Trojaner-Board - "H:\RECYCLER\e621ca05.exe" konnte nicht gefunden werden.

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - "H:\RECYCLER\e621ca05.exe" konnte nicht gefunden werden. (https://www.trojaner-board.de/125731-h-recycler-e621ca05-exe-konnte-gefunden.html)

Mal sehen ob der Mediyes weg ist:

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Telephony\Providers

HKEY_LOCAL_MACHINE\software\Wow6432Node\microsoft\Windows\CurrentVersion\Telephony\Providers

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache /S

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost

HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost

HKEY_LOCAL_MACHINE\SOFTWARE\Joosoft.com

%SystemRoot%\system32\*.tsp

%SystemRoot%\system32\*.tsp /64

C:\Windows\system32\*.dll /360

C:\Windows\SysNative\*.dll /360

C:\Windows\SysWOW64\*.dll /360

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Code:

OTL logfile created on: 19.10.2012 11:21:03 - Run 3

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Hannes\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,91 Gb Total Physical Memory | 2,55 Gb Available Physical Memory | 65,05% Memory free

7,83 Gb Paging File | 6,27 Gb Available in Paging File | 80,17% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 119,24 Gb Total Space | 19,32 Gb Free Space | 16,20% Space Free | Partition Type: NTFS

Drive D: | 153,85 Gb Total Space | 146,72 Gb Free Space | 95,36% Space Free | Partition Type: NTFS

Drive H: | 298,05 Gb Total Space | 82,68 Gb Free Space | 27,74% Space Free | Partition Type: FAT32

 

Computer Name: KIELBASSA | User Name: Hannes | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Hannes\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Users\Hannes\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

PRC - C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe (Microsoft)

PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)

PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)

PRC - C:\Windows\AsScrPro.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)

PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()

PRC - C:\ProgramData\DatacardService\DCSHelper.exe (Huawei Technologies Co., Ltd.)

PRC - C:\ProgramData\DatacardService\DCService.exe ()

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)

PRC - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()

MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll ()

MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll ()

MOD - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - (Amsp) -- C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found

SRV:64bit: - (NIHardwareService) -- C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe (Native Instruments GmbH)

SRV:64bit: - (AFBAgent) -- C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)

SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)

SRV:64bit: - (TiMiniService) -- C:\Program Files\Trend Micro\Titanium\TiMiniService.exe (Trend Micro Inc.)

SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (avgwd) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

SRV - (AVGIDSAgent) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)

SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)

SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)

SRV - (FreemakeVideoCapture) -- C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe (Microsoft)

SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)

SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)

SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)

SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)

SRV - (DCService.exe) -- C:\ProgramData\DatacardService\DCService.exe ()

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)

SRV - (VMCService) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)

SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (Avgmfx64) -- C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgldx64) -- C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgtdia) -- C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgloga) -- C:\Windows\SysNative\drivers\avgloga.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (AVGIDSHA) -- C:\Windows\SysNative\drivers\avgidsha.sys (AVG Technologies CZ, s.r.o. )

DRV:64bit: - (Avgrkx64) -- C:\Windows\SysNative\drivers\avgrkx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (AVGIDSDriver) -- C:\Windows\SysNative\drivers\avgidsdrivera.sys (AVG Technologies CZ, s.r.o. )

DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)

DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)

DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)

DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)

DRV:64bit: - (Netaapl) -- C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (npf) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronics Corp.)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)

DRV:64bit: - (netr28x) -- C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)

DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)

DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)

DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)

DRV:64bit: - (tmcomm) -- C:\Windows\SysNative\drivers\tmcomm.sys (Trend Micro Inc.)

DRV:64bit: - (tmtdi) -- C:\Windows\SysNative\drivers\tmtdi.sys (Trend Micro Inc.)

DRV:64bit: - (tmactmon) -- C:\Windows\SysNative\drivers\tmactmon.sys (Trend Micro Inc.)

DRV:64bit: - (tmevtmgr) -- C:\Windows\SysNative\drivers\tmevtmgr.sys (Trend Micro Inc.)

DRV:64bit: - (ewusbnet) -- C:\Windows\SysNative\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (L1C) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)

DRV:64bit: - (AmUStor) -- C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)

DRV:64bit: - (tcpipBM) -- C:\Windows\SysNative\drivers\tcpipBM.sys (Bytemobile, Inc.)

DRV:64bit: - (BMLoad) -- C:\Windows\SysNative\drivers\BMLoad.sys (Bytemobile, Inc.)

DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (ksaud) -- C:\Windows\SysNative\drivers\ksaud.sys (Creative Technology Ltd.)

DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( )

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (hwusbfake) -- C:\Windows\SysNative\drivers\ewusbfake.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)

DRV:64bit: - (SaiH0C2D) -- C:\Windows\SysNative\drivers\SaiH0C2D.sys (Saitek)

DRV - (ATKWMIACPIIO) -- C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys (ASUS)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =  127.0.0.1;*.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledAddons: fmdownloader@gmail.com:1.0.0

FF - prefs.js..extensions.enabledAddons: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.10

FF - prefs.js..extensions.enabledAddons: stealthyextension@gmail.com:2.3.3

FF - prefs.js..network.proxy.http: "93.123.45.23"

FF - prefs.js..network.proxy.http_port: 8008

FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co"

FF - prefs.js..network.proxy.share_proxy_settings: true

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\ [2011.04.13 04:51:50 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\fmdownloader@gmail.com: C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\ [2011.12.31 17:31:53 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\ff-bmboc@bytemobile.com: C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.10 20:24:41 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.10 20:24:41 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2012.07.07 18:23:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\Extensions

[2012.10.12 01:41:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\Firefox\Profiles\m17vktlk.default\extensions

[2012.09.16 22:31:12 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Hannes\AppData\Roaming\mozilla\Firefox\Profiles\m17vktlk.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2012.10.12 01:41:01 | 000,184,864 | ---- | M] () (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\firefox\profiles\m17vktlk.default\extensions\stealthyextension@gmail.com.xpi

[2012.10.01 01:08:24 | 000,199,396 | ---- | M] () (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\firefox\profiles\m17vktlk.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi

[2012.09.10 20:24:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.09.10 20:24:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

[2011.12.31 17:31:53 | 000,000,000 | ---D | M] (Freemake Video Downloader Plugin) -- C:\PROGRAM FILES (X86)\FREEMAKE\FREEMAKE VIDEO DOWNLOADER\BROWSERPLUGIN\FIREFOX

[2012.09.10 20:24:41 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.06.28 20:22:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.08.30 20:10:33 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.06.28 20:22:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.06.28 20:22:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.06.28 20:22:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.06.28 20:22:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)

O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)

O2:64bit: - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)

O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)

O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)

O4:64bit: - HKLM..\Run: [Creative SB Monitoring Utility] C:\Windows\SysNative\SBAVMon.dll (Creative Technology Ltd.)

O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found

O4:64bit: - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)

O4:64bit: - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\VizorShortCut.exe (Trend Micro Inc.)

O4:64bit: - HKLM..\Run: [VizorHtmlDialog.exe] C:\Program Files\Trend Micro\Titanium\UIFramework\VizorHtmlDialog.exe (Trend Micro Inc.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [ASUSPRP] C:\Program Files (x86)\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe (ecareme)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [DataCardMonitor] C:\Program Files (x86)\Telekom\InternetManager_H\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)

O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)

O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe -StartUpRun File not found

O4 - HKLM..\Run: [Nuance PDF Reader-reminder] C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - Startup: C:\Users\Hannes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Hannes\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0

O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000011 [] - C:\Windows\system32\nspj7uz8.dll File not found

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{380389F5-1978-4D2C-A1F6-97676C386414}: DhcpNameServer = 139.7.30.126 139.7.30.125

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6BDF45EB-8281-455E-BA7F-B7FBF93FE4CB}: DhcpNameServer = 192.168.1.1 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8DE7CF3B-4145-4F90-A36B-2EF8955EFA1C}: DhcpNameServer = 10.74.210.210 10.74.210.211

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AFECACB9-5D82-4CB3-99CD-0C1982721848}: DhcpNameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)

O18:64bit: - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)

O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O27:64bit: - HKLM IFEO\Utilman.exe: Debugger - C:\Windows\SysNative\cmd.exe (Microsoft Corporation)

O27 - HKLM IFEO\Utilman.exe: Debugger - C:\Windows\SysWOW64\cmd.exe (Microsoft Corporation)

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{3402b491-a745-11e1-bf6c-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{3402b491-a745-11e1-bf6c-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{3402b497-a745-11e1-bf6c-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{3402b497-a745-11e1-bf6c-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{3905068d-af84-11e1-9356-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{3905068d-af84-11e1-9356-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{5c850714-df5d-11e1-86d0-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{5c850714-df5d-11e1-86d0-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{6818d084-b314-11e1-8293-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{6818d084-b314-11e1-8293-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{ee16af77-3a34-11e1-8e6d-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{ee16af77-3a34-11e1-8e6d-14dae93eef71}\Shell\AutoRun\command - "" = F:\AutoRun.exe

O33 - MountPoints2\{ee16af84-3a34-11e1-8e6d-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{ee16af84-3a34-11e1-8e6d-14dae93eef71}\Shell\AutoRun\command - "" = F:\AutoRun.exe

O33 - MountPoints2\F\Shell - "" = AutoRun

O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.10.18 22:23:06 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.10.16 20:54:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.10.16 20:53:38 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Hannes\Desktop\esetsmartinstaller_enu.exe

[2012.10.16 09:32:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

[2012.10.15 21:24:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.10.15 21:24:36 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.10.15 20:53:32 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Hannes\Desktop\OTL.exe

[2012.10.15 18:41:47 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\Malwarebytes

[2012.10.15 18:41:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.10.15 18:41:34 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.10.15 18:41:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.10.15 18:41:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.10.15 18:34:55 | 000,000,000 | ---D | C] -- C:\Users\Hannes\Desktop\maurice

[2012.10.15 18:08:11 | 000,000,000 | ---D | C] -- C:\PPF_Scan2

[2012.10.15 13:29:59 | 000,000,000 | ---D | C] -- C:\PPFScan

[2012.10.15 10:51:46 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\AVG2013

[2012.10.15 10:47:40 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\TuneUp Software

[2012.10.15 10:47:09 | 000,000,000 | -H-D | C] -- C:\$AVG

[2012.10.15 10:47:08 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2013

[2012.10.15 10:46:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG

[2012.10.15 10:43:15 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files

[2012.10.15 10:43:15 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Local\MFAData

[2012.10.15 10:43:15 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData

[2012.10.15 10:43:15 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Local\Avg2013

[2012.10.15 02:04:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\STOPzilla!

[2012.10.15 01:46:55 | 001,036,288 | ---- | C] (Skype Technologies S.A.) -- C:\Users\Hannes\AppData\Roaming\Vwgkgf.exe.old

[2012.10.15 00:47:33 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2012.10.15 00:47:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2012.10.15 00:47:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2012.10.05 21:45:09 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\GoforFiles

[2012.10.05 03:26:22 | 000,111,456 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgmfx64.sys

[2012.10.02 03:30:38 | 000,185,696 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys

[2012.09.25 18:56:12 | 000,000,000 | ---D | C] -- C:\Users\Hannes\Documents\Native Instruments

[2012.09.25 18:37:09 | 000,000,000 | -H-D | C] -- C:\ProgramData\{7707EA53-E29B-48FC-B28B-C8EE171EA0EB}

[2012.09.25 18:35:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Native Instruments

[2012.09.25 18:35:23 | 000,000,000 | -H-D | C] -- C:\ProgramData\{A2A4D724-2D08-46E4-BAA8-EC9EE875D133}

[2012.09.25 18:35:05 | 000,000,000 | -H-D | C] -- C:\ProgramData\{95B4F0ED-951F-4D36-B068-5EC1C4C19C14}

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Native Instruments

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Native Instruments

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\Program Files\Native Instruments

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Native Instruments

[2012.09.24 15:51:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

[2012.09.24 15:50:22 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2012.09.24 15:50:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes

[2012.09.24 15:50:22 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2012.09.24 15:50:22 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

[2012.09.24 07:58:54 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Local\ElevatedDiagnostics

[2012.09.21 03:46:04 | 000,200,032 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgtdia.sys

[2012.09.21 03:46:00 | 000,225,120 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgloga.sys

[2012.09.21 03:45:50 | 000,061,792 | ---- | C] (AVG Technologies CZ, s.r.o. ) -- C:\Windows\SysNative\drivers\avgidsha.sys

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.10.19 11:12:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.10.19 11:11:33 | 000,018,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.10.19 11:11:33 | 000,018,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.10.19 11:03:46 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe

[2012.10.19 11:03:44 | 000,000,266 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job

[2012.10.19 11:03:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.10.19 11:03:38 | 3152,203,776 | -HS- | M] () -- C:\hiberfil.sys

[2012.10.17 18:29:21 | 000,538,941 | ---- | M] () -- C:\Users\Hannes\Desktop\adwcleaner.exe

[2012.10.17 18:15:17 | 010,215,277 | ---- | M] () -- C:\Users\Hannes\Desktop\prezentacja2012.ppsx

[2012.10.16 22:00:02 | 005,142,464 | ---- | M] () -- C:\Users\Hannes\Desktop\R.I.O. feat. U-Jean - Animal (PH Electro Radio Edit) (Official Video HD).mp3

[2012.10.16 20:53:38 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Hannes\Desktop\esetsmartinstaller_enu.exe

[2012.10.16 20:45:38 | 017,434,899 | ---- | M] () -- C:\Users\Hannes\Desktop\IMG_0985.MOV

[2012.10.16 09:32:34 | 000,000,983 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk

[2012.10.15 22:03:52 | 123,434,612 | ---- | M] () -- C:\Users\Hannes\Desktop\IMG_0983.mpg

[2012.10.15 21:24:38 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.10.15 20:53:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Hannes\Desktop\OTL.exe

[2012.10.15 18:41:35 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.10.15 13:29:38 | 006,170,946 | ---- | M] () -- C:\PPFScan.zip

[2012.10.15 10:53:28 | 000,001,391 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini

[2012.10.15 10:53:27 | 000,002,250 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini

[2012.10.15 10:41:04 | 000,006,904 | ---- | M] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg

[2012.10.15 01:46:58 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\56F0.exe

[2012.10.15 01:46:55 | 001,036,288 | ---- | M] (Skype Technologies S.A.) -- C:\Users\Hannes\AppData\Roaming\Vwgkgf.exe.old

[2012.10.15 01:39:47 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\C3B6.exe

[2012.10.15 00:56:33 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\2E9E.exe

[2012.10.15 00:47:33 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.10.15 00:34:26 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\EFC9.exe

[2012.10.15 00:16:11 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\3790.exe

[2012.10.14 23:54:15 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\2602.exe

[2012.10.14 22:38:02 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\5EAC.exe

[2012.10.14 22:20:15 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\1452.exe

[2012.10.14 22:02:57 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\3FD4.exe

[2012.10.12 21:32:10 | 003,255,641 | ---- | M] () -- C:\Users\Hannes\Desktop\Linkin Park - Castle of Glass.mp3

[2012.10.05 16:50:32 | 000,054,039 | ---- | M] () -- C:\Users\Hannes\.recently-used.xbel

[2012.10.05 03:26:22 | 000,111,456 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgmfx64.sys

[2012.10.02 17:35:17 | 001,531,218 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.10.02 17:35:17 | 000,666,256 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.10.02 17:35:17 | 000,628,098 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.10.02 17:35:17 | 000,134,178 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.10.02 17:35:17 | 000,110,560 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.10.02 03:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys

[2012.10.01 21:56:54 | 000,015,477 | ---- | M] () -- C:\Users\Hannes\Desktop\relativ.odt

[2012.09.29 17:17:29 | 000,283,745 | ---- | M] () -- C:\Users\Hannes\Desktop\screen_aragon.jpg

[2012.09.28 22:15:46 | 000,000,023 | ---- | M] () -- C:\Windows\Telemax.cfg

[2012.09.26 23:50:45 | 003,257,187 | ---- | M] () -- C:\Users\Hannes\Desktop\Filterfunk - S.O.S. (Message in a bottle).mp3

[2012.09.26 18:14:00 | 000,072,320 | ---- | M] () -- C:\Users\Hannes\Desktop\screen.jpg

[2012.09.25 18:37:05 | 000,001,004 | ---- | M] () -- C:\Users\Public\Desktop\Traktor 2.lnk

[2012.09.24 15:51:26 | 000,001,785 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk

[2012.09.21 03:46:04 | 000,200,032 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgtdia.sys

[2012.09.21 03:46:00 | 000,225,120 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgloga.sys

[2012.09.21 03:45:50 | 000,061,792 | ---- | M] (AVG Technologies CZ, s.r.o. ) -- C:\Windows\SysNative\drivers\avgidsha.sys

 
 ========== Files Created - No Company Name ==========

 

[2012.10.17 18:29:20 | 000,538,941 | ---- | C] () -- C:\Users\Hannes\Desktop\adwcleaner.exe

[2012.10.17 18:15:04 | 010,215,277 | ---- | C] () -- C:\Users\Hannes\Desktop\prezentacja2012.ppsx

[2012.10.16 21:59:18 | 005,142,464 | ---- | C] () -- C:\Users\Hannes\Desktop\R.I.O. feat. U-Jean - Animal (PH Electro Radio Edit) (Official Video HD).mp3

[2012.10.16 21:05:12 | 017,434,899 | ---- | C] () -- C:\Users\Hannes\Desktop\IMG_0985.MOV

[2012.10.15 22:12:30 | 123,434,612 | ---- | C] () -- C:\Users\Hannes\Desktop\IMG_0983.mpg

[2012.10.15 21:24:38 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.10.15 18:41:35 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.10.15 13:29:30 | 006,170,946 | ---- | C] () -- C:\PPFScan.zip

[2012.10.15 10:47:40 | 000,000,983 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2013.lnk

[2012.10.15 03:58:59 | 000,006,904 | ---- | C] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg

[2012.10.15 01:46:58 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\56F0.exe

[2012.10.15 01:39:47 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\C3B6.exe

[2012.10.15 00:56:33 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\2E9E.exe

[2012.10.15 00:47:33 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.10.15 00:34:26 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\EFC9.exe

[2012.10.15 00:16:11 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\3790.exe

[2012.10.14 23:54:15 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\2602.exe

[2012.10.14 22:38:02 | 000,091,136 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\5EAC.exe

[2012.10.14 22:20:15 | 000,091,136 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\1452.exe

[2012.10.14 22:02:57 | 000,091,136 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\3FD4.exe

[2012.10.12 21:32:02 | 003,255,641 | ---- | C] () -- C:\Users\Hannes\Desktop\Linkin Park - Castle of Glass.mp3

[2012.10.05 16:50:32 | 000,054,039 | ---- | C] () -- C:\Users\Hannes\.recently-used.xbel

[2012.10.01 21:56:53 | 000,015,477 | ---- | C] () -- C:\Users\Hannes\Desktop\relativ.odt

[2012.09.29 17:17:28 | 000,283,745 | ---- | C] () -- C:\Users\Hannes\Desktop\screen_aragon.jpg

[2012.09.26 23:50:39 | 003,257,187 | ---- | C] () -- C:\Users\Hannes\Desktop\Filterfunk - S.O.S. (Message in a bottle).mp3

[2012.09.26 18:14:00 | 000,072,320 | ---- | C] () -- C:\Users\Hannes\Desktop\screen.jpg

[2012.09.25 18:37:05 | 000,001,004 | ---- | C] () -- C:\Users\Public\Desktop\Traktor 2.lnk

[2012.09.24 15:51:26 | 000,001,785 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk

