/01/2012] 69A6AF5124F587A3A0C19EC479DBDFB5
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\coach\askready06.vcd        --a---- 1757 bytes        [14:59 08/01/2012]        [14:59 08/01/2012] 23031F30BBA955D7BC63DA8D980F0D70
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\coach\askready07.vcd        --a---- 1757 bytes        [15:02 08/01/2012]        [15:02 08/01/2012] E3BE30EF160486DDA866591741C3B944
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\coach\askready08.vcd        --a---- 1757 bytes        [20:40 08/01/2012]        [20:40 08/01/2012] F89CE4B1111B938653C4B0DA4865DBCF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\coach\askready09.vcd        --a---- 1757 bytes        [17:28 08/01/2012]        [17:28 08/01/2012] 50D97013AC06555B1A6836461CD85CF7
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\gambler\askready01.vcd        --a---- 1518 bytes        [18:15 08/01/2012]        [18:15 08/01/2012] FAB67ECE61FD952E0A65E550645241AB
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\gambler\askready02.vcd        --a---- 1518 bytes        [17:11 08/01/2012]        [17:11 08/01/2012] 1514BA1C9C7A94AC6F298B19D5ED4D12
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\gambler\askready03.vcd        --a---- 1518 bytes        [19:34 08/01/2012]        [19:34 08/01/2012] 73443479C6B76525E8E14D53A82D4516
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\gambler\askready04.vcd        --a---- 1518 bytes        [17:36 08/01/2012]        [17:36 08/01/2012] F54405A85C9327DA26B7C19BB20813D0
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\gambler\askready05.vcd        --a---- 1518 bytes        [17:48 08/01/2012]        [17:48 08/01/2012] 7159AEA7309C77620A58711586EB0E87
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\gambler\askready06.vcd        --a---- 1518 bytes        [18:05 08/01/2012]        [18:05 08/01/2012] F65B060063E7A64E1BF1124FAE9EA669
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\gambler\askready07.vcd        --a---- 1518 bytes        [16:15 08/01/2012]        [16:15 08/01/2012] 9DB2B6A8587E3EE2DE670E2A681A0542
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\gambler\askready08.vcd        --a---- 1518 bytes        [19:17 08/01/2012]        [19:17 08/01/2012] CB0DDC47DAFAEBAE22A8450B7C6AFFDF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\gambler\askready09.vcd        --a---- 1518 bytes        [17:52 08/01/2012]        [17:52 08/01/2012] 062D5B2BFC0970B876006DA795B9009E
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\gambler\askready10.vcd        --a---- 1518 bytes        [17:15 08/01/2012]        [17:15 08/01/2012] B3A345ABA36B5EAA5FF1BEF6C4B7EFFC
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\gambler\askreadyc101.vcd        --a---- 1555 bytes        [18:33 08/01/2012]        [18:34 08/01/2012] 0168D338FB3CE6CA491E7AEFED7A0814
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\gambler\askreadyc102.vcd        --a---- 1520 bytes        [17:28 08/01/2012]        [17:28 08/01/2012] 2E3DBFC5A2F25BB2E79277CFED142BD5
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\gambler\askreadyc103.vcd        --a---- 1388 bytes        [16:38 08/01/2012]        [16:38 08/01/2012] C2F849F82F9FC7C6E2AA1BDD5642F86B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\mechanic\askready01.vcd        --a---- 1769 bytes        [17:26 08/01/2012]        [17:26 08/01/2012] 48AEC88F4EA2CA12B14E0D98A2AAE049
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\mechanic\askready02.vcd        --a---- 1769 bytes        [17:23 08/01/2012]        [17:23 08/01/2012] 51050EE290C5C82506481C129220B39D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\mechanic\askready03.vcd        --a---- 1769 bytes        [20:57 08/01/2012]        [20:57 08/01/2012] 6A9C880A8C60BDF040C62E2CED2AF014
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\producer\askready01.vcd        --a---- 1522 bytes        [21:06 08/01/2012]        [21:06 08/01/2012] 03B1E20CDCDF6DE09C21B6476F51124A
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\producer\askready02.vcd        --a---- 1522 bytes        [17:50 08/01/2012]        [17:50 08/01/2012] 1328EBC274ED880575EF0870EE58BA20
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\scenes\producer\askready03.vcd        --a---- 1522 bytes        [18:07 08/01/2012]        [18:07 08/01/2012] EB7B1B1C72C5EEC77C4B25C2B90B9D72
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\coach\askready01.wav        --a---- 47948 bytes        [17:20 08/01/2012]        [17:20 08/01/2012] 4524130B611D260AFB6DC234FB38C957
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\coach\askready02.wav        --a---- 31374 bytes        [16:53 08/01/2012]        [16:53 08/01/2012] FF52438A59D550907F269500D041121A
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\coach\askready03.wav        --a---- 40934 bytes        [17:08 08/01/2012]        [17:08 08/01/2012] A93779B5778526AE0E82E48C5256D67D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\coach\askready04.wav        --a---- 22524 bytes        [16:39 08/01/2012]        [16:39 08/01/2012] EEDCD1BE58EA4495D2234C52AE214596
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\coach\askready05.wav        --a---- 27394 bytes        [16:25 08/01/2012]        [16:25 08/01/2012] 7B829B51336AFEE2DFA2AE79F892408D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\coach\askready06.wav        --a---- 69706 bytes        [16:07 08/01/2012]        [16:07 08/01/2012] DDBAF147AD006DB15EB369CA891E6396
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\coach\askready07.wav        --a---- 45674 bytes        [15:49 08/01/2012]        [15:49 08/01/2012] 2762AB82F0EC9F340889038C93A606F1
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\coach\askready08.wav        --a---- 59496 bytes        [16:44 08/01/2012]        [16:44 08/01/2012] D52085768EE3EFF63C2898DAC0AE811D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\coach\askready09.wav        --a---- 117976 bytes        [16:06 08/01/2012]        [16:06 08/01/2012] 0FDBEA87B1F0D7362E6A4B11381A88CF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\gambler\askready01.wav        --a---- 41276 bytes        [16:59 08/01/2012]        [16:59 08/01/2012] 6447F132F788C607FA78A1E227A748BF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\gambler\askready02.wav        --a---- 25460 bytes        [16:38 08/01/2012]        [16:38 08/01/2012] 422A794662F41311AF1373CB03F488DB
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\gambler\askready03.wav        --a---- 17482 bytes        [15:06 08/01/2012]        [15:06 08/01/2012] 511427A99A015F9BDD0C5A5340419DE2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\gambler\askready04.wav        --a---- 41562 bytes        [15:11 08/01/2012]        [15:11 08/01/2012] EDF7283A9D67674A8AAAACFA2E51104B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\gambler\askready05.wav        --a---- 24364 bytes        [16:39 08/01/2012]        [16:40 08/01/2012] 72C62689A01A9F54F29CD6592BAB3456
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\gambler\askready06.wav        --a---- 33558 bytes        [16:47 08/01/2012]        [16:47 08/01/2012] 66E6604B25CF5664055C06B539291FF0
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\gambler\askready07.wav        --a---- 29756 bytes        [17:03 08/01/2012]        [17:03 08/01/2012] 9EAFBF0930327221F20A96C2207230AD
