Hallo Leute,
hab hier ja schon immer viel mitgelesen, vielen Dank in dem Sinne bereits jetzt
Mein Rechner hat's jetzt auch erwischt und ich kriege den Lockscreen einfach nicht mehr weg, hab schon ein paar Dinge selbst probiert.
Beim Googlen bin ich auf ein paar "Individuallösungen" von den Profis hier gestoßen, daher möchte ich fragen, ob ihr mir nun auch helfen könnt.

Hier meine OTL.txt

OTL Logfile:

OTL logfile created on: 14.07.2012 18:41:29 - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = R:\
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,43 Gb Available Physical Memory | 80,33% Memory free
16,00 Gb Paging File | 14,23 Gb Available in Paging File | 88,96% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 279,46 Gb Total Space | 61,83 Gb Free Space | 22,12% Space Free | Partition Type: NTFS
Drive D: | 195,31 Gb Total Space | 28,58 Gb Free Space | 14,63% Space Free | Partition Type: NTFS
Drive E: | 247,92 Gb Total Space | 0,01 Gb Free Space | 0,00% Space Free | Partition Type: NTFS
Drive F: | 2,97 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive K: | 488,28 Gb Total Space | 13,08 Gb Free Space | 2,68% Space Free | Partition Type: NTFS
Drive R: | 3,76 Gb Total Space | 1,14 Gb Free Space | 30,40% Space Free | Partition Type: FAT32
 
Computer Name: ROCKY | User Name: *** *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.14 18:35:24 | 000,596,480 | ---- | M] (OldTimer Tools) -- R:\OTL.exe
PRC - [2012.05.16 16:27:30 | 007,345,736 | ---- | M] (Bartels Media GmbH) -- C:\Program Files (x86)\PhraseExpress\phraseexpress.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,981,680 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.09.09 19:46:10 | 008,158,720 | ---- | M] () -- C:\XAMPP\mysql\bin\mysqld.exe
PRC - [2011.06.28 22:38:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.04.28 12:07:54 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011.01.05 10:18:50 | 000,133,432 | ---- | M] (ICQ, LLC.) -- C:\Program Files (x86)\ICQ7.2\ICQ.exe
PRC - [2010.12.27 18:29:34 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2009.08.27 17:09:10 | 001,253,376 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
PRC - [2008.11.18 13:15:30 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.07.14 03:41:01 | 000,197,632 | ---- | M] () -- C:\Users\***KA~1\AppData\Local\Temp\fest0r_ot.exe
MOD - [2012.05.16 16:27:22 | 000,385,608 | ---- | M] () -- C:\Program Files (x86)\PhraseExpress\pexlang.dll
MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.01.05 10:18:56 | 000,733,184 | ---- | M] () -- C:\Program Files (x86)\ICQ7.2\MDb.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.05.27 18:59:40 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.07.11 23:55:34 | 000,250,056 | ---- | M] (*** Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (***FlashPlayerUpdateSvc)
SRV - [2012.06.28 10:55:17 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.02.29 09:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.09.09 19:46:10 | 008,158,720 | ---- | M] () [Auto | Running] -- C:\XAMPP\mysql\bin\mysqld.exe -- (mysql)
SRV - [2011.06.28 22:38:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.04.28 12:07:54 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.28 22:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.12.13 14:37:16 | 000,194,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc)
SRV - [2010.04.10 18:36:15 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (*** Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\***\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.08.27 17:09:10 | 001,253,376 | ---- | M] (MAGIX AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.11.18 13:15:30 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2008.08.07 11:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2008.02.01 04:02:26 | 000,065,536 | ---- | M] (PostgreSQL Global Development Group) [Auto | Stopped] -- C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe -- (pgsql-8.3)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.03.27 21:58:03 | 000,564,792 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.11.18 21:26:18 | 000,021,832 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2011.06.28 22:38:02 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.06.28 22:38:02 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.09 09:11:24 | 000,043,520 | ---- | M] (ZOOM) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\zmhhpau.sys -- (ZMHHPAudioSrv)
DRV:64bit: - [2011.03.04 21:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.12.13 14:37:18 | 000,036,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nx6000.sys -- (MSHUSBVideo)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.07.12 14:49:14 | 000,072,648 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ftdibus.sys -- (FTDIBUS)
DRV:64bit: - [2010.07.12 14:48:50 | 000,085,320 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ftser2k.sys -- (FTSER2K)
DRV:64bit: - [2010.05.27 19:39:12 | 006,856,192 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2010.05.27 19:39:12 | 006,856,192 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.05.27 18:25:36 | 000,264,192 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010.05.06 11:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2010.04.19 14:53:24 | 000,032,768 | ---- | M] (ELTIMA Software) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\evsbc.sys -- (VSBC) Virtual Serial Bus Enumerator (Eltima Software)
DRV:64bit: - [2010.03.08 19:37:00 | 000,125,440 | ---- | M] () [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\acedrv07.sys -- (acedrv07)
DRV:64bit: - [2009.12.01 16:49:52 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc)
DRV:64bit: - [2009.10.16 06:44:56 | 001,309,696 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\P17.sys -- (P17)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:06:43 | 000,060,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\61883.sys -- (61883)
DRV:64bit: - [2009.07.14 02:06:43 | 000,048,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avc.sys -- (Avc)
DRV:64bit: - [2009.07.14 02:06:42 | 000,061,440 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msdv.sys -- (MSDV)
DRV:64bit: - [2009.06.10 22:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.03 00:58:24 | 000,507,392 | ---- | M] (ITETech ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AF15BDA.sys -- (AF15BDA)
DRV:64bit: - [2009.05.18 15:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.01.19 20:32:22 | 000,334,344 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11)
DRV:64bit: - [2008.12.26 12:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer) Avnex Virtual Audio Device (WDM)
DRV:64bit: - [2008.06.27 08:51:10 | 000,088,632 | ---- | M] (*** Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\adfs.sys -- (adfs)
DRV:64bit: - [2008.05.20 02:02:04 | 000,067,072 | ---- | M] (ELTIMA Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evserial.sys -- (evserial) Virtual Serial Ports Driver (Eltima Softwate)
DRV:64bit: - [2007.11.12 05:00:50 | 000,623,872 | ---- | M] (Atheros Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WlanUZ64.sys -- (ZY202_64)
DRV:64bit: - [2007.05.11 01:12:48 | 000,031,744 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\libusb0.sys -- (libusb0)
DRV:64bit: - [2007.01.18 09:23:10 | 000,045,440 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RecFltr.sys -- (RecFltr)
DRV:64bit: - [2007.01.06 23:05:26 | 000,236,032 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RTL8187.sys -- (RTL8187)
DRV:64bit: - [2006.11.06 08:56:30 | 000,030,528 | ---- | M] (Brother Industries Ltd.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\brpar64a.sys -- (BrPar)
DRV - [2012.05.10 15:05:38 | 000,030,592 | ---- | M] (REALiX(tm)) [Kernel | System | Running] -- C:\Programme\HWiNFO64\HWiNFO64A.SYS -- (HWiNFO32)
DRV - [2010.03.10 22:23:48 | 000,024,104 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\gdrv.sys -- (gdrv)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009.02.24 05:08:34 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\SSPORT.SYS -- (SSPORT)
DRV - [2007.01.06 22:05:26 | 000,236,032 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\rtl8187.sys -- (RTL8187)
DRV - [2005.05.25 10:39:14 | 000,007,168 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\RMClock\RTCore64.sys -- (RTCore64)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 95 2E 74 A3 14 E6 CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope = {C6FC6338-0AED-494A-820D-C5ECCB9A0BA3}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=111304&babsrc=SP_ss&mntrId=d86824bd0000000000007a7905998ccf
IE - HKCU\..\SearchScopes\{C1B3246A-6416-4AD9-9268-9158E12A4A07}: "URL" = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms}
IE - HKCU\..\SearchScopes\{C6FC6338-0AED-494A-820D-C5ECCB9A0BA3}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 192.168.8.1:3128
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: calendar-timezones@mozilla.org:0.1.2008d
FF - prefs.js..extensions.enabledItems: default-palette@celtx.com:1.0
FF - prefs.js..extensions.enabledItems: emoticons-msn-smileys@m513901.de:0.1
FF - prefs.js..extensions.enabledItems: inspector@mozilla.org:2.0.0
FF - prefs.js..extensions.enabledItems: messagestyle-blackened@addons.instantbird.org:0.9
FF - prefs.js..extensions.enabledItems: messagestyle-depth@addons.instantbird.org:1.1
FF - prefs.js..extensions.enabledItems: messagestyle-minimal20@addons.instantbird.org:1.5
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@***.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@***.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\*** ***\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\*** ***\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\*** ***\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files (x86)\***\*** Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010.05.17 13:42:01 | 000,000,000 | ---D | M]
 
[2012.04.22 17:11:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*** ***\AppData\Roaming\mozilla\Extensions
[2010.05.09 18:50:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*** ***\AppData\Roaming\mozilla\Extensions\celtx@celtx.com
[2012.05.14 19:56:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*** ***\AppData\Roaming\mozilla\Firefox\Profiles\kz4ym609.default\extensions
[2012.04.10 11:39:26 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\*** ***\AppData\Roaming\mozilla\Firefox\Profiles\kz4ym609.default\extensions\ffxtlbr@babylon.com
[2011.07.18 18:27:03 | 000,000,000 | ---D | M] (Facemoods) -- C:\Users\*** ***\AppData\Roaming\mozilla\Firefox\Profiles\kz4ym609.default\extensions\ffxtlbr@Facemoods.com
[2012.05.15 11:20:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*** ***\AppData\Roaming\mozilla\Firefox\Profiles\kz4ym609.default\extensions\firejump@firejump.net
[2010.05.09 17:49:33 | 000,000,000 | ---D | M] (Timezone Definitions for Mozilla Calendar) -- C:\PROGRAM FILES (X86)\CELTX\EXTENSIONS\CALENDAR-TIMEZONES@MOZILLA.ORG
[2010.05.09 17:49:33 | 000,000,000 | ---D | M] (Default Shot Palette) -- C:\PROGRAM FILES (X86)\CELTX\EXTENSIONS\DEFAULT-PALETTE@CELTX.COM
[2010.05.09 17:49:33 | 000,000,000 | ---D | M] (MSN-Smileys) -- C:\PROGRAM FILES (X86)\CELTX\EXTENSIONS\EMOTICONS-MSN-SMILEYS@M513901.DE
[2010.05.09 17:49:33 | 000,000,000 | ---D | M] (DOM Inspector) -- C:\PROGRAM FILES (X86)\CELTX\EXTENSIONS\INSPECTOR@MOZILLA.ORG
[2010.05.09 17:49:33 | 000,000,000 | ---D | M] (Blackened) -- C:\PROGRAM FILES (X86)\CELTX\EXTENSIONS\MESSAGESTYLE-BLACKENED@ADDONS.INSTANTBIRD.ORG
[2010.05.09 17:49:33 | 000,000,000 | ---D | M] (Depth) -- C:\PROGRAM FILES (X86)\CELTX\EXTENSIONS\MESSAGESTYLE-DEPTH@ADDONS.INSTANTBIRD.ORG
[2010.05.09 17:49:33 | 000,000,000 | ---D | M] (Minimal) -- C:\PROGRAM FILES (X86)\CELTX\EXTENSIONS\MESSAGESTYLE-MINIMAL20@ADDONS.INSTANTBIRD.ORG
[2011.07.18 18:27:08 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml
 
========== Chrome ==========
 
CHR - homepage: hxxp://start.facemoods.com/?a=ddrnw
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://start.facemoods.com/?a=ddrnw
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\*** ***\AppData\Local\Google\Chrome\Application\20.0.1132.47\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\*** ***\AppData\Local\Google\Chrome\Application\20.0.1132.47\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\*** ***\AppData\Local\Google\Chrome\Application\20.0.1132.47\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\*** ***\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: *** Acrobat (Disabled) = C:\Program Files (x86)\***\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: DNA Plug-in (Enabled) = C:\Program Files (x86)\DNA\plugins\npbtdna.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Java(TM) Platform SE 6 U32 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.320.5 (Enabled) = C:\Windows\SysWOW64\npdeployJava1.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\*** ***\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\*** ***\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\*** ***\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: YouTube Downloader: MP3 / HD Video Download = C:\Users\*** ***\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokfcbmfpgeajcgkaeigohghnkhjmcbj\13.0_0\
CHR - Extension: Erweiterung \RSS-Abonnement\ (von Google) = C:\Users\*** ***\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbjncdgjeocebhnmkbbbdekmmmcbfjd\2.2.0_0\
 
