Hallo Leute ich bin neu Im Board.

Ich habe schon viel in google gesucht aber immer nur Bruchteile von meinem Problem gefunden, und das wäre folgendes:

Seit ca. 1 Monat werden auf allen meinen USB Geräten die mit meinem PC verbunden waren/werden, die einzelnen Ordner in Verknüpfungen verwandelt.
Die kann ich ohne weiteres anklicken und es öffnet sich ein neues Fenster mit den Dateien.
Bis vor kurzem hat mich das nicht besonders gestört, da ich aber mal etwas auf meine Handy Speicherkarte laden wollte, wurde alles in Verknüpfungen verwandelt und mein Handy kann diese nicht lesen.
Nun würde ich gerne dieses Problem lösen.

Falls es hilft:

Auf der Externen Festplatte (USB) wurden 2 neue Ordner, eine inf-Datei erstellt:

● $RECYCLE.BIN
● RECYCLER (versteckter Ordner) (im Ordner -> 470a1245.exe, Desktop.ini und 894133bf.exe)
● autorun.inf

Vielen Dank für eure Hilfe =)

p.S
● mein Betriebssystem WIN7 Ultimate, Service Pack 1
● 64-Bit
● 4 GB RAM
● Intel core 2 quad CPU q9400 @ 2.66 GHz

Hallo und Herzlich Willkommen!

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:

• "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
  - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
  - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
• Charakteristische Merkmale/Profilinformationen:
  - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] ersetzen
• Die Systemprüfung und Bereinigung:
  - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
• Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
• Innerhalb der Betreuungszeit:
  - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
• Die Reihenfolge:
  - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
• GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
• Ansonsten unsere Forumsregeln:
  - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
• Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen

Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

► Ab jetzt sofort gilt, bis zum Ende der Reinigung>:

Hast Du externe Festplatte, USB-Sticks und/oder andere externe Speichermedien? Bitte immer (über die ganze Reinigungszeit!!) anschließen,damit gescannt werden kann.- alle Wechseldatenträger und immer bei gedrückter Shift-Taste am USB-Anschluss des Rechners einstecken! - So verhindest Du die Ausführung der AUTORUN-Funktion -> Man kann die AUTORUN-Funktion aber auch generell abschalten.►Anleitung

1.
Lade Dir das Programm auf deinen PC herunter:-> Panda USB Vaccine

2.
Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org

• Installieren und per Doppelklick starten.
• Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
• "Komplett Scan durchführen" wählen (überall Haken setzen)
• wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
• Alle Funde - falls MBAM meldet in C:\System Volume Information - den Haken bitte entfernen - markieren und auf "Löschen" - "Ausgewähltes entfernen") klicken.
• Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"

eine bebilderte Anleitung findest Du hier: Anleitung

3.
Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Doppelklick auf die OTL.exe
• Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
• Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
• Unter Extra Registry, wähle bitte Use SafeList
• Klicke nun auf Run Scan links oben
• Wenn der Scan beendet wurde werden 2 Logfiles erstellt - OTL.txt und Extras.txt
• Poste die Logfiles in Code-Tags hier in den Thread.

4.
Ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool CCleaner herunter
→ Download
installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ falls nötig - unter Options settings-> "german" einstellen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B hjtsanlist o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]

gruß
kira

Hallihallo, ich habe grade Schritt 1 und 2 gemacht, hier das Ergebnis:

Malwarebytes' Anti-Malware 1.51.2.1300
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 7929

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

12.10.2011 20:52:18
mbam-log-2011-10-12 (20-52-18).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|M:\|N:\|O:\|)
Durchsuchte Objekte: 484145
Laufzeit: 56 Minute(n), 11 Sekunde(n)

Infizierte Speicherprozesse: 3
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 6
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 78

Infizierte Speicherprozesse:
c:\Users\Ivan\AppData\Local\Temp\acd\tasked.exe (Trojan.BitMiner) -> 3952 -> Unloaded process successfully.
c:\Users\Ivan\AppData\Local\Temp\acd\tasked.exe (Trojan.BitMiner) -> 1088 -> Unloaded process successfully.
c:\Users\Ivan\AppData\Local\Temp\acd\tasked.exe (Trojan.BitMiner) -> 4032 -> Unloaded process successfully.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\8DDYX0ZBPZ (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\KYQ8ZBOAXR (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\DC3_FEXEC (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsServices (Backdoor.Agent) -> Value: WindowsServices -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8DDYX0ZBPZ (Trojan.FakeAlert.SA) -> Value: 8DDYX0ZBPZ -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsServices (Backdoor.Agent) -> Value: WindowsServices -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\program files (x86)\super meat boy\uninstall.exe (Malware.Packer.Krunchy) -> Quarantined and deleted successfully.
c:\program files (x86)\Ubisoft\ubisoft game launcher\ubiorbitapi_r2.dll (Trojan.Agent.CK) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\2Q1CKDAP\calc[1].dat (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\2Q1CKDAP\calc[2].dat (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\2Q1CKDAP\mycalc[2].dat (Trojan.Agent.H) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\2Q1CKDAP\mycalc[3].dat (Trojan.BitMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\2Q1CKDAP\mycalc[4].dat (Trojan.BitMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\A8H6Z2TJ\th[1].dat (VirTool.VBInject) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\E0EQVP2P\mycalc[2].dat (Trojan.Agent.H) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\E0EQVP2P\mycalc[3].dat (Trojan.BitMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\E0EQVP2P\mycalc[4].dat (Trojan.BitMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\Q2YNAJMJ\th[1].dat (VirTool.VBInject) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\Temp\acc\mamatije5.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\Temp\acd\tasker.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\Temp\acd\taskr.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\Temp\acd\tasks.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\1296.tmp (Backdoor.Bot.WPMH) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\1297.tmp (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\1B96.exe (Trojan.BitMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\1C29.tmp (Backdoor.Bot.WPMH) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\1CB3.tmp (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\1DEB.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\2089.exe (Trojan.BitMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\23E4.tmp (Worm.NgrBot) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\250D.tmp (VirTool.VBInject) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\25B8.tmp (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\270.tmp (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\2B05.tmp (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\2B63.exe (Trojan.BitMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\312D.tmp (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\339E.exe (Trojan.BitMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\3F03.exe (Trojan.BitMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\3FE0.tmp (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\493F.exe (Trojan.Agent.H) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\5A4F.exe (Trojan.BitMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\5D3E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\5DEC.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\60CA.exe (Trojan.Agent.H) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\69BA.tmp (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\69BB.tmp (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\6D04.tmp (Backdoor.Bot.WPMH) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\6E8A.tmp (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\6F56.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\73E9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\742C.exe (Trojan.Agent.H) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\743D.exe (Trojan.Agent.H) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\77F4.tmp (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\7B92.exe (Trojan.BitMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\913C.tmp (Trojan.Agent.H) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\94F5.tmp (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\9990.tmp (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\A2E6.tmp (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\A5E7.exe (Trojan.Agent.H) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\A76F.exe (Trojan.BitMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\B76D.exe (Trojan.BitMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\BE02.tmp (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\C3B.exe (Trojan.Agent.H) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\CD15.exe (Trojan.BitMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\F57E.exe (Trojan.Agent.H) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\FB94.tmp (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\FD9.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\FF8.exe (Trojan.Agent.H) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Roaming\WinMine.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Ivan\Desktop\Desktop\CW.eXe (Hacktool.ChewWGA) -> Quarantined and deleted successfully.
c:\Users\Ivan\downloads\bananegel public\bananegel public.dll (Malware.Packer.T) -> Quarantined and deleted successfully.
c:\Users\Ivan\family guy\adobe.photoshop.cs5.1.extended.v12.1.european.incl.keymaker-core\CORE10k.EXE (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.
c:\Users\Ivan\family guy\neu\garmin keygen v1.5.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
c:\Users\Ivan\family guy\softwarep\neu\garmin keygen v1.5.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
c:\Windows\Pwemia.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Pwemib.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
o:\$RECYCLE.BIN\s-1-5-21-2486027626-856727729-799267760-1001\$RKSQY6H.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
o:\eigene musik\ACDC\acdc - ballbreaker\albumartsmall.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.
o:\Games\assassins.creed.2.multi9.clonedvd-ind\Crack\SKIDROW\ubiorbitapi_r2.dll (Trojan.Agent.CK) -> Quarantined and deleted successfully.
o:\Games\super.meat.boy.v1.0u11.cracked.read.nfo-theta\nfoviewer.exe (Malware.Packer.Krunchy) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> Quarantined and deleted successfully.
c:\Users\Ivan\AppData\Local\Temp\acd\tasked.exe (Trojan.BitMiner) -> Quarantined and deleted successfully.
         