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\gambler\askready08.wav        --a---- 30540 bytes        [15:06 08/01/2012]        [15:06 08/01/2012] 588DCD7995EA9CB5E452776EA49073B4
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\gambler\askready09.wav        --a---- 49020 bytes        [17:16 08/01/2012]        [17:16 08/01/2012] 7BE4825FFADC2FB8F8E72C99B89AE0DA
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\gambler\askready10.wav        --a---- 33870 bytes        [16:45 08/01/2012]        [16:45 08/01/2012] 2DA634AF983913DE99699F5092948E92
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\gambler\askreadyc101.wav        --a---- 36718 bytes        [17:00 08/01/2012]        [17:00 08/01/2012] 416B324314717DF35665D7144DDE7648
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\gambler\askreadyc102.wav        --a---- 56426 bytes        [17:23 08/01/2012]        [17:23 08/01/2012] 1673B3A9777C6C7E7C1253F885F88560
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\gambler\askreadyc103.wav        --a---- 80748 bytes        [17:20 08/01/2012]        [17:20 08/01/2012] 700638BF6F0A606C99F91682346C6CC5
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\mechanic\askready01.wav        --a---- 45053 bytes        [16:52 08/01/2012]        [16:52 08/01/2012] F7E0DCDB435519560C43DDCE068C26B1
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\mechanic\askready02.wav        --a---- 12680 bytes        [16:19 08/01/2012]        [16:19 08/01/2012] F4C761DD7C00ED4EB520CAEFAA0A9DAD
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\mechanic\askready03.wav        --a---- 20098 bytes        [17:15 08/01/2012]        [17:15 08/01/2012] 47E7E736DA31795465AC975D49CF3E1E
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\producer\askready01.wav        --a---- 52446 bytes        [17:10 08/01/2012]        [17:10 08/01/2012] 4DC8556CCDC6BF0F169626117B800799
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\producer\askready02.wav        --a---- 18998 bytes        [16:52 08/01/2012]        [16:52 08/01/2012] E82DC153E2260986DD70E51F7C819C79
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2\sound\player\survivor\voice\producer\askready03.wav        --a---- 51959 bytes        [17:10 08/01/2012]        [17:10 08/01/2012] 120EFB8DDD78A7C638F4C4DD2A305C5B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\biker\askready01.vcd        --a---- 1027 bytes        [21:07 08/01/2012]        [21:07 08/01/2012] 11E8BA43F26E6CA5F4146AC24FE7C73E
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\biker\askready02.vcd        --a---- 1027 bytes        [17:32 08/01/2012]        [17:32 08/01/2012] 3BDA3A4416E69E2CD5E25F84EC063AC0
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\biker\askready03.vcd        --a---- 1027 bytes        [17:18 08/01/2012]        [17:18 08/01/2012] 9CFB65B52AA8C47701A2F3401C7C3FAA
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\biker\askready04.vcd        --a---- 1027 bytes        [17:34 08/01/2012]        [17:34 08/01/2012] 4C065A9EC6E7C52AA4218777A30440A9
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\biker\askready05.vcd        --a---- 1027 bytes        [17:12 08/01/2012]        [17:12 08/01/2012] B3D131485C9DC5AA3E4E08A13569E911
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\biker\askready06.vcd        --a---- 1027 bytes        [17:24 08/01/2012]        [17:24 08/01/2012] A403E8DBE0B10F2E08D30A4DEFE4350A
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\biker\askready07.vcd        --a---- 1027 bytes        [21:07 08/01/2012]        [21:07 08/01/2012] D373D29F8D5F517B41EB712CFB5713F2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\biker\askready08.vcd        --a---- 1027 bytes        [16:15 08/01/2012]        [16:15 08/01/2012] 2BDA341FE0016EBE0E73D25E20C5BACB
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\biker\askready09.vcd        --a---- 1027 bytes        [18:08 08/01/2012]        [18:08 08/01/2012] 374E4ED46C1E3B48E87C5385D64F66C2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\biker\askready10.vcd        --a---- 954 bytes        [20:54 08/01/2012]        [20:54 08/01/2012] 54DDFCACEF4F7549D82C2E0F84D29964
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\manager\askready01.vcd        --a---- 1544 bytes        [16:57 08/01/2012]        [16:57 08/01/2012] 99F1240CBF3CEB17CBB5750EF0263117
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\manager\askready02.vcd        --a---- 1544 bytes        [17:28 08/01/2012]        [17:28 08/01/2012] 69698DC304FF016BB229FE44D69C4197
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\manager\askready03.vcd        --a---- 1382 bytes        [17:11 08/01/2012]        [17:11 08/01/2012] 60C9E6CA26AA062CB493D59C1C78E568
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\manager\askready04.vcd        --a---- 1382 bytes        [17:48 08/01/2012]        [17:48 08/01/2012] F5163F2AAC8827EB5078309029386DC2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\manager\askready05.vcd        --a---- 1544 bytes        [17:47 08/01/2012]        [17:47 08/01/2012] F98FFC8C4371080C06EA5275BA442EEF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\manager\askready06.vcd        --a---- 1470 bytes        [20:39 08/01/2012]        [20:39 08/01/2012] 642CEFC37EA5F6501EDD6ADA451BF1E5
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\manager\askready07.vcd        --a---- 1544 bytes        [17:41 08/01/2012]        [17:41 08/01/2012] A509E90F9960116E8615C5AD08461F0B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\manager\askready08.vcd        --a---- 1503 bytes        [16:07 08/01/2012]        [16:07 08/01/2012] 5839F6BC435404C4D27CE15F2E1533A3
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\manager\askready09.vcd        --a---- 1544 bytes        [19:36 08/01/2012]        [19:36 08/01/2012] 9C6AAADEC562F993BAB5EC17BC5E7EBC
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\namvet\askready01.vcd        --a---- 1425 bytes        [17:39 08/01/2012]        [17:39 08/01/2012] CF505192B8FDC7B4D2B3826D6CE5503E
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\namvet\askready02.vcd        --a---- 1425 bytes        [21:07 08/01/2012]        [21:07 08/01/2012] 1FC22B067D22666659E837AD592234B3
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\namvet\askready03.vcd        --a---- 1425 bytes        [15:02 08/01/2012]        [15:02 08/01/2012] D08B88B94E06D809EEF906C36A4B2BFF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\namvet\askready04.vcd        --a---- 1425 bytes        [17:08 08/01/2012]        [17:08 08/01/2012] BE48B27C9231CE8FFA1502559B3E568D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\namvet\askready05.vcd        --a---- 1425 bytes        [18:42 08/01/2012]        [18:42 08/01/2012] 15C34CC09B02789E8109AB3B304143CD
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\namvet\askready09.vcd        --a---- 1425 bytes        [18:29 08/01/2012]        [18:29 08/01/2012] 0E783066AA46FF58E04E0CCDFE72B333
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\teengirl\askready03.vcd        --a---- 1711 bytes        [15:20 08/01/2012]        [15:20 08/01/2012] 7C0BDCF087062283D66DA55474B30BAF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\teengirl\askready11.vcd        --a---- 1711 bytes        [17:43 08/01/2012]        [17:43 08/01/2012] C44F35D2F4329C3092A65F1C70370AC2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\teengirl\askready12.vcd        --a---- 1711 bytes        [15:08 08/01/2012]        [15:08 08/01/2012] 3225EB482499DBFF54E682CD17A5E640
