Heyho und hallo erstmal alle zusammen. Ich hab mich jetzt durch zahlreiche Foren und Googleergebnisse gekämpft und bin nun hier gelandet. Zuletzt hat mir jemand gesagt, mein Problem könnte ein Verschlüsselungstrojaner sein. Und so wie ich das hier gelesen hab isses wohl auch so.
Also folgender Punkt:
90% meiner Daten (hauptsächlich mkv, jpg und bmp) lassen sich nicht mehr öffnen. mp3s und pngs funktionieren noch. Hab halt in der Hetze sonnen Anhang geöffnet und peng, da isser der Salat. Mittlerweile sollte alles aktive vom Trojaner platt sein, konnte ihn bei der Arbeit noch unterbrechen und hab mich wie gesagt durch einige Foren gekloppt, bei live CDs keine Meldungen mehr, genauso alles was es hier so an scan-Programmen zum Thema gibt.
Nun zum Problem: die Dateien sind nach wie vor wahrscheinlich verschlüsselt. Der Name ist gleich, Endung auch, Header scheint geändert, da nichts mehr die Dateien erkennt. Die verschlüsselten Daten sind meist 2-3 kB größer (hatte einen Ordner noch auf nem Stick).

Wär ziemlich nett, wenn mir da jemand helfen könnte.

Originalen und verschlüsselten Ordner, sowie OLT und Extra Datei würde ich morgen nachreichen, wenn die zur Problemlösung beitragen können.

Downloads.zip

Da die entsprechenden Dateien.

File-Upload.net - Downloads.zip

File-Upload.net - Downloads.zip

... okay, kann ich irgendwie meinen Beitrag editieren? Und vielleicht mal nen Link rein stellen, die OLT und Extra dateien sind etwas groß um sie so zu posten....

Vielleicht so:
Extras:

OTL Extras logfile created on: 15.07.2012 01:10:49 - Run 1
OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Tom.Normal\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,99 Gb Total Physical Memory | 3,97 Gb Available Physical Memory | 66,24% Memory free
11,98 Gb Paging File | 9,74 Gb Available in Paging File | 81,29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,69 Gb Total Space | 26,93 Gb Free Space | 24,11% Space Free | Partition Type: NTFS
Drive D: | 931,51 Gb Total Space | 367,75 Gb Free Space | 39,48% Space Free | Partition Type: NTFS
Unable to calculate disk information.
Drive G: | 100,00 Mb Total Space | 71,86 Mb Free Space | 71,87% Space Free | Partition Type: NTFS
Drive K: | 28,67 Gb Total Space | 14,33 Gb Free Space | 49,99% Space Free | Partition Type: NTFS
Drive L: | 3,69 Gb Total Space | 2,87 Gb Free Space | 77,69% Space Free | Partition Type: FAT32
Drive X: | 1862,89 Gb Total Space | 229,40 Gb Free Space | 12,31% Space Free | Partition Type: NTFS
 