O1 HOSTS File: ([2010.07.29 22:28:25 | 000,001,390 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1                activate.***.com
O1 - Hosts: 127.0.0.1 activate.***.com
O1 - Hosts: 127.0.0.1 ***.activate.com
O1 - Hosts: 127.0.0.1 practivate.***.com
O1 - Hosts: 127.0.0.1 ereg.***.com
O1 - Hosts: 127.0.0.1 ***ereg.com
O1 - Hosts: 127.0.0.1 activate.wip3.***.com
O1 - Hosts: 127.0.0.1 wip3.***.com
O1 - Hosts: 127.0.0.1 3dns-3.***.com
O1 - Hosts: 127.0.0.1 3dns-2.***.com
O1 - Hosts: 127.0.0.1 ***-dns.***.com
O1 - Hosts: 127.0.0.1 ***-dns-2.***.com
O1 - Hosts: 127.0.0.1 ***-dns-3.***.com
O1 - Hosts: 127.0.0.1 ereg.wip3.***.com
O1 - Hosts: 127.0.0.1 activate-sea.***.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.***.com
O1 - Hosts: 127.0.0.1 activate-sjc0.***.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.***.com
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.7\bh\facemoods.dll File not found
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.7\facemoodsTlbr.dll File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [LifeCam] C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [***Bridge] File not found
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background File not found
O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found
O4 - HKCU..\Run: [Vagex] C:\Users\*** ***\Desktop\Vagex\Vagex\Vagex.exe (Vagex)
O4 - HKCU..\Run: [xNeat Clipboard Manager] C:\Program Files (x86)\xNeat Application Builder\xNeatClipMngr.exe File not found
O4 - Startup: C:\Users\*** ***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HDDlife.lnk = File not found
O4 - Startup: C:\Users\*** ***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\*** ***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab (CDownloadCtrl Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.***.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0435BCE2-A61B-4D36-9E0E-134E0AE7F712}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B2CAD3DD-2BDD-4D00-AA72-4622F8023B80}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.07.29 22:14:56 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009.07.15 21:39:51 | 000,000,122 | R--- | M] () - F:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{01653af1-78a0-11df-a7d7-00241d2eea9c}\Shell - "" = AutoRun
O33 - MountPoints2\{01653af1-78a0-11df-a7d7-00241d2eea9c}\Shell\AutoRun\command - "" = M:\LaunchU3.exe -a
O33 - MountPoints2\{76446dc0-7848-11e1-9373-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{76446dc0-7848-11e1-9373-806e6f6e6963}\Shell\AutoRun\command - "" = S:\AUTORUN.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.14 15:17:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.14 15:17:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.07.14 14:22:05 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012.07.13 19:46:52 | 000,000,000 | ---D | C] -- C:\Users\*** ***\Desktop\SciLorsGrooveshark.comDownloaderV0.4.9.4
[2012.07.12 10:40:03 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{A2C4BBB8-7A57-4F31-BFF5-62AFCBCBD971}
[2012.07.12 10:39:48 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{5B467B29-A597-4034-8B71-317B0D67463E}
[2012.07.11 23:09:04 | 000,000,000 | ---D | C] -- C:\Users\*** ***\Desktop\Bilder
[2012.07.11 15:01:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HWiNFO64
[2012.07.11 15:01:02 | 000,000,000 | ---D | C] -- C:\Program Files\HWiNFO64
[2012.07.11 14:42:55 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{2AF61A6F-E43E-44CE-9650-5821726965FA}
[2012.07.11 14:42:42 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{049237B9-9813-4D4C-81F8-52A693A88FCC}
[2012.07.10 23:03:07 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\Ubisoft Game Launcher
[2012.07.10 21:50:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ubisoft
[2012.07.07 12:20:10 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{8C43AAA1-AF79-4F40-8473-9D1A521EC920}
[2012.07.07 12:19:24 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{E76B6C67-4A49-4AE0-BD49-1BFDE9751A21}
[2012.07.06 22:57:53 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Roaming\PhraseExpress
[2012.07.06 22:57:47 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\PhraseExpress
[2012.07.06 22:57:47 | 000,000,000 | ---D | C] -- C:\Users\*** ***\Documents\PhraseExpress
[2012.07.06 22:57:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhraseExpress
[2012.07.06 22:57:46 | 000,000,000 | ---D | C] -- C:\ProgramData\PhraseExpress
[2012.07.06 22:57:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PhraseExpress
[2012.07.01 11:24:38 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{7EFFDBD3-A4FE-44A8-95ED-401B0938325D}
[2012.07.01 11:24:21 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{B63F8B26-2BC8-4B7E-A420-04BAA00CC687}
[2012.06.30 23:51:23 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\Macromedia
[2012.06.30 15:32:38 | 000,000,000 | ---D | C] -- C:\Users\*** ***\Documents\GTA San Andreas User Files
[2012.06.29 18:37:34 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{3367E951-FD98-4423-84AE-3EA864C07780}
[2012.06.29 18:36:48 | 000,000,000 | ---D | C] -- C:\Windows\de
[2012.06.29 18:25:53 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{555B269E-AD07-450E-9649-5C419F751F0C}
[2012.06.29 18:25:30 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{1006A217-34EB-4B61-8542-EE6C076150FA}
[2012.06.22 17:10:58 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{FF416627-514F-47F3-A927-2D3838D6FBA9}
[2012.06.22 17:10:38 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{BC781207-2EFA-4719-A73C-00E4BDE3E002}
[2012.06.18 21:34:19 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{2DEAB5CD-DAEB-4EB3-AA95-4DC063407529}
[2012.06.17 16:22:08 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{7CC2BE35-7215-4432-85EB-5E501910503F}
[2012.06.16 20:25:41 | 000,000,000 | ---D | C] -- C:\Users\*** ***\AppData\Local\{3196C643-9984-4D51-A6AA-3C5DF5D7ED06}
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.14 18:46:34 | 000,020,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.14 18:46:34 | 000,020,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.14 18:39:36 | 000,001,160 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3942922135-1496659649-2599000942-1000UA.job
[2012.07.14 18:34:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.14 18:34:43 | 2146,295,807 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.14 18:26:38 | 004,503,728 | ---- | M] () -- C:\ProgramData\to_r0tsef.pad
[2012.07.14 17:55:07 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\*** Flash Player Updater.job
[2012.07.14 15:17:08 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.14 13:11:05 | 000,003,288 | ---- | M] () -- C:\bootsqm.dat
[2012.07.14 03:41:03 | 000,001,893 | ---- | M] () -- C:\Users\*** ***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.07.14 01:38:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3942922135-1496659649-2599000942-1000Core.job
[2012.07.13 10:55:28 | 111,787,672 | ---- | M] () -- C:\Users\*** ***\Desktop\KlausVersion2.mp4
[2012.07.13 10:41:43 | 000,084,440 | ---- | M] () -- C:\Users\*** ***\Desktop\29335_433621350148_2942775_n.jpg
[2012.07.13 10:40:37 | 108,267,853 | ---- | M] () -- C:\Users\*** ***\Desktop\KlausVersion1.mp4
[2012.07.12 17:59:28 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.12 17:59:28 | 000,696,832 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.12 17:59:28 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.12 17:59:28 | 000,148,128 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.12 17:59:28 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.12 10:30:31 | 005,072,896 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.11 23:37:39 | 001,097,436 | ---- | M] () -- C:\Users\*** ***\Desktop\logojkauswahl2.ai
[2012.07.11 22:53:16 | 000,083,725 | ---- | M] () -- C:\Users\*** ***\Desktop\logolast.jpg
[2012.07.11 22:20:34 | 000,040,697 | ---- | M] () -- C:\Users\*** ***\Desktop\logowhichonejk.png
[2012.07.11 21:10:54 | 000,008,742 | ---- | M] () -- C:\Users\*** ***\Desktop\hut.JPG
[2012.07.11 14:56:22 | 000,007,630 | ---- | M] () -- C:\Users\*** ***\AppData\Local\resmon.resmoncfg
[2012.07.11 13:10:21 | 010,636,490 | ---- | M] () -- C:\Users\*** ***\Desktop\einfuehrung-in-suchmaschinenoptimierung.pdf
[2012.07.11 10:28:02 | 000,001,456 | ---- | M] () -- C:\Users\*** ***\AppData\Local\*** Für Web speichern 12.0 Prefs
[2012.07.10 21:44:37 | 001,111,267 | ---- | M] () -- C:\Users\*** ***\Desktop\logojkauswahl.ai
[2012.07.10 13:54:55 | 000,034,191 | ---- | M] () -- C:\Users\*** ***\Desktop\logojkthird.png
[2012.07.10 13:54:29 | 001,132,097 | ---- | M] () -- C:\Users\*** ***\Desktop\logojk.ai
[2012.07.09 12:25:52 | 000,192,961 | ---- | M] () -- C:\Users\*** ***\Desktop\336459_463579083665846_261404904_o.jpg
[2012.07.08 10:19:15 | 000,000,132 | ---- | M] () -- C:\Users\*** ***\AppData\Roaming\*** PNG Format CS5 Prefs
[2012.07.06 22:57:48 | 000,001,089 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk
[2012.06.26 16:39:54 | 016,552,865 | ---- | M] () -- C:\Users\*** ***\Desktop\Spider Dolly Instructions by Zach King.zip
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.14 15:17:08 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.14 13:11:05 | 000,003,288 | ---- | C] () -- C:\bootsqm.dat
[2012.07.14 03:41:03 | 004,503,728 | ---- | C] () -- C:\ProgramData\to_r0tsef.pad
[2012.07.14 03:41:03 | 000,001,893 | ---- | C] () -- C:\Users\*** ***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.07.13 19:49:24 | 000,084,440 | ---- | C] () -- C:\Users\*** ***\Desktop\29335_433621350148_2942775_n.jpg
[2012.07.13 10:49:14 | 111,787,672 | ---- | C] () -- C:\Users\*** ***\Desktop\KlausVersion2.mp4
[2012.07.13 10:32:36 | 108,267,853 | ---- | C] () -- C:\Users\*** ***\Desktop\KlausVersion1.mp4
[2012.07.11 23:37:33 | 001,097,436 | ---- | C] () -- C:\Users\*** ***\Desktop\logojkauswahl2.ai
[2012.07.11 22:53:15 | 000,083,725 | ---- | C] () -- C:\Users\*** ***\Desktop\logolast.jpg
[2012.07.11 22:20:34 | 000,040,697 | ---- | C] () -- C:\Users\*** ***\Desktop\logowhichonejk.png
[2012.07.11 21:10:54 | 000,008,742 | ---- | C] () -- C:\Users\*** ***\Desktop\hut.JPG
[2012.07.11 13:10:24 | 010,636,490 | ---- | C] () -- C:\Users\*** ***\Desktop\einfuehrung-in-suchmaschinenoptimierung.pdf
[2012.07.10 21:44:34 | 001,111,267 | ---- | C] () -- C:\Users\*** ***\Desktop\logojkauswahl.ai
[2012.07.10 13:54:53 | 000,034,191 | ---- | C] () -- C:\Users\*** ***\Desktop\logojkthird.png
[2012.07.09 12:25:51 | 000,192,961 | ---- | C] () -- C:\Users\*** ***\Desktop\336459_463579083665846_261404904_o.jpg
[2012.07.06 22:57:48 | 000,001,089 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk
[2012.07.06 15:35:34 | 001,132,097 | ---- | C] () -- C:\Users\*** ***\Desktop\logojk.ai
[2012.06.26 16:38:57 | 016,552,865 | ---- | C] () -- C:\Users\*** ***\Desktop\Spider Dolly Instructions by Zach King.zip
[2012.06.05 10:50:24 | 000,000,132 | ---- | C] () -- C:\Users\*** ***\AppData\Roaming\*** GIF Format CS5 Prefs
[2012.05.04 18:00:34 | 000,004,760 | ---- | C] () -- C:\Users\*** ***\.recently-used.xbel
[2012.04.10 11:26:04 | 000,000,025 | ---- | C] () -- C:\Windows\wpd99.drv
[2012.04.10 11:26:02 | 000,040,448 | ---- | C] () -- C:\Windows\SysWow64\pdf995mon64.dll
[2012.02.21 16:14:57 | 000,003,229 | ---- | C] () -- C:\Users\*** ***\AppData\Roaming\glide_wrapper.zbag.ini
[2012.01.13 18:25:47 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2011.11.30 22:02:31 | 000,001,240 | ---- | C] () -- C:\Users\*** ***\Desktop - Verknüpfung.lnk
[2011.11.13 19:37:12 | 000,360,780 | ---- | C] () -- C:\Users\*** ***\DocumentsLayer 1_0001.png
[2011.11.07 18:43:08 | 000,554,496 | ---- | C] () -- C:\Windows\SysWow64\dvmsg.dll
[2011.10.04 16:31:40 | 000,000,000 | ---- | C] () -- C:\Windows\cdplayer.ini
[2011.09.07 19:01:02 | 000,000,389 | ---- | C] () -- C:\Users\*** ***\AppData\Local\postgresinstall.bat
[2011.09.07 18:53:47 | 001,590,298 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.08.18 16:14:08 | 000,210,032 | ---- | C] () -- C:\Windows\SysWow64\DBCLIENT.DLL
[2011.07.05 18:42:30 | 000,017,408 | ---- | C] () -- C:\Users\*** ***\AppData\Local\WebpageIcons.db
[2011.05.12 16:31:24 | 000,012,288 | ---- | C] () -- C:\Users\*** ***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.05.04 10:41:20 | 000,482,408 | ---- | C] () -- C:\Windows\ssndii.exe
[2011.05.02 12:14:41 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.05.02 12:13:37 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini
[2011.05.02 12:13:03 | 000,000,019 | ---- | C] () -- C:\Windows\SysWow64\bd2040.dat
[2011.05.02 12:12:47 | 000,000,238 | ---- | C] () -- C:\Windows\Brownie.ini
[2011.05.01 02:06:17 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.04.10 23:25:40 | 000,000,023 | ---- | C] () -- C:\Windows\dvzxlt.ini
[2011.03.31 21:47:01 | 000,002,892 | ---- | C] () -- C:\Windows\SysWow64\audcon.sys
[2011.03.31 21:46:28 | 000,000,051 | ---- | C] () -- C:\Windows\SysWow64\SYNSOPOS.exe.cfg
[2011.03.31 21:46:23 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\SYNSOPOS.exe
[2010.12.25 21:17:51 | 000,007,630 | ---- | C] () -- C:\Users\*** ***\AppData\Local\resmon.resmoncfg
[2010.12.25 21:06:05 | 000,002,137 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2010.08.29 22:21:47 | 000,000,016 | ---- | C] () -- C:\Users\*** ***\AppData\Roaming\hngmfc.dat
[2010.08.16 15:24:36 | 000,000,020 | ---- | C] () -- C:\Users\*** ***\AppData\Roaming\cgvhed.dat
[2010.07.29 22:31:17 | 000,001,152 | ---- | C] () -- C:\Windows\SysWow64\windrv.sys
[2010.07.27 12:18:02 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2010.07.12 14:20:02 | 000,000,209 | ---- | C] () -- C:\Users\*** ***\dsj.xml
[2010.06.05 21:49:35 | 000,000,132 | ---- | C] () -- C:\Users\*** ***\AppData\Roaming\*** PNG Format CS5 Prefs
[2010.05.29 17:37:08 | 000,000,132 | ---- | C] () -- C:\Users\*** ***\AppData\Roaming\*** BMP Format CS5 Prefs
[2010.05.19 21:53:54 | 000,001,456 | ---- | C] () -- C:\Users\*** ***\AppData\Local\*** Für Web speichern 12.0 Prefs
 