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\teengirl\askready13.vcd        --a---- 1711 bytes        [17:28 08/01/2012]        [17:28 08/01/2012] 60C011D2CD907C97FB9AB70F7B7F299E
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\teengirl\askready14.vcd        --a---- 1711 bytes        [20:52 08/01/2012]        [20:52 08/01/2012] D667FE87A3166795D9A402EF6D335011
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\teengirl\askready15.vcd        --a---- 1711 bytes        [17:25 08/01/2012]        [17:25 08/01/2012] 4870FAC3F4722A52EAB37F6B2926138C
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\teengirl\askready17.vcd        --a---- 1711 bytes        [21:09 08/01/2012]        [21:09 08/01/2012] C337CB7CC4CE5FA796146F2E64B13F62
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\teengirl\askready18.vcd        --a---- 1711 bytes        [17:11 08/01/2012]        [17:11 08/01/2012] 3A4B46FAFE1FCA47553CBE59D1CB054A
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\teengirl\askready19.vcd        --a---- 1711 bytes        [18:03 08/01/2012]        [18:03 08/01/2012] CE6EF2FB50781541A770E7F4B7687B1A
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\scenes\teengirl\askready21.vcd        --a---- 1656 bytes        [17:50 08/01/2012]        [17:51 08/01/2012] D55B6741CEF6E6145F0FF0BFEA4C59F0
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\biker\askready01.wav        --a---- 112613 bytes        [18:28 08/01/2012]        [18:28 08/01/2012] 3B1EC71796F267B3023A530785C58172
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\biker\askready02.wav        --a---- 93951 bytes        [17:39 08/01/2012]        [17:39 08/01/2012] 90D06E556D0B50ACA6BD8113FD26671B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\biker\askready03.wav        --a---- 54690 bytes        [15:51 08/01/2012]        [15:51 08/01/2012] 1FD2314FB3B59848A32893AA92F7F42C
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\biker\askready04.wav        --a---- 80500 bytes        [17:01 08/01/2012]        [17:01 08/01/2012] FAEB07F389209219F22A352398ED48F5
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\biker\askready05.wav        --a---- 138152 bytes        [15:25 08/01/2012]        [15:25 08/01/2012] 83837B6B97137A9E64957FC2480444DF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\biker\askready06.wav        --a---- 102434 bytes        [17:48 08/01/2012]        [17:48 08/01/2012] 36346A470DE79F325DDAA10CC3192E6B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\biker\askready07.wav        --a---- 129460 bytes        [17:44 08/01/2012]        [17:44 08/01/2012] D323461C8E9020188FBFF1BC931EBAB0
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\biker\askready08.wav        --a---- 59774 bytes        [16:53 08/01/2012]        [16:53 08/01/2012] 0A2E1853CAA204D99533BED1EAC63449
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\biker\askready09.wav        --a---- 108160 bytes        [16:48 08/01/2012]        [16:48 08/01/2012] 548D5DBEBC4264E69A437C19382F1B27
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\biker\askready10.wav        --a---- 167754 bytes        [16:53 08/01/2012]        [16:53 08/01/2012] 710E5B404747DA87B024CE8989D13283
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\manager\askready01.wav        --a---- 33318 bytes        [17:35 08/01/2012]        [17:35 08/01/2012] F902A92EA288A9D706F1AB1597DAD415
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\manager\askready02.wav        --a---- 40814 bytes        [17:07 08/01/2012]        [17:07 08/01/2012] 16ECC9DCE7A86E49675156AFAF239E3D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\manager\askready03.wav        --a---- 65953 bytes        [20:11 08/01/2012]        [20:11 08/01/2012] AF9032EFAC69668FFB308A55F1974FAC
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\manager\askready04.wav        --a---- 93785 bytes        [17:27 08/01/2012]        [17:27 08/01/2012] 5738C6D0FDE106A57831318CD6CD2FE9
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\manager\askready05.wav        --a---- 94193 bytes        [16:17 08/01/2012]        [16:18 08/01/2012] 0D54F66619AF4A637EEB45F47060EF79
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\manager\askready06.wav        --a---- 97837 bytes        [15:01 08/01/2012]        [15:01 08/01/2012] 83CFCCC7F196D3E76710FB4FEF1476A7
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\manager\askready07.wav        --a---- 59564 bytes        [19:08 08/01/2012]        [19:09 08/01/2012] 6DA4166FDB4DEBA54EBED6C054862751
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\manager\askready08.wav        --a---- 106884 bytes        [20:54 08/01/2012]        [20:54 08/01/2012] FA5A0677BA537BB0BB83AC014D430F20
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\manager\askready09.wav        --a---- 103896 bytes        [17:25 08/01/2012]        [17:25 08/01/2012] 3A4CBEB6B551A0D03C74DB0BB51322C1
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\namvet\askready01.wav        --a---- 58422 bytes        [16:56 08/01/2012]        [16:56 08/01/2012] A0D99A36FE19ED84F2516333F69F8267
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\namvet\askready02.wav        --a---- 50418 bytes        [18:48 08/01/2012]        [18:49 08/01/2012] C7A78CF71E19CDE054037A5A7A483999
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\namvet\askready03.wav        --a---- 66181 bytes        [17:42 08/01/2012]        [17:42 08/01/2012] 3B936855339B7982B5DF5920512E32FC
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\namvet\askready04.wav        --a---- 122436 bytes        [20:35 08/01/2012]        [20:36 08/01/2012] D415852030278723AA91A371FA25FFDC
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\namvet\askready05.wav        --a---- 77881 bytes        [16:30 08/01/2012]        [16:30 08/01/2012] 881F13A60288FFE7DB71A6623B474390
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\namvet\askready09.wav        --a---- 95117 bytes        [16:47 08/01/2012]        [16:47 08/01/2012] 29DF88A238E0687074354C2103E1A33C
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\teengirl\askready03.wav        --a---- 103456 bytes        [18:28 08/01/2012]        [18:28 08/01/2012] 761C1ED44CE597E4C14CD263483F95D2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\teengirl\askready11.wav        --a---- 59618 bytes        [17:17 08/01/2012]        [17:17 08/01/2012] 1F92136344D2B5922A662F37B318CAEA
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\teengirl\askready12.wav        --a---- 173893 bytes        [15:04 08/01/2012]        [15:04 08/01/2012] 74708AAF32CA10A6A02900FB82AAC197
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\teengirl\askready13.wav        --a---- 93626 bytes        [17:29 08/01/2012]        [17:29 08/01/2012] 63C2C735233E32F60F12D0B60CBF3859
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\teengirl\askready14.wav        --a---- 89535 bytes        [16:19 08/01/2012]        [16:19 08/01/2012] 5DD05CD17B14119FA1E094E058ADEF26
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\teengirl\askready15.wav        --a---- 92216 bytes        [18:37 08/01/2012]        [18:37 08/01/2012] 12582D0D8F4D78D435D2501A74A60F89