Vielen Dank für die schnelle Antwort, die weiteren Schritte werde ich gleich absolvieren.

So hier sind Noch die LOG-Files

OTL logfile created on: 12.10.2011 20:59:08 - Run 1
OTL by OldTimer - Version 3.2.29.1     Folder = C:\Users\Ivan\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 1,34 Gb Available Physical Memory | 33,45% Memory free
8,00 Gb Paging File | 5,23 Gb Available in Paging File | 65,35% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 913,15 Gb Total Space | 576,23 Gb Free Space | 63,10% Space Free | Partition Type: NTFS
Drive D: | 13,87 Gb Total Space | 1,89 Gb Free Space | 13,63% Space Free | Partition Type: NTFS
Drive F: | 4,49 Gb Total Space | 0,07 Gb Free Space | 1,45% Space Free | Partition Type: NTFS
Drive N: | 7,38 Gb Total Space | 5,81 Gb Free Space | 78,67% Space Free | Partition Type: FAT32
Drive O: | 1397,26 Gb Total Space | 991,87 Gb Free Space | 70,99% Space Free | Partition Type: NTFS
 
Computer Name: IVAN-PC | User Name: Ivan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Ivan\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Soda PDF\ConversionService.exe (LULU Software)
PRC - C:\Program Files (x86)\Opera\opera.exe (Opera Software)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe ()
PRC - C:\Program Files (x86)\Razer\DeathAdder\vdDaemon.exe (TODO: <Company name>)
PRC - C:\PROGRA~2\GRETECH\GOMPLA~1\GOM.exe (Gretech Corp.)
PRC - C:\Program Files (x86)\Razer\DeathAdder\razertra.exe ()
PRC - C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner.exe ()
PRC - C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\Tools\RTSS\RTSS.exe ()
PRC - C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
PRC - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
PRC - C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe (RealVNC Ltd.)
PRC - C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe (Razer Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files (x86)\Opera\gstreamer\plugins\gstoggdec.dll ()
MOD - C:\Program Files (x86)\Opera\gstreamer\plugins\gstwebmdec.dll ()
MOD - C:\Program Files (x86)\Opera\gstreamer\plugins\gstwavparse.dll ()
MOD - C:\Program Files (x86)\Opera\gstreamer\plugins\gstautodetect.dll ()
MOD - C:\Program Files (x86)\Opera\gstreamer\plugins\gstwaveform.dll ()
MOD - C:\Program Files (x86)\Opera\gstreamer\plugins\gsttypefindfunctions.dll ()
MOD - C:\Program Files (x86)\Opera\gstreamer\gstreamer.dll ()
MOD - C:\Program Files (x86)\Opera\gstreamer\plugins\gstffmpegcolorspace.dll ()
MOD - C:\Program Files (x86)\Opera\gstreamer\plugins\gstcoreelements.dll ()
MOD - C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioresample.dll ()
MOD - C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioconvert.dll ()
MOD - C:\Program Files (x86)\Opera\gstreamer\plugins\gstdirectsound.dll ()
MOD - C:\Program Files (x86)\Opera\gstreamer\plugins\gstdecodebin2.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()
MOD - C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe ()
MOD - C:\PROGRA~2\GRETECH\GOMPLA~1\GomTVStrm.dll ()
MOD - C:\Program Files (x86)\GRETECH\GomPlayer\GAF.ax ()
MOD - C:\Program Files (x86)\GRETECH\GomPlayer\GVF.ax ()
MOD - C:\PROGRA~2\GRETECH\GOMPLA~1\GVC.dll ()
MOD - C:\Program Files (x86)\GRETECH\GomPlayer\GRFU.ax ()
MOD - C:\Program Files (x86)\Razer\DeathAdder\razertra.exe ()
MOD - C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner.exe ()
MOD - C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\Tools\RTSS\RTSSHooks.dll ()
MOD - C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\Tools\RTSS\RTUI.dll ()
MOD - C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\Tools\RTSS\RTSS.exe ()
MOD - C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\Tools\RTSS\RTFC.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (WTService) -- C:\Windows\SysNative\atwtusb.exe ()
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (Soda PDF Helper Service) -- C:\Program Files (x86)\Soda PDF\HelperService.exe (LULU Software)
SRV - (Soda PDF Service) -- C:\Program Files (x86)\Soda PDF\ConversionService.exe (LULU Software)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (Sony Ericsson PCCompanion) -- C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe (Avanquest Software)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (ezGOSvc) -- C:\Windows\SysWOW64\ezGOSvc.dll ()
SRV - (KMService) -- C:\Windows\SysWOW64\srvany.exe ()
SRV - (TeamViewer6) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (EvtEng) Intel(R) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV - (MyWiFiDHCPDNS) -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV - (RegSrvc) Intel(R) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (IJPLMSVC) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
SRV - (WinVNC4) -- C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe (RealVNC Ltd.)
SRV - (Apache2) -- C:\Program Files (x86)\All in One v1.7\apache\bin\apache.exe (Apache Software Foundation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (vncmirror) -- C:\Windows\SysNative\drivers\vncmirror.sys (RealVNC Ltd.)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (ggsemc) -- C:\Windows\SysNative\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV:64bit: - (ggflt) -- C:\Windows\SysNative\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (VKbms) -- C:\Windows\SysNative\drivers\VKbms.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (taphss) -- C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc)
DRV:64bit: - (jumi) -- C:\Windows\SysNative\drivers\jumi.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (WmVirHid) -- C:\Windows\SysNative\drivers\WmVirHid.sys (Logitech Inc.)
DRV:64bit: - (WmHidLo) -- C:\Windows\SysNative\drivers\WmHidLo.sys (Logitech Inc.)
DRV:64bit: - (WmBEnum) -- C:\Windows\SysNative\drivers\WmBEnum.sys (Logitech Inc.)
DRV:64bit: - (WmXlCore) -- C:\Windows\SysNative\drivers\WmXlCore.sys (Logitech Inc.)
DRV:64bit: - (WmFilter) -- C:\Windows\SysNative\drivers\WmFilter.sys (Logitech Inc.)
DRV:64bit: - (DAdderFltr) -- C:\Windows\SysNative\drivers\dadder.sys (Razer (Asia-Pacific) Pte Ltd)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atipmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (vhidmini) -- C:\Windows\SysNative\drivers\walvhid.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (CYUSB) -- C:\Windows\SysNative\drivers\CYUSB.sys (Cypress Semiconductor)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (netr28x) -- C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (HCW85BDA) -- C:\Windows\SysNative\drivers\HCW85BDA.sys (Hauppauge Computer Works)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (moufiltr) -- C:\Windows\SysNative\drivers\moufiltr.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
DRV:64bit: - (SaiKF620) -- C:\Windows\SysNative\drivers\SaiKF620.sys (Saitek)
DRV:64bit: - (s0017unic) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM) -- C:\Windows\SysNative\drivers\s0017unic.sys (MCCI Corporation)
DRV:64bit: - (s0017obex) -- C:\Windows\SysNative\drivers\s0017obex.sys (MCCI Corporation)
DRV:64bit: - (s0017nd5) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS) -- C:\Windows\SysNative\drivers\s0017nd5.sys (MCCI Corporation)
DRV:64bit: - (s0017mdm) -- C:\Windows\SysNative\drivers\s0017mdm.sys (MCCI Corporation)
DRV:64bit: - (s0017mgmt) Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM) -- C:\Windows\SysNative\drivers\s0017mgmt.sys (MCCI Corporation)
DRV:64bit: - (s0017mdfl) -- C:\Windows\SysNative\drivers\s0017mdfl.sys (MCCI Corporation)
DRV:64bit: - (s0017bus) Sony Ericsson Device 0017 driver (WDM) -- C:\Windows\SysNative\drivers\s0017bus.sys (MCCI Corporation)
DRV - (RivaTuner64) -- C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys ()
DRV - (ISODrive) -- C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys (EZB Systems, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.facebook.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 20 E0 A2 02 F9 D1 CB 01  [binary data]
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.facebook.com/"
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Ivan\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Ivan\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFSodaPDFConverter@sodapdf.com: C:\Program Files (x86)\Soda PDF\FFSodaExt [2011.09.25 16:00:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.09.08 18:09:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2011.06.25 16:13:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ivan\AppData\Roaming\mozilla\Extensions
[2011.09.09 18:19:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ivan\AppData\Roaming\mozilla\Firefox\Profiles\s3d9knrx.default\extensions
[2011.09.09 18:19:29 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Ivan\AppData\Roaming\mozilla\Firefox\Profiles\s3d9knrx.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011.08.09 21:48:38 | 000,000,000 | ---D | M] (FDislike) -- C:\Users\Ivan\AppData\Roaming\mozilla\Firefox\Profiles\s3d9knrx.default\extensions\fbdislike@doweb.fr
[2011.08.14 17:35:54 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.08.14 17:35:54 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011.09.25 16:00:54 | 000,000,000 | ---D | M] (Soda PDF Converter For Firefox) -- C:\PROGRAM FILES (X86)\SODA PDF\FFSODAEXT
[2011.09.08 18:09:20 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.02.21 21:15:06 | 000,002,046 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchddr.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Ivan\AppData\Local\Google\Chrome\Application\14.0.835.202\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Ivan\AppData\Local\Google\Chrome\Application\14.0.835.202\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Ivan\AppData\Local\Google\Chrome\Application\14.0.835.202\pdf.dll
CHR - plugin: CANON iMAGE GATEWAY Album Plugin Utility (Enabled) = C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
 