========== LOP Check ==========
 
[2012.02.11 23:01:18 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Ableton
[2011.03.07 20:43:07 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Acoustica
[2011.02.13 20:19:13 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Antares
[2011.12.31 15:34:06 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\AnvSoft
[2011.07.11 20:47:04 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Avnex
[2012.04.10 11:39:13 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Babylon
[2012.05.05 20:22:14 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\BinarySense
[2011.11.28 21:30:44 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Bitcoin
[2008.05.01 23:35:39 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Blender Foundation
[2010.05.12 16:28:27 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Canneverbe Limited
[2011.08.11 12:58:21 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Celemony Software GmbH
[2010.07.12 14:18:26 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\D-Zed Software
[2012.05.15 11:48:57 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\DAEMON Tools Lite
[2010.03.31 17:45:37 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\DAZ 3D
[2012.04.22 16:12:05 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\DesktopIconForAmazon
[2012.06.28 15:32:00 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Dropbox
[2010.10.03 14:27:07 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\eyeon
[2011.04.21 13:29:54 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\FileMaker
[2012.07.12 00:06:39 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\FileZilla
[2010.04.01 16:43:54 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Genuitec
[2010.07.12 10:51:36 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\gnupg
[2010.05.09 18:50:49 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Greyfirst
[2012.05.03 18:57:13 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\gtk-2.0
[2012.03.27 16:37:17 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\HW group
[2012.07.10 21:39:56 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\ICQ
[2011.01.02 12:41:08 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\IrfanView
[2010.08.17 09:10:08 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Kyuln
[2010.12.13 21:34:41 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\LEGO Company
[2011.11.27 17:58:40 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Line 6
[2010.05.12 16:25:31 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Lionhead Studios
[2011.09.05 18:34:21 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\MAGIX
[2012.05.16 23:38:02 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\MarketSamurai.6E37012E1CBD7F47B14488FCC715944F3EBDCEDC.1
[2011.03.12 12:35:25 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\MAXON
[2011.11.13 19:02:11 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\MonkeyJam
[2010.10.20 17:58:05 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Moyea
[2011.12.31 18:29:28 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Need for Speed World
[2010.07.29 19:14:34 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\NPLUTO Corporation
[2011.01.02 12:48:40 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\OfficeRecovery
[2010.10.20 17:45:42 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Opera
[2010.08.19 12:07:37 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Osywe
[2012.04.03 20:20:23 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\PACE Anti-Piracy
[2011.05.11 20:45:06 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Pegasys Inc
[2012.05.30 03:57:38 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\PhotoScape
[2012.07.06 22:58:00 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\PhraseExpress
[2008.04.08 11:31:34 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Planetside Software
[2011.11.27 17:44:01 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Propellerhead Software
[2010.12.26 15:28:09 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\ProtectDisc
[2010.06.03 20:33:15 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\ResourceCentral.E6E1B28A311BC518DB6C6883EA3757FDE0E90ADC.1
[2010.07.12 10:50:53 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\RetroShare
[2011.11.18 21:41:47 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Screaming Bee
[2011.11.11 22:24:06 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\SimpleScreenshot
[2010.06.05 15:12:36 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012.02.11 20:21:49 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Synthesia
[2011.03.07 20:55:06 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\SynthMaker
[2008.01.28 19:13:42 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Thinstall
[2011.01.02 11:43:10 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Titanium
[2011.11.07 19:40:23 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Tobit
[2010.03.17 17:59:17 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Trillian
[2008.04.08 12:47:49 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\uk.co.planetside
[2010.10.20 18:04:00 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Unity
[2012.03.14 17:36:01 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Utherverse
[2010.07.27 22:44:35 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Vivox
[2011.07.24 20:49:51 | 000,000,000 | ---D | M] -- C:\Users\*** ***\AppData\Roaming\Xtranormal
[2012.03.05 15:37:08 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:DDE29E40
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:B00CB50D
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:C8B8CEBD
@Alternate Data Stream - 1323 bytes -> C:\Users\*** ***\AppData\Local\Temp:xSOcF5wBKn2w3g02Mw2WciBMFyE
@Alternate Data Stream - 1320 bytes -> C:\Users\*** ***\AppData\Local\Temp:nsSAelVBrVbl8fE5WIgYioCdQM
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:5A775C3F
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:2BE9FEFC
@Alternate Data Stream - 1221 bytes -> C:\Users\*** ***\AppData\Local\Temp:tHDZivAp6EuBOoMyObx2DApANM
@Alternate Data Stream - 1152 bytes -> C:\Users\*** ***\AppData\Local\cSjne2Mit1:mpDjCp5dyvzOVJOsYOAnK98D
@Alternate Data Stream - 1116 bytes -> C:\Users\*** ***\AppData\Local\Temp:R83g39BNRw7ZcTJem8SUZ5
 
< End of report >
         

--- --- ---



Extra.txt:

OTL Logfile:

OTL Extras logfile created on: 14.07.2012 18:41:29 - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = R:\
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,43 Gb Available Physical Memory | 80,33% Memory free
16,00 Gb Paging File | 14,23 Gb Available in Paging File | 88,96% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 279,46 Gb Total Space | 61,83 Gb Free Space | 22,12% Space Free | Partition Type: NTFS
Drive D: | 195,31 Gb Total Space | 28,58 Gb Free Space | 14,63% Space Free | Partition Type: NTFS
Drive E: | 247,92 Gb Total Space | 0,01 Gb Free Space | 0,00% Space Free | Partition Type: NTFS
Drive F: | 2,97 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive K: | 488,28 Gb Total Space | 13,08 Gb Free Space | 2,68% Space Free | Partition Type: NTFS
Drive R: | 3,76 Gb Total Space | 1,14 Gb Free Space | 30,40% Space Free | Partition Type: FAT32
 