[2012.01.01 18:36:16 | 000,001,352 | ---- | C] () -- C:\ProgramData\CfSB1090.ini

[2012.01.01 18:36:16 | 000,001,352 | ---- | C] () -- C:\ProgramData\CfSB0910.ini

[2012.01.01 18:36:16 | 000,001,302 | ---- | C] () -- C:\ProgramData\CfSB0300.ini

[2012.01.01 18:36:16 | 000,001,282 | ---- | C] () -- C:\ProgramData\CfSB0471.ini

[2012.01.01 18:36:16 | 000,001,208 | ---- | C] () -- C:\ProgramData\CfSB0490.ini

[2012.01.01 18:36:16 | 000,001,027 | ---- | C] () -- C:\ProgramData\CfSB0560.ini

[2012.01.01 18:36:16 | 000,001,026 | ---- | C] () -- C:\ProgramData\CfSB0271.ini

[2012.01.01 18:36:16 | 000,001,026 | ---- | C] () -- C:\ProgramData\CfSB0270.ini

[2011.12.28 21:58:49 | 000,001,320 | ---- | C] () -- C:\Users\Hannes\.xmlcopyeditor

[2011.12.26 11:57:01 | 001,557,912 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011.12.25 23:18:29 | 000,000,023 | ---- | C] () -- C:\Windows\AIM_LANGUAGE.INI

[2011.12.25 23:18:26 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\glut32.dll

[2011.08.01 22:10:25 | 000,014,051 | ---- | C] () -- C:\Windows\SysWow64\RaCoInst.dat

[2011.08.01 22:10:21 | 000,147,456 | ---- | C] () -- C:\Windows\SysWow64\DiagFunc.dll

[2011.08.01 22:10:21 | 000,000,451 | ---- | C] () -- C:\Windows\SysWow64\DiagFunc.ini

[2011.08.01 22:05:52 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll

[2011.05.31 05:23:33 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin

[2011.05.31 05:23:31 | 000,213,332 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin

[2011.05.31 05:23:30 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin

[2011.04.13 04:48:48 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe

[2011.02.11 23:23:34 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll

[2009.06.16 13:25:02 | 000,121,512 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2012.10.16 09:32:33 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software

[2012.10.16 09:32:33 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software

[2012.03.13 14:08:02 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\AnvSoft

[2011.12.25 20:51:53 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\ASUS WebStorage

[2012.09.24 19:47:46 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Audacity

[2012.10.15 10:51:46 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\AVG2013

[2011.12.28 19:39:50 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Capcom

[2012.10.19 11:05:02 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Dropbox

[2012.02.19 20:06:37 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\DVDVideoSoft

[2012.09.11 15:06:44 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\FileZilla

[2012.10.05 21:45:09 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\GoforFiles

[2012.10.05 16:50:32 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\gtk-2.0

[2012.08.15 10:12:55 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\MAGIX

[2011.12.27 20:35:54 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Nuance

[2012.02.26 22:03:35 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Pamela

[2012.10.05 15:01:01 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\SoftGrid Client

[2012.01.08 22:13:36 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Telekom

[2012.01.08 22:29:42 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Telekom Internet Manager

[2011.12.26 11:57:51 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TP

[2012.09.05 00:02:38 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TS3Client

[2012.10.15 10:47:40 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TuneUp Software

[2012.05.26 18:34:03 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Vodafone

[2011.12.26 15:49:02 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Windows Live Writer

[2012.09.04 23:09:21 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\XnView

[2011.12.27 20:35:51 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Zeon

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Telephony\Providers >

"ProviderID0" = 1

"ProviderID1" = 2

"ProviderID2" = 3

"ProviderID3" = 4

"NextProviderID" = 5

"ProviderFileName0" = unimdm.tsp -- [2010.11.20 14:16:54 | 000,281,088 | ---- | M] (Microsoft Corporation)

"ProviderFileName1" = kmddsp.tsp -- [2009.07.14 03:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation)

"ProviderFileName2" = ndptsp.tsp -- [2009.07.14 03:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation)

"ProviderFileName3" = hidphone.tsp -- [2009.07.14 03:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation)

"NumProviders" = 4

 
 < HKEY_LOCAL_MACHINE\software\Wow6432Node\microsoft\Windows\CurrentVersion\Telephony\Providers >

"ProviderID0" = 1

"ProviderID1" = 2

"ProviderID2" = 3

"ProviderID3" = 4

"NextProviderID" = 5

"ProviderFileName0" = unimdm.tsp -- [2010.11.20 14:16:54 | 000,281,088 | ---- | M] (Microsoft Corporation)

"ProviderFileName1" = kmddsp.tsp -- [2009.07.14 03:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation)

"ProviderFileName2" = ndptsp.tsp -- [2009.07.14 03:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation)

"ProviderFileName3" = hidphone.tsp -- [2009.07.14 03:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation)

"NumProviders" = 4

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters >

"ServiceDll" = %SystemRoot%\System32\wkssvc.dll

"ServiceDllUnloadOnStop" = 1

"EnablePlainTextPassword" = 0

"EnableSecuritySignature" = 1

"RequireSecuritySignature" = 0

"OtherDomains" =  [binary data]

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache /S >

"DisplayName" = @%SystemRoot%\System32\dnsapi.dll,-101

"Group" = TDI

"ImagePath" = %SystemRoot%\system32\svchost.exe -k NetworkService -- [2009.07.14 03:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation)

"Description" = @%SystemRoot%\System32\dnsapi.dll,-102

"ObjectName" = NT AUTHORITY\NetworkService

"ErrorControl" = 1

"Start" = 2

"Type" = 32

"DependOnService" = Tdxnsi [binary data]

"ServiceSidType" = 1

"RequiredPrivileges" = SeChangeNotifyPrivilegeSeCreateGlobalPrivilege [binary data]

"FailureActions" = 80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 14 00 00 00 01 00 00 00 C0 D4 01 00 01 00 00 00 E0 93 04 00 00 00 00 00 00 00 00 00  [binary data]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache\Parameters]

"ServiceDll" = %SystemRoot%\System32\dnsrslvr.dll

"ServiceDllUnloadOnStop" = 1

"extension" = %SystemRoot%\System32\dnsext.dll

"ServiceMain" = SetAccessPolicy

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache\Parameters\DnsCache]

"ShutdownOnIdle" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache\Security]

"Security" = 01 00 14 80 F8 00 00 00 04 01 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 C8 00 08 00 00 00 00 02 18 00 9D 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 21 02 00 00 00 02 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 02 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 04 00 00 00 00 02 14 00 8D 00 02 00 01 01 00 00 00 00 00 05 14 00 00 00 00 02 14 00 8D 00 02 00 01 01 00 00 00 00 00 05 13 00 00 00 00 02 18 00 CD 00 02 00 01 02 00 00 00 00 00 05 20 00 00 00 2C 02 00 00 00 02 28 00 CD 01 02 00 01 06 00 00 00 00 00 05 50 00 00 00 04 C9 44 AF 94 D9 D3 E5 2B E1 B7 1C 17 84 87 13 6E 1A FA 65 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00  [Binary data over 200 bytes]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache\TriggerInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache\TriggerInfo\0]

"Type" = 4

"Action" = 1

"GUID" = 07 9E 56 B7 21 84 E0 4E AD 10 86 91 5A FD AD 09  [binary data]

"Data0" = 5355UDP [binary data]

"DataType0" = 2

 
 < HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost >

"netsvcs" = AeLookupSvcCertPropSvcSCPolicySv [Binary data over 200 bytes]

"LocalService" = RemoteRegistryWinHttpAutoProxySvc [Binary data over 200 bytes]

"LocalSystemNetworkRestricted" = NetmanAudioEndpointBuilderdot3sv [Binary data over 200 bytes]

"LocalServiceNoNetwork" = PLA [binary data] -- [2010.11.20 14:20:56 | 001,508,864 | ---- | M] (Microsoft Corporation)

"rpcss" = RpcSs [binary data]

"LocalServiceNetworkRestricted" = AudioSrvBthHFSrvLmHostswscsvcWPCSvc [binary data]

"LocalServiceAndNoImpersonation" = SSDPSRVupnphostSCardSvrTBSQWAVEwcncsvc [binary data]

"DcomLaunch" = PowerPlugPlayDcomLaunch [binary data]

"NetworkService" = CryptSvcDHCPTermServiceDNSCache [Binary data over 200 bytes]

"imgsvc" = StiSvc [binary data]

"wcssvc" = WcsPlugInService [binary data] -- [2009.07.14 03:16:18 | 000,032,768 | ---- | M] (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalService]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceAndNoImpersonation]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceNetworkRestricted]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalServiceNoNetwork]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalSystemNetworkRestricted]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\netsvcs]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkService]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkServiceRemoteDesktopHyperVAgent]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\NetworkServiceRemoteDesktopPublishing]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\termsvcs]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\wcssvc]

 
 < HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost >

"netsvcs" = AeLookupSvcCertPropSvcSCPolicySv [Binary data over 200 bytes]

"LocalService" = RemoteRegistryWinHttpAutoProxySvc [Binary data over 200 bytes]

"LocalSystemNetworkRestricted" = NetmanAudioEndpointBuilderdot3sv [Binary data over 200 bytes]

"LocalServiceNoNetwork" = PLA [binary data] -- [2010.11.20 14:20:56 | 001,508,864 | ---- | M] (Microsoft Corporation)

"rpcss" = RpcSs [binary data]

"LocalServiceNetworkRestricted" = AudioSrvBthHFSrvLmHostswscsvcWPCSvc [binary data]

"LocalServiceAndNoImpersonation" = SSDPSRVupnphostSCardSvrTBSQWAVEwcncsvc [binary data]

"DcomLaunch" = PowerPlugPlayDcomLaunch [binary data]

"NetworkService" = CryptSvcDHCPTermServiceDNSCache [Binary data over 200 bytes]

"imgsvc" = StiSvc [binary data]

"wcssvc" = WcsPlugInService [binary data] -- [2009.07.14 03:16:18 | 000,032,768 | ---- | M] (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost\LocalService]

 

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost\LocalServiceAndNoImpersonation]

 

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost\LocalServiceNetworkRestricted]

 

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost\LocalServiceNoNetwork]

 

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost\LocalSystemNetworkRestricted]

 

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost\netsvcs]

 

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost\NetworkService]

 

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost\NetworkServiceRemoteDesktopHyperVAgent]

 

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost\NetworkServiceRemoteDesktopPublishing]

 

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost\termsvcs]

 

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost\wcssvc]

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Joosoft.com >

 
 < %SystemRoot%\system32\*.tsp >

[2009.07.14 03:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp

[2009.07.14 03:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp

[2009.07.14 03:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp

[2009.07.14 03:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp

[2010.11.20 14:16:54 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp

 
 < %SystemRoot%\system32\*.tsp /64 >

[2009.07.14 03:38:54 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\hidphone.tsp

[2009.07.14 03:38:54 | 000,047,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\kmddsp.tsp

[2009.07.14 03:38:54 | 000,060,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ndptsp.tsp

[2009.07.14 03:38:54 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\remotesp.tsp

[2010.11.20 15:24:26 | 000,321,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\unimdm.tsp

 
 < C:\Windows\system32\*.dll /360 >

[2012.08.20 19:32:12 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

[2012.08.20 19:32:13 | 000,005,120 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

[2012.08.20 19:32:13 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

[2012.08.20 19:32:13 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

[2012.08.20 19:32:13 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

[2012.08.20 19:32:13 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

[2012.08.20 19:32:13 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

[2012.08.20 19:32:13 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

[2012.08.20 17:33:28 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

[2012.08.20 17:33:28 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

[2012.08.20 17:33:28 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

[2012.08.20 17:33:28 | 000,006,144 | -H-- | M] (Microsoft Corporation) -- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

[2012.07.04 23:14:34 | 000,041,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\browcli.dll

[2012.06.06 07:03:06 | 000,805,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cdosys.dll

[2012.06.02 06:36:29 | 001,159,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\crypt32.dll

[2012.06.02 06:36:29 | 000,103,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cryptnet.dll

[2012.06.02 06:36:29 | 000,140,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\cryptsvc.dll

[2012.08.02 18:57:20 | 000,490,496 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\d3d10level9.dll

[2012.09.05 14:35:01 | 000,473,072 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\system32\deployJava1.dll

[2012.03.03 07:31:19 | 001,077,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\DWrite.dll

[2012.08.21 13:01:20 | 000,106,928 | ---- | M] (GEAR Software Inc.) -- C:\Windows\system32\GEARAspi.dll

[2012.08.24 09:03:49 | 009,738,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ieframe.dll

[2012.08.24 08:44:35 | 001,793,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\iertutil.dll

[2012.08.24 08:40:11 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ieui.dll

[2012.03.01 07:33:23 | 000,159,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\imagehlp.dll

[2012.08.24 08:47:36 | 000,717,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\jscript.dll

[2012.08.24 08:59:17 | 001,800,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\jscript9.dll

[2012.08.24 08:48:38 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\jsproxy.dll

[2012.08.11 01:56:14 | 000,542,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kerberos.dll

[2012.08.20 19:37:18 | 001,114,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kernel32.dll

[2012.08.20 19:37:18 | 000,274,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\KernelBase.dll

[2012.08.24 08:45:46 | 000,607,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msfeeds.dll

[2012.08.24 09:27:00 | 012,319,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mshtml.dll

[2012.08.24 08:44:10 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\mshtmled.dll

[2012.04.07 13:26:29 | 002,342,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msi.dll

[2011.12.16 09:52:58 | 000,690,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msvcrt.dll

[2012.06.06 07:05:52 | 001,236,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msxml3.dll

[2012.06.06 07:05:52 | 001,390,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\msxml6.dll

[2012.06.02 06:39:10 | 000,219,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ncrypt.dll

[2012.07.04 23:16:56 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\netapi32.dll

[2012.09.05 14:35:01 | 000,477,168 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\system32\npdeployJava1.dll

[2011.11.17 07:38:39 | 001,292,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ntdll.dll

[2012.01.04 10:58:41 | 000,442,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ntshrui.dll

[2012.08.20 19:40:21 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ntvdm64.dll

[2011.11.19 16:01:00 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\packager.dll

[2011.10.26 06:32:11 | 000,514,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\qdvd.dll

[2011.10.26 06:32:11 | 001,328,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\quartz.dll

[2012.02.17 07:34:22 | 000,826,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\rdpcore.dll

[2012.02.27 11:22:12 | 000,158,208 | ---- | M] (Scendix Software-Vertriebsges. mbH) -- C:\Windows\system32\RemoteControl.dll

[2012.06.02 06:40:39 | 000,225,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\schannel.dll

[2012.06.02 06:40:42 | 000,022,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\secur32.dll

[2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\shell32.dll

[2012.05.26 18:33:08 | 000,008,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\SpOrder.dll

[2012.05.05 09:46:52 | 000,043,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\srclient.dll

[2012.06.02 06:34:09 | 000,096,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\sspicli.dll

[2012.09.14 20:28:53 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\tzres.dll

[2012.08.24 08:49:57 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\url.dll

[2012.08.24 08:51:50 | 001,103,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\urlmon.dll

[2012.08.24 08:47:12 | 000,420,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\vbscript.dll

[2011.11.17 07:35:02 | 000,314,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\webio.dll

[2012.02.11 07:43:49 | 000,492,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\win32spl.dll

[2012.08.24 08:51:27 | 001,129,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wininet.dll

[2012.08.24 18:57:48 | 000,172,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wintrust.dll

[2012.03.01 07:29:16 | 000,005,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wmi.dll

[2012.08.20 19:37:19 | 000,005,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\wow32.dll

[2009.07.14 07:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT

[2009.07.14 07:08:49 | 000,032,632 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2012.01.22 18:02:21 | 000,000,266 | ---- | C] () -- C:\Windows\Tasks\AutoKMS.job

[2012.06.26 10:05:53 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

 
 < C:\Windows\SysNative\*.dll /360 >

[2012.08.20 20:38:31 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll

[2012.08.20 20:38:31 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll

[2012.08.20 20:38:31 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll

[2012.08.20 20:38:31 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll

[2012.08.20 20:38:31 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll

[2012.08.20 20:38:31 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll

[2012.08.20 20:38:31 | 000,005,120 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll

[2012.08.20 20:38:31 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll

[2012.08.20 20:38:31 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll

[2012.08.20 20:38:31 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll

[2012.08.20 20:38:31 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll

[2012.08.20 20:38:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll

[2012.08.20 20:38:32 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll

[2012.08.20 20:38:32 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll

[2012.08.20 20:38:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll

[2012.08.20 20:38:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll

[2012.08.20 20:38:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll

[2012.08.20 20:38:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll

[2012.08.20 20:38:32 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll

[2012.08.20 20:38:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll

[2012.08.20 20:38:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll

[2012.08.20 20:38:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll

[2012.08.20 20:38:32 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll

[2012.08.20 20:38:32 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll

[2012.08.20 20:38:32 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll

[2012.08.20 20:38:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll

[2012.08.20 20:38:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll

[2012.08.20 20:38:32 | 000,006,144 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll

[2012.07.05 00:13:27 | 000,059,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll

[2012.07.05 00:13:27 | 000,136,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\browser.dll

[2012.06.06 08:02:54 | 001,133,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll

[2012.06.02 07:41:27 | 001,464,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll

[2012.06.02 07:41:28 | 000,140,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll

[2012.06.02 07:41:28 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cryptsvc.dll

[2011.10.26 07:21:20 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll

[2012.08.02 19:58:52 | 000,574,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll

[2012.03.03 08:35:38 | 001,544,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll

[2012.08.21 13:01:20 | 000,125,872 | ---- | M] (GEAR Software Inc.) -- C:\Windows\SysNative\GEARAspi64.dll

[2012.08.24 12:39:42 | 010,925,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieframe.dll

[2012.08.24 12:12:04 | 002,144,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iertutil.dll

[2012.08.24 12:04:06 | 000,248,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2012.03.01 08:33:50 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll

[2012.08.24 12:14:34 | 000,816,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2012.08.24 12:31:32 | 002,312,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2012.08.24 12:17:03 | 000,085,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jsproxy.dll

[2012.08.11 02:56:03 | 000,715,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\kerberos.dll

[2012.08.20 20:48:35 | 001,162,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll

[2012.08.20 20:48:35 | 000,424,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll

[2012.05.14 07:26:34 | 000,956,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll

[2011.11.17 08:35:19 | 001,447,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll

[2012.08.24 12:11:57 | 000,729,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2012.08.24 13:15:45 | 017,810,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtml.dll

[2012.08.24 12:10:14 | 000,096,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2012.04.07 14:31:40 | 003,216,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll

[2011.12.16 10:46:06 | 000,634,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msvcrt.dll

[2012.06.06 08:06:16 | 001,881,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3.dll

[2012.06.06 08:06:16 | 002,004,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msxml6.dll

[2012.06.02 07:44:21 | 000,307,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll

[2012.07.05 00:16:43 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll

[2011.11.17 08:41:18 | 001,731,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll

[2012.01.04 12:44:20 | 000,509,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll

[2012.08.20 20:48:37 | 000,016,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll

[2011.11.19 16:58:00 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\packager.dll

[2012.05.01 07:40:20 | 000,209,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\profsvc.dll

[2011.10.26 07:25:15 | 000,366,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll

[2011.10.26 07:25:16 | 001,572,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll

[2012.02.17 08:38:26 | 001,031,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll

[2012.04.26 07:41:55 | 000,149,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll

[2012.04.26 07:41:56 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll

[2012.06.02 07:45:31 | 000,340,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\schannel.dll