O1 HOSTS File: ([2011.10.12 06:47:31 | 000,000,955 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 genuine.microsoft.com
O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com
O1 - Hosts: 127.0.0.1 sls.microsoft.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll File not found
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll File not found
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (Soda PDF Helper) - {5CFCAFF6-5BB0-4864-B626-021C99ED82E5} - C:\Program Files (x86)\Soda PDF\PDFIEHelper.dll (LULU Software)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll File not found
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Soda PDF Toolbar) - {980EB9EC-6EB5-4258-BDDB-EFE25C5F99EF} - C:\Program Files (x86)\Soda PDF\PDFIEPlugin.dll (LULU Software)
O3 - HKCU\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4:64bit: - HKLM..\Run: []  File not found
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AtwtusbIcon] C:\Windows\SysNative\AtwtusbIcon.exe ()
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [itype] c:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RivaTunerStatisticsServer] 1 File not found
O4:64bit: - HKLM..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [XboxStat] C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation)
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found
O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [DeathAdder] C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe ()
O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [RTSS] C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\Tools\RTSS\RTSSWrapper.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [EADM] C:\Program Files (x86)\Origin\Origin.exe (Electronic Arts)
O4 - HKCU..\Run: [Erdmdq] C:\Users\Ivan\AppData\Roaming\Erdmdq.exe (Thorsten Blauhut hxxp://www.desksave.de)
O4 - HKCU..\Run: [Macroplant.AFConnect] C:\Program Files (x86)\Macroplant\Awesome Files Connect\AFConnectPC.exe File not found
O4 - HKCU..\Run: [Yrdmdk] C:\Users\Ivan\AppData\Roaming\Yrdmdk.exe File not found
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\Ivan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RivaTuner.lnk = C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTunerWrapper.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: &Enviar a OneNote - res://C:\PROGRA~2\MICROS~4\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Ivan\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Ivan\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~4\OFFICE11\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: &Enviar a OneNote - res://C:\PROGRA~2\MICROS~4\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\Ivan\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Ivan\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~4\OFFICE11\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0CD5EECB-BECE-4CF7-8249-FD243E3A599D}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B1B79A99-B34E-4820-96C2-AEA18C77C4F3}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - Unable to obtain root file information for disk N:\
O32 - AutoRun File - [2011.10.12 19:48:30 | 000,014,108 | ---- | M] () - O:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{9f3d0342-4587-11e0-a220-b075c0b65e30}\Shell - "" = AutoRun
O33 - MountPoints2\{9f3d0342-4587-11e0-a220-b075c0b65e30}\Shell\AutoRun\command - "" = M:\autorun.exe
O33 - MountPoints2\{9f3d03f7-4587-11e0-a220-b075c0b65e30}\Shell - "" = AutoRun
O33 - MountPoints2\{9f3d03f7-4587-11e0-a220-b075c0b65e30}\Shell\AutoRun\command - "" = J:\laucher.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.10.12 20:58:13 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Users\Ivan\Desktop\OTL.exe
[2011.10.12 19:59:06 | 000,000,000 | ---D | C] -- C:\Users\Ivan\Desktop\space_invaders_excel
[2011.10.12 19:51:33 | 000,000,000 | ---D | C] -- C:\Users\Ivan\AppData\Roaming\Malwarebytes
[2011.10.12 19:51:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.10.12 19:51:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.10.12 19:51:20 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.10.12 19:51:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.10.12 19:50:54 | 009,852,544 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Ivan\Desktop\mbam-setup-1.51.2.1300.exe
[2011.10.12 19:50:13 | 000,848,856 | ---- | C] (Panda Security                                              ) -- C:\Users\Ivan\Desktop\USBVaccineSetup.exe
[2011.10.12 19:36:20 | 000,274,432 | ---- | C] (Thorsten Blauhut hxxp://www.desksave.de) -- C:\Users\Ivan\AppData\Roaming\Erdmdq.exe
[2011.10.12 06:41:37 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
[2011.10.12 06:39:52 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2011.10.12 06:39:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2011.10.12 06:37:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe AIR
[2011.10.11 23:44:51 | 000,000,000 | ---D | C] -- C:\Users\Ivan\Desktop\Adobe_PS_CS5_PORTABLE
[2011.10.11 22:03:32 | 000,000,000 | ---D | C] -- C:\Users\Ivan\Desktop\Desktop
[2011.10.10 22:32:58 | 000,000,000 | ---D | C] -- C:\Users\Ivan\Desktop\Southpark
[2011.10.10 21:42:55 | 000,000,000 | ---D | C] -- C:\Boot
[2011.10.10 18:24:20 | 000,000,000 | ---D | C] -- C:\ProgramData\MSScanAppDataDir
[2011.10.09 19:27:47 | 000,000,000 | ---D | C] -- C:\PPFS_Tools
[2011.10.09 19:27:47 | 000,000,000 | ---D | C] -- C:\PPF_Scan1
[2011.10.08 22:14:12 | 000,000,000 | ---D | C] -- C:\Users\Ivan\AppData\Roaming\Origin
[2011.10.08 22:14:07 | 000,000,000 | ---D | C] -- C:\Users\Ivan\AppData\Local\Origin
[2011.10.08 22:14:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
[2011.10.08 22:13:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin Games
[2011.10.08 22:13:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin
[2011.10.08 22:13:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin
[2011.10.06 20:47:31 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJEGV
[2011.10.05 21:21:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WebMatte
[2011.10.05 21:21:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\KYE
[2011.10.05 21:21:06 | 000,000,000 | ---D | C] -- C:\Windows\Album
[2011.10.05 20:50:28 | 000,000,000 | ---D | C] -- C:\Users\Ivan\AppData\Local\{A567BD4D-A726-4202-83C7-608061F8B4C6}
[2011.10.05 20:50:16 | 000,000,000 | ---D | C] -- C:\Users\Ivan\AppData\Local\{A2E4ECBA-9F4B-4B4E-A37C-5CC73A09E065}
[2011.10.05 18:38:09 | 000,000,000 | ---D | C] -- C:\Users\Ivan\Roaming
[2011.10.05 18:38:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Roaming
[2011.10.05 18:37:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless
[2011.10.05 18:37:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Intel
[2011.10.05 18:37:05 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel
[2011.10.05 18:37:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cisco
[2011.10.04 20:00:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Connectify
[2011.09.26 00:54:56 | 000,000,000 | ---D | C] -- C:\Users\Ivan\Start Menu
[2011.09.25 16:00:56 | 000,000,000 | ---D | C] -- C:\Users\Ivan\Documents\Soda PDF Files
[2011.09.25 16:00:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Soda PDF
[2011.09.25 16:00:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Soda PDF
[2011.09.25 14:40:29 | 000,000,000 | ---D | C] -- C:\Users\Ivan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SignSIS-GUI
[2011.09.25 14:40:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SignSIS-GUI
[2011.09.24 15:18:01 | 000,000,000 | ---D | C] -- C:\Users\Ivan\Documents\Spieldaten
[2011.09.23 20:10:55 | 000,000,000 | ---D | C] -- C:\Users\Ivan\AppData\Local\{5FC15E4F-2B51-4A2E-B28D-5FE17AE312FA}
[2011.09.23 18:57:57 | 000,000,000 | ---D | C] -- C:\Users\Ivan\AppData\Local\ElevatedDiagnostics
[2011.09.22 20:59:06 | 000,031,344 | ---- | C] (Connectify) -- C:\Windows\SysNative\drivers\cnnctfy2.sys
[2011.09.22 20:55:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Application Data
[2011.09.22 20:54:10 | 000,000,000 | ---D | C] -- C:\Users\Ivan\AppData\Roaming\Intel
[2011.09.22 20:53:15 | 000,000,000 | ---D | C] -- C:\Program Files\Intel
[2011.08.12 22:08:37 | 000,065,024 | ---- | C] (Microsoft) -- C:\Users\Ivan\AppData\Roaming\WindowsApplication1.exe
[22 C:\Users\Ivan\AppData\Roaming\*.tmp files -> C:\Users\Ivan\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.10.12 21:02:16 | 000,014,224 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.10.12 21:02:16 | 000,014,224 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.10.12 20:58:13 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\Ivan\Desktop\OTL.exe
[2011.10.12 20:41:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.10.12 20:28:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2486027626-856727729-799267760-1001UA.job
[2011.10.12 19:51:24 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.10.12 19:51:09 | 009,852,544 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Ivan\Desktop\mbam-setup-1.51.2.1300.exe
[2011.10.12 19:50:18 | 000,848,856 | ---- | M] (Panda Security                                              ) -- C:\Users\Ivan\Desktop\USBVaccineSetup.exe