Computer Name: ROCKY | User Name: *** *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
.jse[@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbe[@ = VBEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbs[@ = VBSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf[@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- Reg Error: Key error. File not found
.js [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found
.jse [@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.txt [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found
.vbe [@ = VBEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files (x86)\***\*** Bridge CS5\Bridge.exe "%L" (*** Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files (x86)\***\*** Bridge CS5\Bridge.exe "%L" (*** Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{002FF466-3B97-46DE-A32B-8AB6C4DCD1B8}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{23D05476-4520-4594-8CFF-3411745BC014}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{2D1D662A-1819-49D4-B8ED-502B6DF4F588}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{2F5914B2-8231-4656-B41A-FFBCB56259DA}" = lport=445 | protocol=6 | dir=in | app=system | 
"{2FC8B90C-E8A4-49CC-909D-FB6DC5B07AED}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{3416E1BF-1D0C-45E1-833C-92D6DF41ADE5}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3B650FDA-FFA7-4E85-8124-415C146BF8A9}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{3F19C91A-19D7-44E9-9FB7-3E7660D1C894}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{4032AB4E-8D86-4F54-8C11-CE9D6F4FB4D3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{4045095A-2CB4-4BDA-AD7E-4B8ABEC9FBFB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{41B1102F-161D-456F-A06E-C76A8E01C917}" = lport=3703 | protocol=6 | dir=in | name=*** version cue cs4 server | 
"{44805419-2E53-4DD7-977D-27BDD1B3A8D3}" = rport=139 | protocol=6 | dir=out | app=system | 
"{4B4B30F5-F524-466C-9958-1605191F29A4}" = lport=58402 | protocol=6 | dir=in | name=pando media booster | 
"{5602A19B-5CF5-4B2D-B0B5-93BFB57F8FB6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{5B073A3E-BCEC-4EE7-94B1-71C8B62FA17D}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{5CBCD109-07CC-4D5D-9B0F-D50B9A721716}" = lport=139 | protocol=6 | dir=in | app=system | 
"{67A2A752-DE9E-4667-9244-5E3456BEDD2C}" = lport=137 | protocol=17 | dir=in | app=system | 
"{6A774612-62AB-4980-BBEE-6560030C4B93}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6B21788F-3488-4711-BDB5-F24BB6DDB2E2}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{72C06B87-DCDF-4EB9-8C7A-1B0DD25FD6A4}" = lport=51000 | protocol=6 | dir=in | name=*** version cue cs4 server | 
"{76EB6CCF-B15C-40A0-83F5-4C24BFA59EDB}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{7966F14D-8F64-46BF-B4C5-2D4A74085B6D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{7D646603-6BF6-49EF-9AF7-5F6A98E6E52F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{8AA9FB96-5964-4C6A-8E50-3060E857CAEC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8AF49A60-E9D9-4DCB-B5B5-66351BFA497D}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{964286BD-E303-44D0-A7D1-7447D32FF34E}" = lport=51001 | protocol=6 | dir=in | name=*** version cue cs4 server | 
"{A28EC79D-DA77-4B41-AD1E-3BF9109939F6}" = rport=445 | protocol=6 | dir=out | app=system | 
"{A798E834-0C68-47EA-BBFD-328FB32CA142}" = lport=58402 | protocol=17 | dir=in | name=pando media booster | 
"{AEBC6DC0-3B45-41B7-A77A-82108AF57171}" = lport=3704 | protocol=6 | dir=in | name=*** version cue cs4 server | 
"{B18BF57B-DB57-4867-A881-9B2611213551}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe | 
"{BF02B8C3-D113-4F50-B74B-9E32CF42A3AA}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C28D19E5-A62E-4EC6-85E3-F44E4733F090}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{C362DDB2-CF09-4444-A065-24B4C32412E2}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{C4E22DA1-9651-46A9-8D0A-1B1F4E215864}" = lport=138 | protocol=17 | dir=in | app=system | 
"{C5BD0E02-F69C-4377-9E86-04F5E8616336}" = rport=137 | protocol=17 | dir=out | app=system | 
"{CDFA8304-E9A5-4F72-B443-31A3B7F02734}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{D321EF34-9957-4510-A3FB-A8B2FF132F1B}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 
"{D460F842-89B8-4776-9E01-B18E631D0363}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{D90921F9-983D-43ED-B626-F8438B282AB2}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{DCCA339B-4273-4CCC-A3A1-2F8D84A54DE9}" = lport=5353 | protocol=6 | dir=in | name=*** csi cs4 | 
"{E3D63A9B-844D-4251-9403-97B5DA45B8E1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F0202373-6988-4FBC-8853-275619E99794}" = rport=138 | protocol=17 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02233276-4BEC-4171-95CF-005BD3FEA062}" = protocol=6 | dir=in | app=c:\users\*** ***\desktop\need for speed 2012\need for speed 2012\nfs2sen.exe | 
"{0306D360-6761-45AA-A435-1270235383CE}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{03CF2AB4-598C-433C-BE00-62B5DDF6A0A7}" = protocol=6 | dir=in | app=c:\program files (x86)\tobit radio.fx\server\rfx-server.exe | 
"{0ECA034D-71D3-48C1-AEC3-CB475C778AE3}" = protocol=6 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe | 
"{172586B6-6AB9-416C-ACE1-EDA7C192B6C1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{1FFDC926-BF4B-43A7-AB91-4A740A3259E2}" = dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe | 
"{21B48BC6-93A1-49D9-A974-FB48B2F71B87}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{223CEDE2-34C7-4194-A472-44B428C952EF}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{23363E7B-10BD-4A3C-A5AB-10436975D2E9}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe | 
"{251BE34D-B049-4043-B5BB-E2416934AB45}" = protocol=17 | dir=in | app=c:\users\*** ***\desktop\need for speed 2012\need for speed 2012\nfs2sea.exe | 
"{2A3B7876-6A92-4164-BD2A-379C8E06EB0A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{2EAE9D23-4849-488C-9129-2BFE411AC9BA}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{2FE0D199-9FB7-4969-9C79-EFD1662094D3}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{300CBAB9-95E9-494A-BFE8-C418A1DB7CAC}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{32C3FEB8-2C73-4A29-9459-E1579CBFE1DD}" = protocol=17 | dir=in | app=k:2\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"{33F013E2-5409-46FB-AB46-EEBE91B9E1B2}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{356BD2A2-E5BB-4E2C-8517-F1F44D45361E}" = protocol=6 | dir=in | app=c:\program files (x86)\hw group\hw vsp3s\hw_vsp3s_client.exe | 
"{379F02C6-ADFB-4C8B-9782-E206D4DD9333}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{38B126E0-6340-4F67-97B8-4BFDBA032DC5}" = protocol=17 | dir=in | app=c:\program files (x86)\tobit radio.fx\server\rfx-server.exe | 
"{3B960B67-63E7-4A27-9B1C-9AE034D47B43}" = protocol=17 | dir=in | app=c:\program files (x86)\arcsoft\totalmedia 3\totalmedia.exe | 
"{3DE5C250-0CB7-48F9-B382-BDC42A8BC873}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{3DED2CEB-CB42-4BB3-9754-1A3B82708238}" = protocol=6 | dir=out | app=system | 
"{42893D9E-06AC-4A64-A9B4-BC98D74340C3}" = protocol=6 | dir=in | app=k:2\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"{455911BC-9D62-4608-AE6A-0789FD01CE3E}" = protocol=6 | dir=in | app=k:0\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"{462D75AC-8790-4408-968F-B4F0934BCEA0}" = protocol=17 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe | 
"{498E8784-E0BA-4B85-885B-2DD81F50DC89}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\tom clancy's splinter cell conviction\src\system\conviction_game.exe | 
"{4FF1184C-1897-467A-84A4-5F62E9A9AA0F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{509B5B01-777E-4AD8-A7B6-59CA72A357E4}" = protocol=6 | dir=in | app=c:\program files (x86)\arcsoft\totalmedia 3\totalmedia.exe | 
"{5546D288-CA94-4D69-927D-6D7ACAE89121}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{55D4F167-B1B6-41A6-9E11-C9D24B627491}" = protocol=6 | dir=in | app=c:\program files (x86)\tobit radio.fx\client\rfx-client.exe | 
"{5723DA89-5BF8-4F80-9DF5-EA971200C0F6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{57E917AB-FD39-4D90-AF2D-ABD9BBBB1670}" = protocol=17 | dir=in | app=c:\program files (x86)\hw group\hw vsp3s\hw_vsp3s_srv.exe | 
"{5D5FB620-010F-46A5-9C9F-BBFD55DDE993}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\tom clancy's splinter cell conviction\src\system\gu.exe | 
"{60F1E9E8-189F-4306-8DFA-A1FF1F209BBC}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{62990B39-8483-48B3-9456-EDD04B7E4E5E}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{62F5B088-3E94-4F88-A01A-90B829DDB238}" = protocol=17 | dir=in | app=k:3\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"{68F6566C-F81C-4301-82CA-8ADCCDD22BCA}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{74869327-A0D2-4051-A504-44C1473C381F}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{75BA6A06-4389-47FD-9757-8535777C01AD}" = dir=in | app=c:\program files (x86)\phraseexpress\phraseexpress.exe | 
"{7781CCF6-139E-441D-868F-419748764F40}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\tom clancy's splinter cell conviction\src\system\gu.exe | 
"{78A22FE8-7592-4F5E-B835-6572ECEC9003}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{7AC0FA3B-F06D-44F5-B962-7097367F9F35}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{7BAEE09E-2FB8-4636-8420-20CCA823C5F6}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe | 
"{7CF5DD58-9304-4535-AD8D-47F85AE1CAC0}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifecam.exe | 
"{7FD1E854-22DA-464F-A2B5-62C4A20A6435}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifecam.exe | 
"{800800B1-2D80-4A6A-BB5A-4310A48BDC20}" = protocol=6 | dir=in | app=c:\program files (x86)\secretcity 3dchat\utherverse vww client\utherverse.exe | 
"{849DDB7D-C63E-40B6-803C-EA5B9F555760}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeenc2.exe | 
"{8A0AC946-7943-43E5-80AC-786ECD2E09D6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{8CAFD3C3-7FC8-4C4D-9B1E-8871F2CC0433}" = protocol=6 | dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe | 
"{8E43296D-5B89-441C-BB8B-9EA69C44E206}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{93456CF0-1C03-4FF9-8F9C-A237A81C8C55}" = protocol=6 | dir=in | app=c:\users\*** ***\desktop\need for speed 2012\need for speed 2012\nfs2sea.exe | 
"{94066E63-22E9-4A46-A6B1-836B0CEFC734}" = protocol=6 | dir=in | app=c:\program files (x86)\dna\btdna.exe | 
"{95AFB5B6-85AA-43C8-A26C-7944FA3ED1FE}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{96850EB8-4122-4C9C-BCC0-A0D76405D472}" = protocol=17 | dir=in | app=c:\program files (x86)\bitcoin\bitcoin-qt.exe | 
"{9726EBF5-75BA-4EA1-A5DF-BDDE8436A7DC}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{99DEDF16-D7D7-40D8-908A-EF3A080D9CF4}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{9B18E177-8DCA-4D05-B57A-060914CED071}" = protocol=17 | dir=in | app=c:\program files (x86)\bitcoin\bitcoin.exe | 
"{9B24064B-6E42-4D7D-9A1E-2775B76421CD}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{A26B3D47-9CF7-470A-AE48-DB9E1CF81AF2}" = protocol=6 | dir=in | app=c:\program files (x86)\hw group\hw vsp3s\hw_vsp3s_srv.exe | 
"{A6E321C2-F07E-49DC-8B40-B11E9DA7EDEA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{A8BFB6CB-D345-447E-B4BA-DF4FE143BE49}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\tom clancy's splinter cell conviction\src\system\conviction_game.exe | 
"{A9A0B210-41F2-41B8-B98F-69619B6963F5}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifetray.exe | 
"{ACA7995D-3AD7-4891-BE92-228F3B4D2C47}" = protocol=17 | dir=in | app=c:\users\*** ***\appdata\roaming\dropbox\bin\dropbox.exe | 
"{AD2E69ED-D999-4DCF-BA3D-F90F65BB162D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{AE4212D8-3897-4045-AB96-9668C91D4497}" = protocol=6 | dir=in | app=c:\program files (x86)\bitcoin\bitcoin-qt.exe | 
"{AE4B7D38-42F0-4689-B8E5-80992FABF0EE}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifetray.exe | 
"{B1B65B2A-B9D9-4BD5-8DC7-1013C8014DE3}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{B22DBEE3-34F3-4B8B-868E-B96C85ACD806}" = protocol=17 | dir=in | app=c:\program files (x86)\secretcity 3dchat\utherverse vww client\utherverse.exe | 
"{B48697AE-C811-4907-A2E7-8C8BF9BB70EA}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeenc2.exe | 
"{B487E90A-9174-4C4E-8589-DEEB57B87DA4}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeexp.exe | 
"{B8AAA18C-AB91-419E-92E0-79F6164895DB}" = protocol=17 | dir=in | app=c:\program files (x86)\codemeter\runtime\bin\codemeter.exe | 
"{B8F22E13-AB94-4FDE-A721-942C9960FC16}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{B8F6DD38-776B-495C-A8AE-D0BC39798F1C}" = protocol=17 | dir=in | app=c:\users\*** ***\desktop\need for speed 2012\need for speed 2012\nfs2sen.exe | 
"{BFDC7F01-BC04-47BC-BA75-1CF8D0809A28}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{C0A129C2-CED6-4695-B584-37E96B0A3F50}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{C48A67D0-14B0-4861-A9AE-CDFEF8A05F00}" = protocol=17 | dir=in | app=k:0\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"{C80D7E24-2767-4539-9AED-7C2E647A58C8}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{C979BB33-4905-4BF8-A0EC-D95803C2638F}" = protocol=17 | dir=in | app=c:\program files (x86)\hw group\hw vsp3s\hw_vsp3s_client.exe | 
"{C9E94CE3-627E-4FC3-8431-74BC51CDD467}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeexp.exe | 
"{CB8A4D40-9E65-4514-BA56-3503DAF43C14}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{CE29DB8D-54B4-4378-997F-8E58B6D4DB98}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{D30A1392-84B1-441B-9B91-049A8BFC10AA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{D4EFF31B-8CBA-46B1-B121-3A8B67F01E2A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{D7C4A87D-71C7-4B21-AA54-FC384CC9ECA2}" = protocol=17 | dir=in | app=c:\program files (x86)\tobit radio.fx\client\rfx-client.exe | 
"{DA236691-5769-45F0-BC52-DA31FAAD70CC}" = protocol=6 | dir=in | app=c:\users\*** ***\appdata\roaming\dropbox\bin\dropbox.exe | 