[2011.11.17 08:35:25 | 000,028,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll

[2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\shell32.dll

[2012.05.05 10:36:55 | 000,503,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll

[2011.11.17 08:35:26 | 000,136,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll

[2011.11.17 08:35:26 | 000,029,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll

[2012.09.14 21:19:29 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tzres.dll

[2012.08.24 12:18:46 | 000,237,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll

[2012.08.24 12:22:46 | 001,346,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\urlmon.dll

[2012.07.09 13:42:56 | 004,547,984 | ---- | M] (Apple, Inc.) -- C:\Windows\SysNative\usbaaplrc.dll

[2012.08.24 12:13:29 | 000,599,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2011.11.17 08:35:28 | 000,395,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll

[2012.02.11 08:43:47 | 000,751,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll

[2012.08.24 12:21:18 | 001,392,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wininet.dll

[2012.08.20 20:48:43 | 000,215,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll

[2012.08.24 20:05:07 | 000,220,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll

[2012.03.01 08:28:47 | 000,005,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wmi.dll

[2012.08.20 20:48:44 | 000,243,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll

[2012.08.20 20:48:44 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll

[2012.08.20 20:48:44 | 000,362,496 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll

[2012.06.03 00:19:23 | 000,701,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll

[2012.06.03 00:19:43 | 002,428,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuaueng.dll

[2012.06.03 00:15:31 | 002,622,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll

[2012.06.03 00:15:08 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll

[2012.06.03 00:19:46 | 000,038,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll

[2012.06.03 00:19:42 | 000,044,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll

[2012.06.02 15:19:42 | 000,186,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll

 
 < C:\Windows\SysWOW64\*.dll /360 >

[2012.08.20 19:32:12 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

[2012.08.20 19:32:13 | 000,005,120 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

[2012.08.20 19:32:13 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

[2012.08.20 19:32:13 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

[2012.08.20 19:32:13 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

[2012.08.20 19:32:13 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

[2012.08.20 19:32:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

[2012.08.20 19:32:13 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

[2012.08.20 19:32:13 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

[2012.08.20 17:33:28 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

[2012.08.20 17:33:28 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

[2012.08.20 17:33:28 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

[2012.08.20 17:33:28 | 000,006,144 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

[2012.07.04 23:14:34 | 000,041,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\browcli.dll

[2012.06.06 07:03:06 | 000,805,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\cdosys.dll

[2012.06.02 06:36:29 | 001,159,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\crypt32.dll

[2012.06.02 06:36:29 | 000,103,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\cryptnet.dll

[2012.06.02 06:36:29 | 000,140,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\cryptsvc.dll

[2012.08.02 18:57:20 | 000,490,496 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\d3d10level9.dll

[2012.09.05 14:35:01 | 000,473,072 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWOW64\deployJava1.dll

[2012.03.03 07:31:19 | 001,077,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\DWrite.dll

[2012.08.21 13:01:20 | 000,106,928 | ---- | M] (GEAR Software Inc.) -- C:\Windows\SysWOW64\GEARAspi.dll

[2012.08.24 09:03:49 | 009,738,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\ieframe.dll

[2012.08.24 08:44:35 | 001,793,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\iertutil.dll

[2012.08.24 08:40:11 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\ieui.dll

[2012.03.01 07:33:23 | 000,159,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\imagehlp.dll

[2012.08.24 08:47:36 | 000,717,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\jscript.dll

[2012.08.24 08:59:17 | 001,800,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\jscript9.dll

[2012.08.24 08:48:38 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\jsproxy.dll

[2012.08.11 01:56:14 | 000,542,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\kerberos.dll

[2012.08.20 19:37:18 | 001,114,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\kernel32.dll

[2012.08.20 19:37:18 | 000,274,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\KernelBase.dll

[2012.08.24 08:45:46 | 000,607,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msfeeds.dll

[2012.08.24 09:27:00 | 012,319,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\mshtml.dll

[2012.08.24 08:44:10 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\mshtmled.dll

[2012.04.07 13:26:29 | 002,342,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msi.dll

[2011.12.16 09:52:58 | 000,690,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msvcrt.dll

[2012.06.06 07:05:52 | 001,236,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msxml3.dll

[2012.06.06 07:05:52 | 001,390,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msxml6.dll

[2012.06.02 06:39:10 | 000,219,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\ncrypt.dll

[2012.07.04 23:16:56 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\netapi32.dll

[2012.09.05 14:35:01 | 000,477,168 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWOW64\npdeployJava1.dll

[2011.11.17 07:38:39 | 001,292,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\ntdll.dll

[2012.01.04 10:58:41 | 000,442,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\ntshrui.dll

[2012.08.20 19:40:21 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\ntvdm64.dll

[2011.11.19 16:01:00 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\packager.dll

[2011.10.26 06:32:11 | 000,514,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\qdvd.dll

[2011.10.26 06:32:11 | 001,328,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\quartz.dll

[2012.02.17 07:34:22 | 000,826,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\rdpcore.dll

[2012.02.27 11:22:12 | 000,158,208 | ---- | M] (Scendix Software-Vertriebsges. mbH) -- C:\Windows\SysWOW64\RemoteControl.dll

[2012.06.02 06:40:39 | 000,225,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\schannel.dll

[2012.06.02 06:40:42 | 000,022,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\secur32.dll

[2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\shell32.dll

[2012.05.26 18:33:08 | 000,008,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\SpOrder.dll

[2012.05.05 09:46:52 | 000,043,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\srclient.dll

[2012.06.02 06:34:09 | 000,096,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\sspicli.dll

[2012.09.14 20:28:53 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\tzres.dll

[2012.08.24 08:49:57 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\url.dll

[2012.08.24 08:51:50 | 001,103,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\urlmon.dll

[2012.08.24 08:47:12 | 000,420,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\vbscript.dll

[2011.11.17 07:35:02 | 000,314,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\webio.dll

[2012.02.11 07:43:49 | 000,492,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\win32spl.dll

[2012.08.24 08:51:27 | 001,129,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wininet.dll

[2012.08.24 18:57:48 | 000,172,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wintrust.dll

[2012.03.01 07:29:16 | 000,005,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wmi.dll

[2012.08.20 19:37:19 | 000,005,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wow32.dll

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 173 bytes -> C:\ProgramData\Temp:FB1B13D8

@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:52DBE86F
 

< End of report >

Ok, scheint besser zu sein

Mach bitte einen (neuen) CustomScan mit OTL - das Log davon nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Bitte entschuldige, ich war über's Wochenende verreist.
Während des Scans sind nun 2 "desktop.ini" Dateien aufgetaucht, und auch in anderen Ordnern befinden sich seit dem Scan blass hinterlegte Elemente, als wären sie "versteckte Dateien".

Hier das neue LOG

Code:

OTL logfile created on: 22.10.2012 17:45:55 - Run 4

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Hannes\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,91 Gb Total Physical Memory | 1,73 Gb Available Physical Memory | 44,21% Memory free

7,83 Gb Paging File | 5,55 Gb Available in Paging File | 70,93% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 119,24 Gb Total Space | 20,67 Gb Free Space | 17,33% Space Free | Partition Type: NTFS

Drive D: | 153,85 Gb Total Space | 146,72 Gb Free Space | 95,36% Space Free | Partition Type: NTFS

Drive H: | 298,05 Gb Total Space | 82,68 Gb Free Space | 27,74% Space Free | Partition Type: FAT32

 

Computer Name: KIELBASSA | User Name: Hannes | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Hannes\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Users\Hannes\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

PRC - C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe (Microsoft)

PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)

PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)

PRC - C:\Windows\AsScrPro.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)

PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()

PRC - C:\ProgramData\DatacardService\DCSHelper.exe (Huawei Technologies Co., Ltd.)

PRC - C:\ProgramData\DatacardService\DCService.exe ()

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)

PRC - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()

MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()

MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll ()

MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll ()

MOD - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - (Amsp) -- C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found

SRV:64bit: - (NIHardwareService) -- C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe (Native Instruments GmbH)

SRV:64bit: - (AFBAgent) -- C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)

SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)

SRV:64bit: - (TiMiniService) -- C:\Program Files\Trend Micro\Titanium\TiMiniService.exe (Trend Micro Inc.)

SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (avgwd) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

SRV - (AVGIDSAgent) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)

SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)

SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)

SRV - (FreemakeVideoCapture) -- C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe (Microsoft)

SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)

SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)

SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)

SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)

SRV - (DCService.exe) -- C:\ProgramData\DatacardService\DCService.exe ()

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)

SRV - (VMCService) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)

SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (Avgmfx64) -- C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgldx64) -- C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgtdia) -- C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgloga) -- C:\Windows\SysNative\drivers\avgloga.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (AVGIDSHA) -- C:\Windows\SysNative\drivers\avgidsha.sys (AVG Technologies CZ, s.r.o. )

DRV:64bit: - (Avgrkx64) -- C:\Windows\SysNative\drivers\avgrkx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (AVGIDSDriver) -- C:\Windows\SysNative\drivers\avgidsdrivera.sys (AVG Technologies CZ, s.r.o. )

DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)

DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)

DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)

DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)

DRV:64bit: - (Netaapl) -- C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (npf) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronics Corp.)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)

DRV:64bit: - (netr28x) -- C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)

DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)

DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)

DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)

DRV:64bit: - (tmcomm) -- C:\Windows\SysNative\drivers\tmcomm.sys (Trend Micro Inc.)

DRV:64bit: - (tmtdi) -- C:\Windows\SysNative\drivers\tmtdi.sys (Trend Micro Inc.)

DRV:64bit: - (tmactmon) -- C:\Windows\SysNative\drivers\tmactmon.sys (Trend Micro Inc.)

DRV:64bit: - (tmevtmgr) -- C:\Windows\SysNative\drivers\tmevtmgr.sys (Trend Micro Inc.)

DRV:64bit: - (ewusbnet) -- C:\Windows\SysNative\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (L1C) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)

DRV:64bit: - (AmUStor) -- C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)

DRV:64bit: - (tcpipBM) -- C:\Windows\SysNative\drivers\tcpipBM.sys (Bytemobile, Inc.)

DRV:64bit: - (BMLoad) -- C:\Windows\SysNative\drivers\BMLoad.sys (Bytemobile, Inc.)

DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (ksaud) -- C:\Windows\SysNative\drivers\ksaud.sys (Creative Technology Ltd.)

DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( )

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (hwusbfake) -- C:\Windows\SysNative\drivers\ewusbfake.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)

DRV:64bit: - (SaiH0C2D) -- C:\Windows\SysNative\drivers\SaiH0C2D.sys (Saitek)

DRV - (ATKWMIACPIIO) -- C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys (ASUS)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =  127.0.0.1;*.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledAddons: fmdownloader@gmail.com:1.0.0

FF - prefs.js..extensions.enabledAddons: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.10

FF - prefs.js..extensions.enabledAddons: stealthyextension@gmail.com:2.3.3

FF - prefs.js..network.proxy.http: "93.123.45.23"

FF - prefs.js..network.proxy.http_port: 8008

FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co"

FF - prefs.js..network.proxy.share_proxy_settings: true

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\ [2011.04.13 04:51:50 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\fmdownloader@gmail.com: C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\ [2011.12.31 17:31:53 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\ff-bmboc@bytemobile.com: C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.10 20:24:41 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.10 20:24:41 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2012.07.07 18:23:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\Extensions

[2012.10.22 17:42:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\Firefox\Profiles\m17vktlk.default\extensions

[2012.09.16 22:31:12 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Hannes\AppData\Roaming\mozilla\Firefox\Profiles\m17vktlk.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2012.10.22 17:42:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\Firefox\Profiles\m17vktlk.default\extensions\staged

[2012.10.12 01:41:01 | 000,184,864 | ---- | M] () (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\firefox\profiles\m17vktlk.default\extensions\stealthyextension@gmail.com.xpi

[2012.10.01 01:08:24 | 000,199,396 | ---- | M] () (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\firefox\profiles\m17vktlk.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi

[2012.10.22 17:42:34 | 000,183,174 | ---- | M] () (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\firefox\profiles\m17vktlk.default\extensions\staged\stealthyextension@gmail.com.xpi

[2012.09.10 20:24:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.09.10 20:24:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

[2011.12.31 17:31:53 | 000,000,000 | ---D | M] (Freemake Video Downloader Plugin) -- C:\PROGRAM FILES (X86)\FREEMAKE\FREEMAKE VIDEO DOWNLOADER\BROWSERPLUGIN\FIREFOX

[2012.09.10 20:24:41 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.06.28 20:22:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.08.30 20:10:33 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.06.28 20:22:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.06.28 20:22:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.06.28 20:22:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.06.28 20:22:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)

O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)

O2:64bit: - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)

O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)

O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)

O4:64bit: - HKLM..\Run: [Creative SB Monitoring Utility] C:\Windows\SysNative\SBAVMon.dll (Creative Technology Ltd.)

O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found

O4:64bit: - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)

O4:64bit: - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\VizorShortCut.exe (Trend Micro Inc.)

O4:64bit: - HKLM..\Run: [VizorHtmlDialog.exe] C:\Program Files\Trend Micro\Titanium\UIFramework\VizorHtmlDialog.exe (Trend Micro Inc.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [ASUSPRP] C:\Program Files (x86)\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe (ecareme)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [DataCardMonitor] C:\Program Files (x86)\Telekom\InternetManager_H\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)

O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)

O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe -StartUpRun File not found

O4 - HKLM..\Run: [Nuance PDF Reader-reminder] C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - Startup: C:\Users\Hannes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Hannes\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0

O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000011 [] - C:\Windows\system32\nspj7uz8.dll File not found

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{380389F5-1978-4D2C-A1F6-97676C386414}: DhcpNameServer = 139.7.30.126 139.7.30.125

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6BDF45EB-8281-455E-BA7F-B7FBF93FE4CB}: DhcpNameServer = 192.168.1.1 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8DE7CF3B-4145-4F90-A36B-2EF8955EFA1C}: DhcpNameServer = 10.74.210.210 10.74.210.211

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AFECACB9-5D82-4CB3-99CD-0C1982721848}: DhcpNameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)

O18:64bit: - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)

O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O27:64bit: - HKLM IFEO\Utilman.exe: Debugger - C:\Windows\SysNative\cmd.exe (Microsoft Corporation)

O27 - HKLM IFEO\Utilman.exe: Debugger - C:\Windows\SysWOW64\cmd.exe (Microsoft Corporation)

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{3402b491-a745-11e1-bf6c-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{3402b491-a745-11e1-bf6c-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{3402b497-a745-11e1-bf6c-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{3402b497-a745-11e1-bf6c-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{3905068d-af84-11e1-9356-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{3905068d-af84-11e1-9356-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{5c850714-df5d-11e1-86d0-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{5c850714-df5d-11e1-86d0-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{6818d084-b314-11e1-8293-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{6818d084-b314-11e1-8293-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{ee16af77-3a34-11e1-8e6d-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{ee16af77-3a34-11e1-8e6d-14dae93eef71}\Shell\AutoRun\command - "" = F:\AutoRun.exe

O33 - MountPoints2\{ee16af84-3a34-11e1-8e6d-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{ee16af84-3a34-11e1-8e6d-14dae93eef71}\Shell\AutoRun\command - "" = F:\AutoRun.exe

O33 - MountPoints2\F\Shell - "" = AutoRun

O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

 

MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^FancyStart daemon.lnk - C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_94E3CE3704FE82FBF49A6A.exe - ()

MsConfig:64bit - StartUpReg: ASUS Screen Saver Protector - hkey= - key= - C:\Windows\AsScrPro.exe (ASUS)

MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

MsConfig:64bit - StartUpReg: HW_OPENEYE_OUC_Telekom Internet Manager - hkey= - key= - C:\Program Files (x86)\Telekom\InternetManager_H\UpdateDog\ouc.exe (Huawei Technologies Co., Ltd.)

MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)

MsConfig:64bit - StartUpReg: Media Finder - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: MobileConnect - hkey= - key= - C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)

MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)

MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)

MsConfig:64bit - StartUpReg: TrayServer - hkey= - key= - C:\PROGRA~2\MAGIX\VIDEO_~1\TrayServer.exe (MAGIX AG)

MsConfig:64bit - State: "startup" - Reg Error: Key error.

 

SafeBootMin:64bit: AppMgmt - Service

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - Service

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6558E982-9398-06B1-7453-356FDC2108EA} - Themes Setup

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {9A4E064D-CDEF-9CD4-61FF-B2B0AC8867FC} - Microsoft Windows Media Player 12.0

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codec - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.10.18 22:23:06 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.10.16 20:54:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.10.16 20:53:38 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Hannes\Desktop\esetsmartinstaller_enu.exe

[2012.10.16 09:32:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

[2012.10.15 21:24:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.10.15 21:24:36 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.10.15 20:53:32 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Hannes\Desktop\OTL.exe

[2012.10.15 18:41:47 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\Malwarebytes

[2012.10.15 18:41:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.10.15 18:41:34 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.10.15 18:41:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.10.15 18:41:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.10.15 18:08:11 | 000,000,000 | ---D | C] -- C:\PPF_Scan2

[2012.10.15 13:29:59 | 000,000,000 | ---D | C] -- C:\PPFScan

[2012.10.15 10:51:46 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\AVG2013

[2012.10.15 10:47:40 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\TuneUp Software

[2012.10.15 10:47:09 | 000,000,000 | -H-D | C] -- C:\$AVG

[2012.10.15 10:47:08 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2013

[2012.10.15 10:46:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG

[2012.10.15 10:43:15 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files

[2012.10.15 10:43:15 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Local\MFAData

[2012.10.15 10:43:15 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData

[2012.10.15 10:43:15 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Local\Avg2013

[2012.10.15 02:04:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\STOPzilla!