[2011.10.12 19:39:56 | 000,274,432 | ---- | M] (Thorsten Blauhut hxxp://www.desksave.de) -- C:\Users\Ivan\AppData\Roaming\Erdmdq.exe
[2011.10.12 19:36:23 | 000,453,071 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\F1FD.exe
[2011.10.12 19:04:49 | 000,453,071 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\BA3.exe
[2011.10.12 19:02:31 | 004,970,816 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.10.12 19:02:30 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.10.12 19:02:14 | 000,000,302 | -HS- | M] () -- C:\Windows\tasks\Kgryunv.job
[2011.10.12 19:02:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.10.12 19:01:47 | 3220,615,168 | -HS- | M] () -- C:\hiberfil.sys
[2011.10.12 06:29:03 | 000,453,071 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\6279.exe
[2011.10.11 22:37:17 | 107,163,922 | ---- | M] () -- C:\Users\Ivan\Desktop\Adobe_PS_CS5_PORTABLE.rar
[2011.10.11 18:28:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2486027626-856727729-799267760-1001Core.job
[2011.10.11 18:06:41 | 000,453,071 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\5D2C.exe
[2011.10.11 14:08:00 | 000,000,496 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Ivan.job
[2011.10.11 06:08:16 | 000,453,071 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\163F.exe
[2011.10.10 21:31:56 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2011.10.10 21:26:34 | 275,480,054 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011.10.10 20:23:20 | 000,002,544 | ---- | M] () -- C:\Windows\diagwrn.xml
[2011.10.10 20:23:20 | 000,001,890 | ---- | M] () -- C:\Windows\diagerr.xml
[2011.10.09 19:17:18 | 001,652,962 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.10.09 19:17:18 | 000,711,414 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.10.09 19:17:18 | 000,664,404 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.10.09 19:17:18 | 000,154,400 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.10.09 19:17:18 | 000,126,430 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.10.06 18:24:53 | 000,098,112 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\B644.exe
[2011.10.04 20:09:18 | 000,000,369 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\A22.exe
[2011.10.04 18:10:17 | 000,452,408 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\13FC.exe
[2011.10.03 18:02:55 | 000,452,408 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\D654.exe
[2011.10.03 17:56:52 | 000,452,408 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\4C9A.exe
[2011.10.03 17:24:55 | 000,452,408 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\1534.exe
[2011.10.02 17:53:25 | 000,452,418 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\2673.exe
[2011.10.01 23:51:56 | 000,452,418 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\54F9.exe
[2011.09.27 18:09:27 | 000,002,005 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\2387.exe
[2011.09.26 18:11:58 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011.09.26 18:09:03 | 000,459,342 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\6EAA.exe
[2011.09.26 00:54:55 | 000,459,342 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\A4E8.exe
[2011.09.25 18:05:05 | 000,000,600 | ---- | M] () -- C:\Users\Ivan\AppData\Roaming\winscp.rnd
[2011.09.22 20:59:06 | 000,031,344 | ---- | M] (Connectify) -- C:\Windows\SysNative\drivers\cnnctfy2.sys
[2011.09.14 23:22:45 | 000,539,834 | ---- | M] () -- C:\Users\Ivan\Documents\IMG_11042011_213134.png
[22 C:\Users\Ivan\AppData\Roaming\*.tmp files -> C:\Users\Ivan\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.10.12 19:51:24 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.10.12 19:36:23 | 000,453,071 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\F1FD.exe
[2011.10.12 19:04:49 | 000,453,071 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\BA3.exe
[2011.10.12 06:41:21 | 000,001,093 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5.1 (64 Bit).lnk
[2011.10.12 06:40:53 | 000,001,223 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5.1.lnk
[2011.10.12 06:39:26 | 000,001,185 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS5.1.lnk
[2011.10.12 06:39:10 | 000,001,278 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS5.5.lnk
[2011.10.12 06:37:58 | 000,001,379 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS5.5.lnk
[2011.10.12 06:37:53 | 000,001,551 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.5.lnk
[2011.10.12 06:37:26 | 000,000,997 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2011.10.12 06:29:03 | 000,453,071 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\6279.exe
[2011.10.11 22:33:58 | 107,163,922 | ---- | C] () -- C:\Users\Ivan\Desktop\Adobe_PS_CS5_PORTABLE.rar
[2011.10.11 18:06:41 | 000,453,071 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\5D2C.exe
[2011.10.11 06:08:16 | 000,453,071 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\163F.exe
[2011.10.10 20:44:10 | 3220,615,168 | -HS- | C] () -- C:\hiberfil.sys
[2011.10.10 20:22:01 | 000,383,786 | RHS- | C] () -- C:\bootmgr
[2011.10.10 19:16:01 | 000,002,544 | ---- | C] () -- C:\Windows\diagwrn.xml
[2011.10.10 19:16:01 | 000,001,890 | ---- | C] () -- C:\Windows\diagerr.xml
[2011.10.06 18:24:53 | 000,098,112 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\B644.exe
[2011.10.04 20:09:18 | 000,000,369 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\A22.exe
[2011.10.04 18:10:17 | 000,452,408 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\13FC.exe
[2011.10.03 18:02:55 | 000,452,408 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\D654.exe
[2011.10.03 17:56:52 | 000,452,408 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\4C9A.exe
[2011.10.03 17:24:55 | 000,452,408 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\1534.exe
[2011.10.02 17:53:25 | 000,452,418 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\2673.exe
[2011.10.01 23:51:56 | 000,452,418 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\54F9.exe
[2011.09.27 18:09:27 | 000,002,005 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\2387.exe
[2011.09.26 18:09:03 | 000,459,342 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\6EAA.exe
[2011.09.26 00:54:55 | 000,459,342 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\A4E8.exe
[2011.09.23 20:38:31 | 275,480,054 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011.09.14 23:20:17 | 000,539,834 | ---- | C] () -- C:\Users\Ivan\Documents\IMG_11042011_213134.png
[2011.09.05 18:08:34 | 000,007,451 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\734B.exe
[2011.08.13 02:11:39 | 000,036,892 | ---- | C] () -- C:\Windows\SysWow64\bassmod.dll
[2011.08.13 00:09:22 | 000,189,248 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.08.13 00:09:22 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.08.12 22:34:05 | 000,064,512 | RHS- | C] () -- C:\Windows\SysWow64\twnlib4G.dll
[2011.08.09 14:10:50 | 000,000,600 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\winscp.rnd
[2011.06.27 17:32:42 | 000,000,056 | ---- | C] () -- C:\Windows\Tkkg_7.ini
[2011.06.27 12:13:17 | 000,017,408 | ---- | C] () -- C:\Users\Ivan\AppData\Local\WebpageIcons.db
[2011.06.25 16:13:29 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.06.24 19:08:14 | 000,000,105 | R--- | C] () -- C:\ProgramData\Ppster.ini
[2011.06.02 00:39:55 | 000,080,256 | ---- | C] () -- C:\Windows\SysWow64\ezGOSvc.dll
[2011.05.29 11:44:51 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat
[2011.05.23 11:46:18 | 000,475,136 | ---- | C] () -- C:\Windows\SysWow64\wall.dll
[2011.05.12 13:04:37 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe
[2011.04.19 17:44:35 | 000,174,080 | ---- | C] () -- C:\Users\Ivan\AppData\Roaming\chrtmp
[2011.04.11 17:28:05 | 000,000,410 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011.04.07 14:00:20 | 000,005,120 | ---- | C] () -- C:\Users\Ivan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.03 11:22:17 | 000,000,056 | ---- | C] () -- C:\Windows\Tkkg_8.ini
[2011.03.19 12:25:18 | 000,138,460 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2011.03.14 20:44:20 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2011.03.11 17:28:44 | 000,000,092 | ---- | C] () -- C:\Users\Ivan\AppData\Local\fusioncache.dat
[2011.03.10 18:14:40 | 001,629,984 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.02.24 20:50:49 | 000,000,534 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.02.23 15:20:52 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\cd.dat
[2011.02.21 20:46:59 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.07.16 11:18:32 | 000,496,360 | ---- | C] () -- C:\Windows\RmTablet.exe
[2009.10.26 21:06:06 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2009.09.14 19:05:04 | 000,808,240 | ---- | C] () -- C:\Windows\SysWow64\imagxra7.dll
[2009.09.14 19:05:04 | 000,374,064 | ---- | C] () -- C:\Windows\SysWow64\twnlib4.dll
[2009.09.14 19:05:02 | 000,263,472 | ---- | C] () -- C:\Windows\SysWow64\imagxr7.dll
[2009.09.14 19:05:00 | 001,762,608 | ---- | C] () -- C:\Windows\SysWow64\imagx7.dll
[2009.09.14 19:04:54 | 000,497,296 | R--- | C] () -- C:\Windows\SysWow64\imagxpr7.dll
[2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2003.02.20 18:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\SysWow64\OUTLPERF.INI