"{DAEB5F03-FD22-4D89-8670-BA45E644809E}" = protocol=17 | dir=in | app=c:\program files (x86)\dna\btdna.exe | 
"{E26A0985-290B-497D-A5D5-E51E89AD8B99}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{E78C840C-2C21-4D53-9049-6E894501B0F7}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{EA8F7EBC-0165-417D-B656-C1F3F482A4F1}" = protocol=6 | dir=in | app=k:3\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"{EBFF5244-E0EF-49D8-939D-6F494BE592BB}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{ED3916F2-9C7A-44BE-B283-3AC30D0BB57B}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{EE01B1DB-6489-4CF3-8E32-46EF8336ABF6}" = protocol=6 | dir=in | app=c:\program files (x86)\bitcoin\bitcoin.exe | 
"{EEFB1CF7-52F2-4DA7-8AF5-E68095F32C69}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{F10E1F62-8C73-44F3-A2B0-4BA5E05E885A}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{F4C5DF9E-6184-4791-8D09-16B06EB33AAE}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{F534CFB3-02A3-457F-A397-828F084EF10F}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{F8EE73E6-381C-4234-A805-614E25CB73F8}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"TCP Query User{017D3F12-F0DD-4BA0-AF3E-29FFC672110A}C:\users\*** ***\desktop\versus\versus\system\scct_versus.ex" = protocol=6 | dir=in | app=c:\users\*** ***\desktop\versus\versus\system\scct_versus.ex | 
"TCP Query User{0A0D3EDE-38CD-42B3-8704-5E06FC5A3717}C:\users\*** ***\desktop\programme\versus\versus\system\scct_versus.ex" = protocol=6 | dir=in | app=c:\users\*** ***\desktop\programme\versus\versus\system\scct_versus.ex | 
"TCP Query User{0BF9EED8-3DE4-48A2-9982-FA0AE2B2FAF3}C:\program files (x86)\steam\steamapps\jkrocky\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\jkrocky\team fortress 2\hl2.exe | 
"TCP Query User{0D223EA1-ED1F-4694-8D25-C04D873CEC21}C:\users\*** ***\desktop\programme\versus\versus\system\scct_versus.ex" = protocol=6 | dir=in | app=c:\users\*** ***\desktop\programme\versus\versus\system\scct_versus.ex | 
"TCP Query User{11E30AE1-F356-4884-92CD-C3450C94CC19}K:3\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=6 | dir=in | app=k:3\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"TCP Query User{12217609-52D9-4902-9194-05697742087E}C:\program files (x86)\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"TCP Query User{1571E83B-B4BB-4A1A-BAF4-834D82D6567E}C:\program files (x86)\r.g. mechanics\splinter cell - conviction\src\system\conviction_game.exe" = protocol=6 | dir=in | app=c:\program files (x86)\r.g. mechanics\splinter cell - conviction\src\system\conviction_game.exe | 
"TCP Query User{1592008E-4FAE-4A5F-8FBC-C09F95C316A0}C:\program files (x86)\digi\xctu\x-ctu.exe" = protocol=6 | dir=in | app=c:\program files (x86)\digi\xctu\x-ctu.exe | 
"TCP Query User{1E7B8D9F-D7D6-4C4B-B83F-1CB8AB8272EF}C:\xampp\apache\bin\httpd.exe" = protocol=6 | dir=in | app=c:\xampp\apache\bin\httpd.exe | 
"TCP Query User{2131784F-C151-4773-BAAA-240586B5CF1C}K:0\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=6 | dir=in | app=k:0\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"TCP Query User{24A66DE4-C6E1-456E-A6F3-B221B778FBD3}C:\users\*** ***\desktop\splinter cell 3***\system\splintercell3.exe" = protocol=6 | dir=in | app=c:\users\*** ***\desktop\splinter cell 3***\system\splintercell3.exe | 
"TCP Query User{27147A75-610D-435C-8423-4696EBD4F7D5}C:\xampp\apache\bin\httpd.exe" = protocol=6 | dir=in | app=c:\xampp\apache\bin\httpd.exe | 
"TCP Query User{272EC818-5190-45C7-986D-2899E375A82E}C:\program files (x86)\trillian\trillian.exe" = protocol=6 | dir=in | app=c:\program files (x86)\trillian\trillian.exe | 
"TCP Query User{2958E46D-8302-4CE3-94DC-57933368C989}C:\xampp\xampp\filezillaftp\filezilla server.exe" = protocol=6 | dir=in | app=c:\xampp\xampp\filezillaftp\filezilla server.exe | 
"TCP Query User{2B1E748A-F401-4001-8334-03EAFBF30F6A}K:6\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=6 | dir=in | app=k:6\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"TCP Query User{3F584C84-8E7E-472F-9804-D0C1D4DB22BA}C:\program files (x86)\driftcity\driftcity.exe" = protocol=6 | dir=in | app=c:\program files (x86)\driftcity\driftcity.exe | 
"TCP Query User{411BDC55-83E8-4809-B87F-D086AC96D405}F:\far cry 2\bin\farcry2.exe" = protocol=6 | dir=in | app=f:\far cry 2\bin\farcry2.exe | 
"TCP Query User{44DAA55F-0C1E-4443-B1EC-EA2BD139D794}K:2\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=6 | dir=in | app=k:2\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"TCP Query User{48A88862-7063-49B8-B18C-7CDE6369DC1A}C:\program files (x86)\secretcity 3dchat\utherverse vww client\utherverse.exe" = protocol=6 | dir=in | app=c:\program files (x86)\secretcity 3dchat\utherverse vww client\utherverse.exe | 
"TCP Query User{51948E75-9F43-4AAA-8206-1BC2B1F2EFA9}C:\program files (x86)\java\jdk1.6.0_18\jre\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jdk1.6.0_18\jre\bin\java.exe | 
"TCP Query User{52D10D4D-9559-4577-9C14-0689B1F8B3A1}C:\program files (x86)\icq7.2\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"TCP Query User{54CC35EB-08F0-445F-A214-3529BADEA934}C:\program files (x86)\bitcoin\bitcoin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\bitcoin\bitcoin.exe | 
"TCP Query User{56721A79-6669-4706-96A0-5D7B40157D09}K:7\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=6 | dir=in | app=k:7\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"TCP Query User{5DB98F8B-7E86-42E9-A5B2-BC20132911F4}R:\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=6 | dir=in | app=r:\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"TCP Query User{5E8421AF-5C16-4DFC-8C5B-7FCB9C15E2E1}C:\program files (x86)\steam\steamapps\common\dc universe online\unreal3\binaries\win32\dcgame.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dc universe online\unreal3\binaries\win32\dcgame.exe | 
"TCP Query User{5EAB6B2A-C230-453E-82E3-CACEF91EA619}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{62D4AE61-0F3E-4791-991E-1AA5654F3232}K:9\programme & spiele\splinter cell 3\system\splintercell3.exe" = protocol=6 | dir=in | app=k:9\programme & spiele\splinter cell 3\system\splintercell3.exe | 
"TCP Query User{63A572D3-88F2-4B20-837F-04F008F4DE99}K:4\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=6 | dir=in | app=k:4\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"TCP Query User{79D10AA8-516F-42FF-8C70-3836B8AC9F59}C:\users\*** ***\desktop\need for speed 2012\need for speed 2012\nfs2sea.exe" = protocol=6 | dir=in | app=c:\users\*** ***\desktop\need for speed 2012\need for speed 2012\nfs2sea.exe | 
"TCP Query User{79E4295F-A994-40C8-9BC3-19273E40E6FF}C:\users\*** ***\desktop\programme\skype portable\skypeportable\app\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\users\*** ***\desktop\programme\skype portable\skypeportable\app\skype\phone\skype.exe | 
"TCP Query User{85605262-EA31-4C1F-B5C0-1C9F7EBC5899}C:\users\*** ***\appdata\roaming\imvuclient\1vivoxvoice.exe" = protocol=6 | dir=in | app=c:\users\*** ***\appdata\roaming\imvuclient\1vivoxvoice.exe | 
"TCP Query User{9DA78447-D9BF-4351-BA2A-A3D56FBA181A}C:\xampp\xampp\apache\bin\httpd.exe" = protocol=6 | dir=in | app=c:\xampp\xampp\apache\bin\httpd.exe | 
"TCP Query User{A1EEAABB-20C2-4CE2-ABC6-F712E4C9501E}C:\program files (x86)\ea games\need for speed most wanted\speed.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\need for speed most wanted\speed.exe | 
"TCP Query User{A3174C0D-2D08-4C08-885F-CF25ADFF3EEC}C:\program files\eltima software\sec\sec.exe" = protocol=6 | dir=in | app=c:\program files\eltima software\sec\sec.exe | 
"TCP Query User{A3F8D1AB-E1EC-465A-A798-F90C708F5DD1}C:\users\*** ***\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\*** ***\appdata\roaming\dropbox\bin\dropbox.exe | 
"TCP Query User{A4576283-AB8F-42CE-938B-EF3CD6B7E8F8}C:\program files (x86)\steam\steamapps\moritzking\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\moritzking\team fortress 2\hl2.exe | 
"TCP Query User{B441B30E-D9A0-4D08-B35E-9B3AB3619CDB}C:\users\*** ***\desktop\programme\teamviewer portable 5\teamviewer.exe" = protocol=6 | dir=in | app=c:\users\*** ***\desktop\programme\teamviewer portable 5\teamviewer.exe | 
"TCP Query User{B4DE3A34-4405-438E-B82E-AD93E0DE32F8}C:\xampp\mysql\bin\mysqld.exe" = protocol=6 | dir=in | app=c:\xampp\mysql\bin\mysqld.exe | 
"TCP Query User{B5662A63-8B42-43E8-853B-F843EDD453D0}C:\xampp\xampp\mysql\bin\mysqld.exe" = protocol=6 | dir=in | app=c:\xampp\xampp\mysql\bin\mysqld.exe | 
"TCP Query User{B5841B54-6781-4928-A9EA-415CFA266780}K:0\programme & spiele\far cry 2\bin\farcry2.exe" = protocol=6 | dir=in | app=k:0\programme & spiele\far cry 2\bin\farcry2.exe | 
"TCP Query User{B827C36B-39CD-49C0-B8EE-E2A14DABBCE8}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 
"TCP Query User{BF083693-58AF-4C7E-BBBA-2E3F7FD4EEDE}R:\programme & spiele\vegas 2\binaries\r6vegas2_gamexd.exe" = protocol=6 | dir=in | app=r:\programme & spiele\vegas 2\binaries\r6vegas2_gamexd.exe | 
"TCP Query User{C5541B30-A920-4D7F-9ADF-C67B340A4361}K:4\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=6 | dir=in | app=k:4\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"TCP Query User{CDBF0C2D-07FC-465E-A93E-F292F00A943B}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{CF4800BF-55D0-4A1C-BDB6-295DBD7B50DA}C:\program files (x86)\bitcoin\bitcoin-qt.exe" = protocol=6 | dir=in | app=c:\program files (x86)\bitcoin\bitcoin-qt.exe | 
"TCP Query User{EDBB7AAA-F496-49EC-B59B-E6BEC83F830C}C:\users\*** ***\desktop\programme\amsnportable\app\amsn\bin\wish.exe" = protocol=6 | dir=in | app=c:\users\*** ***\desktop\programme\amsnportable\app\amsn\bin\wish.exe | 
"TCP Query User{FDB4F702-32E8-4BC7-9494-148558F0B21A}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe | 
"TCP Query User{FF1C20A5-AB9C-42B7-B8E4-596EAD7C97FE}C:\users\*** ***\desktop\need for speed 2012\need for speed 2012\nfs2sen.exe" = protocol=6 | dir=in | app=c:\users\*** ***\desktop\need for speed 2012\need for speed 2012\nfs2sen.exe | 
"UDP Query User{00488863-E487-475E-8D19-FFE307C323A4}C:\program files (x86)\icq7.2\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"UDP Query User{04D3988B-12E4-46B1-81B6-F8DA04569945}R:\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=17 | dir=in | app=r:\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"UDP Query User{051BA892-AB15-43DE-AE85-7BDAB340D786}C:\program files (x86)\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"UDP Query User{0685276F-801D-419B-85B8-61F303A4185C}K:6\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=17 | dir=in | app=k:6\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"UDP Query User{09519FDA-E554-4350-B60A-054A5EB9D320}K:2\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=17 | dir=in | app=k:2\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"UDP Query User{0F6A9D20-7B6E-49EE-A5D5-1AD3AF5736BA}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 
"UDP Query User{19FC1FFD-5BA5-45D3-9CCD-D3E386BF7219}C:\xampp\xampp\apache\bin\httpd.exe" = protocol=17 | dir=in | app=c:\xampp\xampp\apache\bin\httpd.exe | 
"UDP Query User{27DFA403-9C08-402D-9760-D3DCF20B063C}K:3\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=17 | dir=in | app=k:3\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"UDP Query User{28B41613-5F7D-480A-9096-9CE1541F2E19}K:0\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=17 | dir=in | app=k:0\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"UDP Query User{2DBB41DB-4B5A-45B4-B594-98A3E7E1E8FA}C:\users\*** ***\desktop\splinter cell 3***\system\splintercell3.exe" = protocol=17 | dir=in | app=c:\users\*** ***\desktop\splinter cell 3***\system\splintercell3.exe | 
"UDP Query User{3C1FF537-3B3C-4A12-AA5A-17FFB1510728}C:\users\*** ***\appdata\roaming\imvuclient\1vivoxvoice.exe" = protocol=17 | dir=in | app=c:\users\*** ***\appdata\roaming\imvuclient\1vivoxvoice.exe | 
"UDP Query User{4A3EA905-0576-414F-9B25-8DC4B0AE3EB0}K:7\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=17 | dir=in | app=k:7\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"UDP Query User{4B39A2CA-0FCD-43E4-9786-1D86B661239D}K:0\programme & spiele\far cry 2\bin\farcry2.exe" = protocol=17 | dir=in | app=k:0\programme & spiele\far cry 2\bin\farcry2.exe | 
"UDP Query User{55B72F66-9405-4BF5-B593-646845845CEB}C:\program files (x86)\steam\steamapps\common\dc universe online\unreal3\binaries\win32\dcgame.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dc universe online\unreal3\binaries\win32\dcgame.exe | 
"UDP Query User{5681AE84-2C8B-4BC8-ADB0-D1EF204C16B7}F:\far cry 2\bin\farcry2.exe" = protocol=17 | dir=in | app=f:\far cry 2\bin\farcry2.exe | 
"UDP Query User{5786A64C-AAD6-4B35-8186-95AA847BEAE6}C:\users\*** ***\desktop\programme\amsnportable\app\amsn\bin\wish.exe" = protocol=17 | dir=in | app=c:\users\*** ***\desktop\programme\amsnportable\app\amsn\bin\wish.exe | 
"UDP Query User{5FB27B0D-C9FC-4BD3-BA7A-D0745126FAAE}C:\program files (x86)\digi\xctu\x-ctu.exe" = protocol=17 | dir=in | app=c:\program files (x86)\digi\xctu\x-ctu.exe | 
"UDP Query User{661C2AEE-DFE9-4A10-BEAD-C232A206A6FB}C:\xampp\xampp\filezillaftp\filezilla server.exe" = protocol=17 | dir=in | app=c:\xampp\xampp\filezillaftp\filezilla server.exe | 
"UDP Query User{7037270D-6FCD-4954-89EE-A7D7FD9E8853}C:\program files (x86)\java\jdk1.6.0_18\jre\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jdk1.6.0_18\jre\bin\java.exe | 
"UDP Query User{70B132D4-50FA-48AE-8A34-66AAF5ECFD41}C:\xampp\apache\bin\httpd.exe" = protocol=17 | dir=in | app=c:\xampp\apache\bin\httpd.exe | 
"UDP Query User{747CF7D4-D8BB-486F-BEDD-9D140337EBA1}C:\program files (x86)\bitcoin\bitcoin-qt.exe" = protocol=17 | dir=in | app=c:\program files (x86)\bitcoin\bitcoin-qt.exe | 
"UDP Query User{75B2FE4C-F04F-459C-B9F3-B4FD7BF791BB}K:9\programme & spiele\splinter cell 3\system\splintercell3.exe" = protocol=17 | dir=in | app=k:9\programme & spiele\splinter cell 3\system\splintercell3.exe | 
"UDP Query User{77B329E7-EC16-4B56-8BDC-9D2717E3BF60}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe | 
"UDP Query User{79CC59CC-5BF4-41C8-92B8-D57EA7C56F6F}C:\users\*** ***\desktop\programme\versus\versus\system\scct_versus.ex" = protocol=17 | dir=in | app=c:\users\*** ***\desktop\programme\versus\versus\system\scct_versus.ex | 