[2012.10.15 01:46:55 | 001,036,288 | ---- | C] (Skype Technologies S.A.) -- C:\Users\Hannes\AppData\Roaming\Vwgkgf.exe.old

[2012.10.15 00:47:33 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2012.10.15 00:47:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2012.10.15 00:47:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2012.10.05 21:45:09 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\GoforFiles

[2012.10.05 03:26:22 | 000,111,456 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgmfx64.sys

[2012.10.02 03:30:38 | 000,185,696 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys

[2012.09.25 18:56:12 | 000,000,000 | ---D | C] -- C:\Users\Hannes\Documents\Native Instruments

[2012.09.25 18:37:09 | 000,000,000 | -H-D | C] -- C:\ProgramData\{7707EA53-E29B-48FC-B28B-C8EE171EA0EB}

[2012.09.25 18:35:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Native Instruments

[2012.09.25 18:35:23 | 000,000,000 | -H-D | C] -- C:\ProgramData\{A2A4D724-2D08-46E4-BAA8-EC9EE875D133}

[2012.09.25 18:35:05 | 000,000,000 | -H-D | C] -- C:\ProgramData\{95B4F0ED-951F-4D36-B068-5EC1C4C19C14}

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Native Instruments

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Native Instruments

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\Program Files\Native Instruments

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Native Instruments

[2012.09.24 15:51:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

[2012.09.24 15:50:22 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2012.09.24 15:50:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes

[2012.09.24 15:50:22 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2012.09.24 15:50:22 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

[2012.09.24 07:58:54 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Local\ElevatedDiagnostics

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.10.22 17:12:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.10.22 16:13:13 | 000,018,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.10.22 16:13:13 | 000,018,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.10.22 16:03:27 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe

[2012.10.22 16:03:13 | 000,000,266 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job

[2012.10.22 16:03:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.10.22 16:03:05 | 3152,203,776 | -HS- | M] () -- C:\hiberfil.sys

[2012.10.17 18:29:21 | 000,538,941 | ---- | M] () -- C:\Users\Hannes\Desktop\adwcleaner.exe

[2012.10.17 18:15:17 | 010,215,277 | ---- | M] () -- C:\Users\Hannes\Desktop\prezentacja2012.ppsx

[2012.10.16 22:00:02 | 005,142,464 | ---- | M] () -- C:\Users\Hannes\Desktop\R.I.O. feat. U-Jean - Animal (PH Electro Radio Edit) (Official Video HD).mp3

[2012.10.16 20:53:38 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Hannes\Desktop\esetsmartinstaller_enu.exe

[2012.10.16 20:45:38 | 017,434,899 | ---- | M] () -- C:\Users\Hannes\Desktop\IMG_0985.MOV

[2012.10.16 09:32:34 | 000,000,983 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk

[2012.10.15 22:03:52 | 123,434,612 | ---- | M] () -- C:\Users\Hannes\Desktop\IMG_0983.mpg

[2012.10.15 21:24:38 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.10.15 20:53:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Hannes\Desktop\OTL.exe

[2012.10.15 18:41:35 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.10.15 13:29:38 | 006,170,946 | ---- | M] () -- C:\PPFScan.zip

[2012.10.15 10:53:28 | 000,001,391 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini

[2012.10.15 10:53:27 | 000,002,250 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini

[2012.10.15 10:41:04 | 000,006,904 | ---- | M] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg

[2012.10.15 01:46:58 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\56F0.exe

[2012.10.15 01:46:55 | 001,036,288 | ---- | M] (Skype Technologies S.A.) -- C:\Users\Hannes\AppData\Roaming\Vwgkgf.exe.old

[2012.10.15 01:39:47 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\C3B6.exe

[2012.10.15 00:56:33 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\2E9E.exe

[2012.10.15 00:47:33 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.10.15 00:34:26 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\EFC9.exe

[2012.10.15 00:16:11 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\3790.exe

[2012.10.14 23:54:15 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\2602.exe

[2012.10.14 22:38:02 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\5EAC.exe

[2012.10.14 22:20:15 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\1452.exe

[2012.10.14 22:02:57 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\3FD4.exe

[2012.10.12 21:32:10 | 003,255,641 | ---- | M] () -- C:\Users\Hannes\Desktop\Linkin Park - Castle of Glass.mp3

[2012.10.05 16:50:32 | 000,054,039 | ---- | M] () -- C:\Users\Hannes\.recently-used.xbel

[2012.10.05 03:26:22 | 000,111,456 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgmfx64.sys

[2012.10.02 17:35:17 | 001,531,218 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.10.02 17:35:17 | 000,666,256 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.10.02 17:35:17 | 000,628,098 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.10.02 17:35:17 | 000,134,178 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.10.02 17:35:17 | 000,110,560 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.10.02 03:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys

[2012.10.01 21:56:54 | 000,015,477 | ---- | M] () -- C:\Users\Hannes\Desktop\relativ.odt

[2012.09.29 17:17:29 | 000,283,745 | ---- | M] () -- C:\Users\Hannes\Desktop\screen_aragon.jpg

[2012.09.28 22:15:46 | 000,000,023 | ---- | M] () -- C:\Windows\Telemax.cfg

[2012.09.26 23:50:45 | 003,257,187 | ---- | M] () -- C:\Users\Hannes\Desktop\Filterfunk - S.O.S. (Message in a bottle).mp3

[2012.09.26 18:14:00 | 000,072,320 | ---- | M] () -- C:\Users\Hannes\Desktop\screen.jpg

[2012.09.25 18:37:05 | 000,001,004 | ---- | M] () -- C:\Users\Public\Desktop\Traktor 2.lnk

[2012.09.24 15:51:26 | 000,001,785 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk

 
 ========== Files Created - No Company Name ==========

 

[2012.10.17 18:29:20 | 000,538,941 | ---- | C] () -- C:\Users\Hannes\Desktop\adwcleaner.exe

[2012.10.17 18:15:04 | 010,215,277 | ---- | C] () -- C:\Users\Hannes\Desktop\prezentacja2012.ppsx

[2012.10.16 21:59:18 | 005,142,464 | ---- | C] () -- C:\Users\Hannes\Desktop\R.I.O. feat. U-Jean - Animal (PH Electro Radio Edit) (Official Video HD).mp3

[2012.10.16 21:05:12 | 017,434,899 | ---- | C] () -- C:\Users\Hannes\Desktop\IMG_0985.MOV

[2012.10.15 22:12:30 | 123,434,612 | ---- | C] () -- C:\Users\Hannes\Desktop\IMG_0983.mpg

[2012.10.15 21:24:38 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.10.15 18:41:35 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.10.15 13:29:30 | 006,170,946 | ---- | C] () -- C:\PPFScan.zip

[2012.10.15 10:47:40 | 000,000,983 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2013.lnk

[2012.10.15 03:58:59 | 000,006,904 | ---- | C] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg

[2012.10.15 01:46:58 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\56F0.exe

[2012.10.15 01:39:47 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\C3B6.exe

[2012.10.15 00:56:33 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\2E9E.exe

[2012.10.15 00:47:33 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.10.15 00:34:26 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\EFC9.exe

[2012.10.15 00:16:11 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\3790.exe

[2012.10.14 23:54:15 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\2602.exe

[2012.10.14 22:38:02 | 000,091,136 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\5EAC.exe

[2012.10.14 22:20:15 | 000,091,136 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\1452.exe

[2012.10.14 22:02:57 | 000,091,136 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\3FD4.exe

[2012.10.12 21:32:02 | 003,255,641 | ---- | C] () -- C:\Users\Hannes\Desktop\Linkin Park - Castle of Glass.mp3

[2012.10.05 16:50:32 | 000,054,039 | ---- | C] () -- C:\Users\Hannes\.recently-used.xbel

[2012.10.01 21:56:53 | 000,015,477 | ---- | C] () -- C:\Users\Hannes\Desktop\relativ.odt

[2012.09.29 17:17:28 | 000,283,745 | ---- | C] () -- C:\Users\Hannes\Desktop\screen_aragon.jpg

[2012.09.26 23:50:39 | 003,257,187 | ---- | C] () -- C:\Users\Hannes\Desktop\Filterfunk - S.O.S. (Message in a bottle).mp3

[2012.09.26 18:14:00 | 000,072,320 | ---- | C] () -- C:\Users\Hannes\Desktop\screen.jpg

[2012.09.25 18:37:05 | 000,001,004 | ---- | C] () -- C:\Users\Public\Desktop\Traktor 2.lnk

[2012.09.24 15:51:26 | 000,001,785 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk

[2012.01.01 18:36:16 | 000,001,352 | ---- | C] () -- C:\ProgramData\CfSB1090.ini

[2012.01.01 18:36:16 | 000,001,352 | ---- | C] () -- C:\ProgramData\CfSB0910.ini

[2012.01.01 18:36:16 | 000,001,302 | ---- | C] () -- C:\ProgramData\CfSB0300.ini

[2012.01.01 18:36:16 | 000,001,282 | ---- | C] () -- C:\ProgramData\CfSB0471.ini

[2012.01.01 18:36:16 | 000,001,208 | ---- | C] () -- C:\ProgramData\CfSB0490.ini

[2012.01.01 18:36:16 | 000,001,027 | ---- | C] () -- C:\ProgramData\CfSB0560.ini

[2012.01.01 18:36:16 | 000,001,026 | ---- | C] () -- C:\ProgramData\CfSB0271.ini

[2012.01.01 18:36:16 | 000,001,026 | ---- | C] () -- C:\ProgramData\CfSB0270.ini

[2011.12.28 21:58:49 | 000,001,320 | ---- | C] () -- C:\Users\Hannes\.xmlcopyeditor

[2011.12.26 11:57:01 | 001,557,912 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011.12.25 23:18:29 | 000,000,023 | ---- | C] () -- C:\Windows\AIM_LANGUAGE.INI

[2011.12.25 23:18:26 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\glut32.dll

[2011.08.01 22:10:25 | 000,014,051 | ---- | C] () -- C:\Windows\SysWow64\RaCoInst.dat

[2011.08.01 22:10:21 | 000,147,456 | ---- | C] () -- C:\Windows\SysWow64\DiagFunc.dll

[2011.08.01 22:10:21 | 000,000,451 | ---- | C] () -- C:\Windows\SysWow64\DiagFunc.ini

[2011.08.01 22:05:52 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll

[2011.05.31 05:23:33 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin

[2011.05.31 05:23:31 | 000,213,332 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin

[2011.05.31 05:23:30 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin

[2011.04.13 04:48:48 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe

[2011.02.11 23:23:34 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll

[2009.06.16 13:25:02 | 000,121,512 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2012.10.16 09:32:33 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software

[2012.10.16 09:32:33 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software

[2012.03.13 14:08:02 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\AnvSoft

[2011.12.25 20:51:53 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\ASUS WebStorage

[2012.09.24 19:47:46 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Audacity

[2012.10.15 10:51:46 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\AVG2013

[2011.12.28 19:39:50 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Capcom

[2012.10.22 16:04:34 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Dropbox

[2012.02.19 20:06:37 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\DVDVideoSoft

[2012.09.11 15:06:44 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\FileZilla

[2012.10.05 21:45:09 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\GoforFiles

[2012.10.05 16:50:32 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\gtk-2.0

[2012.08.15 10:12:55 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\MAGIX

[2011.12.27 20:35:54 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Nuance

[2012.02.26 22:03:35 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Pamela

[2012.10.05 15:01:01 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\SoftGrid Client

[2012.01.08 22:13:36 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Telekom

[2012.01.08 22:29:42 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Telekom Internet Manager

[2011.12.26 11:57:51 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TP

[2012.09.05 00:02:38 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TS3Client

[2012.10.15 10:47:40 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TuneUp Software

[2012.05.26 18:34:03 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Vodafone

[2011.12.26 15:49:02 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Windows Live Writer

[2012.09.04 23:09:21 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\XnView

[2011.12.27 20:35:51 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Zeon

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.02.02 00:49:28 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Adobe

[2012.03.13 14:08:02 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\AnvSoft

[2012.02.15 23:15:43 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Apple Computer

[2011.12.25 20:51:53 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\ASUS WebStorage

[2012.09.24 19:47:46 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Audacity

[2012.10.15 10:51:46 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\AVG2013

[2011.12.28 19:39:50 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Capcom

[2012.01.16 01:08:36 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Corel

[2012.01.02 17:57:40 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Creative

[2011.12.28 18:52:16 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\CyberLink

[2012.10.22 16:04:34 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Dropbox

[2012.09.23 22:59:43 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\dvdcss

[2012.02.19 20:06:37 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\DVDVideoSoft

[2012.09.11 15:06:44 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\FileZilla

[2011.12.27 20:35:55 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\FLEXnet

[2012.10.05 21:45:09 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\GoforFiles

[2012.10.05 16:50:32 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\gtk-2.0

[2011.12.25 19:48:52 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Identities

[2011.12.25 20:30:23 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Macromedia

[2012.08.15 10:12:55 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\MAGIX

[2012.10.15 18:41:47 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Malwarebytes

[2009.07.14 09:44:38 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Media Center Programs

[2012.09.21 13:44:13 | 000,000,000 | --SD | M] -- C:\Users\Hannes\AppData\Roaming\Microsoft

[2012.05.28 16:50:06 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\mIRC

[2011.12.25 21:40:37 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Mozilla

[2011.12.27 20:35:54 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Nuance

[2012.02.26 22:03:35 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Pamela

[2012.10.22 17:45:59 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Skype

[2012.10.05 15:01:01 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\SoftGrid Client

[2012.01.08 22:13:36 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Telekom

[2012.01.08 22:29:42 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Telekom Internet Manager

[2011.12.26 11:57:51 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TP

[2012.09.05 00:02:38 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TS3Client

[2012.10.15 10:47:40 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TuneUp Software

[2012.10.19 15:15:45 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\vlc

[2012.05.26 18:34:03 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Vodafone

[2011.12.26 15:49:02 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Windows Live Writer

[2011.12.26 22:11:56 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\WinRAR

[2012.09.04 23:09:21 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\XnView

[2011.12.27 20:35:51 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Zeon

 
 < %APPDATA%\*.exe /s >

[2012.10.14 22:20:15 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\1452.exe

[2012.10.14 23:54:15 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\2602.exe

[2012.10.15 00:56:33 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\2E9E.exe

[2012.10.15 00:16:11 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\3790.exe

[2012.10.14 22:02:57 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\3FD4.exe

[2012.10.15 01:46:58 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\56F0.exe

[2012.10.14 22:38:02 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\5EAC.exe

[2012.10.15 01:39:47 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\C3B6.exe

[2012.10.15 00:34:26 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\EFC9.exe

[2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\Hannes\AppData\Roaming\Dropbox\bin\Dropbox.exe

[2012.05.24 20:39:24 | 000,872,144 | ---- | M] (Dropbox, Inc.) -- C:\Users\Hannes\AppData\Roaming\Dropbox\bin\DropboxUpdateHelper.exe

[2012.05.24 20:39:56 | 000,177,280 | ---- | M] (Dropbox, Inc.) -- C:\Users\Hannes\AppData\Roaming\Dropbox\bin\Uninstall.exe

[2010.01.07 15:35:18 | 001,007,616 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\Hannes\AppData\Roaming\Telekom Internet Manager\LiveUpdate.exe

[2009.12.31 15:13:52 | 000,110,592 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\Hannes\AppData\Roaming\Telekom Internet Manager\ouc.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2010.11.05 17:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\eSupport\eDriver\Software\Others\Intel\IRST\Vista64_Win7_64_10.1.0.1008\iaStor.sys

[2010.11.05 17:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\SysNative\drivers\iaStor.sys

[2010.11.05 17:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_710b330fb3531234\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 15:33:40 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 15:33:40 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010.11.20 15:27:24 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.20 15:27:24 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 14:20:30 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.20 14:20:30 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 15:33:50 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 15:33:50 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010.11.20 14:21:06 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.20 14:21:06 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 15:27:26 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.20 15:27:26 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.20 14:08:58 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.20 14:08:58 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010.11.20 15:27:28 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.20 15:27:28 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 14:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010.11.20 15:25:26 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 15:25:26 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.20 15:25:32 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 15:25:32 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2012.09.07 17:04:42 | 000,218,696 | ---- | M] () MD5=4E0D8C9F83B7FD82393F7D8CCC27E7AE -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2009.07.14 03:15:21 | 000,462,848 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\FirewallAPI.dll

[2012.08.24 09:03:49 | 009,738,240 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\ieframe.dll

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 173 bytes -> C:\ProgramData\Temp:FB1B13D8

@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:52DBE86F
 

< End of report >

LSP-Fix

Bitte downloade dir LSPFix

Speichere die Datei auf dem Desktop.
Starte die LSPFix.exe.
Markiere die Box "I know what I'm doing"
In der Keep Box solltest eine oder mehrere dieser nspj7uz8.dll Dateien finden.
Wähle jede einzelne vorhandene nspj7uz8.dll und verschiebe diese in die Remove Box indem du den >> Button drückst.
Wenn alle Dateien verschoben wurden klicke Finish>>.

War genau eine Datei mit diesem Namen.

Zitat:

Repairs complete.

1 NameSpace provider entries removed.

Mach bitte einen (neuen) CustomScan mit OTL - das Log davon nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Code:

OTL logfile created on: 23.10.2012 17:33:43 - Run 5

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Hannes\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,91 Gb Total Physical Memory | 2,14 Gb Available Physical Memory | 54,76% Memory free

7,83 Gb Paging File | 5,59 Gb Available in Paging File | 71,40% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 119,24 Gb Total Space | 18,55 Gb Free Space | 15,55% Space Free | Partition Type: NTFS

Drive D: | 153,85 Gb Total Space | 146,72 Gb Free Space | 95,36% Space Free | Partition Type: NTFS

Drive H: | 298,05 Gb Total Space | 82,68 Gb Free Space | 27,74% Space Free | Partition Type: FAT32

 

Computer Name: KIELBASSA | User Name: Hannes | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Hannes\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgcfgex.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Users\Hannes\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

PRC - C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe (Microsoft)

PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)

PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)

PRC - C:\Windows\AsScrPro.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)

PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()

PRC - C:\ProgramData\DatacardService\DCSHelper.exe (Huawei Technologies Co., Ltd.)

PRC - C:\ProgramData\DatacardService\DCService.exe ()

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)

PRC - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()

MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()

MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll ()

MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll ()

MOD - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - (Amsp) -- C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found

SRV:64bit: - (NIHardwareService) -- C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe (Native Instruments GmbH)

SRV:64bit: - (AFBAgent) -- C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)

SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)

SRV:64bit: - (TiMiniService) -- C:\Program Files\Trend Micro\Titanium\TiMiniService.exe (Trend Micro Inc.)

SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (avgwd) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

SRV - (AVGIDSAgent) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)

SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)

SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)

SRV - (FreemakeVideoCapture) -- C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe (Microsoft)

SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)

SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)

SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)

SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)

SRV - (DCService.exe) -- C:\ProgramData\DatacardService\DCService.exe ()

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)

SRV - (VMCService) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)

SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (Avgmfx64) -- C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgldx64) -- C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgtdia) -- C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgloga) -- C:\Windows\SysNative\drivers\avgloga.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (AVGIDSHA) -- C:\Windows\SysNative\drivers\avgidsha.sys (AVG Technologies CZ, s.r.o. )

DRV:64bit: - (Avgrkx64) -- C:\Windows\SysNative\drivers\avgrkx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (AVGIDSDriver) -- C:\Windows\SysNative\drivers\avgidsdrivera.sys (AVG Technologies CZ, s.r.o. )

DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)

DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)

DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)

DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)

DRV:64bit: - (Netaapl) -- C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (npf) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronics Corp.)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)

DRV:64bit: - (netr28x) -- C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)

DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)

DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)

DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)

DRV:64bit: - (tmcomm) -- C:\Windows\SysNative\drivers\tmcomm.sys (Trend Micro Inc.)

DRV:64bit: - (tmtdi) -- C:\Windows\SysNative\drivers\tmtdi.sys (Trend Micro Inc.)

DRV:64bit: - (tmactmon) -- C:\Windows\SysNative\drivers\tmactmon.sys (Trend Micro Inc.)

DRV:64bit: - (tmevtmgr) -- C:\Windows\SysNative\drivers\tmevtmgr.sys (Trend Micro Inc.)

DRV:64bit: - (ewusbnet) -- C:\Windows\SysNative\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (L1C) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)

DRV:64bit: - (AmUStor) -- C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)

DRV:64bit: - (tcpipBM) -- C:\Windows\SysNative\drivers\tcpipBM.sys (Bytemobile, Inc.)

DRV:64bit: - (BMLoad) -- C:\Windows\SysNative\drivers\BMLoad.sys (Bytemobile, Inc.)

DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (ksaud) -- C:\Windows\SysNative\drivers\ksaud.sys (Creative Technology Ltd.)

DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( )

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (hwusbfake) -- C:\Windows\SysNative\drivers\ewusbfake.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)

DRV:64bit: - (SaiH0C2D) -- C:\Windows\SysNative\drivers\SaiH0C2D.sys (Saitek)

DRV - (ATKWMIACPIIO) -- C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys (ASUS)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =  127.0.0.1;*.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledAddons: fmdownloader@gmail.com:1.0.0

FF - prefs.js..extensions.enabledAddons: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.10

FF - prefs.js..extensions.enabledAddons: stealthyextension@gmail.com:2.4

FF - prefs.js..network.proxy.http: "93.123.45.23"

FF - prefs.js..network.proxy.http_port: 8008

FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co"

FF - prefs.js..network.proxy.share_proxy_settings: true

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\ [2011.04.13 04:51:50 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\fmdownloader@gmail.com: C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\ [2011.12.31 17:31:53 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\ff-bmboc@bytemobile.com: C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.10 20:24:41 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.10 20:24:41 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2012.07.07 18:23:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\Extensions

[2012.10.22 18:24:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\Firefox\Profiles\m17vktlk.default\extensions

[2012.09.16 22:31:12 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Hannes\AppData\Roaming\mozilla\Firefox\Profiles\m17vktlk.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2012.10.22 18:24:01 | 000,183,174 | ---- | M] () (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\firefox\profiles\m17vktlk.default\extensions\stealthyextension@gmail.com.xpi

[2012.10.01 01:08:24 | 000,199,396 | ---- | M] () (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\firefox\profiles\m17vktlk.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi

[2012.09.10 20:24:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.09.10 20:24:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

[2011.12.31 17:31:53 | 000,000,000 | ---D | M] (Freemake Video Downloader Plugin) -- C:\PROGRAM FILES (X86)\FREEMAKE\FREEMAKE VIDEO DOWNLOADER\BROWSERPLUGIN\FIREFOX

[2012.09.10 20:24:41 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.06.28 20:22:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.08.30 20:10:33 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.06.28 20:22:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.06.28 20:22:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.06.28 20:22:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.06.28 20:22:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)

O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)

O2:64bit: - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)

O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)

O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)

O4:64bit: - HKLM..\Run: [Creative SB Monitoring Utility] C:\Windows\SysNative\SBAVMon.dll (Creative Technology Ltd.)

O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found

O4:64bit: - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)

O4:64bit: - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\VizorShortCut.exe (Trend Micro Inc.)

O4:64bit: - HKLM..\Run: [VizorHtmlDialog.exe] C:\Program Files\Trend Micro\Titanium\UIFramework\VizorHtmlDialog.exe (Trend Micro Inc.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [ASUSPRP] C:\Program Files (x86)\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe (ecareme)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [DataCardMonitor] C:\Program Files (x86)\Telekom\InternetManager_H\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)

O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)

O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe -StartUpRun File not found

O4 - HKLM..\Run: [Nuance PDF Reader-reminder] C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - Startup: C:\Users\Hannes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Hannes\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0

O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{380389F5-1978-4D2C-A1F6-97676C386414}: DhcpNameServer = 139.7.30.126 139.7.30.125

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6BDF45EB-8281-455E-BA7F-B7FBF93FE4CB}: DhcpNameServer = 192.168.1.1 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8DE7CF3B-4145-4F90-A36B-2EF8955EFA1C}: DhcpNameServer = 10.74.210.210 10.74.210.211

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AFECACB9-5D82-4CB3-99CD-0C1982721848}: DhcpNameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)

O18:64bit: - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)

O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O27:64bit: - HKLM IFEO\Utilman.exe: Debugger - C:\Windows\SysNative\cmd.exe (Microsoft Corporation)

O27 - HKLM IFEO\Utilman.exe: Debugger - C:\Windows\SysWOW64\cmd.exe (Microsoft Corporation)

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{3402b491-a745-11e1-bf6c-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{3402b491-a745-11e1-bf6c-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{3402b497-a745-11e1-bf6c-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{3402b497-a745-11e1-bf6c-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{3905068d-af84-11e1-9356-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{3905068d-af84-11e1-9356-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{5c850714-df5d-11e1-86d0-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{5c850714-df5d-11e1-86d0-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{6818d084-b314-11e1-8293-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{6818d084-b314-11e1-8293-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{ee16af77-3a34-11e1-8e6d-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{ee16af77-3a34-11e1-8e6d-14dae93eef71}\Shell\AutoRun\command - "" = F:\AutoRun.exe

O33 - MountPoints2\{ee16af84-3a34-11e1-8e6d-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{ee16af84-3a34-11e1-8e6d-14dae93eef71}\Shell\AutoRun\command - "" = F:\AutoRun.exe

O33 - MountPoints2\F\Shell - "" = AutoRun

O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

 

MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^FancyStart daemon.lnk - C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_94E3CE3704FE82FBF49A6A.exe - ()

MsConfig:64bit - StartUpReg: ASUS Screen Saver Protector - hkey= - key= - C:\Windows\AsScrPro.exe (ASUS)

MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

MsConfig:64bit - StartUpReg: HW_OPENEYE_OUC_Telekom Internet Manager - hkey= - key= - C:\Program Files (x86)\Telekom\InternetManager_H\UpdateDog\ouc.exe (Huawei Technologies Co., Ltd.)

MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)

MsConfig:64bit - StartUpReg: Media Finder - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: MobileConnect - hkey= - key= - C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)

MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)

MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)

MsConfig:64bit - StartUpReg: TrayServer - hkey= - key= - C:\PROGRA~2\MAGIX\VIDEO_~1\TrayServer.exe (MAGIX AG)

MsConfig:64bit - State: "startup" - Reg Error: Key error.

 

SafeBootMin:64bit: AppMgmt - Service

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - Service

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6558E982-9398-06B1-7453-356FDC2108EA} - Themes Setup

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {9A4E064D-CDEF-9CD4-61FF-B2B0AC8867FC} - Microsoft Windows Media Player 12.0

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codec - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.10.22 22:09:35 | 000,186,880 | ---- | C] (CEXX.ORG) -- C:\Users\Hannes\Desktop\LSPFix.exe

[2012.10.18 22:23:06 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.10.16 20:54:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.10.16 20:53:38 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Hannes\Desktop\esetsmartinstaller_enu.exe

[2012.10.16 09:32:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

[2012.10.15 21:24:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.10.15 21:24:36 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.10.15 20:53:32 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Hannes\Desktop\OTL.exe

[2012.10.15 18:41:47 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\Malwarebytes

[2012.10.15 18:41:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.10.15 18:41:34 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.10.15 18:41:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.10.15 18:41:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.10.15 18:08:11 | 000,000,000 | ---D | C] -- C:\PPF_Scan2

[2012.10.15 13:29:59 | 000,000,000 | ---D | C] -- C:\PPFScan

[2012.10.15 10:51:46 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\AVG2013

[2012.10.15 10:47:40 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\TuneUp Software

[2012.10.15 10:47:09 | 000,000,000 | -H-D | C] -- C:\$AVG

[2012.10.15 10:47:08 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2013

[2012.10.15 10:46:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG

[2012.10.15 10:43:15 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files

[2012.10.15 10:43:15 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Local\MFAData

[2012.10.15 10:43:15 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData

[2012.10.15 10:43:15 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Local\Avg2013

[2012.10.15 02:04:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\STOPzilla!

[2012.10.15 01:46:55 | 001,036,288 | ---- | C] (Skype Technologies S.A.) -- C:\Users\Hannes\AppData\Roaming\Vwgkgf.exe.old

[2012.10.15 00:47:33 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2012.10.15 00:47:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2012.10.15 00:47:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2012.10.05 21:45:09 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\GoforFiles

[2012.10.05 03:26:22 | 000,111,456 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgmfx64.sys

[2012.10.02 03:30:38 | 000,185,696 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys

[2012.09.25 18:56:12 | 000,000,000 | ---D | C] -- C:\Users\Hannes\Documents\Native Instruments

[2012.09.25 18:37:09 | 000,000,000 | -H-D | C] -- C:\ProgramData\{7707EA53-E29B-48FC-B28B-C8EE171EA0EB}

[2012.09.25 18:35:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Native Instruments

[2012.09.25 18:35:23 | 000,000,000 | -H-D | C] -- C:\ProgramData\{A2A4D724-2D08-46E4-BAA8-EC9EE875D133}

[2012.09.25 18:35:05 | 000,000,000 | -H-D | C] -- C:\ProgramData\{95B4F0ED-951F-4D36-B068-5EC1C4C19C14}

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Native Instruments

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Native Instruments

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\Program Files\Native Instruments

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Native Instruments

[2012.09.24 15:51:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

[2012.09.24 15:50:22 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2012.09.24 15:50:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes

[2012.09.24 15:50:22 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2012.09.24 15:50:22 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

[2012.09.24 07:58:54 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Local\ElevatedDiagnostics

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.10.23 17:12:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.10.23 10:55:00 | 000,000,266 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job

[2012.10.22 22:09:35 | 000,186,880 | ---- | M] (CEXX.ORG) -- C:\Users\Hannes\Desktop\LSPFix.exe

[2012.10.22 16:13:13 | 000,018,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.10.22 16:13:13 | 000,018,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.10.22 16:03:27 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe

[2012.10.22 16:03:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.10.22 16:03:05 | 3152,203,776 | -HS- | M] () -- C:\hiberfil.sys

[2012.10.17 18:29:21 | 000,538,941 | ---- | M] () -- C:\Users\Hannes\Desktop\adwcleaner.exe

[2012.10.17 18:15:17 | 010,215,277 | ---- | M] () -- C:\Users\Hannes\Desktop\prezentacja2012.ppsx

[2012.10.16 22:00:02 | 005,142,464 | ---- | M] () -- C:\Users\Hannes\Desktop\R.I.O. feat. U-Jean - Animal (PH Electro Radio Edit) (Official Video HD).mp3

[2012.10.16 20:53:38 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Hannes\Desktop\esetsmartinstaller_enu.exe

[2012.10.16 20:45:38 | 017,434,899 | ---- | M] () -- C:\Users\Hannes\Desktop\IMG_0985.MOV

[2012.10.16 09:32:34 | 000,000,983 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk

[2012.10.15 22:03:52 | 123,434,612 | ---- | M] () -- C:\Users\Hannes\Desktop\IMG_0983.mpg

[2012.10.15 21:24:38 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.10.15 20:53:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Hannes\Desktop\OTL.exe

[2012.10.15 18:41:35 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.10.15 13:29:38 | 006,170,946 | ---- | M] () -- C:\PPFScan.zip

[2012.10.15 10:53:28 | 000,001,391 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini

[2012.10.15 10:53:27 | 000,002,250 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini

[2012.10.15 10:41:04 | 000,006,904 | ---- | M] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg

[2012.10.15 01:46:58 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\56F0.exe

[2012.10.15 01:46:55 | 001,036,288 | ---- | M] (Skype Technologies S.A.) -- C:\Users\Hannes\AppData\Roaming\Vwgkgf.exe.old

[2012.10.15 01:39:47 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\C3B6.exe

[2012.10.15 00:56:33 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\2E9E.exe

[2012.10.15 00:47:33 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.10.15 00:34:26 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\EFC9.exe

[2012.10.15 00:16:11 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\3790.exe

[2012.10.14 23:54:15 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\2602.exe

[2012.10.14 22:38:02 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\5EAC.exe

[2012.10.14 22:20:15 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\1452.exe

[2012.10.14 22:02:57 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\3FD4.exe

[2012.10.12 21:32:10 | 003,255,641 | ---- | M] () -- C:\Users\Hannes\Desktop\Linkin Park - Castle of Glass.mp3

[2012.10.05 16:50:32 | 000,054,039 | ---- | M] () -- C:\Users\Hannes\.recently-used.xbel

[2012.10.05 03:26:22 | 000,111,456 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgmfx64.sys

[2012.10.02 17:35:17 | 001,531,218 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.10.02 17:35:17 | 000,666,256 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.10.02 17:35:17 | 000,628,098 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.10.02 17:35:17 | 000,134,178 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.10.02 17:35:17 | 000,110,560 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.10.02 03:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys

[2012.10.01 21:56:54 | 000,015,477 | ---- | M] () -- C:\Users\Hannes\Desktop\relativ.odt

[2012.09.29 17:17:29 | 000,283,745 | ---- | M] () -- C:\Users\Hannes\Desktop\screen_aragon.jpg

[2012.09.28 22:15:46 | 000,000,023 | ---- | M] () -- C:\Windows\Telemax.cfg

[2012.09.26 23:50:45 | 003,257,187 | ---- | M] () -- C:\Users\Hannes\Desktop\Filterfunk - S.O.S. (Message in a bottle).mp3

[2012.09.26 18:14:00 | 000,072,320 | ---- | M] () -- C:\Users\Hannes\Desktop\screen.jpg

[2012.09.25 18:37:05 | 000,001,004 | ---- | M] () -- C:\Users\Public\Desktop\Traktor 2.lnk

[2012.09.24 15:51:26 | 000,001,785 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk

 
 ========== Files Created - No Company Name ==========

 

[2012.10.17 18:29:20 | 000,538,941 | ---- | C] () -- C:\Users\Hannes\Desktop\adwcleaner.exe

[2012.10.17 18:15:04 | 010,215,277 | ---- | C] () -- C:\Users\Hannes\Desktop\prezentacja2012.ppsx

[2012.10.16 21:59:18 | 005,142,464 | ---- | C] () -- C:\Users\Hannes\Desktop\R.I.O. feat. U-Jean - Animal (PH Electro Radio Edit) (Official Video HD).mp3

[2012.10.16 21:05:12 | 017,434,899 | ---- | C] () -- C:\Users\Hannes\Desktop\IMG_0985.MOV

[2012.10.15 22:12:30 | 123,434,612 | ---- | C] () -- C:\Users\Hannes\Desktop\IMG_0983.mpg

[2012.10.15 21:24:38 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.10.15 18:41:35 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.10.15 13:29:30 | 006,170,946 | ---- | C] () -- C:\PPFScan.zip

[2012.10.15 10:47:40 | 000,000,983 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2013.lnk

[2012.10.15 03:58:59 | 000,006,904 | ---- | C] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg

[2012.10.15 01:46:58 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\56F0.exe

[2012.10.15 01:39:47 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\C3B6.exe

[2012.10.15 00:56:33 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\2E9E.exe

[2012.10.15 00:47:33 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.10.15 00:34:26 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\EFC9.exe

[2012.10.15 00:16:11 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\3790.exe

[2012.10.14 23:54:15 | 000,076,288 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\2602.exe

[2012.10.14 22:38:02 | 000,091,136 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\5EAC.exe

[2012.10.14 22:20:15 | 000,091,136 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\1452.exe

[2012.10.14 22:02:57 | 000,091,136 | ---- | C] () -- C:\Users\Hannes\AppData\Roaming\3FD4.exe

[2012.10.12 21:32:02 | 003,255,641 | ---- | C] () -- C:\Users\Hannes\Desktop\Linkin Park - Castle of Glass.mp3

[2012.10.05 16:50:32 | 000,054,039 | ---- | C] () -- C:\Users\Hannes\.recently-used.xbel

[2012.10.01 21:56:53 | 000,015,477 | ---- | C] () -- C:\Users\Hannes\Desktop\relativ.odt

[2012.09.29 17:17:28 | 000,283,745 | ---- | C] () -- C:\Users\Hannes\Desktop\screen_aragon.jpg

[2012.09.26 23:50:39 | 003,257,187 | ---- | C] () -- C:\Users\Hannes\Desktop\Filterfunk - S.O.S. (Message in a bottle).mp3

[2012.09.26 18:14:00 | 000,072,320 | ---- | C] () -- C:\Users\Hannes\Desktop\screen.jpg

[2012.09.25 18:37:05 | 000,001,004 | ---- | C] () -- C:\Users\Public\Desktop\Traktor 2.lnk

[2012.09.24 15:51:26 | 000,001,785 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk

[2012.01.01 18:36:16 | 000,001,352 | ---- | C] () -- C:\ProgramData\CfSB1090.ini

[2012.01.01 18:36:16 | 000,001,352 | ---- | C] () -- C:\ProgramData\CfSB0910.ini

[2012.01.01 18:36:16 | 000,001,302 | ---- | C] () -- C:\ProgramData\CfSB0300.ini

[2012.01.01 18:36:16 | 000,001,282 | ---- | C] () -- C:\ProgramData\CfSB0471.ini

[2012.01.01 18:36:16 | 000,001,208 | ---- | C] () -- C:\ProgramData\CfSB0490.ini

[2012.01.01 18:36:16 | 000,001,027 | ---- | C] () -- C:\ProgramData\CfSB0560.ini

[2012.01.01 18:36:16 | 000,001,026 | ---- | C] () -- C:\ProgramData\CfSB0271.ini

[2012.01.01 18:36:16 | 000,001,026 | ---- | C] () -- C:\ProgramData\CfSB0270.ini

[2011.12.28 21:58:49 | 000,001,320 | ---- | C] () -- C:\Users\Hannes\.xmlcopyeditor

[2011.12.26 11:57:01 | 001,557,912 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011.12.25 23:18:29 | 000,000,023 | ---- | C] () -- C:\Windows\AIM_LANGUAGE.INI

[2011.12.25 23:18:26 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\glut32.dll

[2011.08.01 22:10:25 | 000,014,051 | ---- | C] () -- C:\Windows\SysWow64\RaCoInst.dat

[2011.08.01 22:10:21 | 000,147,456 | ---- | C] () -- C:\Windows\SysWow64\DiagFunc.dll

[2011.08.01 22:10:21 | 000,000,451 | ---- | C] () -- C:\Windows\SysWow64\DiagFunc.ini

[2011.08.01 22:05:52 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll

[2011.05.31 05:23:33 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin

[2011.05.31 05:23:31 | 000,213,332 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin

[2011.05.31 05:23:30 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin

[2011.04.13 04:48:48 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe

[2011.02.11 23:23:34 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll

[2009.06.16 13:25:02 | 000,121,512 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2012.10.16 09:32:33 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software

[2012.10.16 09:32:33 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software

[2012.03.13 14:08:02 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\AnvSoft

[2011.12.25 20:51:53 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\ASUS WebStorage

[2012.09.24 19:47:46 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Audacity

[2012.10.15 10:51:46 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\AVG2013

[2011.12.28 19:39:50 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Capcom

[2012.10.22 16:04:34 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Dropbox

[2012.02.19 20:06:37 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\DVDVideoSoft

[2012.09.11 15:06:44 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\FileZilla

[2012.10.05 21:45:09 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\GoforFiles

[2012.10.05 16:50:32 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\gtk-2.0

[2012.08.15 10:12:55 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\MAGIX

[2011.12.27 20:35:54 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Nuance

[2012.02.26 22:03:35 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Pamela

[2012.10.05 15:01:01 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\SoftGrid Client

[2012.01.08 22:13:36 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Telekom

[2012.01.08 22:29:42 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Telekom Internet Manager

[2011.12.26 11:57:51 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TP

[2012.09.05 00:02:38 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TS3Client

[2012.10.15 10:47:40 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TuneUp Software

[2012.05.26 18:34:03 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Vodafone

[2011.12.26 15:49:02 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Windows Live Writer

[2012.09.04 23:09:21 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\XnView

[2011.12.27 20:35:51 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Zeon

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.02.02 00:49:28 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Adobe

[2012.03.13 14:08:02 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\AnvSoft

[2012.02.15 23:15:43 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Apple Computer

[2011.12.25 20:51:53 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\ASUS WebStorage

[2012.09.24 19:47:46 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Audacity

[2012.10.15 10:51:46 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\AVG2013

[2011.12.28 19:39:50 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Capcom

[2012.01.16 01:08:36 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Corel

[2012.01.02 17:57:40 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Creative

[2011.12.28 18:52:16 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\CyberLink

[2012.10.22 16:04:34 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Dropbox

[2012.09.23 22:59:43 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\dvdcss

[2012.02.19 20:06:37 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\DVDVideoSoft

[2012.09.11 15:06:44 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\FileZilla

[2011.12.27 20:35:55 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\FLEXnet

[2012.10.05 21:45:09 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\GoforFiles

[2012.10.05 16:50:32 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\gtk-2.0

[2011.12.25 19:48:52 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Identities

[2011.12.25 20:30:23 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Macromedia

[2012.08.15 10:12:55 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\MAGIX

[2012.10.15 18:41:47 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Malwarebytes

[2009.07.14 09:44:38 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Media Center Programs