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\teengirl\askready17.wav        --a---- 90874 bytes        [20:20 08/01/2012]        [20:20 08/01/2012] 5C54FB271D170883192FDA8717079DA1
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\teengirl\askready18.wav        --a---- 86284 bytes        [16:05 08/01/2012]        [16:05 08/01/2012] 4C964FEAB8259CFD64D80B5DA0E533B8
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\teengirl\askready19.wav        --a---- 89412 bytes        [17:02 08/01/2012]        [17:02 08/01/2012] B116A2927094939759DE797A9E2F800B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc2\sound\player\survivor\voice\teengirl\askready21.wav        --a---- 83726 bytes        [17:34 08/01/2012]        [17:34 08/01/2012] 913FD68348B708C0990F55B37D1CDBC2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\biker\askready01.vcd        --a---- 1027 bytes        [17:28 08/01/2012]        [17:28 08/01/2012] 11E8BA43F26E6CA5F4146AC24FE7C73E
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\biker\askready02.vcd        --a---- 1027 bytes        [18:30 08/01/2012]        [18:30 08/01/2012] 3BDA3A4416E69E2CD5E25F84EC063AC0
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\biker\askready03.vcd        --a---- 1027 bytes        [16:00 08/01/2012]        [16:00 08/01/2012] 9CFB65B52AA8C47701A2F3401C7C3FAA
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\biker\askready04.vcd        --a---- 1027 bytes        [17:16 08/01/2012]        [17:16 08/01/2012] 4C065A9EC6E7C52AA4218777A30440A9
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\biker\askready05.vcd        --a---- 1027 bytes        [15:06 08/01/2012]        [15:06 08/01/2012] B3D131485C9DC5AA3E4E08A13569E911
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\biker\askready06.vcd        --a---- 1027 bytes        [19:07 08/01/2012]        [19:07 08/01/2012] A403E8DBE0B10F2E08D30A4DEFE4350A
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\biker\askready07.vcd        --a---- 1027 bytes        [17:39 08/01/2012]        [17:39 08/01/2012] D373D29F8D5F517B41EB712CFB5713F2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\biker\askready08.vcd        --a---- 1027 bytes        [17:29 08/01/2012]        [17:29 08/01/2012] 2BDA341FE0016EBE0E73D25E20C5BACB
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\biker\askready09.vcd        --a---- 1027 bytes        [17:26 08/01/2012]        [17:26 08/01/2012] 374E4ED46C1E3B48E87C5385D64F66C2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\biker\askready10.vcd        --a---- 954 bytes        [15:14 08/01/2012]        [15:14 08/01/2012] 54DDFCACEF4F7549D82C2E0F84D29964
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\manager\askready01.vcd        --a---- 1544 bytes        [18:41 08/01/2012]        [18:42 08/01/2012] 99F1240CBF3CEB17CBB5750EF0263117
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\manager\askready02.vcd        --a---- 1544 bytes        [16:30 08/01/2012]        [16:30 08/01/2012] 69698DC304FF016BB229FE44D69C4197
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\manager\askready03.vcd        --a---- 1382 bytes        [15:39 08/01/2012]        [15:39 08/01/2012] 60C9E6CA26AA062CB493D59C1C78E568
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\manager\askready04.vcd        --a---- 1382 bytes        [19:00 08/01/2012]        [19:00 08/01/2012] F5163F2AAC8827EB5078309029386DC2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\manager\askready05.vcd        --a---- 1544 bytes        [20:40 08/01/2012]        [20:40 08/01/2012] F98FFC8C4371080C06EA5275BA442EEF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\manager\askready06.vcd        --a---- 1470 bytes        [17:34 08/01/2012]        [17:34 08/01/2012] 642CEFC37EA5F6501EDD6ADA451BF1E5
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\manager\askready07.vcd        --a---- 1544 bytes        [15:13 08/01/2012]        [15:13 08/01/2012] A509E90F9960116E8615C5AD08461F0B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\manager\askready08.vcd        --a---- 1503 bytes        [17:25 08/01/2012]        [17:25 08/01/2012] 5839F6BC435404C4D27CE15F2E1533A3
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\manager\askready09.vcd        --a---- 1544 bytes        [15:01 08/01/2012]        [15:01 08/01/2012] 9C6AAADEC562F993BAB5EC17BC5E7EBC
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\namvet\askready01.vcd        --a---- 1425 bytes        [17:47 08/01/2012]        [17:47 08/01/2012] CF505192B8FDC7B4D2B3826D6CE5503E
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\namvet\askready02.vcd        --a---- 1425 bytes        [17:27 08/01/2012]        [17:27 08/01/2012] 1FC22B067D22666659E837AD592234B3
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\namvet\askready03.vcd        --a---- 1425 bytes        [17:51 08/01/2012]        [17:51 08/01/2012] D08B88B94E06D809EEF906C36A4B2BFF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\namvet\askready04.vcd        --a---- 1425 bytes        [17:49 08/01/2012]        [17:50 08/01/2012] BE48B27C9231CE8FFA1502559B3E568D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\namvet\askready05.vcd        --a---- 1425 bytes        [16:55 08/01/2012]        [16:55 08/01/2012] 15C34CC09B02789E8109AB3B304143CD
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\namvet\askready09.vcd        --a---- 1425 bytes        [16:43 08/01/2012]        [16:43 08/01/2012] 0E783066AA46FF58E04E0CCDFE72B333
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\teengirl\askready03.vcd        --a---- 1711 bytes        [21:15 08/01/2012]        [21:15 08/01/2012] 7C0BDCF087062283D66DA55474B30BAF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\teengirl\askready11.vcd        --a---- 1711 bytes        [17:28 08/01/2012]        [17:28 08/01/2012] C44F35D2F4329C3092A65F1C70370AC2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\teengirl\askready12.vcd        --a---- 1711 bytes        [15:55 08/01/2012]        [15:55 08/01/2012] 3225EB482499DBFF54E682CD17A5E640
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\teengirl\askready13.vcd        --a---- 1711 bytes        [19:23 08/01/2012]        [19:23 08/01/2012] 60C011D2CD907C97FB9AB70F7B7F299E
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\teengirl\askready14.vcd        --a---- 1711 bytes        [17:48 08/01/2012]        [17:48 08/01/2012] D667FE87A3166795D9A402EF6D335011
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\teengirl\askready15.vcd        --a---- 1711 bytes        [17:40 08/01/2012]        [17:40 08/01/2012] 4870FAC3F4722A52EAB37F6B2926138C
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\teengirl\askready17.vcd        --a---- 1711 bytes        [17:36 08/01/2012]        [17:37 08/01/2012] C337CB7CC4CE5FA796146F2E64B13F62
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\teengirl\askready18.vcd        --a---- 1711 bytes        [16:16 08/01/2012]        [16:16 08/01/2012] 3A4B46FAFE1FCA47553CBE59D1CB054A
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\teengirl\askready19.vcd        --a---- 1711 bytes        [15:08 08/01/2012]        [15:08 08/01/2012] CE6EF2FB50781541A770E7F4B7687B1A
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\scenes\teengirl\askready21.vcd        --a---- 1656 bytes        [15:05 08/01/2012]        [15:05 08/01/2012] D55B6741CEF6E6145F0FF0BFEA4C59F0