Computer Name: NETAD | User Name: Tom.Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01826225-A1AE-4787-86D6-F46AD00A6AA4}" = rport=139 | protocol=6 | dir=out | app=system | 
"{0F618B06-8317-4507-8B4B-D4E39113CC88}" = lport=138 | protocol=17 | dir=in | app=system | 
"{19BF4C4A-1C8E-4C3C-8673-C0A6D46E83B9}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{22E511AF-F4C8-4562-A02D-9C7D8637D860}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{2338A6AE-DE28-4478-914C-994ED62379DE}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{24A8F49C-48E7-4C40-B1DC-C62E60DD2F5A}" = lport=58821 | protocol=6 | dir=in | name=pando media booster | 
"{2ACD734B-E134-4141-9F16-525E57D86713}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{3BE49050-E561-4980-AFD9-02E007D63209}" = rport=445 | protocol=6 | dir=out | app=system | 
"{3D14BF86-89F1-4FAE-8139-292FB9BB1C38}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{43FDF60D-580B-4D48-8706-735B5B17C44A}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 
"{47BE752B-6532-4717-BC15-3A36832F3B3F}" = lport=7935 | protocol=6 | dir=in | name=adobe flash builder 4.6 | 
"{4B3B7558-79EF-4AF4-8183-65DD7F5A9B70}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{5075E1F6-BAFD-4007-9749-C96877913EFB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{56CB5F68-B504-4828-B22B-FA3C81569D11}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{5B9E55C2-BC1D-4F97-A853-B6EDE330B440}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{6E3BC323-6166-4CBC-807C-40D503B38388}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6EE3E343-81F2-4231-A031-8765857E51B3}" = rport=138 | protocol=17 | dir=out | app=system | 
"{6F35D5F8-2730-402D-87F2-155EC366E818}" = lport=58821 | protocol=17 | dir=in | name=pando media booster | 
"{6FEACCFD-49D0-4AF1-B99C-FB04F6D3191D}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{71C37AB2-2836-42B1-8024-5C5843A9437D}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{7A9D3382-7D95-413D-B9A1-3D00B09DC9FA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{7E4AF29B-D60A-4C4E-8889-DD81C4C1C8AD}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{8173E00A-DE58-47A9-88CC-D96EE8A91223}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{85438B4E-2DBC-4153-9305-2E2602506CE3}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe | 
"{89B09531-3E5C-46AE-8ECD-36F798ADF2BC}" = rport=137 | protocol=17 | dir=out | app=system | 
"{97EBFEC9-5540-493A-94AF-4CC2CD851B3C}" = lport=58821 | protocol=6 | dir=in | name=pando media booster | 
"{9C80CDF1-100C-4A55-B9A5-5934554508FA}" = lport=137 | protocol=17 | dir=in | app=system | 
"{A695D76C-0D9C-4526-9384-1755B124D9B8}" = lport=58821 | protocol=17 | dir=in | name=pando media booster | 
"{AC08EFF7-4FCB-4B6F-93F9-F9E011D72B37}" = lport=445 | protocol=6 | dir=in | app=system | 
"{B3DEDD84-BD67-41E2-BA37-C72FC186DD79}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{B73EE606-ECDC-4DB7-B53E-306FD5D52DAC}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{BDE64636-41D7-43AC-859C-E2D3496132F4}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{D163DF8B-3296-4B93-8838-5ECBD75E1763}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{DBE4AB2B-663B-4071-84C9-9B5B97C7D08F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{DC64D868-1ABC-40AA-B6C1-1434C5DB8716}" = lport=139 | protocol=6 | dir=in | app=system | 
"{E031942A-A21B-4C3B-A34E-F08D81A9E13E}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{F23B6CD1-9888-4617-A10D-DB0046486B1A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{F86D028F-544C-471B-869A-FA858992BFE9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{016754D5-6D61-4955-87CA-B63CE8A25F1F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{01A6ADCB-1408-47A4-9CB6-06ACA02974D9}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{01CCA142-3D8B-473B-B4C1-51D44DF469B7}" = protocol=17 | dir=in | app=d:\program files (x86)\rockstar games\max payne 3\playmaxpayne3.exe | 
"{02D2725F-6A34-468B-AF15-F6F15D539EE9}" = protocol=17 | dir=in | app=c:\program files (x86)\terratec\terratec home cinema\cinergydvr.exe | 
"{04EC56DC-D6E9-4CAD-AA84-AC216AD18C87}" = protocol=6 | dir=in | app=c:\program files (x86)\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe | 
"{0558CFE1-C47A-4D6E-8520-1BAA68511CC2}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd8\powerdvd8.exe | 
"{06B54BB7-6397-43C1-8443-403B59190270}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed ii\assassinscreediigame.exe | 
"{06EB6BE5-7C3A-4B5F-B0A1-428E48D5687C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{071F40CF-0897-4498-9A1A-41BB43EFA830}" = protocol=17 | dir=in | app=d:\program files (x86)\electronic arts\burnout(tm) paradise the ultimate box\burnoutlauncher.exe | 
"{0BED5E9B-2F59-4830-9F76-7624FDB2AB08}" = protocol=17 | dir=in | app=d:\program files (x86)\electronic arts\burnout(tm) paradise the ultimate box\burnoutconfigtool.exe | 
"{107A256A-C621-4D70-9C6D-C167E9BB3F6A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{121F8400-50FF-4809-A84F-A4B62028989F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{167C2CD9-0641-4712-AA44-D182D8123F6B}" = protocol=6 | dir=in | app=c:\users\tom.admin\appdata\local\temp\{46492591-b0d7-402e-ad36-9a787ca55bdd}\{63b9bab5-f36a-4a3b-9e5c-68a7f212bfb9}\insttool.exe | 
"{1A607C59-1ECD-4B88-A008-903716653C04}" = protocol=6 | dir=in | app=d:\program files (x86)\steam\steam.exe | 
"{1D975EC9-A0D4-4F89-8D39-308F8ACD8618}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{1F0D8CD6-49E4-453B-AD9F-6E48A95C8919}" = protocol=6 | dir=in | app=d:\program files (x86)\electronic arts\burnout(tm) paradise the ultimate box\burnoutlauncher.exe | 
"{213A4D1D-5596-47C9-89E8-7A4636EFA802}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 
"{252FD396-F7C8-4582-A0FC-1FCCEB1B36D1}" = protocol=17 | dir=in | app=c:\users\tom.admin\appdata\local\temp\{46492591-b0d7-402e-ad36-9a787ca55bdd}\{63b9bab5-f36a-4a3b-9e5c-68a7f212bfb9}\insttool.exe | 
"{2596C306-8409-4C87-ACFA-99D25CFF825F}" = protocol=6 | dir=in | app=d:\program files (x86)\rockstar games\max payne 3\playmaxpayne3.exe | 
"{2BE3A65D-7C83-4FF7-81D6-4C3B1995D630}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed revelations\acrsp.exe | 
"{2F5667F0-A0B3-4875-BC5E-564E0ECA503A}" = protocol=17 | dir=in | app=c:\users\tom.admin\downloads\sweetimsetup.exe | 
"{302E6F50-34E8-404D-B700-66D728766D0F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{33416C8A-40BC-4E63-91CF-D406D53A284C}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed ii\uplaybrowser.exe | 
"{338EE863-3E0D-4ADF-AA32-E9DFBD0AC7B4}" = protocol=17 | dir=in | app=d:\program files (x86)\microsoft games\age of empires iii\age3x.exe | 
"{347C8002-19E9-46D1-9CD1-048BA99A2123}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\driver san francisco\driver.exe | 
"{362325D0-11F4-491B-B7BD-693EF2BD02C9}" = protocol=6 | dir=in | app=d:\program files (x86)\electronic arts\burnout(tm) paradise the ultimate box\burnoutconfigtool.exe | 
"{3AB21CC1-6F9F-490B-ABC3-C54B950440E0}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed brotherhood\uplaybrowser.exe | 
"{3B0DE401-FE93-4236-B638-E2C0A249A353}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifetray.exe | 
"{3B4C8D98-9854-488C-84D0-049756CB8446}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{40F5BA1D-696A-49E6-9CDD-75034C8B6C75}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{423B63DA-EC85-4CA4-AFA2-3FBA78CE5D06}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{450ECE9F-28A2-461C-84CE-E2CDF23774E3}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed brotherhood\acbsp.exe | 
"{4844F123-003F-448F-B2C3-710F8697FF8B}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{48E224F9-1D95-4F07-AAA2-9411BF3376CF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{499137A2-CCA0-46EE-AE71-3AFF3DF6E253}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{4BFBF130-AE84-44FE-8769-33E248240E1C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{4FBB43C3-B94B-4CE6-AA05-D24DE0393B1D}" = protocol=6 | dir=in | app=d:\program files (x86)\capcom\street fighter x tekken\sftk.exe | 
"{5098D933-ED69-4EB0-A2F5-A75666CCAD95}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{5557571A-16D4-4CA6-8EED-D2D922BC4CA6}" = protocol=6 | dir=in | app=c:\program files (x86)\adobe\adobe flash builder 4.6\flashbuilder.exe | 
"{555963A5-E11E-419F-B61B-6E27B60C73B4}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed\assassinscreed_dx10.exe | 
"{588FC8D3-EC15-4E2E-B473-C525CCB7DBE7}" = protocol=6 | dir=in | app=d:\program files (x86)\electronic arts\burnout(tm) paradise the ultimate box\burnoutparadise.exe | 
"{5C631104-1FBE-4608-BA3D-69D88C35F841}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{5C8A7C2F-35BE-4AD5-B8DD-AE95F25E5A98}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{5E1CCBC7-47DE-4E80-B57F-0ABE8410C5E1}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\die siedler 7\data\base\_dbg\bin\release\settlers7r.exe | 
"{61A5E68C-DE2B-49FF-98C8-94A73CB86834}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 
"{61F5E080-5322-4F22-B1FD-2C22F93279F7}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeenc2.exe | 
"{62F6CACE-E652-402B-B8CA-48594823E4D0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{659B0413-6564-495D-B19E-243F7D50D266}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{66AE0E04-1FB5-42CD-B8A8-541C463A473C}" = protocol=6 | dir=in | app=c:\users\tom.admin\downloads\sweetimsetup.exe | 
"{68BDEE34-8DDE-4DAB-A485-4496B237070A}" = protocol=17 | dir=in | app=d:\program files (x86)\electronic arts\burnout(tm) paradise the ultimate box\burnoutparadise.exe | 
"{69A0AE24-5B2A-4009-BDEA-5568CA57C1B3}" = protocol=17 | dir=in | app=d:\program files (x86)\capcom\street fighter x tekken\sftk.exe | 