[2012.09.21 13:44:13 | 000,000,000 | --SD | M] -- C:\Users\Hannes\AppData\Roaming\Microsoft

[2012.05.28 16:50:06 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\mIRC

[2011.12.25 21:40:37 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Mozilla

[2011.12.27 20:35:54 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Nuance

[2012.02.26 22:03:35 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Pamela

[2012.10.23 17:32:24 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Skype

[2012.10.05 15:01:01 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\SoftGrid Client

[2012.01.08 22:13:36 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Telekom

[2012.01.08 22:29:42 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Telekom Internet Manager

[2011.12.26 11:57:51 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TP

[2012.09.05 00:02:38 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TS3Client

[2012.10.15 10:47:40 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TuneUp Software

[2012.10.23 17:17:09 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\vlc

[2012.05.26 18:34:03 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Vodafone

[2011.12.26 15:49:02 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Windows Live Writer

[2011.12.26 22:11:56 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\WinRAR

[2012.09.04 23:09:21 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\XnView

[2011.12.27 20:35:51 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Zeon

 
 < %APPDATA%\*.exe /s >

[2012.10.14 22:20:15 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\1452.exe

[2012.10.14 23:54:15 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\2602.exe

[2012.10.15 00:56:33 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\2E9E.exe

[2012.10.15 00:16:11 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\3790.exe

[2012.10.14 22:02:57 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\3FD4.exe

[2012.10.15 01:46:58 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\56F0.exe

[2012.10.14 22:38:02 | 000,091,136 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\5EAC.exe

[2012.10.15 01:39:47 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\C3B6.exe

[2012.10.15 00:34:26 | 000,076,288 | ---- | M] () -- C:\Users\Hannes\AppData\Roaming\EFC9.exe

[2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\Hannes\AppData\Roaming\Dropbox\bin\Dropbox.exe

[2012.05.24 20:39:24 | 000,872,144 | ---- | M] (Dropbox, Inc.) -- C:\Users\Hannes\AppData\Roaming\Dropbox\bin\DropboxUpdateHelper.exe

[2012.05.24 20:39:56 | 000,177,280 | ---- | M] (Dropbox, Inc.) -- C:\Users\Hannes\AppData\Roaming\Dropbox\bin\Uninstall.exe

[2010.01.07 15:35:18 | 001,007,616 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\Hannes\AppData\Roaming\Telekom Internet Manager\LiveUpdate.exe

[2009.12.31 15:13:52 | 000,110,592 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\Hannes\AppData\Roaming\Telekom Internet Manager\ouc.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2009.07.14 03:15:21 | 000,462,848 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\FirewallAPI.dll

[2012.08.24 09:03:49 | 009,738,240 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\ieframe.dll

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 173 bytes -> C:\ProgramData\Temp:FB1B13D8

@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:52DBE86F
 

< End of report >

Beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O27:64bit: - HKLM IFEO\Utilman.exe: Debugger - C:\Windows\SysNative\cmd.exe (Microsoft Corporation)

O27 - HKLM IFEO\Utilman.exe: Debugger - C:\Windows\SysWOW64\cmd.exe (Microsoft Corporation)

@Alternate Data Stream - 173 bytes -> C:\ProgramData\Temp:FB1B13D8

@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:52DBE86F

:Files

C:\Users\Hannes\AppData\Roaming\1452.exe

C:\Users\Hannes\AppData\Roaming\2602.exe

C:\Users\Hannes\AppData\Roaming\2E9E.exe

C:\Users\Hannes\AppData\Roaming\3790.exe

C:\Users\Hannes\AppData\Roaming\3FD4.exe

C:\Users\Hannes\AppData\Roaming\56F0.exe

C:\Users\Hannes\AppData\Roaming\5EAC.exe

C:\Users\Hannes\AppData\Roaming\C3B6.exe

C:\Users\Hannes\AppData\Roaming\EFC9.exe

C:\Users\Hannes\AppData\Roaming\Vwgkgf.exe.old

C:\Windows\tasks\AutoKMS.job

C:\Windows\SysNative\drivers\kgpcpy.cfg

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Code:

All processes killed

========== OTL ==========

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Utilman.exe\ deleted successfully.

File move failed. C:\Windows\SysNative\cmd.exe scheduled to be moved on reboot.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Utilman.exe\ not found.

File move failed. C:\Windows\SysWOW64\cmd.exe scheduled to be moved on reboot.

ADS C:\ProgramData\Temp:FB1B13D8 deleted successfully.

ADS C:\ProgramData\Temp:52DBE86F deleted successfully.

========== FILES ==========

C:\Users\Hannes\AppData\Roaming\1452.exe moved successfully.

C:\Users\Hannes\AppData\Roaming\2602.exe moved successfully.

C:\Users\Hannes\AppData\Roaming\2E9E.exe moved successfully.

C:\Users\Hannes\AppData\Roaming\3790.exe moved successfully.

C:\Users\Hannes\AppData\Roaming\3FD4.exe moved successfully.

C:\Users\Hannes\AppData\Roaming\56F0.exe moved successfully.

C:\Users\Hannes\AppData\Roaming\5EAC.exe moved successfully.

C:\Users\Hannes\AppData\Roaming\C3B6.exe moved successfully.

C:\Users\Hannes\AppData\Roaming\EFC9.exe moved successfully.

C:\Users\Hannes\AppData\Roaming\Vwgkgf.exe.old moved successfully.

C:\Windows\tasks\AutoKMS.job moved successfully.

C:\Windows\SysNative\drivers\kgpcpy.cfg moved successfully.
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Aufl”sungscache konnte nicht geleert werden: Beim Ausfhren der Funktion ist ein Fehler aufgetreten.

C:\Users\Hannes\Desktop\cmd.bat deleted successfully.

C:\Users\Hannes\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Hannes

->Temp folder emptied: 25536401 bytes

->Temporary Internet Files folder emptied: 2832438 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 778778496 bytes

->Flash cache emptied: 5682 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 8114 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes

RecycleBin emptied: 14920493 bytes

 

Total Files Cleaned = 784,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.69.0 log created on 10242012_003212
 

Files\Folders moved on Reboot...

File move failed. C:\Windows\SysNative\cmd.exe scheduled to be moved on reboot.

File move failed. C:\Windows\SysWOW64\cmd.exe scheduled to be moved on reboot.

C:\Users\Hannes\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

File\Folder C:\Users\Hannes\AppData\Local\Temp\~PI3685.tmp not found!

File\Folder C:\Users\Hannes\AppData\Local\Temp\~PIF001.tmp not found!
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Ok, bitte eine Kontrolle nach dem Fix:

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%systemdrive%\*.

%allusersprofile%\*. /s

%allusersprofile%\Application Data\*. /s

%appdata%\*. /s

%systemroot%\system32\*. /s

%systemroot%\system32\drivers\*. /s

%systemroot%\System32\config\*. /s

%systemroot%\*. /mp /s

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Mittlerweile sind bei "Hannes", wo auf C:/ die eigenen Dateien gespeichert sind, die ganzen "versteckten Ordner" wieder weg. Dort sieht es normal aus.
Auf meine externe Festplatte habe ich immer noch keinen Zugriff. (Siehe Dateianhang/ Screenshot)
Die Dateien die wir gestern mit dem Fix gelöscht haben stammen glaube ich noch aus dem ursprünglichen Virus den ich mir via Skype eingefangen habe.
Soweit meine Info.
Hier das neueste LOG File von OTL:

-Edit-
Leider musste ich diesmal das Log File auch im Anhang hochladen, da 529.237 Zeichen in diesem Beitrag bei erlaubten 120.000 zu viele sind.

-Edit2-
Ich kann sie auch nicht hochladen. Sie ist 1,01MB groß, und darf als .txt nur 97KB haben -.-
Ich werde sie jetzt in mehreren Beiträgen als (code)-Tag posten.

Code:

OTL logfile created on: 24.10.2012 19:21:15 - Run 6

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Hannes\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,91 Gb Total Physical Memory | 2,38 Gb Available Physical Memory | 60,85% Memory free

7,83 Gb Paging File | 6,21 Gb Available in Paging File | 79,31% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 119,24 Gb Total Space | 18,93 Gb Free Space | 15,87% Space Free | Partition Type: NTFS

Drive D: | 153,85 Gb Total Space | 146,72 Gb Free Space | 95,36% Space Free | Partition Type: NTFS

Drive H: | 298,05 Gb Total Space | 82,68 Gb Free Space | 27,74% Space Free | Partition Type: FAT32

 

Computer Name: KIELBASSA | User Name: Hannes | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Users\Hannes\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files (x86)\AVG\AVG2013\avgcfgex.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Users\Hannes\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

PRC - C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe (Microsoft)

PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)

PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)

PRC - C:\Windows\AsScrPro.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)

PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)

PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()

PRC - C:\ProgramData\DatacardService\DCSHelper.exe (Huawei Technologies Co., Ltd.)

PRC - C:\ProgramData\DatacardService\DCService.exe ()

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)

PRC - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()

MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll ()

MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll ()

MOD - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - (Amsp) -- C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found

SRV:64bit: - (NIHardwareService) -- C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe (Native Instruments GmbH)

SRV:64bit: - (AFBAgent) -- C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)

SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)

SRV:64bit: - (TiMiniService) -- C:\Program Files\Trend Micro\Titanium\TiMiniService.exe (Trend Micro Inc.)

SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (avgwd) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

SRV - (AVGIDSAgent) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)

SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)

SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)

SRV - (FreemakeVideoCapture) -- C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe (Microsoft)

SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)

SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)

SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)

SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)

SRV - (DCService.exe) -- C:\ProgramData\DatacardService\DCService.exe ()

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)

SRV - (VMCService) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)

SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (Avgmfx64) -- C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgldx64) -- C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgtdia) -- C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (Avgloga) -- C:\Windows\SysNative\drivers\avgloga.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (AVGIDSHA) -- C:\Windows\SysNative\drivers\avgidsha.sys (AVG Technologies CZ, s.r.o. )

DRV:64bit: - (Avgrkx64) -- C:\Windows\SysNative\drivers\avgrkx64.sys (AVG Technologies CZ, s.r.o.)

DRV:64bit: - (AVGIDSDriver) -- C:\Windows\SysNative\drivers\avgidsdrivera.sys (AVG Technologies CZ, s.r.o. )

DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)

DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)

DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)

DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)

DRV:64bit: - (Netaapl) -- C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (npf) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronics Corp.)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)

DRV:64bit: - (netr28x) -- C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)

DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)

DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)

DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)

DRV:64bit: - (tmcomm) -- C:\Windows\SysNative\drivers\tmcomm.sys (Trend Micro Inc.)

DRV:64bit: - (tmtdi) -- C:\Windows\SysNative\drivers\tmtdi.sys (Trend Micro Inc.)

DRV:64bit: - (tmactmon) -- C:\Windows\SysNative\drivers\tmactmon.sys (Trend Micro Inc.)

DRV:64bit: - (tmevtmgr) -- C:\Windows\SysNative\drivers\tmevtmgr.sys (Trend Micro Inc.)

DRV:64bit: - (ewusbnet) -- C:\Windows\SysNative\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (L1C) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)

DRV:64bit: - (AmUStor) -- C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)

DRV:64bit: - (tcpipBM) -- C:\Windows\SysNative\drivers\tcpipBM.sys (Bytemobile, Inc.)

DRV:64bit: - (BMLoad) -- C:\Windows\SysNative\drivers\BMLoad.sys (Bytemobile, Inc.)

DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (ksaud) -- C:\Windows\SysNative\drivers\ksaud.sys (Creative Technology Ltd.)

DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( )

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (hwusbfake) -- C:\Windows\SysNative\drivers\ewusbfake.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)

DRV:64bit: - (SaiH0C2D) -- C:\Windows\SysNative\drivers\SaiH0C2D.sys (Saitek)

DRV - (ATKWMIACPIIO) -- C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys (ASUS)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =  127.0.0.1;*.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledAddons: fmdownloader@gmail.com:1.0.0

FF - prefs.js..extensions.enabledAddons: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.10

FF - prefs.js..extensions.enabledAddons: stealthyextension@gmail.com:2.4

FF - prefs.js..network.proxy.http: "93.123.45.23"

FF - prefs.js..network.proxy.http_port: 8008

FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co"

FF - prefs.js..network.proxy.share_proxy_settings: true

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\ [2011.04.13 04:51:50 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\fmdownloader@gmail.com: C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\ [2011.12.31 17:31:53 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\ff-bmboc@bytemobile.com: C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.23 22:56:21 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.23 22:56:21 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2012.07.07 18:23:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\Extensions

[2012.10.23 18:07:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\Firefox\Profiles\m17vktlk.default\extensions

[2012.09.16 22:31:12 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Hannes\AppData\Roaming\mozilla\Firefox\Profiles\m17vktlk.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2012.10.22 18:24:01 | 000,183,174 | ---- | M] () (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\firefox\profiles\m17vktlk.default\extensions\stealthyextension@gmail.com.xpi

[2012.10.01 01:08:24 | 000,199,396 | ---- | M] () (No name found) -- C:\Users\Hannes\AppData\Roaming\mozilla\firefox\profiles\m17vktlk.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi

[2012.10.23 22:56:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.10.23 22:56:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

[2011.12.31 17:31:53 | 000,000,000 | ---D | M] (Freemake Video Downloader Plugin) -- C:\PROGRAM FILES (X86)\FREEMAKE\FREEMAKE VIDEO DOWNLOADER\BROWSERPLUGIN\FIREFOX

[2012.10.23 22:56:21 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.06.28 20:22:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.08.30 20:10:33 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.06.28 20:22:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.06.28 20:22:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.06.28 20:22:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.06.28 20:22:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2012.10.24 00:34:13 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2:64bit: - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)

O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)

O2:64bit: - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)

O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)

O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)

O4:64bit: - HKLM..\Run: [Creative SB Monitoring Utility] C:\Windows\SysNative\SBAVMon.dll (Creative Technology Ltd.)

O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found

O4:64bit: - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)

O4:64bit: - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\VizorShortCut.exe (Trend Micro Inc.)

O4:64bit: - HKLM..\Run: [VizorHtmlDialog.exe] C:\Program Files\Trend Micro\Titanium\UIFramework\VizorHtmlDialog.exe (Trend Micro Inc.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [ASUSPRP] C:\Program Files (x86)\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe (ecareme)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [DataCardMonitor] C:\Program Files (x86)\Telekom\InternetManager_H\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)

O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)

O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe -StartUpRun File not found

O4 - HKLM..\Run: [Nuance PDF Reader-reminder] C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - Startup: C:\Users\Hannes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Hannes\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKU\S-1-5-21-3038508100-2890377417-1923366057-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0

O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{380389F5-1978-4D2C-A1F6-97676C386414}: DhcpNameServer = 139.7.30.126 139.7.30.125

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6BDF45EB-8281-455E-BA7F-B7FBF93FE4CB}: DhcpNameServer = 192.168.1.1 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8DE7CF3B-4145-4F90-A36B-2EF8955EFA1C}: DhcpNameServer = 10.74.210.210 10.74.210.211

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AFECACB9-5D82-4CB3-99CD-0C1982721848}: DhcpNameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)

O18:64bit: - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)

O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{3402b491-a745-11e1-bf6c-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{3402b491-a745-11e1-bf6c-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{3402b497-a745-11e1-bf6c-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{3402b497-a745-11e1-bf6c-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{3905068d-af84-11e1-9356-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{3905068d-af84-11e1-9356-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{5c850714-df5d-11e1-86d0-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{5c850714-df5d-11e1-86d0-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{6818d084-b314-11e1-8293-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{6818d084-b314-11e1-8293-14dae93eef71}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{ee16af77-3a34-11e1-8e6d-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{ee16af77-3a34-11e1-8e6d-14dae93eef71}\Shell\AutoRun\command - "" = F:\AutoRun.exe

O33 - MountPoints2\{ee16af84-3a34-11e1-8e6d-14dae93eef71}\Shell - "" = AutoRun

O33 - MountPoints2\{ee16af84-3a34-11e1-8e6d-14dae93eef71}\Shell\AutoRun\command - "" = F:\AutoRun.exe

O33 - MountPoints2\F\Shell - "" = AutoRun

O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

 

MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^FancyStart daemon.lnk - C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_94E3CE3704FE82FBF49A6A.exe - ()

MsConfig:64bit - StartUpReg: ASUS Screen Saver Protector - hkey= - key= - C:\Windows\AsScrPro.exe (ASUS)

MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

MsConfig:64bit - StartUpReg: HW_OPENEYE_OUC_Telekom Internet Manager - hkey= - key= - C:\Program Files (x86)\Telekom\InternetManager_H\UpdateDog\ouc.exe (Huawei Technologies Co., Ltd.)

MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)

MsConfig:64bit - StartUpReg: Media Finder - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: MobileConnect - hkey= - key= - C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)

MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)

MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)

MsConfig:64bit - StartUpReg: TrayServer - hkey= - key= - C:\PROGRA~2\MAGIX\VIDEO_~1\TrayServer.exe (MAGIX AG)

MsConfig:64bit - State: "startup" - Reg Error: Key error.

 

SafeBootMin:64bit: AppMgmt - Service

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - Service

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6558E982-9398-06B1-7453-356FDC2108EA} - Themes Setup

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {9A4E064D-CDEF-9CD4-61FF-B2B0AC8867FC} - Microsoft Windows Media Player 12.0

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codec - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

Code:

========== Files/Folders - Created Within 30 Days ==========

 

[2012.10.23 22:56:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

[2012.10.22 22:09:35 | 000,186,880 | ---- | C] (CEXX.ORG) -- C:\Users\Hannes\Desktop\LSPFix.exe

[2012.10.18 22:23:06 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.10.16 20:54:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.10.16 20:53:38 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Hannes\Desktop\esetsmartinstaller_enu.exe

[2012.10.16 09:32:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

[2012.10.15 21:24:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.10.15 21:24:36 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.10.15 20:53:32 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Hannes\Desktop\OTL.exe

[2012.10.15 18:41:47 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\Malwarebytes

[2012.10.15 18:41:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.10.15 18:41:34 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.10.15 18:41:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.10.15 18:41:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.10.15 18:08:11 | 000,000,000 | ---D | C] -- C:\PPF_Scan2

[2012.10.15 13:29:59 | 000,000,000 | ---D | C] -- C:\PPFScan

[2012.10.15 10:51:46 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\AVG2013

[2012.10.15 10:47:40 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\TuneUp Software

[2012.10.15 10:47:09 | 000,000,000 | -H-D | C] -- C:\$AVG

[2012.10.15 10:47:08 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2013

[2012.10.15 10:46:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG

[2012.10.15 10:43:15 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files

[2012.10.15 10:43:15 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Local\MFAData

[2012.10.15 10:43:15 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData

[2012.10.15 10:43:15 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Local\Avg2013

[2012.10.15 02:04:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\STOPzilla!