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\biker\askready01.wav        --a---- 112613 bytes        [18:09 08/01/2012]        [18:09 08/01/2012] 3B1EC71796F267B3023A530785C58172
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\biker\askready02.wav        --a---- 93951 bytes        [18:04 08/01/2012]        [18:04 08/01/2012] 90D06E556D0B50ACA6BD8113FD26671B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\biker\askready03.wav        --a---- 54690 bytes        [17:18 08/01/2012]        [17:18 08/01/2012] 1FD2314FB3B59848A32893AA92F7F42C
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\biker\askready04.wav        --a---- 80500 bytes        [20:12 08/01/2012]        [20:12 08/01/2012] FAEB07F389209219F22A352398ED48F5
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\biker\askready05.wav        --a---- 138152 bytes        [16:07 08/01/2012]        [16:07 08/01/2012] 83837B6B97137A9E64957FC2480444DF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\biker\askready06.wav        --a---- 102434 bytes        [17:09 08/01/2012]        [17:09 08/01/2012] 36346A470DE79F325DDAA10CC3192E6B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\biker\askready07.wav        --a---- 129460 bytes        [17:46 08/01/2012]        [17:46 08/01/2012] D323461C8E9020188FBFF1BC931EBAB0
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\biker\askready08.wav        --a---- 59774 bytes        [17:41 08/01/2012]        [17:41 08/01/2012] 0A2E1853CAA204D99533BED1EAC63449
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\biker\askready09.wav        --a---- 108160 bytes        [17:24 08/01/2012]        [17:24 08/01/2012] 548D5DBEBC4264E69A437C19382F1B27
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\biker\askready10.wav        --a---- 167754 bytes        [17:48 08/01/2012]        [17:48 08/01/2012] 710E5B404747DA87B024CE8989D13283
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\manager\askready01.wav        --a---- 33318 bytes        [17:30 08/01/2012]        [17:30 08/01/2012] F902A92EA288A9D706F1AB1597DAD415
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\manager\askready02.wav        --a---- 40814 bytes        [19:31 08/01/2012]        [19:31 08/01/2012] 16ECC9DCE7A86E49675156AFAF239E3D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\manager\askready03.wav        --a---- 65953 bytes        [17:39 08/01/2012]        [17:39 08/01/2012] AF9032EFAC69668FFB308A55F1974FAC
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\manager\askready04.wav        --a---- 93785 bytes        [17:24 08/01/2012]        [17:24 08/01/2012] 5738C6D0FDE106A57831318CD6CD2FE9
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\manager\askready05.wav        --a---- 94193 bytes        [17:43 08/01/2012]        [17:43 08/01/2012] 0D54F66619AF4A637EEB45F47060EF79
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\manager\askready06.wav        --a---- 97837 bytes        [20:55 08/01/2012]        [20:55 08/01/2012] 83CFCCC7F196D3E76710FB4FEF1476A7
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\manager\askready07.wav        --a---- 59564 bytes        [15:09 08/01/2012]        [15:09 08/01/2012] 6DA4166FDB4DEBA54EBED6C054862751
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\manager\askready08.wav        --a---- 106884 bytes        [18:54 08/01/2012]        [18:54 08/01/2012] FA5A0677BA537BB0BB83AC014D430F20
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\manager\askready09.wav        --a---- 103896 bytes        [17:38 08/01/2012]        [17:38 08/01/2012] 3A4CBEB6B551A0D03C74DB0BB51322C1
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\namvet\askready01.wav        --a---- 58422 bytes        [16:56 08/01/2012]        [16:57 08/01/2012] A0D99A36FE19ED84F2516333F69F8267
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\namvet\askready02.wav        --a---- 50418 bytes        [17:26 08/01/2012]        [17:26 08/01/2012] C7A78CF71E19CDE054037A5A7A483999
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\namvet\askready03.wav        --a---- 66181 bytes        [17:08 08/01/2012]        [17:08 08/01/2012] 3B936855339B7982B5DF5920512E32FC
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\namvet\askready04.wav        --a---- 122436 bytes        [17:42 08/01/2012]        [17:42 08/01/2012] D415852030278723AA91A371FA25FFDC
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\namvet\askready05.wav        --a---- 77881 bytes        [18:54 08/01/2012]        [18:55 08/01/2012] 881F13A60288FFE7DB71A6623B474390
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\namvet\askready09.wav        --a---- 95117 bytes        [17:49 08/01/2012]        [17:49 08/01/2012] 29DF88A238E0687074354C2103E1A33C
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\teengirl\askready03.wav        --a---- 103456 bytes        [20:29 08/01/2012]        [20:29 08/01/2012] 761C1ED44CE597E4C14CD263483F95D2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\teengirl\askready11.wav        --a---- 59618 bytes        [19:53 08/01/2012]        [19:53 08/01/2012] 1F92136344D2B5922A662F37B318CAEA
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\teengirl\askready12.wav        --a---- 173893 bytes        [16:42 08/01/2012]        [16:42 08/01/2012] 74708AAF32CA10A6A02900FB82AAC197
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\teengirl\askready13.wav        --a---- 93626 bytes        [17:39 08/01/2012]        [17:39 08/01/2012] 63C2C735233E32F60F12D0B60CBF3859
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\teengirl\askready14.wav        --a---- 89535 bytes        [16:49 08/01/2012]        [16:49 08/01/2012] 5DD05CD17B14119FA1E094E058ADEF26
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\teengirl\askready15.wav        --a---- 92216 bytes        [17:16 08/01/2012]        [17:16 08/01/2012] 12582D0D8F4D78D435D2501A74A60F89
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\teengirl\askready17.wav        --a---- 90875 bytes        [17:27 08/01/2012]        [17:27 08/01/2012] AE8E3EFD3D1054BF167E2F3D8A6E6BCF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\teengirl\askready18.wav        --a---- 86284 bytes        [19:11 08/01/2012]        [19:11 08/01/2012] 4C964FEAB8259CFD64D80B5DA0E533B8
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\teengirl\askready19.wav        --a---- 89412 bytes        [17:02 08/01/2012]        [17:02 08/01/2012] B116A2927094939759DE797A9E2F800B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3\sound\player\survivor\voice\teengirl\askready21.wav        --a---- 83726 bytes        [16:49 08/01/2012]        [16:49 08/01/2012] 913FD68348B708C0990F55B37D1CDBC2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\biker\askready01.wav        --a---- 113727 bytes        [13:36 09/01/2012]        [13:36 09/01/2012] F7E5F30A638118A710F72EF7B8DFD627
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\biker\askready02.wav        --a---- 95292 bytes        [13:36 09/01/2012]        [13:36 09/01/2012] B5EED1FE054CC00B7949E59B9DFD8371
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\biker\askready03.wav        --a---- 55875 bytes        [13:36 09/01/2012]        [13:36 09/01/2012] C80E17FA645020A93B4AFA3269D71F66
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\biker\askready04.wav        --a---- 82079 bytes        [13:41 09/01/2012]        [13:41 09/01/2012] 6038A683282B3AC23E2403F76D964931