"{6B3BC4EF-B9C5-4031-9D5C-21CCDD75B934}" = protocol=6 | dir=in | app=c:\program files (x86)\unreal tournament 3 (lg)\binaries\ut3.exe | 
"{6F9B0605-23CE-45A4-814E-2D89A8C51249}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{73A77010-F5AB-425B-9010-373828B97EB7}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeexp.exe | 
"{74C5FA94-3C13-45A0-85E6-FA7AA505D3F8}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{758783B4-4BDE-4B10-AC4C-1D47152536DA}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{76FF5984-3463-4053-85F9-FD4D79B09486}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed brotherhood\acbmp.exe | 
"{7B3B8808-F2D1-4E11-BE82-C7746D4B9BB0}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed\assassinscreed_launcher.exe | 
"{7B49FB62-D748-4634-81DD-07B13A5DBA81}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed ii\assassinscreedii.exe | 
"{7D25D66B-F12D-4083-9741-9422A95985C5}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{7D6B6D15-25A5-41B4-81A2-3CD0669578A5}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{82BAA05F-8167-4E24-BE49-1A69F662EC3B}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeexp.exe | 
"{89492240-39BF-41DC-8A39-E8DA8D69A9BC}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed revelations\assassinscreedrevelations.exe | 
"{8A14739F-0F52-48CC-9FF2-1C4A9CD728E4}" = protocol=17 | dir=in | app=c:\program files (x86)\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe | 
"{8C121210-8125-4DD5-9C54-23B4B8B9875A}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed ii\uplaybrowser.exe | 
"{8DB66097-5C06-43D1-BC4F-3F1141DDD840}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed brotherhood\acbsp.exe | 
"{93CE89F5-DA7C-43BD-B8DD-D09809934909}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed revelations\acrsp.exe | 
"{950B9103-2630-4060-9FB8-FE3ED92D0BA9}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe | 
"{9D36DE32-28B8-477F-AB78-16DA20A169E1}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed brotherhood\acbmp.exe | 
"{9F729243-18BF-4D7A-858C-BD3A62782971}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{A4A0F80C-8999-427B-8C10-60B7468B5923}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed\assassinscreed_launcher.exe | 
"{A4DA362C-E58B-48EE-BF82-373007A98FC4}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed brotherhood\uplaybrowser.exe | 
"{A5E9B122-1E71-49F5-8CB6-178B5FAB6614}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed\assassinscreed_dx9.exe | 
"{A6AEFEC3-16AE-413A-8B51-B85042E93C7F}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed revelations\assassinscreedrevelations.exe | 
"{AA058D82-37BE-44AA-9DF6-4A17136650FF}" = protocol=17 | dir=in | app=d:\program files (x86)\steam\steam.exe | 
"{ABB64CAD-78D9-4511-80F0-36165243C8C7}" = protocol=17 | dir=in | app=d:\program files (x86)\microsoft games\age of empires iii\age3y.exe | 
"{B1C861E0-0F72-49DD-BBD3-CD86AD197022}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe | 
"{B25E4DDC-BE67-4D02-B6B4-CBBD0E2B0AB3}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed\assassinscreed_dx10.exe | 
"{B77FB328-1176-4176-9446-49A9CED24BCF}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifecam.exe | 
"{B9265327-CA3F-4158-886C-1F627BB68244}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed revelations\acrmp.exe | 
"{BB705F38-D760-4F67-B8C8-EA11082AB275}" = protocol=17 | dir=in | app=c:\users\tom.admin\appdata\roaming\dropbox\bin\dropbox.exe | 
"{BC127EC0-4C12-4E5D-A55F-DF7F56C839EF}" = protocol=6 | dir=in | app=c:\program files (x86)\terratec\terratec home cinema\cinergydvr.exe | 
"{C0EC518C-04CE-413E-805A-57924F83AEED}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{C384C370-01ED-46B7-9240-35FD25CB8EC1}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{C3A84506-C765-46E3-8FA8-03D3128EC67D}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed brotherhood\assassinscreedbrotherhood.exe | 
"{C674FBE3-90B0-4D08-A370-C1AB57AAC215}" = protocol=17 | dir=in | app=c:\program files (x86)\unreal tournament 3 (lg)\binaries\ut3.exe | 
"{CE14F570-5458-4D92-BE7B-F37633C478D9}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed revelations\acrmp.exe | 
"{CE33BA2F-A935-490F-A471-7048935E8BE1}" = protocol=6 | dir=in | app=d:\program files (x86)\microsoft games\age of empires iii\age3y.exe | 
"{D0C32F99-9B47-4B2E-A6C1-1110374AE250}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed brotherhood\assassinscreedbrotherhood.exe | 
"{D27CCC1A-3F21-474B-9806-6847E153FD10}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed ii\assassinscreedii.exe | 
"{D57170C0-5DB5-4CE7-9BB8-EA7BADA4771B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{D8DD0534-8DC2-42CE-A187-DBD4A992EB3D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{DF713167-4412-4093-A637-D792AF32CE46}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed ii\assassinscreediigame.exe | 
"{E5269471-CEC6-43DB-AEA9-7B5603F216CA}" = protocol=6 | dir=in | app=c:\users\tom.admin\appdata\roaming\dropbox\bin\dropbox.exe | 
"{E696B19B-89A5-4BE6-8FF4-83A0ED94CF82}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeenc2.exe | 
"{E71A94DE-699C-4C15-8381-D3B91D34BFA8}" = protocol=6 | dir=in | app=d:\program files (x86)\microsoft games\age of empires iii\age3x.exe | 
"{EA299167-D387-48DA-9E51-CC887ABF7121}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifetray.exe | 
"{EBA7CA89-0800-416F-9516-11EBCD1C3D85}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{EBAD9BCE-CEE1-4DAE-92F3-023E85869762}" = protocol=6 | dir=out | app=system | 
"{EC01156D-6B6A-471B-A038-83D7FFBCB702}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{EFACD1F9-B628-4D7B-B0E8-242201439E5B}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\die siedler 7\data\base\_dbg\bin\release\settlers7r.exe | 
"{F7C730C8-0415-4F7D-A60A-CC727632A97F}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifecam.exe | 
"{F8165C45-CFB4-45DD-A4DA-AA7F87066A30}" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\driver san francisco\driver.exe | 
"{F9E82858-F4D6-488A-A582-F657978D3E2F}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{FA5CC394-93AF-4500-812E-B9E6B2B39FE3}" = protocol=17 | dir=in | app=c:\program files (x86)\adobe\adobe flash builder 4.6\flashbuilder.exe | 
"{FFCDC922-E386-4F21-A7B5-FF22CA142409}" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed\assassinscreed_dx9.exe | 
"TCP Query User{0106D21E-0A7E-4B39-8AA2-677A96A59B9A}G:\portableapps\xampp\filezillaftp\filezilla server.exe" = protocol=6 | dir=in | app=g:\portableapps\xampp\filezillaftp\filezilla server.exe | 
"TCP Query User{025FF1F9-BF3B-4B97-852F-38966F2BA4EE}M:\portableapps\xampp\mysql\bin\mysqld.exe" = protocol=6 | dir=in | app=m:\portableapps\xampp\mysql\bin\mysqld.exe | 
"TCP Query User{034400B8-6283-425F-ABDE-DD0DE3E0B9E7}G:\portableapps\skypeportable\app\skype\phone\skype.exe" = protocol=6 | dir=in | app=g:\portableapps\skypeportable\app\skype\phone\skype.exe | 
"TCP Query User{0F202C1D-D4E3-45D3-9426-EC76B6CF6FD7}C:\program files (x86)\terratec\terratec home cinema\versioncheck\versioncheck.exe" = protocol=6 | dir=in | app=c:\program files (x86)\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"TCP Query User{0FED6711-6F74-4079-8D0A-249D936FDA9C}C:\users\tom.normal\desktop\skypeportable\app\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\users\tom.normal\desktop\skypeportable\app\skype\phone\skype.exe | 
"TCP Query User{0FF5E10B-EE95-4BB9-800E-47895E8413AF}J:\portableapps\xampp\apache\bin\httpd.exe" = protocol=6 | dir=in | app=j:\portableapps\xampp\apache\bin\httpd.exe | 
"TCP Query User{1EFB31F7-1495-4A25-9185-62469A0F0297}C:\users\tom.admin\appdata\local\temp\d2ca.tmp\kmservice.exe" = protocol=6 | dir=in | app=c:\users\tom.admin\appdata\local\temp\d2ca.tmp\kmservice.exe | 
"TCP Query User{24F67B71-3EDC-4941-B395-3C3180D7C119}H:\portableapps\skypeportable\app\skype\phone\skype.exe" = protocol=6 | dir=in | app=h:\portableapps\skypeportable\app\skype\phone\skype.exe | 
"TCP Query User{2956D08A-2B39-4095-9C44-64FD46762843}D:\program files (x86)\batman arkham city\binaries\win32\batmanac.exe" = protocol=6 | dir=in | app=d:\program files (x86)\batman arkham city\binaries\win32\batmanac.exe | 
"TCP Query User{2C9D8E01-4867-4296-BD98-134BB460783E}C:\program files (x86)\cisco packet tracer 5.3.1\bin\packettracer5.exe" = protocol=6 | dir=in | app=c:\program files (x86)\cisco packet tracer 5.3.1\bin\packettracer5.exe | 
"TCP Query User{37F7B07A-334F-45E5-AFBC-8154994311BD}D:\program files (x86)\kings of amalur reckoning\12345-aamurmul5\reckoning.exe" = protocol=6 | dir=in | app=d:\program files (x86)\kings of amalur reckoning\12345-aamurmul5\reckoning.exe | 
"TCP Query User{3B160251-9DA4-403D-BF29-7721E4611265}C:\users\tom.admin\appdata\local\temp\14ec.tmp\kmservice.exe" = protocol=6 | dir=in | app=c:\users\tom.admin\appdata\local\temp\14ec.tmp\kmservice.exe | 
"TCP Query User{3BACA3DB-05EB-4D35-A9FF-34BE179D8E3E}M:\portableapps\xampp\mysql\bin\mysqld.exe" = protocol=6 | dir=in | app=m:\portableapps\xampp\mysql\bin\mysqld.exe | 
"TCP Query User{3BDC283A-D1B8-4CC9-975E-920F68FDA8B7}D:\downloads\020-a1amur5mul5\12345-aamurmul5\reckoning.exe" = protocol=6 | dir=in | app=d:\downloads\020-a1amur5mul5\12345-aamurmul5\reckoning.exe | 
"TCP Query User{420FB716-86F8-494B-9199-0EBB57D70A92}C:\users\tom.normal\appdata\roaming\icq\application\icq7.4\icq.exe" = protocol=6 | dir=in | app=c:\users\tom.normal\appdata\roaming\icq\application\icq7.4\icq.exe | 
"TCP Query User{53920DD2-1D53-40EA-AAAC-9C1436E43310}M:\portableapps\xampp\apache\bin\httpd.exe" = protocol=6 | dir=in | app=m:\portableapps\xampp\apache\bin\httpd.exe | 