[2012.10.15 00:47:33 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2012.10.15 00:47:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2012.10.15 00:47:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2012.10.05 21:45:09 | 000,000,000 | ---D | C] -- C:\Users\Hannes\AppData\Roaming\GoforFiles

[2012.10.05 03:26:22 | 000,111,456 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgmfx64.sys

[2012.10.02 03:30:38 | 000,185,696 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys

[2012.09.25 18:56:12 | 000,000,000 | ---D | C] -- C:\Users\Hannes\Documents\Native Instruments

[2012.09.25 18:37:09 | 000,000,000 | -H-D | C] -- C:\ProgramData\{7707EA53-E29B-48FC-B28B-C8EE171EA0EB}

[2012.09.25 18:35:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Native Instruments

[2012.09.25 18:35:23 | 000,000,000 | -H-D | C] -- C:\ProgramData\{A2A4D724-2D08-46E4-BAA8-EC9EE875D133}

[2012.09.25 18:35:05 | 000,000,000 | -H-D | C] -- C:\ProgramData\{95B4F0ED-951F-4D36-B068-5EC1C4C19C14}

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Native Instruments

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Native Instruments

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\Program Files\Native Instruments

[2012.09.25 18:35:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Native Instruments

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.10.24 19:25:41 | 000,018,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.10.24 19:25:41 | 000,018,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.10.24 19:17:48 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe

[2012.10.24 19:17:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.10.24 19:17:30 | 3152,203,776 | -HS- | M] () -- C:\hiberfil.sys

[2012.10.24 00:34:13 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts

[2012.10.24 00:12:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.10.22 22:09:35 | 000,186,880 | ---- | M] (CEXX.ORG) -- C:\Users\Hannes\Desktop\LSPFix.exe

[2012.10.17 18:29:21 | 000,538,941 | ---- | M] () -- C:\Users\Hannes\Desktop\adwcleaner.exe

[2012.10.17 18:15:17 | 010,215,277 | ---- | M] () -- C:\Users\Hannes\Desktop\prezentacja2012.ppsx

[2012.10.16 22:00:02 | 005,142,464 | ---- | M] () -- C:\Users\Hannes\Desktop\R.I.O. feat. U-Jean - Animal (PH Electro Radio Edit) (Official Video HD).mp3

[2012.10.16 20:53:38 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Hannes\Desktop\esetsmartinstaller_enu.exe

[2012.10.16 09:32:34 | 000,000,983 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk

[2012.10.15 21:24:38 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.10.15 20:53:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Hannes\Desktop\OTL.exe

[2012.10.15 18:41:35 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.10.15 13:29:38 | 006,170,946 | ---- | M] () -- C:\PPFScan.zip

[2012.10.15 10:53:28 | 000,001,391 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini

[2012.10.15 10:53:27 | 000,002,250 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini

[2012.10.15 00:47:33 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.10.12 21:32:10 | 003,255,641 | ---- | M] () -- C:\Users\Hannes\Desktop\Linkin Park - Castle of Glass.mp3

[2012.10.05 16:50:32 | 000,054,039 | ---- | M] () -- C:\Users\Hannes\.recently-used.xbel

[2012.10.05 03:26:22 | 000,111,456 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgmfx64.sys

[2012.10.02 17:35:17 | 001,531,218 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.10.02 17:35:17 | 000,666,256 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.10.02 17:35:17 | 000,628,098 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.10.02 17:35:17 | 000,134,178 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.10.02 17:35:17 | 000,110,560 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.10.02 03:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys

[2012.10.01 21:56:54 | 000,015,477 | ---- | M] () -- C:\Users\Hannes\Desktop\relativ.odt

[2012.09.29 17:17:29 | 000,283,745 | ---- | M] () -- C:\Users\Hannes\Desktop\screen_aragon.jpg

[2012.09.28 22:15:46 | 000,000,023 | ---- | M] () -- C:\Windows\Telemax.cfg

[2012.09.26 23:50:45 | 003,257,187 | ---- | M] () -- C:\Users\Hannes\Desktop\Filterfunk - S.O.S. (Message in a bottle).mp3

[2012.09.26 18:14:00 | 000,072,320 | ---- | M] () -- C:\Users\Hannes\Desktop\screen.jpg

[2012.09.25 18:37:05 | 000,001,004 | ---- | M] () -- C:\Users\Public\Desktop\Traktor 2.lnk

 
 ========== Files Created - No Company Name ==========

 

[2012.10.17 18:29:20 | 000,538,941 | ---- | C] () -- C:\Users\Hannes\Desktop\adwcleaner.exe

[2012.10.17 18:15:04 | 010,215,277 | ---- | C] () -- C:\Users\Hannes\Desktop\prezentacja2012.ppsx

[2012.10.16 21:59:18 | 005,142,464 | ---- | C] () -- C:\Users\Hannes\Desktop\R.I.O. feat. U-Jean - Animal (PH Electro Radio Edit) (Official Video HD).mp3

[2012.10.15 21:24:38 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.10.15 18:41:35 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.10.15 13:29:30 | 006,170,946 | ---- | C] () -- C:\PPFScan.zip

[2012.10.15 10:47:40 | 000,000,983 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2013.lnk

[2012.10.15 00:47:33 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.10.12 21:32:02 | 003,255,641 | ---- | C] () -- C:\Users\Hannes\Desktop\Linkin Park - Castle of Glass.mp3

[2012.10.05 16:50:32 | 000,054,039 | ---- | C] () -- C:\Users\Hannes\.recently-used.xbel

[2012.10.01 21:56:53 | 000,015,477 | ---- | C] () -- C:\Users\Hannes\Desktop\relativ.odt

[2012.09.29 17:17:28 | 000,283,745 | ---- | C] () -- C:\Users\Hannes\Desktop\screen_aragon.jpg

[2012.09.26 23:50:39 | 003,257,187 | ---- | C] () -- C:\Users\Hannes\Desktop\Filterfunk - S.O.S. (Message in a bottle).mp3

[2012.09.26 18:14:00 | 000,072,320 | ---- | C] () -- C:\Users\Hannes\Desktop\screen.jpg

[2012.09.25 18:37:05 | 000,001,004 | ---- | C] () -- C:\Users\Public\Desktop\Traktor 2.lnk

[2012.01.01 18:36:16 | 000,001,352 | ---- | C] () -- C:\ProgramData\CfSB1090.ini

[2012.01.01 18:36:16 | 000,001,352 | ---- | C] () -- C:\ProgramData\CfSB0910.ini

[2012.01.01 18:36:16 | 000,001,302 | ---- | C] () -- C:\ProgramData\CfSB0300.ini

[2012.01.01 18:36:16 | 000,001,282 | ---- | C] () -- C:\ProgramData\CfSB0471.ini

[2012.01.01 18:36:16 | 000,001,208 | ---- | C] () -- C:\ProgramData\CfSB0490.ini

[2012.01.01 18:36:16 | 000,001,027 | ---- | C] () -- C:\ProgramData\CfSB0560.ini

[2012.01.01 18:36:16 | 000,001,026 | ---- | C] () -- C:\ProgramData\CfSB0271.ini

[2012.01.01 18:36:16 | 000,001,026 | ---- | C] () -- C:\ProgramData\CfSB0270.ini

[2011.12.28 21:58:49 | 000,001,320 | ---- | C] () -- C:\Users\Hannes\.xmlcopyeditor

[2011.12.26 11:57:01 | 001,557,912 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011.12.25 23:18:29 | 000,000,023 | ---- | C] () -- C:\Windows\AIM_LANGUAGE.INI

[2011.12.25 23:18:26 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\glut32.dll

[2011.08.01 22:10:25 | 000,014,051 | ---- | C] () -- C:\Windows\SysWow64\RaCoInst.dat

[2011.08.01 22:10:21 | 000,147,456 | ---- | C] () -- C:\Windows\SysWow64\DiagFunc.dll

[2011.08.01 22:10:21 | 000,000,451 | ---- | C] () -- C:\Windows\SysWow64\DiagFunc.ini

[2011.08.01 22:05:52 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll

[2011.05.31 05:23:33 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin

[2011.05.31 05:23:31 | 000,213,332 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin

[2011.05.31 05:23:30 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin

[2011.04.13 04:48:48 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe

[2011.02.11 23:23:34 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll

[2009.06.16 13:25:02 | 000,121,512 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2012.10.16 09:32:33 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software

[2012.10.16 09:32:33 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software

[2012.03.13 14:08:02 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\AnvSoft

[2011.12.25 20:51:53 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\ASUS WebStorage

[2012.09.24 19:47:46 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Audacity

[2012.10.15 10:51:46 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\AVG2013

[2011.12.28 19:39:50 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Capcom

[2012.10.24 19:18:51 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Dropbox

[2012.02.19 20:06:37 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\DVDVideoSoft

[2012.09.11 15:06:44 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\FileZilla

[2012.10.05 21:45:09 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\GoforFiles

[2012.10.05 16:50:32 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\gtk-2.0

[2012.08.15 10:12:55 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\MAGIX

[2011.12.27 20:35:54 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Nuance

[2012.02.26 22:03:35 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Pamela

[2012.10.05 15:01:01 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\SoftGrid Client

[2012.01.08 22:13:36 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Telekom

[2012.01.08 22:29:42 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Telekom Internet Manager

[2011.12.26 11:57:51 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TP

[2012.09.05 00:02:38 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TS3Client

[2012.10.15 10:47:40 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\TuneUp Software

[2012.05.26 18:34:03 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Vodafone

[2011.12.26 15:49:02 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Windows Live Writer

[2012.09.04 23:09:21 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\XnView

[2011.12.27 20:35:51 | 000,000,000 | ---D | M] -- C:\Users\Hannes\AppData\Roaming\Zeon

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %systemdrive%\*. >

[2012.10.15 10:47:09 | 000,000,000 | -H-D | M] -- C:\$AVG

[2012.01.17 00:56:40 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin

[2011.12.25 23:18:31 | 000,000,000 | ---D | M] -- C:\AIM_SPORT

[2012.04.28 20:11:42 | 000,000,000 | ---D | M] -- C:\Aprilia

[2012.04.28 20:31:27 | 000,000,000 | ---D | M] -- C:\ApriliaData

[2012.07.16 10:09:13 | 000,000,000 | -H-D | M] -- C:\ASUS.DAT

[2011.04.13 04:49:40 | 000,000,000 | ---D | M] -- C:\AsusVibeData

[2009.07.29 08:03:34 | 000,000,000 | -HSD | M] -- C:\Boot

[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2011.08.01 22:11:38 | 000,000,000 | ---D | M] -- C:\eSupport

[2012.01.14 23:08:27 | 000,000,000 | ---D | M] -- C:\install_4f11eecad213f

[2011.08.01 22:07:08 | 000,000,000 | ---D | M] -- C:\Intel

[2011.12.27 19:24:35 | 000,000,000 | RH-D | M] -- C:\MSOCache

[2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2012.10.15 13:30:00 | 000,000,000 | ---D | M] -- C:\PPFScan

[2012.10.15 18:08:37 | 000,000,000 | ---D | M] -- C:\PPF_Scan2

[2012.10.15 21:24:36 | 000,000,000 | R--D | M] -- C:\Program Files

[2012.10.24 00:40:47 | 000,000,000 | R--D | M] -- C:\Program Files (x86)

[2012.10.17 22:51:24 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2011.12.25 19:46:27 | 000,000,000 | -HSD | M] -- C:\Recovery

[2012.10.24 19:23:49 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2012.01.31 15:56:09 | 000,000,000 | ---D | M] -- C:\TEMP

[2011.12.25 19:47:51 | 000,000,000 | R--D | M] -- C:\Users

[2012.09.25 15:43:12 | 000,000,000 | ---D | M] -- C:\Windows

[2012.10.18 22:23:06 | 000,000,000 | ---D | M] -- C:\_OTL

 
 < %allusersprofile%\*. /s >

[2012.09.24 15:51:16 | 000,000,000 | ---D | M] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

[2012.08.28 13:05:33 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe

[2011.08.01 22:10:10 | 000,000,000 | ---D | M] -- C:\ProgramData\AmUStor

[2012.01.24 14:20:11 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple

[2012.01.24 14:20:57 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple Computer

[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data

[2011.12.27 12:00:45 | 000,000,000 | ---D | M] -- C:\ProgramData\ASUS

[2012.10.15 11:19:28 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013

[2011.12.25 19:51:30 | 000,000,000 | ---D | M] -- C:\ProgramData\ChangeFolderView

[2012.10.15 10:43:15 | 000,000,000 | -H-D | M] -- C:\ProgramData\Common Files

[2012.01.16 01:24:31 | 000,000,000 | ---D | M] -- C:\ProgramData\Corel

[2012.01.16 01:07:57 | 000,000,000 | ---D | M] -- C:\ProgramData\CorelDRAW Graphics Suite X5

[2012.01.02 17:58:13 | 000,000,000 | ---D | M] -- C:\ProgramData\Creative

[2011.12.28 18:51:13 | 000,000,000 | ---D | M] -- C:\ProgramData\CyberLink

[2012.01.08 22:13:49 | 000,000,000 | ---D | M] -- C:\ProgramData\DatacardService

[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop

[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents

[2011.04.13 04:33:02 | 000,000,000 | ---D | M] -- C:\ProgramData\Downloaded Installations

[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites

[2012.02.02 00:30:29 | 000,000,000 | ---D | M] -- C:\ProgramData\FLEXnet

[2011.12.25 19:48:30 | 000,000,000 | ---D | M] -- C:\ProgramData\FolderView

[2011.12.31 17:32:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Freemake

[2011.04.13 04:33:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Google

[2012.04.20 01:38:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Hewlett-Packard

[2011.08.01 22:09:11 | 000,000,000 | ---D | M] -- C:\ProgramData\Intel

[2012.08.15 10:12:55 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX

[2012.10.15 18:41:34 | 000,000,000 | ---D | M] -- C:\ProgramData\Malwarebytes

[2012.10.24 19:21:42 | 000,000,000 | ---D | M] -- C:\ProgramData\MFAData

[2012.10.15 00:30:06 | 000,000,000 | --SD | M] -- C:\ProgramData\Microsoft

[2012.10.10 20:16:51 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft Help

[2012.04.26 12:55:07 | 000,000,000 | ---D | M] -- C:\ProgramData\Mozilla

[2012.09.25 18:35:34 | 000,000,000 | ---D | M] -- C:\ProgramData\Native Instruments

[2011.12.27 20:35:54 | 000,000,000 | ---D | M] -- C:\ProgramData\Nuance

[2011.04.13 04:48:44 | 000,000,000 | ---D | M] -- C:\ProgramData\OberonGameConsole

[2011.08.01 22:10:55 | 000,000,000 | ---D | M] -- C:\ProgramData\P4G

[2012.01.16 01:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\Protexis

[2011.08.01 22:10:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Ralink Driver

[2011.04.13 04:33:05 | 000,000,000 | ---D | M] -- C:\ProgramData\ScanSoft

[2012.10.15 00:47:38 | 000,000,000 | ---D | M] -- C:\ProgramData\Skype

[2011.08.01 22:09:39 | 000,000,000 | ---D | M] -- C:\ProgramData\SonicFocus

[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu

[2011.12.27 17:11:35 | 000,000,000 | ---D | M] -- C:\ProgramData\Sun

[2012.07.21 22:43:34 | 000,000,000 | ---D | M] -- C:\ProgramData\Temp

[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates

[2012.10.14 22:18:53 | 000,000,000 | ---D | M] -- C:\ProgramData\Trend Micro

[2011.12.26 18:10:53 | 000,000,000 | ---D | M] -- C:\ProgramData\VirtualizedApplications

[2012.06.06 05:53:28 | 000,000,000 | ---D | M] -- C:\ProgramData\Vodafone

[2012.09.25 18:37:09 | 000,000,000 | -H-D | M] -- C:\ProgramData\{7707EA53-E29B-48FC-B28B-C8EE171EA0EB}

[2012.01.24 14:21:15 | 000,000,000 | ---D | M] -- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}

[2012.09.25 18:35:06 | 000,000,000 | -H-D | M] -- C:\ProgramData\{95B4F0ED-951F-4D36-B068-5EC1C4C19C14}

[2012.09.25 18:35:23 | 000,000,000 | -H-D | M] -- C:\ProgramData\{A2A4D724-2D08-46E4-BAA8-EC9EE875D133}

[2012.09.24 15:50:03 | 000,000,000 | ---D | M] -- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}\x64

[2012.09.24 15:51:17 | 000,000,000 | ---D | M] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64

[2012.09.24 15:51:16 | 000,000,000 | ---D | M] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\x64

[2012.02.02 18:43:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw

[2012.02.02 00:35:43 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\ISO-19770

[2012.02.02 00:45:11 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\Updater6

[2012.02.02 18:43:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Adobe Standard

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 1000D

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 10D

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 20D

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 20Da

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 300D

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 30D

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 350D

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 400D

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 40D

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 450D

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 500D

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 50D

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 550D

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 5D

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 5D Mark II

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS 7D

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS D30

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS D60

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS-1D

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS-1D Mark II

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS-1D Mark II N

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS-1D Mark III

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS-1D Mark IV

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS-1Ds

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS-1Ds Mark II

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon EOS-1Ds Mark III

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon PowerShot G10

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon PowerShot G11

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon PowerShot G9

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon PowerShot S90

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Canon PowerShot SX1 IS

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Leica M8

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D1

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D100

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D1H

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D1X

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D200

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D2H

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D2Hs

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D2X

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D2Xs

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D3

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D300

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D3000

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D300S

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D3S

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D3X

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D40

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D40X

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D50

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D5000

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D60

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D70

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D700

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D70s

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D80

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Nikon D90

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Pentax K-7

[2012.02.02 18:43:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Pentax K10D

[2012.02.02 18:43:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Pentax K200D

[2012.02.02 18:43:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe\CameraRaw\CameraProfiles\Camera\Pentax K20D

[2012.09.24 15:50:22 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple Computer\Installer Cache

[2012.09.24 19:48:54 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple Computer\iTunes

[2012.09.24 15:50:22 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple Computer\Installer Cache\iTunes 10.7.0.21

[2012.09.24 15:51:26 | 000,000,000 | -H-D | M] -- C:\ProgramData\Apple Computer\iTunes\SC Info

[2012.09.24 15:46:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple\Installer Cache

[2012.09.07 18:56:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple\Lockdown

[2012.01.24 14:20:05 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple\Installer Cache\Apple Mobile Device Support 4.0.0.97

[2012.03.27 21:30:45 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple\Installer Cache\Apple Mobile Device Support 5.1.1.4

[2012.09.07 19:51:57 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple\Installer Cache\Apple Mobile Device Support 5.2.0.6

[2012.09.24 15:46:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple\Installer Cache\Apple Mobile Device Support 6.0.0.59

[2012.01.24 14:20:14 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple\Installer Cache\Apple Software Update 2.1.3.127

[2012.01.24 14:19:52 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple\Installer Cache\AppleApplicationSupport 2.1.6

[2012.03.27 21:30:14 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple\Installer Cache\AppleApplicationSupport 2.1.7

[2012.09.07 19:51:32 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple\Installer Cache\AppleApplicationSupport 2.1.9

[2012.09.24 15:46:08 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple\Installer Cache\AppleApplicationSupport 2.2.2

[2012.01.24 14:19:57 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple\Installer Cache\Bonjour 3.0.0.10

[2012.10.19 15:18:36 | 000,000,000 | ---D | M] -- C:\ProgramData\ASUS\LifeFrame

[2011.12.27 12:00:56 | 000,000,000 | ---D | M] -- C:\ProgramData\ASUS\LifeFrame\LifeFrame

[2012.10.15 10:47:08 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\admincli

[2012.10.15 10:47:08 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\Antispam

[2012.10.24 19:21:46 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\avi

[2012.10.18 22:19:49 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\Cfg

[2012.10.22 16:12:12 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\Chjw

[2012.10.24 19:17:55 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\DB

[2012.10.24 19:21:43 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS

[2012.10.15 10:47:57 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\log

[2012.10.15 10:47:08 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\lsdb

[2012.10.22 16:07:41 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\SetupBackup

[2012.10.24 19:21:07 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\Chjw\aaa6f0e3a6f0b0c5

[2012.10.24 19:21:07 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\Chjw\ea8ac8d98ac8a403

[2012.10.24 19:21:44 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\config

[2012.10.24 19:21:11 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\malwareprofile

[2012.10.24 19:21:43 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\outbox

[2012.10.24 19:21:11 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\profile