"UDP Query User{812BC237-E461-48CB-9E35-92B359711B4E}C:\xampp\xampp\mysql\bin\mysqld.exe" = protocol=17 | dir=in | app=c:\xampp\xampp\mysql\bin\mysqld.exe | 
"UDP Query User{8DA44BFC-033B-4EEC-B4D1-AA140417ECA4}C:\users\*** ***\desktop\versus\versus\system\scct_versus.ex" = protocol=17 | dir=in | app=c:\users\*** ***\desktop\versus\versus\system\scct_versus.ex | 
"UDP Query User{943A4CC5-5DD6-4A1E-B37A-644ED1B9135F}K:4\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=17 | dir=in | app=k:4\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"UDP Query User{95B70E40-4482-43B2-BA2F-89C07D5AABF5}C:\xampp\apache\bin\httpd.exe" = protocol=17 | dir=in | app=c:\xampp\apache\bin\httpd.exe | 
"UDP Query User{978030CB-82E4-43F2-87E6-111C49D6263F}C:\users\*** ***\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\*** ***\appdata\roaming\dropbox\bin\dropbox.exe | 
"UDP Query User{9A39EB89-09D1-4FDA-8CF5-945D36F10912}C:\program files (x86)\steam\steamapps\jkrocky\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\jkrocky\team fortress 2\hl2.exe | 
"UDP Query User{9B73EB22-6FA3-4BA6-8861-3234F4443E71}C:\users\*** ***\desktop\programme\teamviewer portable 5\teamviewer.exe" = protocol=17 | dir=in | app=c:\users\*** ***\desktop\programme\teamviewer portable 5\teamviewer.exe | 
"UDP Query User{A20784D6-7B3B-46FF-95C8-D1321C876F86}C:\program files\eltima software\sec\sec.exe" = protocol=17 | dir=in | app=c:\program files\eltima software\sec\sec.exe | 
"UDP Query User{A4CD7E66-7F09-47B9-844A-8652D003C38D}C:\xampp\mysql\bin\mysqld.exe" = protocol=17 | dir=in | app=c:\xampp\mysql\bin\mysqld.exe | 
"UDP Query User{A8806230-C8F0-45AE-9CE3-6E2508E7BE41}C:\users\*** ***\desktop\need for speed 2012\need for speed 2012\nfs2sen.exe" = protocol=17 | dir=in | app=c:\users\*** ***\desktop\need for speed 2012\need for speed 2012\nfs2sen.exe | 
"UDP Query User{B8266FAB-7F90-41EA-84E9-4AD45EB9DF9B}C:\program files (x86)\bitcoin\bitcoin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\bitcoin\bitcoin.exe | 
"UDP Query User{B909BA77-EF7E-4268-9610-5FDDC7E7445F}C:\program files (x86)\secretcity 3dchat\utherverse vww client\utherverse.exe" = protocol=17 | dir=in | app=c:\program files (x86)\secretcity 3dchat\utherverse vww client\utherverse.exe | 
"UDP Query User{BA767F77-3D64-455E-B5E5-937496D89DFB}C:\program files (x86)\steam\steamapps\moritzking\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\moritzking\team fortress 2\hl2.exe | 
"UDP Query User{CA8057AB-C9E4-43D2-8C44-BDAA544D1659}C:\program files (x86)\ea games\need for speed most wanted\speed.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\need for speed most wanted\speed.exe | 
"UDP Query User{D6C19A26-C3AD-467E-974B-74945FADDE72}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{DDDBE4D0-CC91-47FD-96C7-73CDE41464B2}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{E5630291-2231-4718-8190-1F638F939087}R:\programme & spiele\vegas 2\binaries\r6vegas2_gamexd.exe" = protocol=17 | dir=in | app=r:\programme & spiele\vegas 2\binaries\r6vegas2_gamexd.exe | 
"UDP Query User{E7EEBD5C-B41B-413A-9C22-9FBAA7E86F30}C:\program files (x86)\r.g. mechanics\splinter cell - conviction\src\system\conviction_game.exe" = protocol=17 | dir=in | app=c:\program files (x86)\r.g. mechanics\splinter cell - conviction\src\system\conviction_game.exe | 
"UDP Query User{EC5CA57C-9C8F-448E-AC8B-E8A753FD9A2F}C:\users\*** ***\desktop\programme\skype portable\skypeportable\app\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\users\*** ***\desktop\programme\skype portable\skypeportable\app\skype\phone\skype.exe | 
"UDP Query User{EC624F26-D1E0-4343-9684-B666C2B4704F}K:4\programme & spiele\vegas 2\binaries\r6vegas2_game.exe" = protocol=17 | dir=in | app=k:4\programme & spiele\vegas 2\binaries\r6vegas2_game.exe | 
"UDP Query User{ED7A1A92-C3B6-4959-9E4C-AC8A2931F9A4}C:\program files (x86)\trillian\trillian.exe" = protocol=17 | dir=in | app=c:\program files (x86)\trillian\trillian.exe | 
"UDP Query User{F13C856B-679F-49CE-A0AF-A4AD56AA43E9}C:\program files (x86)\driftcity\driftcity.exe" = protocol=17 | dir=in | app=c:\program files (x86)\driftcity\driftcity.exe | 
"UDP Query User{F86AB121-F3D6-4E1E-827E-579CF9A97CA4}C:\users\*** ***\desktop\need for speed 2012\need for speed 2012\nfs2sea.exe" = protocol=17 | dir=in | app=c:\users\*** ***\desktop\need for speed 2012\need for speed 2012\nfs2sea.exe | 
"UDP Query User{FFEFFA66-CED0-47C7-8056-B35DC6F1DA05}C:\users\*** ***\desktop\programme\versus\versus\system\scct_versus.ex" = protocol=17 | dir=in | app=c:\users\*** ***\desktop\programme\versus\versus\system\scct_versus.ex | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{25D04DBB-FE9D-E3BA-C2F3-F1BE9B8C0709}" = ATI Catalyst Install Manager
"{44713725-8CC8-4710-B727-DC13A3665F9C}" = *** Photoshop Lightroom 3.5 64-bit
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{55B44B84-A758-EAF7-0906-E397B384FCDF}" = ATI AVIVO64 Codecs
"{595AC242-897D-494C-A278-2A2781403824}" = Magic Bullet Looks
"{5CE7E3F5-9803-4F32-AA89-2D8848A80109}" = Microsoft LifeCam
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7DE223C2-C857-44E5-9311-67AA5731B39B}" = Melodyne Runtime 4.0 (x64)
"{7de963c9-aef2-4a49-85ae-a58f90ed295d}.sdb" = Need For Speed 2 SE 3Dfx Patch
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9C5A08BF-BB99-4998-81BD-F6CC32483B34}" = Microsoft Corporation
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{cbe4920d-fc87-4c7e-a3e8-fa0eb7f874d2}.sdb" = Need For Speed 2 SE Patch
"{CF8FFD12-602B-422D-AF1D-511B411E7632}" = iTunes
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{E5A509B4-D9B1-4FD9-B3EF-EDB216AA8651}" = ccc-utility64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F9A11F80-49DA-11E0-B577-00269E8DC781}" = H-Series_ASIO64
"Agent Ransack (64-bit)_is1" = Agent Ransack 2010 (64-bit)
"Blender" = Blender
"CCleaner" = CCleaner
"HWiNFO64_is1" = HWiNFO64 Version 4.00
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0556F885-2415-4666-B53E-33727E46AEA1}" = The Movies(TM)
"{05B49229-22A2-4F88-842A-BBC2EBE1CCF6}" = Microsoft Games for Windows - LIVE Redistributable
"{06FE1146-4FF8-45DF-B0D9-CBA8E38C708C}" = REALTEK RTL8187 Wireless LAN Driver
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0FFAC7BB-50DC-CB54-6CA7-A8B74513280B}" = CCC Help Chinese Traditional
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = ***ColorCommonSetRGB
"{1BBD8D70-721A-41AD-AC8F-7308A0C8FA92}" = *** Creative Suite 5 Master Collection
"{1C802083-6D79-78ED-BF1C-601DDF908DD1}" = Catalyst Control Center Core Implementation
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216032FF}" = Java(TM) 6 Update 32
"{28728178-FF15-218B-0B63-012692F42C28}" = CCC Help Danish
"{31405CA2-F009-D91B-FEFF-35924343CB14}" = Catalyst Control Center InstallProxy
"{32851025-1E46-83A3-1320-471619254E39}" = Catalyst Control Center Localization All
"{32A3A4F4-B792-11D6-A78A-00B0D0160180}" = Java(TM) SE Development Kit 6 Update 18
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = *** Media Player
"{40217B2F-462B-94A4-E84E-6A1C6EDBCE2F}" = CCC Help Swedish
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = *** AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5343A801-92E5-C234-9F27-AB27EC738BF6}" = CCC Help Japanese
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5D22226D-EBC1-C95F-7746-2E3A9F4C97BA}" = CCC Help Russian
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{600C37F2-098B-A165-C1DB-6AE2B89D8D49}" = Catalyst Control Center Graphics Previews Common
"{61F8CA2C-9A80-8A1B-D3B9-347530CB387F}" = CCC Help Norwegian
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = *** Color Video Profiles CS CS4
"{674B407D-EAB1-B6B6-F9BF-C34CEE4CD83F}" = Catalyst Control Center Graphics Light
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69F411C5-4851-6DA9-EA4C-160BEF8788AA}" = CCC Help French
"{6D8DDB4A-C263-40DE-BA16-AFDAD159D59A}" = Tom Clancy's Splinter Cell Conviction
"{6DD27E54-2598-0FEC-7CE1-BE00924C0570}" = Catalyst Control Center Graphics Previews Vista
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7C27114E-6FC8-21F5-E501-FE48F09243DF}" = CCC Help Dutch
"{80237C20-CBF3-F841-4AD5-E727AA86FBD1}" = CCC Help Italian
"{802EE127-D32A-1447-09DC-77419772BCDC}" = CCC Help Portuguese
"{836AFA32-7B8B-2C19-99D9-36EF32B42EB8}" = CCC Help Thai
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93089416-6549-44C6-99B1-B3B192902FBD}" = MAGIX Music Maker 16
"{946942CB-D078-F33A-A3CD-27E0393507FD}" = CCC Help Turkish
"{9682B99B-BB28-AD37-CA50-C1CB5BFF0FA6}" = Catalyst Control Center Graphics Full New
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A02CC93A-134F-0319-1438-B1E895B52577}" = CCC Help German
"{A48B9CD8-C2BA-4EC9-0081-7260D238C7CF}" = Need for Speed™ Most Wanted
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A7E1ADB8-162B-7C33-60FB-0561A17BD876}" = CCC Help Spanish
"{A96EEF55-155C-552E-ABB1-6FDAEF5BD944}" = CCC Help Polish
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAF4238F-7C29-451D-9925-C753271A5728}" = Microsoft Visual C++ Run Time Lib Setup
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = *** Reader 9.4.2 - Deutsch
"{ADB25FF0-AEC4-2CFB-130C-2C60D80C5934}" = CCC Help Greek
"{B04D5DA5-11DA-830C-85C6-0FF9185787E7}" = Skins
"{B05DE7B7-0B40-4411-BD4B-222CAE2D8F15}" = *** MotionPicture Color Files CS4
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B15381DD-FF97-4FCD-A881-ED4DB0975500}" = *** Color Video Profiles AE CS4
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B823632F-3B72-4514-8861-B961CE263224}" = PostgreSQL 8.3
"{BB603E9F-ECE8-7713-B0AC-7E0614E8C058}" = Catalyst Control Center HydraVision Full
"{BE232D60-AEA5-502F-ACBF-9AC188A82C21}" = CCC Help Finnish
"{C06A7DAC-1708-417C-B694-28C84DFE2DF9}" = The Movies(TM) Stunts & Spezialeffekte
"{C09F1573-6262-47F2-8B90-5B2290A58B12}" = MAGIX Speed 2 (MSI)
"{C15C4AB5-EF5D-5050-273C-4636E3FBE301}" = CCC Help Czech
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DF2035BE-5820-4965-BD97-7FAF8D4A7879}" = Microsoft_VC90_CRT_x86
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E09CD13D-7CE3-351C-1625-8DC7F21A99C0}" = ccc-core-static
"{E373E0E2-20F5-90DF-B315-615EA6E52101}" = Catalyst Control Center Graphics Full Existing
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E6DA746E-1175-88BD-2B16-1DC62018E060}" = CCC Help Chinese Standard
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F053BFD9-4357-6A82-6042-CF919667448F}" = CCC Help English
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F17EB02C-DA0D-EDEF-2E16-501FB700A710}" = CCC Help Hungarian
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F5DDC0CD-F13A-83F0-5103-563A17EA306F}" = CCC Help Korean
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"1489-3350-5074-6281" = JDownloader 0.9
"*** AIR" = *** AIR
"*** Flash Player ActiveX" = *** Flash Player 11 ActiveX
"*** Flash Player Plugin" = *** Flash Player 11 Plugin
"Alligator Flash Designer 7" = Alligator Flash Designer 7 (7.1.0.1) Trial
"AnalogX AutoTune" = AnalogX AutoTune
"AnimatorDV Simple+ 9.02_is1" = AnimatorDV Simple+ 9.02
"Antares Autotune Evo VST RTAS_is1" = Antares Autotune Evo VST RTAS v6.0.9
"apEQ" = apEQ 1.3.2
"ASIO4ALL" = ASIO4ALL
"AudioCS" = Creative Audio-Systemsteuerung
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Camera" = USB Camera Manager
"CamStudio" = CamStudio
"Celtx (2.7)" = Celtx (2.7)
"com.***.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = *** Media Player
"Creative Sound Blaster Properties x64 Edition" = Creative Sound Blaster Properties x64 Edition
"DAEMON Tools Lite" = DAEMON Tools Lite
"DivX Setup.divx.com" = DivX-Setup
"DriftCity_EU" = Drift City (EU_DE)
"eLicenser Control" = eLicenser Control
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EOS Utility" = Canon Utilities EOS Utility
"FileZilla Client" = FileZilla Client 3.5.3
"FL Studio 9" = FL Studio 9
"Fraps" = Fraps (remove only)
"Hamachi" = Hamachi 1.0.1.5
"Hardcore" = Hardcore
"InstallShield_{0556F885-2415-4666-B53E-33727E46AEA1}" = The Movies(TM) Stunts & Spezialeffekte
"InstallShield_{595AC242-897D-494C-A278-2A2781403824}" = Magic Bullet Looks
"Line 6 Uninstaller" = Line 6 Uninstaller
"MAGIX Video deluxe 2007 PLUS D" = MAGIX Video deluxe 2007 PLUS (D)
"MailStore Home_universal1" = MailStore Home 5.0.1.6919
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"mm16" = MAGIX Music Maker 16
"PhotoScape" = PhotoScape
"PhraseExpress_is1" = PhraseExpress v8.0.152
"PoiZone" = PoiZone
"Predator_is1" = Rob Papen Predator V1.5.8 32 Bits Single Core
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"PsiWin 2.3" = PsiWin 2.3
"reFX Nexus 1.0.9_is1" = reFX Nexus 1.0.9
"SUPER ©" = SUPER © Version 2010.bld.38 (May 2, 2010)
"Sylenth1_is1" = Sylenth1 v2.20
"Synthesia" = Synthesia (remove only)
"Toxic Biohazard" = Toxic Biohazard
"VST Bridge_is1" = VST Bridge 1.1
"WinLiveSuite" = Windows Live Essentials
"xampp" = XAMPP 1.7.7
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 08.09.2011 11:13:39 | Computer Name = Rocky | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 08.09.2011 12:13:22 | Computer Name = Rocky | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 08.09.2011 13:12:25 | Computer Name = Rocky | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 08.09.2011 14:06:24 | Computer Name = Rocky | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 08.09.2011 15:02:48 | Computer Name = Rocky | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 08.09.2011 16:13:15 | Computer Name = Rocky | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 10.09.2011 04:21:24 | Computer Name = Rocky | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 10.09.2011 05:05:50 | Computer Name = Rocky | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 10.09.2011 06:13:13 | Computer Name = Rocky | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 10.09.2011 07:00:33 | Computer Name = Rocky | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 10.09.2011 12:45:22 | Computer Name = Rocky | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
[ System Events ]
Error - 14.07.2012 11:51:47 | Computer Name = Rocky | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
 