"TCP Query User{58F02B7B-6EAF-4975-8F0E-360EF8B08E4E}C:\program files (x86)\starcraft ii\support\blizzarddownloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\support\blizzarddownloader.exe | 
"TCP Query User{5BEBD505-4FBC-4F27-BB5B-FC1A395482E8}C:\users\tom.normal\appdata\roaming\icq\application\icq7.2\icq.exe" = protocol=6 | dir=in | app=c:\users\tom.normal\appdata\roaming\icq\application\icq7.2\icq.exe | 
"TCP Query User{5F1B5E2B-384A-420D-9DBC-C781DCED558D}I:\portableapps\skypeportable\app\skype\phone\skype.exe" = protocol=6 | dir=in | app=i:\portableapps\skypeportable\app\skype\phone\skype.exe | 
"TCP Query User{5F307C74-56D7-419A-866A-B6C5B03455E7}D:\program files (x86)\the witcher 2\bin\witcher2.exe" = protocol=6 | dir=in | app=d:\program files (x86)\the witcher 2\bin\witcher2.exe | 
"TCP Query User{5FC6A774-FB9A-4F94-A9FC-ED0D41E41077}D:\program files (x86)\ubisoft\assassin's creed revelations\acrpr.exe" = protocol=6 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed revelations\acrpr.exe | 
"TCP Query User{657B0811-BBF1-4D6E-BB54-DACFCC2D1AD4}D:\installstuff & benches\spiele\wc3- v1.20c\war3.exe" = protocol=6 | dir=in | app=d:\installstuff & benches\spiele\wc3- v1.20c\war3.exe | 
"TCP Query User{66E5D8CE-489F-433F-B8B3-A67C05FCA910}G:\portableapps\xampp\apache\bin\httpd.exe" = protocol=6 | dir=in | app=g:\portableapps\xampp\apache\bin\httpd.exe | 
"TCP Query User{6DFC1C10-0684-46E6-B65C-2E1634932E3F}C:\program files (x86)\starcraft ii\versions\base15405\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base15405\sc2.exe | 
"TCP Query User{82741466-F2AA-4484-A3A0-A885BEE21F94}H:\portableapps\xampp\apache\bin\httpd.exe" = protocol=6 | dir=in | app=h:\portableapps\xampp\apache\bin\httpd.exe | 
"TCP Query User{84282782-D00A-450E-A669-841C2D073B6F}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{872C6E20-41DC-4873-980E-57CFB9EC3DBC}C:\users\tom.normal\appdata\roaming\icq\application\icq7.7\icq.exe" = protocol=6 | dir=in | app=c:\users\tom.normal\appdata\roaming\icq\application\icq7.7\icq.exe | 
"TCP Query User{8817550B-50D0-4943-8FF0-FFED8963B700}D:\program files (x86)\blades of time\bladesoftime.exe" = protocol=6 | dir=in | app=d:\program files (x86)\blades of time\bladesoftime.exe | 
"TCP Query User{884F8636-4E36-4E86-A3EB-2D129684507A}J:\portableapps\xampp\mysql\bin\mysqld.exe" = protocol=6 | dir=in | app=j:\portableapps\xampp\mysql\bin\mysqld.exe | 
"TCP Query User{89307FDA-BC80-441A-8D00-53D56E0BF472}D:\program files (x86)\ea games\kingdoms of amalur reckoning\reckoning.exe" = protocol=6 | dir=in | app=d:\program files (x86)\ea games\kingdoms of amalur reckoning\reckoning.exe | 
"TCP Query User{9130B265-24C2-4309-8FF4-BB5FC28EE129}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe | 
"TCP Query User{93F8CB67-55FC-4008-8D2A-38EB6B431624}C:\program files (x86)\starcraft ii\versions\base16755\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base16755\sc2.exe | 
"TCP Query User{948DDBE5-11E6-4F6F-8114-37723BCA4447}C:\users\tom.normal\desktop\teamviewerportable\app\teamviewer\teamviewer.exe" = protocol=6 | dir=in | app=c:\users\tom.normal\desktop\teamviewerportable\app\teamviewer\teamviewer.exe | 
"TCP Query User{9F337BB8-3DA2-43F1-BC88-171F3A2F0E98}C:\users\tom.admin\appdata\local\temp\b4ec.tmp\kmservice.exe" = protocol=6 | dir=in | app=c:\users\tom.admin\appdata\local\temp\b4ec.tmp\kmservice.exe | 
"TCP Query User{A60B6509-7431-4B85-99FD-96E7CB190B5A}M:\portableapps\xampp\apache\bin\httpd.exe" = protocol=6 | dir=in | app=m:\portableapps\xampp\apache\bin\httpd.exe | 
"TCP Query User{A836F430-53AD-42CF-917D-7D3D0DFD1F50}C:\users\tom.normal\appdata\local\programs\opera\opera.exe" = protocol=6 | dir=in | app=c:\users\tom.normal\appdata\local\programs\opera\opera.exe | 
"TCP Query User{AB1BF72D-6BEF-4599-8CC6-FB7D5EEFCF41}C:\users\tom.admin\appdata\local\temp\780d.tmp\kmservice.exe" = protocol=6 | dir=in | app=c:\users\tom.admin\appdata\local\temp\780d.tmp\kmservice.exe | 
"TCP Query User{AB62D7B2-1806-4040-976F-82364B92CE72}C:\users\tom.normal\appdata\roaming\icq\application\icq7.5\icq.exe" = protocol=6 | dir=in | app=c:\users\tom.normal\appdata\roaming\icq\application\icq7.5\icq.exe | 
"TCP Query User{B1E9783B-1A8D-4A36-8238-BE26D2B6B1E4}I:\portableapps\xampp\mysql\bin\mysqld.exe" = protocol=6 | dir=in | app=i:\portableapps\xampp\mysql\bin\mysqld.exe | 
"TCP Query User{B2A9EBAE-928F-4A17-97F8-45A22F17B2F8}J:\portableapps\neuer ordner\aptanastudio3.exe" = protocol=6 | dir=in | app=j:\portableapps\neuer ordner\aptanastudio3.exe | 
"TCP Query User{B7ECC421-2ADE-4DBB-BD48-5B860EA7A174}D:\program files (x86)\rockstar games\max payne 3\maxpayne3.exe" = protocol=6 | dir=in | app=d:\program files (x86)\rockstar games\max payne 3\maxpayne3.exe | 
"TCP Query User{BA7B6299-BD48-4E91-A42C-C6E67FF2D7FF}H:\portableapps\xampp\mysql\bin\mysqld.exe" = protocol=6 | dir=in | app=h:\portableapps\xampp\mysql\bin\mysqld.exe | 
"TCP Query User{CDBB1E54-6E78-4AAB-B449-200DD3BA1CC2}C:\users\tom.normal\appdata\roaming\icq\application\icq7.7\icq.exe" = protocol=6 | dir=in | app=c:\users\tom.normal\appdata\roaming\icq\application\icq7.7\icq.exe | 
"TCP Query User{CE440432-1230-438F-B408-6276BBEAEC3E}C:\users\tom.normal\appdata\roaming\icq\application\icq7.5\icq.exe" = protocol=6 | dir=in | app=c:\users\tom.normal\appdata\roaming\icq\application\icq7.5\icq.exe | 
"TCP Query User{D0759BD0-C7FC-458B-BA51-18BD016A1B06}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{D69817C1-4227-488C-AD9A-7EE281AA0539}D:\daten\dota 2 beta\dota.exe" = protocol=6 | dir=in | app=d:\daten\dota 2 beta\dota.exe | 
"TCP Query User{DA24D23D-493A-4288-9BAD-8EF5EBBCDF38}G:\portableapps\teamviewerportable\app\teamviewer\teamviewer.exe" = protocol=6 | dir=in | app=g:\portableapps\teamviewerportable\app\teamviewer\teamviewer.exe | 
"TCP Query User{DB9F164D-3BA1-4835-B0AB-73276B3B3AAA}I:\portableapps\xampp\apache\bin\httpd.exe" = protocol=6 | dir=in | app=i:\portableapps\xampp\apache\bin\httpd.exe | 
"TCP Query User{DCB7A852-2BE6-440C-89A9-CA87096B778B}C:\users\tom.admin\appdata\local\temp\f391.tmp\kmservice.exe" = protocol=6 | dir=in | app=c:\users\tom.admin\appdata\local\temp\f391.tmp\kmservice.exe | 
"TCP Query User{E080484E-3F6B-470C-8059-64452D6BD031}D:\program files (x86)\electronic arts\shift 2 unleashed\shift2u.exe" = protocol=6 | dir=in | app=d:\program files (x86)\electronic arts\shift 2 unleashed\shift2u.exe | 
"TCP Query User{E092E133-ACE4-4B7B-905C-CD9D1A85C381}D:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe" = protocol=6 | dir=in | app=d:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe | 
"TCP Query User{E0D3CFA9-BE3B-4677-94A9-B8FCE79A4AD4}C:\windows\syswow64\java.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\java.exe | 
"TCP Query User{EC8B9DDA-746B-43FD-97C5-BD9E2B4D72DC}G:\portableapps\xampp\mysql\bin\mysqld.exe" = protocol=6 | dir=in | app=g:\portableapps\xampp\mysql\bin\mysqld.exe | 
"TCP Query User{F5B85821-5C98-4AD5-A701-F0D2B4722C82}C:\program files (x86)\unreal tournament 3 (lg)\binaries\ut3.exe" = protocol=6 | dir=in | app=c:\program files (x86)\unreal tournament 3 (lg)\binaries\ut3.exe | 
"TCP Query User{F71E1B5B-5EA1-4A56-80A1-9910A896F383}D:\program files (x86)\the witcher 2\bin\witcher2.exe" = protocol=6 | dir=in | app=d:\program files (x86)\the witcher 2\bin\witcher2.exe | 
"TCP Query User{FEE34FE3-3044-45A6-B99B-3C5703597770}J:\portableapps\aptana\aptanastudio3.exe" = protocol=6 | dir=in | app=j:\portableapps\aptana\aptanastudio3.exe | 
"UDP Query User{0336AAF5-C112-4D9C-99DF-E2B8BE036BAB}C:\program files (x86)\starcraft ii\support\blizzarddownloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\support\blizzarddownloader.exe | 
"UDP Query User{059733BA-3047-4DDB-AA9E-704808EBDF30}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe | 
"UDP Query User{0B7E7DEB-1E02-45E3-897D-936083005160}C:\users\tom.admin\appdata\local\temp\780d.tmp\kmservice.exe" = protocol=17 | dir=in | app=c:\users\tom.admin\appdata\local\temp\780d.tmp\kmservice.exe | 
"UDP Query User{0DF64442-AB48-4213-848B-2A099FD45863}C:\program files (x86)\unreal tournament 3 (lg)\binaries\ut3.exe" = protocol=17 | dir=in | app=c:\program files (x86)\unreal tournament 3 (lg)\binaries\ut3.exe | 
"UDP Query User{0E7BC6BE-287B-41DC-B737-676A027C5476}C:\users\tom.normal\appdata\roaming\icq\application\icq7.7\icq.exe" = protocol=17 | dir=in | app=c:\users\tom.normal\appdata\roaming\icq\application\icq7.7\icq.exe | 
"UDP Query User{0F2750D7-A11F-4BFC-AD70-041FAA4F6D7D}D:\program files (x86)\rockstar games\max payne 3\maxpayne3.exe" = protocol=17 | dir=in | app=d:\program files (x86)\rockstar games\max payne 3\maxpayne3.exe | 
"UDP Query User{12F38D19-903F-457A-A8F6-ED49B7A10440}C:\users\tom.normal\appdata\roaming\icq\application\icq7.7\icq.exe" = protocol=17 | dir=in | app=c:\users\tom.normal\appdata\roaming\icq\application\icq7.7\icq.exe | 
"UDP Query User{167B2188-2223-4900-A12A-590B52F664A0}G:\portableapps\xampp\apache\bin\httpd.exe" = protocol=17 | dir=in | app=g:\portableapps\xampp\apache\bin\httpd.exe | 
"UDP Query User{1BDC888F-EFE4-4F80-BAA8-CE0BEFE7C68C}J:\portableapps\aptana\aptanastudio3.exe" = protocol=17 | dir=in | app=j:\portableapps\aptana\aptanastudio3.exe | 
"UDP Query User{1E76EDCE-E846-4453-B032-81FE3CD6142C}C:\users\tom.admin\appdata\local\temp\b4ec.tmp\kmservice.exe" = protocol=17 | dir=in | app=c:\users\tom.admin\appdata\local\temp\b4ec.tmp\kmservice.exe | 
"UDP Query User{1EE47F26-7F20-4831-996C-E92BCA86A0BE}M:\portableapps\xampp\apache\bin\httpd.exe" = protocol=17 | dir=in | app=m:\portableapps\xampp\apache\bin\httpd.exe | 
"UDP Query User{28CA21F3-08C3-4590-9171-3F9E4051C3EE}D:\program files (x86)\batman arkham city\binaries\win32\batmanac.exe" = protocol=17 | dir=in | app=d:\program files (x86)\batman arkham city\binaries\win32\batmanac.exe | 