< End of report >
         

OTL Extras logfile created on: 12.10.2011 20:59:08 - Run 1
OTL by OldTimer - Version 3.2.29.1     Folder = C:\Users\Ivan\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 1,34 Gb Available Physical Memory | 33,45% Memory free
8,00 Gb Paging File | 5,23 Gb Available in Paging File | 65,35% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 913,15 Gb Total Space | 576,23 Gb Free Space | 63,10% Space Free | Partition Type: NTFS
Drive D: | 13,87 Gb Total Space | 1,89 Gb Free Space | 13,63% Space Free | Partition Type: NTFS
Drive F: | 4,49 Gb Total Space | 0,07 Gb Free Space | 1,45% Space Free | Partition Type: NTFS
Drive N: | 7,38 Gb Total Space | 5,81 Gb Free Space | 78,67% Space Free | Partition Type: FAT32
Drive O: | 1397,26 Gb Total Space | 991,87 Gb Free Space | 70,99% Space Free | Partition Type: NTFS
 
Computer Name: IVAN-PC | User Name: Ivan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP560_series" = Canon MP560 series MP Drivers
"{11BA2B00-1495-47B8-BFA8-D08C605AB2CC}" = Windows Live Family Safety
"{1444D2EE-C7AD-44A8-844F-2634B49353D1}" = Logitech Gaming Software 5.10
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{439760BC-7737-4386-9B1D-A90A3E8A22EA}" = Apple Mobile Device Support
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{5F94D3B9-2B02-9C37-740B-A59C7B8D17CC}" = ATI Catalyst Install Manager
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{66A4349A-AA55-43E5-A781-62867A701A90}" = USB Tablet Manager
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{90140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-1000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-1000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-1000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-1000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-1000-0000000FF1CE}_Office14.PROPLUS_{70A3169E-288F-454F-A08D-20DF66639B50}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUS_{0242505C-4E90-407F-9299-B5B275F50D86}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUS_{B51389C8-2890-4633-81D8-47D2A7402274}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-1000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-1000-0000000FF1CE}_Office14.PROPLUS_{3013A793-10A7-4D1F-B8B4-2FAA82F4D259}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-1000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-1000-0000000FF1CE}_Office14.PROPLUS_{98782D5D-A9EE-43C6-88AD-B50AD8530E78}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010
"{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0407-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (German) 2010
"{90140000-0043-0407-1000-0000000FF1CE}_Office14.PROPLUS_{8DFD91C7-66AE-4E54-9901-5D5F401AD329}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-1000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-1000-0000000FF1CE}_Office14.PROPLUS_{8299B64F-1537-4081-974C-033EAB8F098E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-1000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90BF0360-A1DB-4599-A643-95AB90A52C1E}" = Microsoft_VC90_MFCLOC_x86_x64
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-007D-0409-1000-0000000FF1CE}" = Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit
"{95140000-007F-0407-1000-0000000FF1CE}" = Microsoft Outlook Hotmail Connector 64-Bit
"{98C8DF59-BE5F-4EC2-9B12-FD2A54928EDB}" = Microsoft IntelliType Pro 8.0
"{997C9EC4-B53D-479D-81B7-0AEC8D174BA1}" = iTunes
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{A792E67C-FDA4-A301-0C3C-53BA86EFBB5A}" = ccc-utility64
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{AF162E20-417F-4946-A06D-65734984957F}" = Intel(R) PROSet/Wireless WiFi-Software
"{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}" = Microsoft Xbox 360 Accessories 1.2
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{CA0D2F09-F811-48D4-843E-C87696C6A9D9}" = Bonjour
"{CEA21F20-DBF4-464C-8B81-28B8508AFDDD}" = Windows Live Family Safety
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"ProInst" = Intel PROSet Wireless
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{16C3C822-052E-4CD7-8CEB-AE5352F1E76E}_is1" = Macro Recorder 4.69.0
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 26
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3D6A24EA-A543-6C84-351E-D7646E7AB86E}" = Catalyst Control Center InstallProxy
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{47CAFF95-C3D8-ABF2-70BC-89DE00D8FB19}" = Catalyst Control Center Graphics Light
"{4962EBAC-AE7C-1B22-1EA0-0916A7E40954}" = Catalyst Control Center Graphics Full Existing
"{49A62E2B-B35C-941D-DF48-601207CF14C0}" = Catalyst Control Center Graphics Previews Common
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{6A490E11-6C8A-777C-4E00-43F3CC16A1EC}" = CCC Help English
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72651B0D-1313-4F03-96B7-47A04E2F24E1}" = WebMate
"{72736F5F-520D-472A-88CC-7B02872FD34E}" = ATI Catalyst Registration
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{735619D4-B42A-437A-958C-199BFCAEDB38}" = Safari
"{77919701-C3E7-09AA-D2F7-DBF42CD7C13D}" = Catalyst Control Center HydraVision Full
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{78B2F09F-BDC7-7865-CF4C-233B64A3BE51}" = Catalyst Control Center Graphics Full New
"{82EF29B1-9B60-4142-A155-0599216DD053}" = LightScribe System Software
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8537166B-40F4-4FAE-BAC5-454A4DD773B7}" = Power Presenter RE II
"{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}" = Assassin's Creed II
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial 
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_VISPRO_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_VISPRO_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_VISPRO_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_VISPRO_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)soft Office Proof (Italian) 2007