Error - 14.07.2012 11:51:55 | Computer Name = Rocky | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
 
Error - 14.07.2012 12:11:42 | Computer Name = Rocky | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
 
Error - 14.07.2012 12:11:50 | Computer Name = Rocky | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
 
Error - 14.07.2012 12:15:13 | Computer Name = Rocky | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
acedrv07
 
Error - 14.07.2012 12:34:50 | Computer Name = Rocky | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?14.?07.?2012 um 18:26:23 unerwartet heruntergefahren.
 
Error - 14.07.2012 12:34:59 | Computer Name = Rocky | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
 
Error - 14.07.2012 12:36:21 | Computer Name = Rocky | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
 
Error - 14.07.2012 12:38:35 | Computer Name = Rocky | Source = DCOM | ID = 10010
Description = 
 
Error - 14.07.2012 12:39:24 | Computer Name = Rocky | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
acedrv07
 
 
< End of report >
         

--- --- ---


Danke schonmal

hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
[2012.07.14 03:41:03 | 000,001,893 | ---- | M] () -- C:\Users\*** ***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
 :Files
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden
öffne Malwarebytes poste alle logs

Hey, danke, dass du dich meinem Problem annimmst

All processes killed
========== OTL ==========
C:\Users\*** ***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 56466 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: *** ***
->Flash cache emptied: 66529 bytes

User: Public

User: themonkeymonk
->Flash cache emptied: 56502 bytes

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: *** ***
->Temp folder emptied: 160972319 bytes
->Temporary Internet Files folder emptied: 47739647 bytes
->Java cache emptied: 23436902 bytes
->FireFox cache emptied: 7231442 bytes
->Google Chrome cache emptied: 470978002 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: themonkeymonk
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1093771 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 543650 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 679,00 mb


OTL by OldTimer - Version 3.2.54.0 log created on 07142012_200531

Files\Folders moved on Reboot...
C:\Users\*** ***\AppData\Local\Temp\fest0r_ot.exe moved successfully.
C:\Users\*** ***\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Users\*** ***\AppData\Local\Temp\fest0r_ot.exe not found!
File C:\Users\*** ***\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...

nach einem malwarbytes Quickscan:

Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.04.04.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jano Kaltenbach :: ROCKY [Administrator]

Schutz: Aktiviert

14.07.2012 20:15:33
mbam-log-2012-07-14 (20-15-33).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 217002
Laufzeit: 4 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Ich hab bisher noch nichts mit Internetverbindung gemacht (dann sperrte er ja bisher) - oder sollte ich?

Ich hab Malwarebytes nochmal den Tag über alles durchsuchen lassen - folgender Log:

Malwarebytes Anti-Malware (Test) 1.62.0.1300
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.07.15.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** *** :: ROCKY [Administrator]

Schutz: Aktiviert

15.07.2012 12:21:34
mbam-log-2012-07-15 (19-30-07).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|K:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 713935
Laufzeit: 3 Stunde(n), 22 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\*** ***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt.

(Ende)

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Alles klar, hat geklappt- danke:

Combofix Logfile:

ComboFix 12-07-16.01 - *** *** 17.07.2012  15:32:11.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8190.6080 [GMT 2:00]
ausgeführt von:: c:\users\*** ***\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
c:\windows\system\OMCAMEXT.AX
c:\windows\SysWow64\windrv.sys
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-06-17 bis 2012-07-17  ))))))))))))))))))))))))))))))
.
.
2012-07-17 13:44 . 2012-07-17 13:44	--------	d-----w-	c:\users\themonkeymonk\AppData\Local\temp
2012-07-17 13:44 . 2012-07-17 13:44	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-07-17 13:25 . 2012-06-29 10:04	9133488	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{EA8634AC-4E8F-4ADD-8771-208BDDB42E1B}\mpengine.dll
2012-07-16 15:09 . 2012-07-16 15:09	--------	d-----w-	c:\program files (x86)\Kontor.NET 2010 R2
2012-07-16 15:07 . 2010-04-03 18:51	47456	----a-w-	c:\windows\SysWow64\perf-MSSQL10_50.KONTOR_NET-sqlagtctr.dll
2012-07-16 15:07 . 2010-04-03 17:57	77152	----a-w-	c:\windows\system32\perf-MSSQL10_50.KONTOR_NET-sqlagtctr.dll
2012-07-16 15:07 . 2010-04-03 18:51	73568	----a-w-	c:\windows\SysWow64\perf-MSSQL$KONTOR_NET-sqlctr10.50.1600.1.dll
2012-07-16 15:07 . 2010-04-03 17:57	79200	----a-w-	c:\windows\system32\perf-MSSQL$KONTOR_NET-sqlctr10.50.1600.1.dll
2012-07-16 15:06 . 2012-07-16 15:06	--------	d-----w-	c:\windows\system32\RsFx
2012-07-16 15:05 . 2012-07-16 15:05	--------	d-----w-	c:\program files\Microsoft Visual Studio 9.0
2012-07-16 15:05 . 2012-07-16 15:05	--------	d-----w-	c:\program files (x86)\Microsoft Visual Studio 9.0
2012-07-16 15:05 . 2012-07-16 15:05	--------	d-----w-	c:\program files\Microsoft.NET
2012-07-16 15:04 . 2012-07-16 15:04	--------	d-----w-	c:\windows\SysWow64\1033
2012-07-16 15:04 . 2012-07-16 15:04	--------	d-----w-	c:\windows\system32\1033
2012-07-16 15:01 . 2012-07-16 15:04	--------	d-----w-	c:\program files (x86)\Microsoft SQL Server
2012-07-16 15:01 . 2012-07-16 15:06	--------	d-----w-	c:\program files\Microsoft SQL Server
2012-07-16 13:47 . 2012-07-16 13:47	--------	dc-h--w-	c:\programdata\{74AE91B2-9FF0-42A6-BD48-ACFD37397C61}
2012-07-16 13:45 . 2012-07-16 13:45	--------	d-----w-	C:\inetpub
2012-07-16 13:45 . 2012-07-16 13:45	--------	d-----w-	c:\program files (x86)\SAP BusinessObjects
2012-07-16 13:43 . 2012-07-16 15:19	--------	dc-h--w-	c:\programdata\{719D6AE6-3348-497A-A7E8-44D65CACB9AC}
2012-07-16 13:43 . 2012-07-16 13:43	--------	d-----w-	c:\users\*** ***\AppData\Local\PackageAware
2012-07-15 10:19 . 2012-07-15 10:19	--------	d-----w-	c:\users\*** ***\AppData\Roaming\Avira
2012-07-15 10:13 . 2012-05-02 13:24	27760	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2012-07-15 10:13 . 2012-04-27 08:20	132832	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-07-15 10:13 . 2012-04-24 22:32	98848	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-07-15 10:13 . 2012-07-15 10:13	--------	d-----w-	c:\programdata\Avira
2012-07-15 10:13 . 2012-07-15 10:13	--------	d-----w-	c:\program files (x86)\Avira
2012-07-14 13:17 . 2012-07-15 09:56	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2012-07-14 12:22 . 2012-07-14 14:05	--------	d---a-w-	C:\Kaspersky Rescue Disk 10.0
2012-07-11 22:16 . 2012-06-12 03:08	3148800	----a-w-	c:\windows\system32\win32k.sys
2012-07-11 13:01 . 2012-07-11 13:01	--------	d-----w-	c:\program files\HWiNFO64
2012-07-10 21:03 . 2012-07-10 21:08	--------	d-----w-	c:\users\*** ***\AppData\Local\Ubisoft Game Launcher
2012-07-10 19:50 . 2012-07-10 20:11	--------	d-----w-	c:\program files (x86)\Ubisoft
2012-07-06 20:57 . 2012-07-06 20:58	--------	d-----w-	c:\users\*** ***\AppData\Roaming\PhraseExpress
2012-07-06 20:57 . 2012-07-06 20:57	--------	d-----w-	c:\programdata\PhraseExpress
2012-07-06 20:57 . 2012-07-06 20:57	--------	d-----w-	c:\program files (x86)\PhraseExpress
2012-06-30 21:51 . 2012-06-30 21:51	--------	d-----w-	c:\users\*** ***\AppData\Local\Macromedia
2012-06-29 16:36 . 2012-06-29 16:36	--------	d-----w-	c:\windows\de
2012-06-29 16:28 . 2012-06-29 16:28	89944	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\449460db1cd561401\DSETUP.dll
2012-06-29 16:28 . 2012-06-29 16:28	537432	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\449460db1cd561401\DXSETUP.exe
2012-06-29 16:28 . 2012-06-29 16:28	1801048	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\449460db1cd561401\dsetup32.dll
2012-06-22 06:22 . 2012-06-02 22:19	2428952	----a-w-	c:\windows\system32\wuaueng.dll
2012-06-22 06:22 . 2012-06-02 22:19	57880	----a-w-	c:\windows\system32\wuauclt.exe
2012-06-22 06:22 . 2012-06-02 22:19	44056	----a-w-	c:\windows\system32\wups2.dll
2012-06-22 06:22 . 2012-06-02 22:15	2622464	----a-w-	c:\windows\system32\wucltux.dll
2012-06-22 06:21 . 2012-06-02 22:19	38424	----a-w-	c:\windows\system32\wups.dll
2012-06-22 06:21 . 2012-06-02 22:19	701976	----a-w-	c:\windows\system32\wuapi.dll
2012-06-22 06:21 . 2012-06-02 22:15	99840	----a-w-	c:\windows\system32\wudriver.dll
2012-06-22 06:20 . 2012-06-02 13:19	186752	----a-w-	c:\windows\system32\wuwebv.dll
2012-06-22 06:20 . 2012-06-02 13:15	36864	----a-w-	c:\windows\system32\wuapp.exe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-11 21:55 . 2012-03-31 12:51	426184	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-11 21:55 . 2011-07-06 09:30	70344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-03 11:46 . 2010-07-29 20:39	24904	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-05-31 10:25 . 2010-03-07 21:00	279656	------w-	c:\windows\system32\MpSigStub.exe
2012-05-25 17:37 . 2012-05-25 17:37	476960	----a-w-	c:\windows\SysWow64\npdeployJava1.dll
2012-05-25 17:37 . 2010-06-20 18:07	472864	----a-w-	c:\windows\SysWow64\deployJava1.dll
2012-05-04 11:06 . 2012-06-16 18:41	5559664	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-05-04 10:03 . 2012-06-16 18:41	3968368	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03 . 2012-06-16 18:41	3913072	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2012-05-01 05:40 . 2012-06-16 18:41	209920	----a-w-	c:\windows\system32\profsvc.dll
2012-04-28 03:55 . 2012-06-16 18:41	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-04-26 05:41 . 2012-06-16 18:42	77312	----a-w-	c:\windows\system32\rdpwsx.dll
2012-04-26 05:41 . 2012-06-16 18:42	149504	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-04-26 05:34 . 2012-06-16 18:42	9216	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-04-24 05:37 . 2012-06-16 18:40	184320	----a-w-	c:\windows\system32\cryptsvc.dll
2012-04-24 05:37 . 2012-06-16 18:40	140288	----a-w-	c:\windows\system32\cryptnet.dll
2012-04-24 05:37 . 2012-06-16 18:40	1462272	----a-w-	c:\windows\system32\crypt32.dll
2012-04-24 04:36 . 2012-06-16 18:40	140288	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2012-04-24 04:36 . 2012-06-16 18:40	1158656	----a-w-	c:\windows\SysWow64\crypt32.dll
2012-04-24 04:36 . 2012-06-16 18:40	103936	----a-w-	c:\windows\SysWow64\cryptnet.dll
2006-05-03 09:06	163328	--sh--r-	c:\windows\SysWOW64\flvDX.dll
2007-02-21 10:47	31232	--sh--r-	c:\windows\SysWOW64\msfDX.dll
2008-03-16 12:30	216064	--sh--r-	c:\windows\SysWOW64\nbDX.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\*** ***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\*** ***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\*** ***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Vagex"="c:\users\*** ***\Desktop\Vagex\Vagex\Vagex.exe" [2012-05-12 158720]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"ICQ"="c:\program files (x86)\ICQ7.2\ICQ.exe" [2011-01-05 133432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]
"LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-05-01 348624]
.
c:\users\*** ***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
HDDlife.lnk - c:\program files (x86)\BinarySense\HDDlife 3\HDDlifePro.exe [N/A]
IMVU.lnk - c:\users\*** ***\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe [N/A]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
PhraseExpress.lnk - c:\program files (x86)\PhraseExpress\phraseexpress.exe [2012-7-6 7345736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe [2008-02-01 65536]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]
R2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [x]
R3 ***FlashPlayerUpdateSvc;*** Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-11 250056]
R3 ALSysIO;ALSysIO;c:\users\***KA~1\AppData\Local\Temp\ALSysIO64.sys [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-04-10 79360]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 evserial;Virtual Serial Ports Driver (Eltima Softwate);c:\windows\system32\DRIVERS\evserial.sys [2008-05-20 67072]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 libusb0;LibUsb-Win32 - Kernel Driver 08/27/2006, 0.1.12.0;c:\windows\system32\DRIVERS\libusb0.sys [2007-05-10 31744]
R3 RecFltr;Reclusa Keyboard;c:\windows\system32\drivers\RecFltr.sys [2007-01-18 45440]
R3 RTCore64;RTCore64;c:\program files (x86)\RMClock\RTCore64.sys [2005-05-25 7168]
R3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys [2009-12-01 38992]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\***\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
R3 ZMHHPAudioSrv;ZOOM H Series High Performance Audio Driver Service;c:\windows\system32\drivers\zmhhpau.sys [2011-03-09 43520]
R3 ZY202_64;Speedport W 101 Stick;c:\windows\system32\DRIVERS\WlanUZ64.SYS [2007-11-12 623872]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2010-04-03 59744]
R4 RsFx0150;RsFx0150 Driver;c:\windows\system32\DRIVERS\RsFx0150.sys [2010-04-03 313696]
R4 SQLAgent$KONTOR_NET;SQL Server Agent (KONTOR_NET);c:\program files\Microsoft SQL Server\MSSQL10_50.KONTOR_NET\MSSQL\Binn\SQLAGENT.EXE [2010-04-03 428384]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2011-03-04 55856]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-05-02 27760]
S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\program files\HWiNFO64\HWiNFO64A.SYS [2012-05-10 30592]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2009-01-19 334344]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-05-27 203264]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-01 86224]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
S2 MSSQL$KONTOR_NET;SQL Server (KONTOR_NET);c:\program files\Microsoft SQL Server\MSSQL10_50.KONTOR_NET\MSSQL\Binn\sqlservr.exe [2010-04-03 61913952]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-05-27 6856192]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-05-27 264192]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2010-12-13 36720]
S3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
S3 RTL8187;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187.sys [2007-01-06 236032]
S3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\DRIVERS\vcsvad.sys [2008-12-26 21504]
S3 VSBC;Virtual Serial Bus Enumerator (Eltima Software);c:\windows\system32\DRIVERS\evsbc.sys [2010-04-19 32768]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-07-17 c:\windows\Tasks\*** Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 21:55]
.
2012-07-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3942922135-1496659649-2599000942-1000Core.job
- c:\users\*** ***\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-11 19:06]
.
2012-07-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3942922135-1496659649-2599000942-1000UA.job
- c:\users\*** ***\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-11 19:06]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\*** ***\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\*** ***\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\*** ***\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\*** ***\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://google.de/
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = 192.168.8.1:3128
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\*** ***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1
.
.
------- Dateityp-Verknüpfung -------
.
JSEFile=%SystemRoot%\SysWow64\CScript.exe "%1" %*
.txt=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-***Bridge - (no file)
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
Wow6432Node-HKCU-Run-xNeat Clipboard Manager - c:\program files (x86)\xNeat Application Builder\xNeatClipMngr.exe
AddRemove-Fraps - d:\fraps\uninstall.exe
AddRemove-MD Adressbuch 2011_is1 - c:\users\*** ***\Desktop\mda\unins000.exe
AddRemove-PsiWin 2.3 - c:\windows\IsUn0407.exe
AddRemove-Synthesia - c:\program files (x86)\Synthesia\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3942922135-1496659649-2599000942-1000\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:a0,f2,95,c4,8a,a1,4f,8a,3d,fc,67,5f,6d,22,9d,79,c4,4e,05,91,a2,
   3a,f0,ac,c1,b2,99,15,48,88,14,8f,76,64,da,e8,e9,8b,ad,36,c0,fa,5a,20,88,4d,\
"rkeysecu"=hex:9a,ae,85,fa,24,b9,ae,e7,61,30,00,06,05,85,7a,6a
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\xampp\mysql\bin\mysqld.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-07-17  16:05:42 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-07-17 14:05
.
Vor Suchlauf: 11 Verzeichnis(se), 62.297.092.096 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 62.564.286.464 Bytes frei
.
- - End Of File - - 5B9EDF5C551808EFA90F179C6EC1D454
         

--- --- ---

malwarebytes:
Downloade Dir bitte Malwarebytes

• Installiere
  das Programm in den vorgegebenen Pfad.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Starte Malwarebytes, klicke auf Aktualisierung --> Suche
  nach Aktualisierung
• Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
• Wenn der Scan beendet
  ist, klicke auf Ergebnisse anzeigen.
• Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
• Poste
  das Logfile, welches sich in Notepad öffnet, hier in den Thread.
• Nachträglich kannst du den Bericht unter "Log Dateien" finden.

So, dass wärs!
Danke!

Malwarebytes' Anti-Malware 1.46
Malwarebytes : Free Anti-Malware download

Datenbank Version: 4052

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

29.07.2010 22:45:06
mbam-log-2010-07-29 (22-45-06).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 116527
Laufzeit: 4 Minute(n), 26 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 2
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
C:\Windows\System32\SYSTEM32 (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\SYSTEM32\DRIVERS (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\Windows\System32\SYSTEM32\DRIVERS\rtl8187.sys (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\*** ***\AppData\Local\Temp\0.8722967928734544.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

hi
hast du dir das datum vom log mal angesehen?
29.07.2010 22:45:06
das kann man nicht grad das aktuelle log nennen :-)

Huch? Damals hatte ich Malwarebytes doch noch gar nicht, aber der ist es jetzt :

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.19.10

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** *** :: ROCKY [Administrator]

Schutz: Aktiviert

19.07.2012 17:11:16
mbam-log-2012-07-19 (17-11-16).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|K:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 704814
Laufzeit: 3 Stunde(n), 35 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)