"UDP Query User{2F820B9F-2CAF-45CD-80F0-71B874C14E92}D:\program files (x86)\kings of amalur reckoning\12345-aamurmul5\reckoning.exe" = protocol=17 | dir=in | app=d:\program files (x86)\kings of amalur reckoning\12345-aamurmul5\reckoning.exe | 
"UDP Query User{30856B05-FE53-414F-93D6-7FFFF19B83C3}C:\users\tom.normal\appdata\roaming\icq\application\icq7.4\icq.exe" = protocol=17 | dir=in | app=c:\users\tom.normal\appdata\roaming\icq\application\icq7.4\icq.exe | 
"UDP Query User{3585DD1B-FC4E-4591-9B2D-D37100ED4A7A}G:\portableapps\xampp\filezillaftp\filezilla server.exe" = protocol=17 | dir=in | app=g:\portableapps\xampp\filezillaftp\filezilla server.exe | 
"UDP Query User{3D9966BA-8E4D-4A61-BFB9-51C35D7A36E2}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{402950C1-D412-443D-BF24-6A7FF38C2BB2}D:\downloads\020-a1amur5mul5\12345-aamurmul5\reckoning.exe" = protocol=17 | dir=in | app=d:\downloads\020-a1amur5mul5\12345-aamurmul5\reckoning.exe | 
"UDP Query User{42F3FC3C-ADAC-495E-BEC4-AF9D5D280B43}C:\users\tom.admin\appdata\local\temp\d2ca.tmp\kmservice.exe" = protocol=17 | dir=in | app=c:\users\tom.admin\appdata\local\temp\d2ca.tmp\kmservice.exe | 
"UDP Query User{4E31C271-DEEC-4CF1-A529-0910A3F04F1D}D:\program files (x86)\electronic arts\shift 2 unleashed\shift2u.exe" = protocol=17 | dir=in | app=d:\program files (x86)\electronic arts\shift 2 unleashed\shift2u.exe | 
"UDP Query User{4EB22547-6332-4F8D-867E-5B71BF3EE1B9}C:\users\tom.normal\appdata\roaming\icq\application\icq7.5\icq.exe" = protocol=17 | dir=in | app=c:\users\tom.normal\appdata\roaming\icq\application\icq7.5\icq.exe | 
"UDP Query User{4F21B89F-A0FA-43F9-8D4D-E2C78FC6FDF8}D:\program files (x86)\blades of time\bladesoftime.exe" = protocol=17 | dir=in | app=d:\program files (x86)\blades of time\bladesoftime.exe | 
"UDP Query User{521B3B62-F93C-4E39-95F7-3EB4E3E62C95}C:\program files (x86)\starcraft ii\versions\base15405\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base15405\sc2.exe | 
"UDP Query User{52868F20-9BA0-40E3-A8EF-DA806828AE6D}G:\portableapps\xampp\mysql\bin\mysqld.exe" = protocol=17 | dir=in | app=g:\portableapps\xampp\mysql\bin\mysqld.exe | 
"UDP Query User{53892960-97E7-4368-AF79-9BC5B7B1246D}G:\portableapps\teamviewerportable\app\teamviewer\teamviewer.exe" = protocol=17 | dir=in | app=g:\portableapps\teamviewerportable\app\teamviewer\teamviewer.exe | 
"UDP Query User{5DC61C66-1F28-442F-9A18-ED5D08F6297D}H:\portableapps\skypeportable\app\skype\phone\skype.exe" = protocol=17 | dir=in | app=h:\portableapps\skypeportable\app\skype\phone\skype.exe | 
"UDP Query User{61F9D124-75CC-49AF-8094-88CA8A4BC5DA}D:\program files (x86)\the witcher 2\bin\witcher2.exe" = protocol=17 | dir=in | app=d:\program files (x86)\the witcher 2\bin\witcher2.exe | 
"UDP Query User{641FEC3B-B825-41A3-82DC-CF92E824E41B}M:\portableapps\xampp\mysql\bin\mysqld.exe" = protocol=17 | dir=in | app=m:\portableapps\xampp\mysql\bin\mysqld.exe | 
"UDP Query User{6635605D-92EE-45A0-8DB2-270AA03C9832}C:\windows\syswow64\java.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\java.exe | 
"UDP Query User{6A46D6AA-C98D-4188-95B9-10330CC9822E}C:\users\tom.admin\appdata\local\temp\14ec.tmp\kmservice.exe" = protocol=17 | dir=in | app=c:\users\tom.admin\appdata\local\temp\14ec.tmp\kmservice.exe | 
"UDP Query User{75C04960-7DE3-4468-9AA9-EE38E836A7B7}M:\portableapps\xampp\apache\bin\httpd.exe" = protocol=17 | dir=in | app=m:\portableapps\xampp\apache\bin\httpd.exe | 
"UDP Query User{803192A4-3D8C-4E20-B529-70D7491C20FD}C:\users\tom.normal\desktop\teamviewerportable\app\teamviewer\teamviewer.exe" = protocol=17 | dir=in | app=c:\users\tom.normal\desktop\teamviewerportable\app\teamviewer\teamviewer.exe | 
"UDP Query User{8D8A4006-DCB5-454D-AD48-F190575D8209}I:\portableapps\xampp\mysql\bin\mysqld.exe" = protocol=17 | dir=in | app=i:\portableapps\xampp\mysql\bin\mysqld.exe | 
"UDP Query User{953404EA-EA14-4575-BFDB-AEA5687AE147}C:\users\tom.normal\desktop\skypeportable\app\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\users\tom.normal\desktop\skypeportable\app\skype\phone\skype.exe | 
"UDP Query User{9B4847AB-E226-44C7-B6CF-9D079429F69C}I:\portableapps\xampp\apache\bin\httpd.exe" = protocol=17 | dir=in | app=i:\portableapps\xampp\apache\bin\httpd.exe | 
"UDP Query User{9DBA5E52-2486-417A-9068-963121943907}D:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe" = protocol=17 | dir=in | app=d:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe | 
"UDP Query User{AC3479F2-C809-4E6B-900E-C8692F923C24}I:\portableapps\skypeportable\app\skype\phone\skype.exe" = protocol=17 | dir=in | app=i:\portableapps\skypeportable\app\skype\phone\skype.exe | 
"UDP Query User{AC8E43ED-5C97-40BF-AB3F-BD2FF8143F13}C:\program files (x86)\cisco packet tracer 5.3.1\bin\packettracer5.exe" = protocol=17 | dir=in | app=c:\program files (x86)\cisco packet tracer 5.3.1\bin\packettracer5.exe | 
"UDP Query User{ADFE3881-6D9A-4B5A-BA25-2282A35CB38F}J:\portableapps\neuer ordner\aptanastudio3.exe" = protocol=17 | dir=in | app=j:\portableapps\neuer ordner\aptanastudio3.exe | 
"UDP Query User{AEE0B118-80B6-4A4F-8037-62D571CB593F}C:\program files (x86)\starcraft ii\versions\base16755\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base16755\sc2.exe | 
"UDP Query User{B0751398-C55F-4A85-8276-9D83248C81B8}H:\portableapps\xampp\apache\bin\httpd.exe" = protocol=17 | dir=in | app=h:\portableapps\xampp\apache\bin\httpd.exe | 
"UDP Query User{B2FABEB8-53C8-40B1-8D27-BA2472E68277}C:\users\tom.normal\appdata\roaming\icq\application\icq7.5\icq.exe" = protocol=17 | dir=in | app=c:\users\tom.normal\appdata\roaming\icq\application\icq7.5\icq.exe | 
"UDP Query User{BAA7FC60-9E73-4D0A-A522-A940E33D2771}J:\portableapps\xampp\mysql\bin\mysqld.exe" = protocol=17 | dir=in | app=j:\portableapps\xampp\mysql\bin\mysqld.exe | 
"UDP Query User{C3D6763A-03CA-418D-9F59-83029B4E2AAB}D:\program files (x86)\ubisoft\assassin's creed revelations\acrpr.exe" = protocol=17 | dir=in | app=d:\program files (x86)\ubisoft\assassin's creed revelations\acrpr.exe | 
"UDP Query User{C4013BD0-94A1-48C0-A067-CD335FDA6AAE}C:\users\tom.admin\appdata\local\temp\f391.tmp\kmservice.exe" = protocol=17 | dir=in | app=c:\users\tom.admin\appdata\local\temp\f391.tmp\kmservice.exe | 
"UDP Query User{C5F55DD7-4BD6-45AE-8DDE-38DD0B1C3E38}C:\program files (x86)\terratec\terratec home cinema\versioncheck\versioncheck.exe" = protocol=17 | dir=in | app=c:\program files (x86)\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"UDP Query User{C7EC3CEE-21F8-4296-BA6D-FF5AC5DDF0CD}M:\portableapps\xampp\mysql\bin\mysqld.exe" = protocol=17 | dir=in | app=m:\portableapps\xampp\mysql\bin\mysqld.exe | 
"UDP Query User{CC325BEE-5255-48CC-9D11-DE3152C494E5}G:\portableapps\skypeportable\app\skype\phone\skype.exe" = protocol=17 | dir=in | app=g:\portableapps\skypeportable\app\skype\phone\skype.exe | 
"UDP Query User{E02AFFC5-4E43-4D54-BE63-75FA960A24DD}C:\users\tom.normal\appdata\roaming\icq\application\icq7.2\icq.exe" = protocol=17 | dir=in | app=c:\users\tom.normal\appdata\roaming\icq\application\icq7.2\icq.exe | 
"UDP Query User{E338C5D5-CFB2-40E4-BB8E-6BB0F4B2C2B8}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{E414F17A-659A-4BD1-A9D2-B6E093717D14}D:\daten\dota 2 beta\dota.exe" = protocol=17 | dir=in | app=d:\daten\dota 2 beta\dota.exe | 
"UDP Query User{E4F52A4C-33FF-41D0-AE41-CA6E53EFF8D2}D:\installstuff & benches\spiele\wc3- v1.20c\war3.exe" = protocol=17 | dir=in | app=d:\installstuff & benches\spiele\wc3- v1.20c\war3.exe | 
"UDP Query User{EBE2A6D8-4D10-45AE-9936-4001D87B255A}J:\portableapps\xampp\apache\bin\httpd.exe" = protocol=17 | dir=in | app=j:\portableapps\xampp\apache\bin\httpd.exe | 
"UDP Query User{F0076DDC-A4B7-4ED9-8D90-8086410AEDE0}D:\program files (x86)\ea games\kingdoms of amalur reckoning\reckoning.exe" = protocol=17 | dir=in | app=d:\program files (x86)\ea games\kingdoms of amalur reckoning\reckoning.exe | 
"UDP Query User{F44B50FB-C591-4403-89CB-ABF0F066E25C}H:\portableapps\xampp\mysql\bin\mysqld.exe" = protocol=17 | dir=in | app=h:\portableapps\xampp\mysql\bin\mysqld.exe | 
"UDP Query User{FB8634D9-581E-45F7-83CE-18E4F4EE0239}C:\users\tom.normal\appdata\local\programs\opera\opera.exe" = protocol=17 | dir=in | app=c:\users\tom.normal\appdata\local\programs\opera\opera.exe | 
"UDP Query User{FC617BEE-56B1-406A-85B6-44504E7A5103}D:\program files (x86)\the witcher 2\bin\witcher2.exe" = protocol=17 | dir=in | app=d:\program files (x86)\the witcher 2\bin\witcher2.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{09782D89-1CA6-4B7D-82C5-2DE01AF5601B}" = Microsoft SQL Server 2008 Common Files
"{0ADF605D-2D94-4467-91F7-D75C71CF328D}" = Microsoft SQL Server 2008 Database Engine Shared
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP490_series" = Canon MP490 series MP Drivers
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{28D06854-572C-4A65-83E5-F8CAF26B9FDC}" = Microsoft SQL Server VSS Writer
"{2DF4C5DD-7417-301D-935D-939D3B7B5997}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{2F14965D-567B-4E59-ADEB-0A2CC1E3ADDF}" = Sql Server Customer Experience Improvement Program
"{3C983A67-DFB2-3D3D-AD9E-CA1A5A09FD18}" = Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU
"{440668AA-7524-40DB-966A-60BE535E1B3F}" = Microsoft SQL Server 2008 Database Engine Services
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5340A3B5-3853-4745-BED2-DD9FF5371331}" = Microsoft SQL Server 2008 Common Files
"{5CE7E3F5-9803-4F32-AA89-2D8848A80109}" = Microsoft LifeCam
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{624C7F0A-89B2-4C49-9CAB-9D69613EC95A}" = Microsoft IntelliPoint 8.2