"{90120000-002A-0000-1000-0000000FF1CE}_VISPRO_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-002A-0407-1000-0000000FF1CE}_VISPRO_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007
"{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{0FD405D3-CAF8-4CA6-8BFD-911D2F8A6585}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0054-0407-0000-0000000FF1CE}" = Microsoft Office Visio MUI (German) 2007
"{90120000-0054-0407-0000-0000000FF1CE}_VISPRO_{60CC0F2D-BFA0-4851-903D-809D876DD87B}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_VISPRO_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9158FF30-78D7-40EF-B83E-451AC5334640}" = Adobe Photoshop CS5.1
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.1) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{BE4BA698-8533-4F77-9559-C7F3F78C0B05}" = Assassin's Creed Brotherhood
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die*Sims™*3
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D241BBEC-B1C7-7953-EDDE-D90A654A8D2C}" = ccc-core-static
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D5C24E77-099E-9B84-5BE2-708E70B938A9}" = Catalyst Control Center Core Implementation
"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DC4757E2-BAE3-0BFE-C6E5-576CB911FF52}" = Catalyst Control Center Graphics Previews Vista
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2E7BF69-F0FF-42F5-9486-4829CA051450}" = Soda PDF
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EB1B8449-CD8F-485B-ADB6-02FBCFE180D3}" = Razer DeathAdder(TM) Mouse
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony Ericsson PC Companion 2.01.210
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FD9C31B6-F572-414D-81E3-89368C97A125}_is1" = CamStudio OSS Desktop Recorder
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.13 (Unicode)
"Canon MP560 series Benutzerregistrierung" = Canon MP560 series Benutzerregistrierung
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"DAEMON Tools Lite" = DAEMON Tools Lite
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"FormatFactory" = FormatFactory 2.60
"Free Studio_is1" = Free Studio version 5.0.8
"GOM Player" = GOM Player
"JDownloader" = JDownloader
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.2.1300
"Mozilla Firefox 6.0.2 (x86 de)" = Mozilla Firefox 6.0.2 (x86 de)
"MP Navigator EX 3.0" = Canon MP Navigator EX 3.0
"NSS" = Norton Security Scan
"Opera 11.51.1087" = Opera 11.51
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"RealVNC_is1" = VNC Free Edition 4.1.3
"RivaTuner" = RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
"Steam App 10" = Counter-Strike
"Steam App 42700" = Call of Duty: Black Ops
"Steam App 42710" = Call of Duty: Black Ops - Multiplayer
"TeamViewer 6" = TeamViewer 6
"UltraISO_is1" = UltraISO Premium V9.36
"VISPRO" = Microsoft Office Visio Professional 2007
"VLC media player" = VLC media player 1.1.8
"WinLiveSuite" = Windows Live Essentials
"winscp3_is1" = WinSCP 4.3.1 beta
"YTdetect" = Yahoo! Detect
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         

Freundliche Grüsse

SpeeDex

So und hier sind noch meine installierten Programme, vielen Dank das du dir die Zeit dafüt nimmst =)

Adobe AIR	Adobe Systems Inc.	11.10.2011		2.5.1.17730
Adobe Community Help	Adobe Systems Incorporated.	11.10.2011		3.4.980
Adobe Flash Player 10 ActiveX	Adobe Systems Incorporated	06.04.2011	6,00MB	10.2.153.1
Adobe Flash Player 10 Plugin	Adobe Systems Incorporated	25.09.2011	6,00MB	10.3.183.10
Adobe Photoshop CS5.1	Adobe Systems Incorporated	11.10.2011	3.033MB	12.1
Adobe Reader X (10.1.1) - Deutsch	Adobe Systems Incorporated	23.09.2011	167,5MB	10.1.1
Adobe Shockwave Player 11.6	Adobe Systems, Inc.	08.09.2011		11.6.1.629
Apple Application Support	Apple Inc.	22.08.2011	60,2MB	2.0.1
Apple Mobile Device Support	Apple Inc.	09.06.2011	22,7MB	3.4.1.2
Apple Software Update	Apple Inc.	26.06.2011	2,25MB	2.1.3.127
Assassin's Creed	Ubisoft	09.09.2011		1.00
Assassin's Creed Brotherhood	Ubisoft	12.08.2011		1.03
Assassin's Creed II	Ubisoft	12.08.2011		1.00
ATI Catalyst Install Manager	ATI Technologies, Inc.	13.08.2011	22,1MB	3.0.762.0
Audacity 1.3.13 (Unicode)	Audacity Team	02.07.2011	40,2MB	
Bonjour	Apple Inc.	15.08.2011	1,54MB	3.0.0.2
Call of Duty: Black Ops	Treyarch	24.02.2011		
Call of Duty: Black Ops - Multiplayer	Treyarch	24.02.2011		
CamStudio OSS Desktop Recorder	CamStudio Open Source Dev Team	07.08.2011	14,9MB	2.6 Beta r294
Canon Easy-WebPrint EX		14.03.2011		
Canon IJ Network Scan Utility		14.03.2011		
Canon IJ Network Tool		14.03.2011		
Canon Inkjet Printer/Scanner/Fax Extended Survey Program		14.03.2011		
Canon MP Navigator EX 3.0		14.03.2011		
Canon MP560 series Benutzerregistrierung		14.03.2011		
Canon MP560 series MP Drivers		14.03.2011		
Canon Utilities Easy-PhotoPrint EX		14.03.2011		
Canon Utilities My Printer		14.03.2011		
Canon Utilities Solution Menu		14.03.2011		
CCleaner	Piriform	12.08.2011		3.09
Counter-Strike	Valve	06.08.2011		
DAEMON Tools Lite	DT Soft Ltd	02.03.2011		4.40.2.0131
Die*Sims™*3	Electronic Arts	09.07.2011		1.0.631
FormatFactory 2.60	Free Time	13.04.2011		2.60
Free Studio version 5.0.8	DVDVideoSoft Limited.	19.04.2011	256MB	