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\biker\askready05.wav        --a---- 139761 bytes        [13:40 09/01/2012]        [13:40 09/01/2012] 584BE46961B87DAE320CF65B280CA38B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\biker\askready06.wav        --a---- 103725 bytes        [13:33 09/01/2012]        [13:33 09/01/2012] E014D3C6CD5467014FC6E71C12B3B3F0
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\biker\askready07.wav        --a---- 130688 bytes        [13:28 09/01/2012]        [13:28 09/01/2012] 9961F1CE0251280769C343FF749711B7
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\biker\askready08.wav        --a---- 60943 bytes        [13:43 09/01/2012]        [13:43 09/01/2012] 7CBBC06E13947664830F773A189C81E1
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\biker\askready09.wav        --a---- 109416 bytes        [13:31 09/01/2012]        [13:31 09/01/2012] 9D3446EA8CC8A1A598AADC4BEAA7C4E2
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\biker\askready10.wav        --a---- 169145 bytes        [13:37 09/01/2012]        [13:37 09/01/2012] 58DEC3BDC21273BC8CF864F9AC55A53E
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\manager\askready01.wav        --a---- 34527 bytes        [13:33 09/01/2012]        [13:33 09/01/2012] 530D1145A9E74EF85E37CFE27C268D11
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\manager\askready02.wav        --a---- 42171 bytes        [13:42 09/01/2012]        [13:42 09/01/2012] 2DF0495C4B5366503A7E6DD4F090DC24
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\manager\askready03.wav        --a---- 67069 bytes        [13:36 09/01/2012]        [13:36 09/01/2012] F46127A8824E2D3C7549AB1B0B8FF391
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\manager\askready04.wav        --a---- 94880 bytes        [13:44 09/01/2012]        [13:44 09/01/2012] 5D9A354E9138CD50EE75C6C1D4ACFE50
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\manager\askready05.wav        --a---- 95591 bytes        [13:39 09/01/2012]        [13:39 09/01/2012] 951B09A4D73BB2F59712F2316C29E84C
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\manager\askready06.wav        --a---- 98747 bytes        [13:37 09/01/2012]        [13:37 09/01/2012] 353718B8968A64D4CD431884918745F9
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\manager\askready07.wav        --a---- 60565 bytes        [13:29 09/01/2012]        [13:29 09/01/2012] CA28CEE7B6F1F41720F7E071DBD2AF24
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\manager\askready08.wav        --a---- 108307 bytes        [13:44 09/01/2012]        [13:44 09/01/2012] 55C6613F8BC050B52360B219A9A9FE11
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\manager\askready09.wav        --a---- 105264 bytes        [13:36 09/01/2012]        [13:36 09/01/2012] F00009E1298468C13E0AAF34BB2C6AEA
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\namvet\askready01.wav        --a---- 58423 bytes        [13:36 09/01/2012]        [13:36 09/01/2012] F6C0D8AF019C429CBB7437801FF4BB70
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\namvet\askready02.wav        --a---- 50431 bytes        [13:43 09/01/2012]        [13:43 09/01/2012] 5A16B4E1EB530F613FBE147BF82CBD55
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\namvet\askready03.wav        --a---- 65635 bytes        [13:43 09/01/2012]        [13:43 09/01/2012] A89CCE067C43B5E961C0131515D6E3AF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\namvet\askready04.wav        --a---- 122045 bytes        [13:38 09/01/2012]        [13:38 09/01/2012] F84A752ADFE6957D89AB838689B10A3C
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\namvet\askready05.wav        --a---- 77403 bytes        [13:43 09/01/2012]        [13:43 09/01/2012] BBCE040CA64062E98A879C15049B4BFA
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\namvet\askready09.wav        --a---- 94900 bytes        [13:42 09/01/2012]        [13:42 09/01/2012] 5909089E15ED785BBBE4276D843DDF4D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\teengirl\askready03.wav        --a---- 104550 bytes        [13:42 09/01/2012]        [13:42 09/01/2012] 422521F8A8228A3000F098262BA1DB7E
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\teengirl\askready11.wav        --a---- 60685 bytes        [13:41 09/01/2012]        [13:41 09/01/2012] DBC7D966A155E8FD0B35BFA9146B09BF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\teengirl\askready12.wav        --a---- 175519 bytes        [13:28 09/01/2012]        [13:28 09/01/2012] C4FB32DA50AE7F56425015A538016CAC
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\teengirl\askready13.wav        --a---- 94621 bytes        [13:34 09/01/2012]        [13:34 09/01/2012] B8B2F0EF9E96B6F3F34F3105A061D56D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\teengirl\askready14.wav        --a---- 90763 bytes        [13:29 09/01/2012]        [13:29 09/01/2012] 4D342EA5CC9B005FEF31EC10FD036CD9
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\teengirl\askready15.wav        --a---- 93154 bytes        [13:44 09/01/2012]        [13:44 09/01/2012] DB060B3C5FE5A8822D983525D20114DF
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\teengirl\askready17.wav        --a---- 92135 bytes        [13:29 09/01/2012]        [13:29 09/01/2012] 0BB7B14E8677DA60EBDD6B2A24AEEAD8
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\teengirl\askready18.wav        --a---- 87097 bytes        [13:35 09/01/2012]        [13:35 09/01/2012] C7C1EA1979ECA0C62909A813229A482A
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\teengirl\askready19.wav        --a---- 90602 bytes        [13:29 09/01/2012]        [13:29 09/01/2012] 5E5E018DEA7973F1A816B8E028DBE443
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_dlc3_german\sound\player\survivor\voice\teengirl\askready21.wav        --a---- 84543 bytes        [13:43 09/01/2012]        [13:43 09/01/2012] BD0CC28A92DE8486F81E08B5B3C15B5D
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Coach\AskReady01.wav        --a---- 49263 bytes        [13:34 09/01/2012]        [13:34 09/01/2012] AA0FFEAAC67C041ABE825812B9B18491
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Coach\AskReady02.wav        --a---- 32628 bytes        [13:41 09/01/2012]        [13:41 09/01/2012] 3C01CBB49351DB1421665F5EA5179694
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Coach\AskReady03.wav        --a---- 42101 bytes        [13:40 09/01/2012]        [13:40 09/01/2012] 2C67C736B2B75EED537FF4FA3CD15C22
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Coach\AskReady04.wav        --a---- 23433 bytes        [13:38 09/01/2012]        [13:38 09/01/2012] 15E17FDB272CC68578F273E8CC802BD5
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Coach\AskReady05.wav        --a---- 26493 bytes        [13:33 09/01/2012]        [13:33 09/01/2012] 707ABB43CB7EBB4B01FE1DE229814B5A
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Coach\AskReady06.wav        --a---- 70830 bytes        [13:44 09/01/2012]        [13:44 09/01/2012] 495A266026A091096D5F1D30A2EF63B3
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Coach\AskReady07.wav        --a---- 45569 bytes        [13:32 09/01/2012]        [13:32 09/01/2012] ABC02E48FCE9FFC5499F41D8BC710D30