[2012.10.15 13:28:10 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\quarantine

[2012.10.24 19:21:43 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\outbox\0

[2012.10.24 19:21:43 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\outbox\1

[2012.10.24 19:21:43 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\outbox\2

[2012.10.24 19:21:43 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\outbox\3

[2012.10.24 19:21:43 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\outbox\4

[2012.10.24 19:21:43 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\outbox\5

[2012.10.24 19:21:43 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\outbox\6

[2012.10.24 19:21:43 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\outbox\7

[2012.10.24 19:21:43 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\outbox\8

[2012.10.24 19:21:43 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\IDS\outbox\9

[2012.10.15 10:47:08 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2013\lsdb\prev

[2012.01.16 01:24:28 | 000,000,000 | ---D | M] -- C:\ProgramData\Corel\CorelDRAW Graphics Suite X5

[2012.01.01 18:44:01 | 000,000,000 | ---D | M] -- C:\ProgramData\Creative\Software Update

[2012.01.01 18:44:01 | 000,000,000 | ---D | M] -- C:\ProgramData\Creative\Software Update\Data

[2012.01.01 18:44:01 | 000,000,000 | ---D | M] -- C:\ProgramData\Creative\Software Update\Log

[2012.01.01 18:44:01 | 000,000,000 | ---D | M] -- C:\ProgramData\Creative\Software Update\Data\CTSUApp2_v1.06.00_v02

[2011.12.28 18:51:13 | 000,000,000 | ---D | M] -- C:\ProgramData\CyberLink\CLUpdater

[2012.01.20 16:48:50 | 000,000,000 | -H-D | M] -- C:\ProgramData\CyberLink\EvoParser

[2011.08.01 22:14:23 | 000,000,000 | ---D | M] -- C:\ProgramData\CyberLink\Power2Go

[2011.12.28 18:51:13 | 000,000,000 | ---D | M] -- C:\ProgramData\CyberLink\CLUpdater\Power2Go

[2011.12.28 18:51:13 | 000,000,000 | -H-D | M] -- C:\ProgramData\CyberLink\CLUpdater\Power2Go\6.1

[2011.12.28 18:51:12 | 000,000,000 | ---D | M] -- C:\ProgramData\CyberLink\EvoParser\Power2Go

[2011.12.28 18:51:13 | 000,000,000 | -H-D | M] -- C:\ProgramData\CyberLink\EvoParser\Power2Go\6.1

[2012.10.04 17:04:31 | 000,000,000 | ---D | M] -- C:\ProgramData\DatacardService\log

[2012.01.08 22:12:56 | 000,000,000 | ---D | M] -- C:\ProgramData\DatacardService\SysConfig

[2011.04.13 04:33:02 | 000,000,000 | ---D | M] -- C:\ProgramData\Downloaded Installations\{03A968BA-D27D-4EA9-81F5-579FB8ECD28B}

[2011.04.13 04:33:07 | 000,000,000 | ---D | M] -- C:\ProgramData\FLEXnet\Connect

[2011.04.13 04:33:04 | 000,000,000 | ---D | M] -- C:\ProgramData\FLEXnet\Connect\11

[2012.05.26 18:47:59 | 000,000,000 | ---D | M] -- C:\ProgramData\FLEXnet\Connect\Database

[2011.04.13 04:33:04 | 000,000,000 | ---D | M] -- C:\ProgramData\FLEXnet\Connect\11\ui

[2011.04.13 04:33:04 | 000,000,000 | ---D | M] -- C:\ProgramData\FLEXnet\Connect\11\ui\images

[2011.04.13 04:33:04 | 000,000,000 | ---D | M] -- C:\ProgramData\FLEXnet\Connect\11\ui\lang

[2012.09.28 13:57:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Freemake\FreemakeVideoDownloader

[2011.04.13 04:33:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Google\Custom Buttons

[2011.04.13 04:33:14 | 000,000,000 | ---D | M] -- C:\ProgramData\Google\Google Toolbar

[2011.04.13 04:33:14 | 000,000,000 | ---D | M] -- C:\ProgramData\Google\Google Toolbar\Component

[2012.04.20 01:38:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Hewlett-Packard\HP Print Settings

[2011.08.01 22:09:11 | 000,000,000 | ---D | M] -- C:\ProgramData\Intel\ExtremeGraphics

[2011.08.01 22:09:11 | 000,000,000 | ---D | M] -- C:\ProgramData\Intel\ExtremeGraphics\CUI

[2011.12.25 19:50:00 | 000,000,000 | ---D | M] -- C:\ProgramData\Intel\ExtremeGraphics\CUI\Resource

[2012.08.15 10:12:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Common

[2012.08.15 10:12:55 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\MagixOfa Helper-Module

[2012.08.15 10:08:25 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Screenshare

[2012.08.15 10:08:21 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Speed3_burnR_mxcdr_MSI

[2012.08.15 10:12:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version

[2012.08.15 10:12:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Common\Communities

[2012.08.15 10:08:16 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Common\Database

[2012.08.31 12:04:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Common\Instances

[2012.08.15 10:12:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Common\News Feed Info

[2012.08.15 10:08:44 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Common\VfxPlugins

[2012.08.15 10:08:15 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Common\Database\FABS

[2012.08.15 10:12:55 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\MagixOfa Helper-Module\UserData

[2012.08.15 10:08:25 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Screenshare\Movies

[2012.08.15 10:08:25 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Screenshare\Session History

[2012.08.15 10:08:25 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Screenshare\Session History\Utilities

[2012.08.15 10:08:25 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Screenshare\Session History\Utilities\assets

[2012.08.15 18:59:01 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\AudioEffects

[2012.08.15 10:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Borders

[2012.08.15 18:59:06 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default

[2012.08.15 20:16:19 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD

[2012.08.15 10:09:56 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\FX-Preset

[2012.08.15 10:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\IntroOutro

[2012.08.15 10:10:19 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\MusicEditor

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\NoisePrintSamples

[2012.08.15 10:09:32 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX

[2012.08.15 10:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Plugins

[2012.08.15 10:09:34 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Slideshow music

[2012.08.15 10:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Soundtrack Maker Styles

[2012.08.15 10:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Synth

[2012.08.15 10:09:32 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles

[2012.08.15 10:12:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\UserData

[2012.08.15 10:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\UserVideoEffects

[2012.08.15 10:13:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects

[2012.08.15 10:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\XAR

[2012.08.15 10:11:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\_Demo_3D

[2012.08.15 10:09:32 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\_Sichtbares TV Bild

[2012.08.15 10:09:32 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\_Studio-Vorspann

[2012.08.15 18:59:01 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\AudioEffects\Icons

[2012.08.15 10:09:32 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Communities

[2012.08.15 10:09:56 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\geoimport

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\html

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\layout

[2012.08.15 10:09:51 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets

[2012.08.15 10:09:42 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\RemoteControl

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Shortcuts

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\StoryMaker

[2012.08.15 10:09:31 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\VideoPluginPresets

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\AnimatedGIF

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\Avi

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\AviMJPEG

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\AviRaw

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\BmpSeries

[2012.08.15 10:09:50 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\Devices

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\DvAvi

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\McMpeg2

[2012.08.15 10:09:46 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\McMpeg2-Blu-ray

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\McMpeg2-Conversion

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\McMpeg2-DVD

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\McMpeg2-DVDCapt

[2012.08.15 10:09:46 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\McMpeg2-ExportWizard

[2012.08.15 10:09:50 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\McMpeg2-HDDVD

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\MPEG4

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\MPEG4-AVCHD

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\MPEG4-Blu-ray

[2012.08.15 10:09:57 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\MPEG4-Device

[2012.08.15 10:09:46 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\MPEG4-ExportWizard

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\MPEG4-WebDVD

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\Mxv

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\Quicktime

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\Real

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\Still-BMP

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\Still-JPG

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\WindowsMedia

[2012.08.15 10:09:46 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\WindowsMedia-ExportWizard

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\WindowsMedia-ExportWizard3d

[2012.08.15 10:09:46 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\WindowsMedia-HD

[2012.08.15 10:09:46 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\WindowsMedia-PCShow

[2012.08.15 10:09:46 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\Presets\WindowsMedia-WebDVD

[2012.08.15 10:09:43 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Default\StoryMaker\RotationPresets

[2012.08.15 10:11:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout

[2012.08.15 20:16:19 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\LastLayout

[2012.08.15 10:08:47 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\Layout

[2012.08.15 10:08:46 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\TextLayout

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\Wmv_disc

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_00_auto

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_01_1

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_01_2

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_01_3

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_01_4

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_01_5

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_02_1

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_02_2

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_02_3

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_02_4

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_02_5

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_02_6

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_03_1

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_03_2

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_03_3

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_03_4

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_03_5

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_03_6

[2012.08.15 10:11:08 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_03_7

[2012.08.15 10:11:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_03_8

[2012.08.15 10:11:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_04_1

[2012.08.15 10:11:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_04_2

[2012.08.15 10:11:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_04_3

[2012.08.15 10:11:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_04_4

[2012.08.15 10:11:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\CompLayout\comp_04_5

[2012.08.15 10:09:57 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\Layout\C_warmPan

[2012.08.15 10:11:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\Layout\default

[2012.08.15 10:11:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\Layout\default_169

[2012.08.15 10:09:56 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\TextLayout\text_01

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\Wmv_disc\components

[2012.08.15 10:11:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\Wmv_disc\menu

[2012.08.15 10:09:56 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\DVD\Wmv_disc\menu\images

[2012.08.15 10:09:57 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\MusicEditor\fx-preset

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\MusicEditor\fx-preset\CleaningFX

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\MusicEditor\fx-preset\MasteringFX

[2012.08.15 10:09:57 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\MusicEditor\fx-preset\NoisePrintSamples

[2012.08.15 10:09:53 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\MusicEditor\fx-preset\CleaningFX\1_Tape Restauration

[2012.08.15 10:09:53 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\MusicEditor\fx-preset\CleaningFX\2_Other Restauration

[2012.08.15 10:09:53 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\MusicEditor\fx-preset\MasteringFX\0_Basic Optimizations

[2012.08.15 10:09:57 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\MusicEditor\fx-preset\MasteringFX\1_Fit To Music Gender

[2012.08.15 10:09:53 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\MusicEditor\fx-preset\MasteringFX\2_Dynamic Optimation

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\MusicEditor\fx-preset\MasteringFX\5_MP3 & Tape Recording Optimization

[2012.08.15 10:09:57 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\MusicEditor\fx-preset\MasteringFX\6_Audio From Video & Vocal Recordings Optimization

[2012.08.15 10:09:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Border

[2012.08.15 10:09:53 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Comic

[2012.08.15 10:09:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Deko

[2012.08.15 10:09:57 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Full

[2012.08.15 10:09:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Fun

[2012.08.15 10:09:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Mix

[2012.08.15 10:09:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Pointer

[2012.08.15 10:09:47 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Text

[2012.08.15 10:09:50 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Border\Icons

[2012.08.15 10:09:53 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Comic\Icons

[2012.08.15 10:09:50 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Deko\Icons

[2012.08.15 10:09:57 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Full\Icons

[2012.08.15 10:09:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Fun\Icons

[2012.08.15 10:09:51 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Mix\Icons

[2012.08.15 10:09:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Pointer\Icons

[2012.08.15 10:09:47 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\OverlayFX\Text\Icons

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Plugins\3dMorph

[2012.08.15 10:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Plugins\3dSeries

[2012.08.15 10:09:56 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Plugins\3DStandard

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Plugins\3dTiles

[2012.08.15 10:11:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Plugins\Standard

[2012.08.15 10:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Plugins\TransitionPresets

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\Combination

[2012.08.15 10:09:53 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\FileInfo

[2012.08.15 10:09:56 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\Fonts

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\Moving

[2012.08.15 10:09:51 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\Rotation

[2012.08.30 20:16:03 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\Standard

[2012.08.15 10:08:47 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\Xara3D

[2012.08.15 10:09:57 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\Combination\Icons

[2012.08.15 10:09:56 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\Fonts\Icons

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\Moving\Icons

[2012.08.15 10:09:51 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\Rotation\Icons

[2012.08.30 20:16:03 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\Standard\Icons

[2012.08.15 10:09:57 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\Xara3D\Animated

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\Xara3D\Lighting

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\Titles\Xara3D\Plain

[2012.08.15 10:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\BackgroundEffects

[2012.08.15 10:13:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Collage

[2012.08.15 10:08:47 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\EffectAlphaMasks

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Move

[2012.08.15 10:09:46 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Multi_PiP

[2012.08.15 10:09:59 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\One click animation

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\One click optimization

[2012.08.15 10:09:59 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\PortraitEffects

[2012.08.15 23:14:21 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Standard

[2012.08.15 10:09:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles

[2012.08.15 23:41:33 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\VideoMixFX

[2012.08.15 10:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\BackgroundEffects\ColorFields

[2012.08.15 10:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\BackgroundEffects\Pictures

[2012.08.15 10:12:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\BackgroundEffects\Videos

[2012.08.15 10:09:53 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\EffectAlphaMasks\HD

[2012.08.15 10:09:53 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\EffectAlphaMasks\SD

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Move\Icons

[2012.08.15 10:09:59 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\One click animation\Icons

[2012.08.15 10:09:48 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\One click optimization\Brightness

[2012.08.15 10:09:48 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\One click optimization\Color

[2012.08.15 10:09:57 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\One click optimization\Preview

[2012.08.15 10:09:48 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\One click optimization\Sharpness

[2012.08.15 10:09:48 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\One click optimization\Brightness\Preview

[2012.08.15 10:09:48 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\One click optimization\Color\Preview

[2012.08.15 10:09:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\One click optimization\Sharpness\Preview

[2012.08.15 10:09:34 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\PortraitEffects\Icons

[2012.08.15 23:14:21 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Standard\Icons

[2012.08.15 10:09:57 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Standard\Preview

[2012.08.15 10:09:48 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\ChillOut-Light

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components

[2012.08.15 10:08:47 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Decoration

[2012.08.15 10:08:47 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Mix

[2012.08.15 10:08:48 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Move

[2012.08.15 10:08:48 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Panorama

[2012.08.15 10:08:48 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Rotation

[2012.08.15 10:09:31 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_3D

[2012.08.15 10:09:31 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_Mix

[2012.08.15 10:08:48 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom

[2012.08.15 10:09:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Decoration\01_Sepia

[2012.08.15 10:09:56 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Decoration\02_TVstripes

[2012.08.15 10:09:57 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Decoration\03_Waterrings

[2012.08.15 10:09:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Decoration\04_nightvision

[2012.08.15 10:09:53 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Decoration\05_Puzzle

[2012.08.15 10:09:47 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Mix\01_BlackWhite

[2012.08.15 10:09:57 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Mix\02_WarmColor

[2012.08.15 10:09:49 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Mix\03_ColdColor

[2012.08.15 10:09:47 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Mix\04_Blur

[2012.08.15 10:09:50 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Mix\05_Fisheye

[2012.08.15 10:09:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Mix\06_Mosaic

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Mix\07_Sand

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Mix\08_Whirlpool

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Move\01_MoveLR

[2012.08.15 10:09:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Move\01_MoveLR_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Move\02_MoveRL

[2012.08.15 10:09:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Move\02_MoveRL_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Move\03_MoveTB

[2012.08.15 10:09:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Move\03_MoveTB_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Move\04_MoveBT

[2012.08.15 10:09:52 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Move\04_MoveBT_Bez

[2012.08.15 10:09:59 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Panorama\01_ZoomInLR_small

[2012.08.15 10:09:59 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Panorama\02_ZoomInLR_large

[2012.08.15 10:09:59 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Panorama\03_ZoomOutLR_small

[2012.08.15 10:09:59 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Panorama\04_ZoomOutLR_large

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Panorama\05_ZoomOutRL_small

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Panorama\06_ZoomOutRL_large

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Panorama\07_ZoomOutRLRot

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Panorama\08_ZoomOutZoomInRLRot

[2012.08.15 10:09:59 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Panorama\09_ZoomInFastLR_small

[2012.08.15 10:09:59 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Panorama\10_ZoomInFastLR_large

[2012.08.15 10:09:43 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Rotation\01_RotL_ZInC

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Rotation\01_RotL_ZInC_Bez

[2012.08.15 10:09:43 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Rotation\02_RotR_ZInC

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Rotation\02_RotR_ZInC_Bez

[2012.08.15 10:09:43 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Rotation\03_RotLR_ZInC

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Rotation\03_RotLR_ZInC_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Rotation\04_RotL_ZOutC

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Rotation\04_RotL_ZOutC_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Rotation\05_RotR_ZOutC

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Rotation\05_RotR_ZOutC_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Rotation\06_RotLR_ZOutC

[2012.08.15 10:09:54 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Rotation\06_RotLR_ZOutC_Bez

[2012.08.15 10:09:30 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_3D\ChangeBySide

[2012.08.15 10:09:30 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_3D\ChangeDiagonal

[2012.08.15 10:09:30 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_3D\ChangeUpright

[2012.08.15 10:09:30 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_3D\Flip1

[2012.08.15 10:09:29 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_3D\Flip2

[2012.08.15 10:09:29 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_3D\Flip3

[2012.08.15 10:09:29 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_3D\Swing1

[2012.08.15 10:09:29 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_3D\Swing2

[2012.08.15 10:09:31 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_3D\Turn

[2012.08.15 10:09:29 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_Mix\01_Wipe

[2012.08.15 10:09:30 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_Mix\02_WipeDiagonal

[2012.08.15 10:09:29 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_Mix\03_Stretch

[2012.08.15 10:09:29 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_Mix\04_Slide

[2012.08.15 10:09:29 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_Mix\05_SlideBoxes

[2012.08.15 10:09:31 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_Mix\06_Jalousie

[2012.08.15 10:09:30 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_Mix\07_Swing

[2012.08.15 10:09:30 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_Mix\08_Leaf

[2012.08.15 10:09:29 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Transition_Mix\09_Zoom

[2012.08.15 10:09:34 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\01_ZInFirst

[2012.08.15 10:09:50 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\01_ZInFirst_Bez

[2012.08.15 10:09:34 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\02_ZOutLast

[2012.08.15 10:09:51 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\02_ZOutLast_Bez

[2012.08.15 10:09:42 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\03_ZInC

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\03_ZInC_Bez

[2012.08.15 10:09:42 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\04_ZInT

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\04_ZInT_Bez

[2012.08.15 10:09:43 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\05_ZInB

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\05_ZInB_Bez

[2012.08.15 10:09:43 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\06_ZInL

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\06_ZInL_Bez

[2012.08.15 10:09:43 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\07_ZInR

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\07_ZInR_Bez

[2012.08.15 10:09:43 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\08_ZInBL

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\08_ZInBL_Bez

[2012.08.15 10:09:43 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\09_ZInBR

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\09_ZInBR_Bez

[2012.08.15 10:09:43 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\10_ZInTL

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\10_ZInTL_Bez

[2012.08.15 10:09:43 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\11_ZInTR

[2012.08.15 10:09:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\11_ZInTR_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\12_ZOutC

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\12_ZOutC_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\13_ZOutT

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\13_ZOutT_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\14_ZOutB

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\14_ZOutB_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\15_ZOutL

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\15_ZOutL_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\16_ZOutR

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\16_ZOutR_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\17_ZOutBL

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\17_ZOutBL_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\18_ZOutBR

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\18_ZOutBR_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\19_ZOutTL

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\19_ZOutTL_Bez

[2012.08.15 10:09:45 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\20_ZOutTR

[2012.08.15 10:10:00 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\Styles\Components\Zoom\20_ZOutTR_Bez

[2012.08.15 23:41:33 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX\Video_deluxe_17_Premium_Download-Version\VideoEffects\VideoMixFX\Icons