GOM Player	Gretech Corporation	20.02.2011		2.1.28.5039
Google Chrome	Google Inc.	05.04.2011		14.0.835.202
Intel(R) PROSet/Wireless WiFi-Software	Intel Corporation	04.10.2011	137,6MB	14.00.0000
iTunes	Apple Inc.	22.08.2011	142,0MB	10.4.1.10
Java(TM) 6 Update 26	Oracle	07.03.2011	96,9MB	6.0.260
JDownloader	AppWork UG (haftungsbeschränkt)	20.02.2011		
LightScribe System Software	LightScribe	19.04.2011	22,5MB	1.18.6.1
Logitech Gaming Software 5.10	Logitech	25.02.2011	15,3MB	5.10.127
Macro Recorder 4.69.0	Jitbit Software	08.05.2011	5,65MB	4.69.0
Malwarebytes' Anti-Malware Version 1.51.2.1300	Malwarebytes Corporation	11.10.2011	13,8MB	1.51.2.1300
Microsoft .NET Framework 1.1	Microsoft	10.03.2011	34,8MB	1.1.4322
Microsoft .NET Framework 4 Client Profile	Microsoft Corporation	23.02.2011	38,8MB	4.0.30319
Microsoft .NET Framework 4 Client Profile DEU Language Pack	Microsoft Corporation	23.02.2011	2,94MB	4.0.30319
Microsoft .NET Framework 4 Extended	Microsoft Corporation	09.03.2011	52,0MB	4.0.30319
Microsoft IntelliType Pro 8.0	Microsoft	20.02.2011	34,8MB	8.0.225.0
Microsoft Office File Validation Add-In	Microsoft Corporation	21.09.2011	7,95MB	14.0.5130.5003
Microsoft Office Professional Edition 2003	Microsoft Corporation	17.09.2011	790MB	11.0.8173.0
Microsoft Office Professional Plus 2010	Microsoft Corporation	19.09.2011		14.0.6029.1000
Microsoft Office Visio Professional 2007	Microsoft Corporation	08.09.2011		12.0.6425.1000
Microsoft Outlook Hotmail Connector 64-Bit	Microsoft Corporation	02.06.2011	4,68MB	14.0.5139.5001
Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit	Microsoft Corporation	07.08.2011	1,96MB	14.0.5120.5000
Microsoft Silverlight	Microsoft Corporation	15.06.2011	120,1MB	4.0.60531.0
Microsoft SQL Server 2005 Compact Edition [ENU]	Microsoft Corporation	20.02.2011	1,70MB	3.1.0000
Microsoft Visual C++ 2005 Redistributable	Microsoft Corporation	15.06.2011	0,29MB	8.0.59193
Microsoft Visual C++ 2005 Redistributable (x64)	Microsoft Corporation	25.02.2011	0,61MB	8.0.61000
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175	Microsoft Corporation	12.04.2011	0,57MB	8.0.51011
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148	Microsoft Corporation	22.02.2011	0,21MB	9.0.30729.4148
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148	Microsoft Corporation	22.02.2011	0,20MB	9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570	Microsoft Corporation	12.04.2011	0,77MB	9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570	Microsoft Corporation	12.04.2011	0,58MB	9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17	Microsoft Corporation	22.02.2011	0,77MB	9.0.30729
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148	Microsoft Corporation	09.03.2011	0,76MB	9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161	Microsoft Corporation	15.06.2011	0,77MB	9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17	Microsoft Corporation	21.02.2011	0,58MB	9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148	Microsoft Corporation	19.04.2011	0,22MB	9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161	Microsoft Corporation	15.06.2011	0,59MB	9.0.30729.6161
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219	Microsoft Corporation	10.10.2011	13,8MB	10.0.40219
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219	Microsoft Corporation	10.10.2011	15,0MB	10.0.40219
Microsoft WSE 3.0 Runtime	Microsoft Corp.	09.07.2011	0,92MB	3.0.5305.0
Microsoft Xbox 360 Accessories 1.2	Microsoft	10.04.2011	7,82MB	1.20.146.0
Mozilla Firefox 6.0.2 (x86 de)	Mozilla	07.09.2011	32,6MB	6.0.2
Norton Security Scan	Symantec Corporation	01.05.2011		2.7.6.13
Opera 11.51	Opera Software ASA	11.09.2011		11.51.1087
Origin	Electronic Arts, Inc.	07.10.2011		8.2.6.475
Paint.NET v3.5.10	dotPDN LLC	09.10.2011	10,7MB	3.60.0
Power Presenter RE II	Software	23.06.2011		2.53.00
PunkBuster Services	Even Balance, Inc.	12.08.2011		0.990
QuickTime	Apple Inc.	22.08.2011	73,0MB	7.70.80.34
Razer DeathAdder(TM) Mouse	Razer USA Ltd.	06.03.2011		3.02
Realtek High Definition Audio Driver	Realtek Semiconductor Corp.	03.06.2011		6.0.1.5910
RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition	Alexey Nicolaychuk	10.03.2011		v2.24 MSI Master Overclocking Arena 2009 edition
Safari	Apple Inc.	22.08.2011	43,4MB	5.34.50.0
Skype Toolbars	Skype Technologies S.A.	29.06.2011	5,84MB	5.3.7555
Skype™ 5.3	Skype Technologies S.A.	29.06.2011	16,6MB	5.3.120
Soda PDF	LULU Software	24.09.2011	87,3MB	1.2.155.1729
Sony Ericsson PC Companion 2.01.210	Sony Ericsson	06.08.2011	17,1MB	2.01.210
Steam	Valve Corporation	24.02.2011	1,49MB	1.0.0.0
TeamSpeak 3 Client	TeamSpeak Systems GmbH	22.02.2011		
TeamViewer 6	TeamViewer GmbH	25.03.2011		6.0.10418
Ubisoft Game Launcher	UBISOFT	12.08.2011		1.0.0.0
UltraISO Premium V9.36		02.04.2011		
VLC media player 1.1.8	VideoLAN	26.03.2011		1.1.8
VNC Free Edition 4.1.3	RealVNC Ltd.	07.09.2011		4.1.3
WebMate	KYE	04.10.2011		2.00.000
Windows Live Essentials	Microsoft Corporation	08.08.2011		15.4.3538.0513
Windows Live Mesh ActiveX control for remote connections	Microsoft Corporation	20.02.2011	5,58MB	15.4.5722.2
WinRAR		24.02.2011		
WinSCP 4.3.1 beta	Martin Prikryl	08.08.2011	8,63MB	4.3.1 beta
         