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Coach\AskReady08.wav        --a---- 59878 bytes        [13:31 09/01/2012]        [13:31 09/01/2012] F40A6FD354403545F7A0B634E0DF0FA8
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Coach\AskReady09.wav        --a---- 119627 bytes        [13:29 09/01/2012]        [13:29 09/01/2012] D9B442FCA3035FC96052A70C62DA4D4F
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Gambler\AskReady01.wav        --a---- 42607 bytes        [13:33 09/01/2012]        [13:33 09/01/2012] AE1BEC7B7ECA4ECAF618B83F78575A63
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Gambler\AskReady02.wav        --a---- 26611 bytes        [13:40 09/01/2012]        [13:40 09/01/2012] 2E758F1BA2EB7E3DCFF44309D30123B0
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Gambler\AskReady03.wav        --a---- 18600 bytes        [13:32 09/01/2012]        [13:32 09/01/2012] 182180F062932E445C9FF61E009EA2F4
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Gambler\AskReady04.wav        --a---- 42718 bytes        [13:41 09/01/2012]        [13:41 09/01/2012] BF6B0C215213023941A9734F4D29A6A6
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Gambler\AskReady05.wav        --a---- 24074 bytes        [13:30 09/01/2012]        [13:30 09/01/2012] 30514A36627D15964B07361D3E9DD322
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Gambler\AskReady06.wav        --a---- 34852 bytes        [13:41 09/01/2012]        [13:41 09/01/2012] F4735DF5B1873434BC5066C86B944F21
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Gambler\AskReady07.wav        --a---- 30912 bytes        [13:37 09/01/2012]        [13:37 09/01/2012] E100BCEFBB1458B54242A661493B43E7
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Gambler\AskReady08.wav        --a---- 31719 bytes        [13:43 09/01/2012]        [13:43 09/01/2012] 50A98419EC71DBF30A2564A03047B848
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Gambler\AskReady09.wav        --a---- 50247 bytes        [13:38 09/01/2012]        [13:38 09/01/2012] 04A3C57C9AD1C09DAC4F5D48C3DF0E9A
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Gambler\AskReady10.wav        --a---- 35145 bytes        [13:35 09/01/2012]        [13:35 09/01/2012] 68102BE68EDFE31445C0F7BAF7BF04ED
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Gambler\AskReadyC101.wav        --a---- 37875 bytes        [13:34 09/01/2012]        [13:34 09/01/2012] 6D203FAF3F17AC85B06D87BB1D055D15
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Gambler\AskReadyC102.wav        --a---- 57325 bytes        [13:35 09/01/2012]        [13:35 09/01/2012] 5212AE84ED60A022822989F7CFF114F0
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Gambler\AskReadyC103.wav        --a---- 82108 bytes        [13:29 09/01/2012]        [13:29 09/01/2012] ECB072A85C0E9EA2CF5A91EA4A763275
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Mechanic\AskReady01.wav        --a---- 44418 bytes        [13:31 09/01/2012]        [13:31 09/01/2012] 3B62269197F7E48D894B89827258EFD9
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Mechanic\AskReady02.wav        --a---- 12959 bytes        [13:37 09/01/2012]        [13:37 09/01/2012] 5EC4635AFFB95215BC5BEA413779460B
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Mechanic\AskReady03.wav        --a---- 21236 bytes        [13:31 09/01/2012]        [13:31 09/01/2012] 92133CED9C621455D7E29DECEB2075F4
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Producer\AskReady01.wav        --a---- 53763 bytes        [13:32 09/01/2012]        [13:32 09/01/2012] 3BCBFBE8134F198093BE1B194B71691E
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Producer\AskReady02.wav        --a---- 20169 bytes        [13:27 09/01/2012]        [13:27 09/01/2012] A1A6A48A77B9786E0331B7FE6B72D352
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2_german\sound\player\survivor\voice\Producer\AskReady03.wav        --a---- 53350 bytes        [13:29 09/01/2012]        [13:29 09/01/2012] A2B8AFBB24B4298D521BBA6A65C1329B
C:\ProgramData\MAGIX\PC_Check_Tuning_Free_2011\softupdate\Ask Toolbar.png        --a---- 3694 bytes        [16:31 15/10/2011]        [16:31 15/10/2011] 171EBED11CA097CE3D0397075426D04E
C:\ProgramData\MAGIX\PC_Check_Tuning_Free_2011\softupdate\Ask.com Search Assistant.png        --a---- 2708 bytes        [16:30 15/10/2011]        [16:30 15/10/2011] 9790FC3B170766FA5A8B43B150BC4E26
C:\Users\All Users\MAGIX\PC_Check_Tuning_Free_2011\softupdate\Ask Toolbar.png        --a---- 3694 bytes        [16:31 15/10/2011]        [16:31 15/10/2011] 171EBED11CA097CE3D0397075426D04E
C:\Users\All Users\MAGIX\PC_Check_Tuning_Free_2011\softupdate\Ask.com Search Assistant.png        --a---- 2708 bytes        [16:30 15/10/2011]        [16:30 15/10/2011] 9790FC3B170766FA5A8B43B150BC4E26
C:\Users\Lena\AppData\Local\Temp\AskSLib.dll        --a---- 246440 bytes        [01:22 07/01/2012]        [01:22 07/01/2012] 197215658B8015182192E1EBCA3BBCC3

========== regfind ==========

Searching for "facemoods"
[HKEY_CURRENT_USER\Software\facemoods.com]
[HKEY_CURRENT_USER\Software\facemoods.com\facemoods]
[HKEY_CURRENT_USER\Software\facemoods.com\facemoods\instl]
"tlbrSrchUrl"="hxxp://start.facemoods.com/?a=wbst&f=3"
[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com]
[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com\facemoods]
[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com\facemoods\Instl]
"InstallDir"="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4"
[HKEY_LOCAL_MACHINE\SOFTWARE\facemoods.com]
[HKEY_LOCAL_MACHINE\SOFTWARE\facemoods.com\facemoods]
[HKEY_LOCAL_MACHINE\SOFTWARE\facemoods.com\facemoods\Instl]
"InstallDir"="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\ihflimipbcaljfnojhhknppphnnciiif]
"path"="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoods.crx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFDF9EF3-3C3A-4f05-9A6E-5D3B778EC567}]
"AppName"="facemoodssrv.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFDF9EF3-3C3A-4f05-9A6E-5D3B778EC567}]
"AppPath"="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Facemoods_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Facemoods_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\facemoods]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\facemoods]
"DisplayName"="Facemoods Toolbar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\facemoods]
"UninstallString"=""C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\uninstall.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46df-B041-1E593282C7D0}\Instl\Data]
"prtnrId"="facemoods.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{929801A8-4AEF-4d12-BE31-D85BF666452B}]
@="facemoods.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{929801A8-4AEF-4d12-BE31-D85BF666452B}\InprocServer32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\bh\facemoods.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5B99E41-E157-4209-8AAC-DB003A816079}\InprocServer32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodsEng.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5B99E41-E157-4209-8AAC-DB003A816079}\ProgID]
@="facemoods.xtrnl.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5B99E41-E157-4209-8AAC-DB003A816079}\VersionIndependentProgID]
@="facemoods.xtrnl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AD20D01C-C939-4dd2-8C55-56935A48987E}\InprocServer32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodsApp.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AD20D01C-C939-4dd2-8C55-56935A48987E}\ProgID]