"{6AF73222-EE90-434C-AE7E-B96F70A68D89}" = Unterstützungsdateien für Microsoft SQL Server 2008-Setup 
"{75d2897c-87aa-4a06-8710-3ebda9f02de0}.sdb" = Adobe Audition 3.0 Vista Compatibility
"{7ACE202B-1B01-4B43-B6AE-03D66D621CDE}" = Microsoft SQL Server 2008 RsFx Driver
"{8325FD0C-2FDB-46C3-921A-3A78385EA972}" = Microsoft SQL Server 2008 Native Client
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{9C5A08BF-BB99-4998-81BD-F6CC32483B34}" = Microsoft Corporation
"{A122AD66-B765-4B61-8B2B-EFEDE5BB9779}" = Media Preview
"{A1E85B9A-AFAD-4D38-AF01-6B020DD5213A}" = Logitech GamePanel Software 3.06.109
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 301.42
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.8.15
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{C3EAE456-7E7A-451F-80EF-F34C7A13C558}" = Microsoft SQL Server Compact 3.5 SP2 x64 DEU
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{CC8BA866-16A7-4667-BA0C-C494A1E7B2BF}" = Microsoft SQL Server 2008 Database Engine Shared
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FBD367D1-642F-47CF-B79B-9BE48FB34007}" = Microsoft SQL Server 2008 Database Engine Services
"{FCADA26A-5672-31DD-BF0E-BA76ECF9B02D}" = Microsoft Help Viewer 1.0
"CrystalDiskMark_is1" = CrystalDiskMark 3.0.0h
"MAXONFB05E576" = CINEMA 4D 13.029
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2
"Microsoft SQL Server 10" = Microsoft SQL Server 2008 (64-bit)
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008 (64-bit)
"Pen Tablet Driver" = Bamboo
"Recuva" = Recuva
"SearchAnonymizer" = SearchAnonymizer
"Unlocker" = Unlocker 1.9.1-x64
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05D996FA-ADCB-4D23-BA3C-A7C184A8FAC6}_is1" = MiniTool Partition Wizard Home Edition 7.5
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A0E062D-3235-406B-8D3C-090923EDFC00}_is1" = C2DtoG15 2.0.2.1
"{0D4E1FFF-26C4-4A62-9D26-44264B0F9F5E}_is1" = The Witcher Enhanced Edition
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{185F9795-9663-4F13-9EF9-307A282ADB5A}" = ph
"{1AA94747-3BF6-4237-9E1A-7B3067738FE1}" = Max Payne 3
"{1BBD8D70-721A-41AD-AC8F-7308A0C8FA92}" = Adobe Creative Suite 5 Master Collection
"{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 24
"{2A075BB4-E976-4278-BF3F-E5C6945D84C0}" = bl
"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"{2F603A45-D956-496B-81B5-50D782424976}" = SweetPacks Toolbar for Internet Explorer 4.4
"{33A22B2D-55BA-4508-B767-BF2E9C21A73F}" = Assassin's Creed Revelations
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMicron JMB36X Driver
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{43430FA5-AF68-4A2D-A7D4-891000008200}" = Street Fighter X Tekken
"{4761EB82-E8BD-45A4-B19B-586FA9D1D7E6}" = Camtasia Studio 6
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AF2248C-B3DF-46FB-9596-87F5DB193689}" = Microsoft SQL Server 2008 Browser
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4D53090A-CE35-42BD-B377-831000018301}" = Fable III
"{4D53090A-CE35-42BD-B377-831000018302}" = Fable III
"{4D53090A-CE35-42BD-B377-831000018303}" = Fable III
"{4D53090A-CE35-42BD-B377-831000018304}" = Fable III
"{4D53090A-CE35-42BD-B377-831000018305}" = Fable III
"{4EBFAB00-674D-27E3-91B0-3BAA73FC6FA6}" = Bamboo Dock
"{531E1936-95AC-4F7D-8071-BBE9502C670B}" = Stereoscopic Player
"{53C141BA-4F9E-43FB-B4F9-0C01BB716FA8}" = Adobe Audition 3.0
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{6033673D-2530-4587-8AD0-EB059FC263F9}" = Crysis® 2
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}" = Adobe AIR
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74E2CD0C-D4A2-11D3-95A6-0000E86CFDE5}" = SSH Secure Shell
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA nTune
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 3.3.0
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}" = Assassin's Creed II
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0017-0407-0000-0000000FF1CE}" = Microsoft Office SharePoint Designer MUI (German) 2010
"{90140000-0017-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{0F513B77-0D84-4615-87F7-B814D1FC64F5}" = Microsoft SharePoint Designer 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.VISIO_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.OMUI.de-de_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.VISIO_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.OMUI.de-de_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.VISIO_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.VISIO_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-0054-0407-0000-0000000FF1CE}" = Microsoft Office Visio MUI (German) 2010
"{90140000-0054-0407-0000-0000000FF1CE}_Office14.VISIO_{1FEAC070-BB09-4055-9BD0-48CF52023F92}" = Microsoft Office 2010 Language Pack Service Pack 1 (SP1)
"{90140000-0057-0000-0000-0000000FF1CE}" = Microsoft Office Visio 2010
"{90140000-0057-0000-0000-0000000FF1CE}_Office14.VISIO_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}" = Microsoft Visio 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.VISIO_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-0100-0407-0000-0000000FF1CE}" = Microsoft Office O MUI (German) 2010
"{90140000-0100-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{90D3D490-F6C4-4F4A-971B-93D0A66F2E2E}" = Microsoft Office 2010 Language Pack Service Pack 1 (SP1)
"{90140000-0101-0407-0000-0000000FF1CE}" = Microsoft Office X MUI (German) 2010
"{90140000-0101-0407-0000-0000000FF1CE}_Office14.OMUI.de-de_{4733E76A-5F12-4513-9CA8-DB2540A74EDA}" = Microsoft Office 2010 Language Pack Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{918A9082-6287-4D25-9002-5E5D5E4971CB}" = League of Legends
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A996B6A-846E-4A89-B9C4-17546B7BE49F}" = Burnout(TM) Paradise The Ultimate Box
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C916142-C18C-429D-BFED-40094A7E0BEB}" = Die Siedler 7
"{A1E1A376-49D4-4960-8599-D5D26A4C2E7B}" = Razer Imperator
"{A8CF5C37-8EC5-4C33-BB4A-87F468B77D45}" = Age of Empires III
"{AC76BA86-1033-F400-7760-000000000005}" = Adobe Acrobat X Pro - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch
"{AF37176A-78CA-545B-34EF-8B6A21514DD1}" = Adobe Help Manager
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B531E735-8ED5-4270-ACCE-3809086FBD02}_is1" = Batman Arkham City version 1.0
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B85C4CB2-B352-4BD8-818C-BCE353599107}" = SweetIM for Messenger 3.6
"{B8EC3F1B-6838-4268-BE23-931FE74230A0}" = PixRecovery 3.0.18586.1 Demo License
"{BE4BA698-8533-4F77-9559-C7F3F78C0B05}" = Assassin's Creed Brotherhood
"{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}" = PDF Settings CS6
"{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D9292112-253F-438D-B1AB-432E5A1FE1B5}" = Razer Imperator Firmware Updater
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DEEB5FE3-40F5-3C5B-8F85-5306EF3C08F4}" = Microsoft Visual C++ 2010 Express - DEU
"{E8AD3069-9EB7-4BA8-8BFE-83F4E69355C0}" = Adobe Creative Suite 6 Master Collection
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EFBE6DD5-B224-96E5-72B9-68D328CB12A6}" = Adobe Widget Browser
"{F0A209B7-7F85-4BDD-8F1F-B98EEAD9E04B}" = The Witcher 2
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Audition 3.0" = Adobe Audition 3.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Aptana Studio 3" = Aptana Studio 3
"Avira AntiVir Desktop" = Avira Free Antivirus
"Bamboo Dock" = Bamboo Dock
"Best Service Galaxy Steinway 5.1" = Best Service Galaxy Steinway 5.1
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Help Manager
"Cinergy S2 PCI" = Cinergy S2 PCI V1.01.01.901
"ColorPic" = ColorPic
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.WidgetBrowser" = Adobe Widget Browser
"CrystalDiskInfo_is1" = CrystalDiskInfo 5.0.0
"DAEMON Tools Lite" = DAEMON Tools Lite
"DivX Setup" = DivX-Setup
"Driver San Francisco" = Driver San Francisco
"ffdshow_is1" = ffdshow v1.1.3892 [2011-06-20]
"File Repair_is1" = File Repair
"Finale Reader" = Finale Reader 2011
"Free YouTube to iPod Converter_is1" = Free YouTube to iPod Converter version 3.10.17.221
"Freemake Video Converter_is1" = Freemake Video Converter Version 2.3.4
"htmltads.exe" = HTML TADS Player Kit
"ImgBurn" = ImgBurn
"InstallShield_{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"InstallShield_{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA nTune
"InstallShield_{A8CF5C37-8EC5-4C33-BB4A-87F468B77D45}" = Age of Empires III
"Kernel for Word  Evaluation ver_is1" = Kernel for Word Evaluation ver 11.01.01
"Live 8.2.2" = Live 8.2.2
"MakeMKV" = MakeMKV v1.6.13
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"MediaMonkey_is1" = MediaMonkey 3.2
"Microsoft Visual C++ 2010 Express - DEU" = Microsoft Visual C++ 2010 Express - DEU
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"PunkBusterSvc" = PunkBuster Services
"Racket-5.1.3" = Racket v5.1.3
"Registry Repair" = Registry Repair 4.1.0.388
"Rockstar Games Social Club" = Rockstar Games Social Club
"S2TNG" = Die Siedler II - Die nächste Generation
"S3" = Die Siedler III Gold Edition
"S4Uninst" = Die Siedler IV
"SADK" = Die Siedler - Aufbruch der Kulturen
"Stellar Phoenix JPEG Repair_is1" = Stellar Phoenix JPEG Repair
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 2.0.2
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1" = Bamboo Dock
"WebSpider2" = Xaldon WebSpider2
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"InstallShield_{FDBBAF14-5ED8-49B7-A5BE-1C35668B074D}" = Unreal Tournament 3 (LG)
"OkozoInstaller" = Okozo Desktop
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 21.03.2012 16:18:30 | Computer Name = NetAd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung.  .
 