Das Installieren von "nicht legal erworbene Software" ist eine ziemlich sichere Methode, ein Rechner zu infizieren:

c:\program files (x86)\Ubisoft\ubisoft game launcher\ubiorbitapi_r2.dll (Trojan.Agent.CK)
c:\Users\Ivan\family guy\adobe.photoshop.cs5.1.extended.v12.1.european.incl.keymaker-core\CORE10k.EXE (Dont.Steal.Our.Software)
c:\Users\Ivan\family guy\neu\garmin keygen v1.5.exe (RiskWare.Tool.CK) 
c:\Users\Ivan\family guy\softwarep\neu\garmin keygen v1.5.exe (RiskWare.Tool.CK) 
o:\Games\assassins.creed.2.multi9.clonedvd-ind\Crack\SKIDROW\ubiorbitapi_r2.dll (Trojan.Agent.CK) 
o:\Games\super.meat.boy.v1.0u11.cracked.read.nfo-theta\nfoviewer.exe
         

Einen durch Keygen [Key Generator/Keymaker] verseuchten PC und eventuell gespeicherte externe Daten auf SB Sticks, ext.Platte etc,, sollte formatiert und neu aufgesetzt werden, weil ja durch gecrackte oder mit Viren verseuchte Software wie auch immer, ein Angreifer erfolgreich in dein System eingedrungen ist:-> *Technische Kompromittierung*
Denn die angebotenen Programme und Dateien enthalten jede erdenkliche Art von Malware/Schadprogramm wie z.B. Backdoors, Rootkits etc, die dann den PC unter Kontrolle nehmen und die Administratorrolle übernehmen können
Weil dieses `selbstzerrstörerischem Verhalten `illegal` ist bzw verstößt gegen das Gesetz, wir dürfen Dir nicht weiter helfen. Aus diesem Grund sehen wir uns gezwungen den Thread zu schließen:-> Forumregel:- Cracks, Keygens und andere illegale Software
Also Du kannst Dir viel Ärger und unnötige Zeitverschwendung ersparen, indem du dein System und auch die externe potenziell verseuchte Platte, USB-Stick etc neu installierst! Aber wenigstens hast Du dann nach einer Neuinstallation wieder ein sauberes System und hoffentlich hast Du was draus gelernt und in Zukunft lässt die Finger von...