@="facemoodsApp.appCore.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AD20D01C-C939-4dd2-8C55-56935A48987E}\VersionIndependentProgID]
@="facemoodsApp.appCore"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DDE2C74F-58CC-4d71-8CE1-09DEBB8CFB78}\InprocServer32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\bh\facemoods.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E95EAD3F-18C6-4304-9DC6-BD6FD8E11D37}\LocalServer32]
@=""C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodssrv.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\facemoods.xtrnl]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\facemoods.xtrnl\CurVer]
@="facemoods.xtrnl.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\facemoods.xtrnl.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\facemoodsApp.appCore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\facemoodsApp.appCore\CurVer]
@="facemoodsApp.appCore.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\facemoodsApp.appCore.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{12A5F606-B1EC-474C-83ED-95E99FD8058E}\1.0]
@="facemoodsCmn 1.0 Type Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{12A5F606-B1EC-474C-83ED-95E99FD8058E}\1.0\0\win32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodsEng.dll\2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{12A5F606-B1EC-474C-83ED-95E99FD8058E}\1.0\HELPDIR]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AD25754E-D76C-42B3-A335-2F81478B722F}\1.0\0\win32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodssrv.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AD25754E-D76C-42B3-A335-2F81478B722F}\1.0\HELPDIR]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B12E99ED-69BD-437C-86BE-C862B9E5444D}\1.0\0\win32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodsEng.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B12E99ED-69BD-437C-86BE-C862B9E5444D}\1.0\HELPDIR]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\0\win32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodsApp.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\HELPDIR]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{929801A8-4AEF-4d12-BE31-D85BF666452B}]
@="facemoods.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{929801A8-4AEF-4d12-BE31-D85BF666452B}\InprocServer32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\bh\facemoods.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A5B99E41-E157-4209-8AAC-DB003A816079}\InprocServer32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodsEng.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A5B99E41-E157-4209-8AAC-DB003A816079}\ProgID]
@="facemoods.xtrnl.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A5B99E41-E157-4209-8AAC-DB003A816079}\VersionIndependentProgID]
@="facemoods.xtrnl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AD20D01C-C939-4dd2-8C55-56935A48987E}\InprocServer32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodsApp.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AD20D01C-C939-4dd2-8C55-56935A48987E}\ProgID]
@="facemoodsApp.appCore.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AD20D01C-C939-4dd2-8C55-56935A48987E}\VersionIndependentProgID]
@="facemoodsApp.appCore"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DDE2C74F-58CC-4d71-8CE1-09DEBB8CFB78}\InprocServer32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\bh\facemoods.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E95EAD3F-18C6-4304-9DC6-BD6FD8E11D37}\LocalServer32]
@=""C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodssrv.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{5B1881D1-D9C7-46df-B041-1E593282C7D0}\Instl\Data]
"prtnrId"="facemoods.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{12A5F606-B1EC-474C-83ED-95E99FD8058E}\1.0]
@="facemoodsCmn 1.0 Type Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{12A5F606-B1EC-474C-83ED-95E99FD8058E}\1.0\0\win32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodsEng.dll\2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{12A5F606-B1EC-474C-83ED-95E99FD8058E}\1.0\HELPDIR]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{AD25754E-D76C-42B3-A335-2F81478B722F}\1.0\0\win32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodssrv.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{AD25754E-D76C-42B3-A335-2F81478B722F}\1.0\HELPDIR]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{B12E99ED-69BD-437C-86BE-C862B9E5444D}\1.0\0\win32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodsEng.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{B12E99ED-69BD-437C-86BE-C862B9E5444D}\1.0\HELPDIR]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\0\win32]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\facemoodsApp.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\HELPDIR]
@="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4\"
[HKEY_USERS\S-1-5-21-2018371923-2337490450-2213972827-1001\Software\facemoods.com]
[HKEY_USERS\S-1-5-21-2018371923-2337490450-2213972827-1001\Software\facemoods.com\facemoods]
[HKEY_USERS\S-1-5-21-2018371923-2337490450-2213972827-1001\Software\facemoods.com\facemoods\instl]
"tlbrSrchUrl"="hxxp://start.facemoods.com/?a=wbst&f=3"
[HKEY_USERS\S-1-5-21-2018371923-2337490450-2213972827-1001\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com]
[HKEY_USERS\S-1-5-21-2018371923-2337490450-2213972827-1001\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com\facemoods]
[HKEY_USERS\S-1-5-21-2018371923-2337490450-2213972827-1001\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com\facemoods\Instl]
"InstallDir"="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4"
[HKEY_USERS\S-1-5-21-2018371923-2337490450-2213972827-1001_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com]
[HKEY_USERS\S-1-5-21-2018371923-2337490450-2213972827-1001_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com\facemoods]
[HKEY_USERS\S-1-5-21-2018371923-2337490450-2213972827-1001_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com\facemoods\Instl]
"InstallDir"="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.4"

-= EOF =-

Larusso 29.01.2012 20:06
Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
@echo off
for %%g in (
"C:\Users\Lena\Downloads\Facemoods.exe"
"C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\zfa4farx.default\extensions\ffxtlbr@Facemoods.com.xpi"
) do (
del /a /F /q %%g
rd /s /q "C:\Program Files (x86)\facemoods.com"
reg delete HKEY_CURRENT_USER\Software\facemoods.com /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\facemoods.com /f
echo Rechner neu starten
del /%0
Vista und Win7 User: Mit Rechtsklick "als Administrator starten"


Dauert nicht lange, starte den Rechner danach neu auf. Berichte ob die Plugins immer noch vorhanden sind

Emerell 31.01.2012 22:40
Oki ich das morgen machen weil ich die letzten Tage zeitlich nicht die Möglichkeit dafür hatte. Hoffe um Verständnis.

Larusso 05.02.2012 10:09
Fehlende Rückmeldung
Dieses Thema wurde aus den Abos gelöscht. Somit bekomm ich keine Benachrichtigung über neue Antworten.
PM an mich falls Du denoch weiter machen willst.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen


Alle Zeitangaben in WEZ +1. Es ist jetzt 19:03 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55