Error - 21.03.2012 16:18:30 | Computer Name = NetAd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung.  .
 
Error - 21.03.2012 17:09:08 | Computer Name = NetAd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung.  .
 
Error - 21.03.2012 17:09:08 | Computer Name = NetAd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung.  .
 
Error - 21.03.2012 17:09:08 | Computer Name = NetAd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung.  .
 
Error - 21.03.2012 17:09:08 | Computer Name = NetAd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung.  .
 
Error - 21.03.2012 17:09:08 | Computer Name = NetAd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung.  .
 
Error - 21.03.2012 17:09:08 | Computer Name = NetAd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung.  .
 
Error - 21.03.2012 17:09:08 | Computer Name = NetAd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung.  .
 
Error - 21.03.2012 17:09:08 | Computer Name = NetAd | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung.  .
 
[ System Events ]
Error - 11.07.2012 17:01:49 | Computer Name = NetAd | Source = bowser | ID = 8003
Description = 
 
Error - 11.07.2012 17:54:49 | Computer Name = NetAd | Source = bowser | ID = 8003
Description = 
 
Error - 13.07.2012 08:24:40 | Computer Name = NetAd | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR5 gefunden.
 
Error - 13.07.2012 08:24:40 | Computer Name = NetAd | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR5 gefunden.
 
Error - 13.07.2012 08:24:41 | Computer Name = NetAd | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR5 gefunden.
 
Error - 13.07.2012 08:24:41 | Computer Name = NetAd | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR5 gefunden.
 
Error - 13.07.2012 08:24:42 | Computer Name = NetAd | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR5 gefunden.
 
Error - 14.07.2012 08:53:57 | Computer Name = NetAd | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk4\DR4 gefunden.
 
Error - 14.07.2012 08:53:58 | Computer Name = NetAd | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk4\DR4 gefunden.
 
Error - 14.07.2012 08:53:59 | Computer Name = NetAd | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk4\DR4 gefunden.
 
 
< End of report >
         

OLT:

OTL logfile created on: 15.07.2012 01:10:49 - Run 1
OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Tom.Normal\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,99 Gb Total Physical Memory | 3,97 Gb Available Physical Memory | 66,24% Memory free
11,98 Gb Paging File | 9,74 Gb Available in Paging File | 81,29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,69 Gb Total Space | 26,93 Gb Free Space | 24,11% Space Free | Partition Type: NTFS
Drive D: | 931,51 Gb Total Space | 367,75 Gb Free Space | 39,48% Space Free | Partition Type: NTFS
Unable to calculate disk information.
Drive G: | 100,00 Mb Total Space | 71,86 Mb Free Space | 71,87% Space Free | Partition Type: NTFS
Drive K: | 28,67 Gb Total Space | 14,33 Gb Free Space | 49,99% Space Free | Partition Type: NTFS
Drive L: | 3,69 Gb Total Space | 2,87 Gb Free Space | 77,69% Space Free | Partition Type: FAT32
Drive X: | 1862,89 Gb Total Space | 229,40 Gb Free Space | 12,31% Space Free | Partition Type: NTFS
 
Computer Name: NETAD | User Name: Tom.Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.15 01:07:34 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Tom.Normal\Downloads\OTL.exe
PRC - [2012.06.17 15:40:45 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012.05.15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.02 00:31:35 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.01.24 15:19:10 | 002,606,912 | ---- | M] (DT Soft Ltd) -- D:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe
PRC - [2012.01.19 13:30:04 | 000,114,992 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe
PRC - [2011.09.05 19:04:58 | 002,904,984 | ---- | M] (Adobe Systems Inc.) -- D:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
PRC - [2011.08.24 18:34:10 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.01.26 20:51:34 | 000,059,392 | ---- | M] (Andreas Sammann) -- D:\Program Files (x86)\C2DtoG15\SystoG15Svc.exe
PRC - [2010.11.20 14:17:56 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PRC - [2010.11.20 14:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Sidebar\sidebar.exe
PRC - [2010.11.06 00:54:20 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.09.07 15:15:28 | 002,787,224 | ---- | M] (Razer USA Ltd) -- C:\Program Files (x86)\Razer\Imperator\RazerImperatorTray.exe
PRC - [2010.08.03 09:44:28 | 000,858,696 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\GamePanel Software\Applets\ColorOnly\LCDYT.exe
PRC - [2010.08.03 09:44:16 | 000,498,248 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\GamePanel Software\Applets\ColorOnly\LCDWebCam.exe
PRC - [2010.08.03 09:43:32 | 000,850,504 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\GamePanel Software\Applets\ColorOnly\LCDMovieViewer.exe
PRC - [2010.08.03 09:43:02 | 000,522,824 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe
PRC - [2010.01.18 14:41:44 | 000,116,088 | ---- | M] (Sysinternals - www.sysinternals.com) -- C:\Users\Tom.Normal\AppData\Local\Temp\7zO318F.tmp\Desktops.exe
PRC - [2009.08.28 12:36:28 | 000,075,048 | R--- | M] (cyberlink) -- C:\Program Files (x86)\CyberLink\Shared Files\brs.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.17 15:40:45 | 002,042,848 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012.06.16 18:09:27 | 000,475,648 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\1cb5f5d54ef9b24b90a51b006181fe71\IAStorUtil.ni.dll
MOD - [2012.06.14 20:22:09 | 012,436,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012.06.14 20:22:03 | 001,591,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012.05.15 02:21:26 | 000,368,448 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll
MOD - [2012.05.13 00:53:54 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012.05.13 00:53:16 | 005,452,800 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.05.13 00:53:14 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.05.13 00:53:13 | 007,967,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.05.13 00:53:10 | 011,492,864 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011.09.05 19:05:06 | 000,019,968 | ---- | M] () -- D:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\AcroTray.DEU
MOD - [2011.07.29 01:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
MOD - [2011.03.17 01:11:16 | 004,297,568 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
MOD - [2010.11.13 01:26:08 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.07.14 19:58:10 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2009.04.15 16:04:38 | 000,104,520 | ---- | M] () -- C:\Windows\SysWOW64\OSD.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.12.13 15:37:16 | 000,194,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc)
SRV:64bit: - [2010.10.13 11:41:06 | 000,487,280 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Program Files\Tablet\Pen\Pen_TouchService.exe -- (TouchServicePen)
SRV:64bit: - [2010.10.13 11:41:04 | 005,790,064 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Program Files\Tablet\Pen\Pen_Tablet.exe -- (TabletServicePen)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.07.13 15:57:10 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.05.15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.03.08 15:51:45 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.08.24 18:34:10 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.04.17 22:28:46 | 000,040,960 | ---- | M] () [Auto | Running] -- C:\Users\Tom.Admin\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer)
SRV - [2011.01.26 20:51:34 | 000,059,392 | ---- | M] (Andreas Sammann) [Auto | Running] -- D:\Program Files (x86)\C2DtoG15\SystoG15Svc.exe -- (SystoG15Svc)
SRV - [2010.11.06 00:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2006.10.31 07:35:04 | 000,164,352 | ---- | M] (NVIDIA) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe -- (nTuneService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.06.18 13:34:44 | 000,019,032 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdrvio.sys -- (pwdrvio)
DRV:64bit: - [2012.06.18 13:34:42 | 000,012,384 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdspio.sys -- (pwdspio)
DRV:64bit: - [2012.05.02 15:24:12 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.04.27 10:20:04 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.04.25 00:32:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.01.26 15:31:56 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.11.03 03:01:00 | 000,056,208 | ---- | M] (Rovi Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2011.08.01 16:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2011.07.28 19:37:10 | 000,052,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB)
DRV:64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.05.19 15:55:34 | 000,120,920 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.14 22:59:15 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2010.11.20 15:34:02 | 000,360,832 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm)
DRV:64bit: - [2010.11.20 15:34:02 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:35:32 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb)
DRV:64bit: - [2010.11.20 13:35:20 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.11.06 00:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.10.05 13:26:10 | 000,018,288 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV:64bit: - [2010.07.29 00:25:10 | 000,029,720 | ---- | M] (Initio Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ivusb.sys -- (ivusb)
DRV:64bit: - [2009.11.23 18:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009.11.09 13:42:56 | 000,348,224 | ---- | M] (TerraTec Provide) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\MtsBda.sys -- (MTSBDA)
DRV:64bit: - [2009.11.09 13:42:56 | 000,025,664 | ---- | M] (TerraTec Provide) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\MtsHID.sys -- (MtsHID)
DRV:64bit: - [2009.09.22 01:29:22 | 000,016,168 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacomvhid.sys -- (wacomvhid)
DRV:64bit: - [2009.08.13 23:10:18 | 000,073,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:06:43 | 000,060,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\61883.sys -- (61883)
DRV:64bit: - [2009.07.14 02:06:43 | 000,048,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avc.sys -- (Avc)
DRV:64bit: - [2009.07.14 02:06:42 | 000,061,440 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msdv.sys -- (MSDV)
DRV:64bit: - [2009.07.01 12:54:54 | 000,030,728 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGPBTDD.sys -- (LGPBTDD)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2007.02.16 21:12:36 | 000,012,848 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV:64bit: - [2005.03.29 02:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV - [2010.07.01 19:11:24 | 000,012,352 | ---- | M] () [Kernel | Unavailable | Unknown] -- D:\Program Files\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)
DRV - [2009.08.28 19:36:26 | 000,146,928 | ---- | M] (CyberLink Corp.) [2011/02/24 18:58:18] [Kernel | Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl -- ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054})
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2008.07.26 22:30:00 | 000,014,544 | ---- | M] (OpenLibSys.org) [Kernel | On_Demand | Running] -- D:\Program Files (x86)\C2DtoG15\WinRing0x64.sys -- (WinRing0_1_2_0)
DRV - [2006.10.31 07:29:10 | 000,018,216 | ---- | M] (NVidia Corp.) [Kernel | On_Demand | Running] -- C:\Windows\nvoclk64.sys -- (NVR0Dev)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.facemoods.com/?a=ddrnw
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E7 E6 93 D9 26 B4 CB 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0D7562AE-8EF6-416d-A838-AB665251703A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=4adec284-9169-4d22-a06e-3564e0169db5&pid=murb&k=0
IE - HKCU\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
IE - HKCU\..\SearchScopes\{1E9B5C5E-E4F4-45F0-9F89-62966C271ADF}: "URL" = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=4adec284-9169-4d22-a06e-3564e0169db5&pid=murb&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{21AE1226-C16D-485C-BDE9-7B36A99FF59F}: "URL" = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=4adec284-9169-4d22-a06e-3564e0169db5&pid=murb&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{27352971-4B75-43A2-8C29-7C0518ED5D54}: "URL" = hxxp://www.google.de.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E64652F7365617263683F713D7B7365617263685465726D737D&st={searchTerms}&clid=4adec284-9169-4d22-a06e-3564e0169db5&pid=murb&k=0
IE - HKCU\..\SearchScopes\{3B6CB6F2-F0E3-4D68-B508-1C48736D1FAF}: "URL" = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=4adec284-9169-4d22-a06e-3564e0169db5&pid=murb&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{8A4209FD-7ABD-4EF5-93FB-215520BE1EE7}: "URL" = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=4adec284-9169-4d22-a06e-3564e0169db5&pid=murb&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E6461656D6F6E2D7365617263682E636F6D2F7365617263682F7765623F713D7B7365617263685465726D737D&st={searchTerms}&clid=4adec284-9169-4d22-a06e-3564e0169db5&pid=murb&k=0
IE - HKCU\..\SearchScopes\{D263372B-5E18-4210-AC62-C670DAACAE0C}: "URL" = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=4adec284-9169-4d22-a06e-3564e0169db5&pid=murb&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{D98AE1D1-BFBA-478F-9191-B024741987F8}: "URL" = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=4adec284-9169-4d22-a06e-3564e0169db5&pid=murb&mode=bounce&k=0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Facemoods Search"
FF - prefs.js..browser.search.selectedEngine: "Facemoods Search"
FF - prefs.js..browser.startup.homepage: "chrome://speeddial/content/speeddial.xul"
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7.2
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.4
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.11
FF - prefs.js..extensions.enabledItems: {64161300-e22b-11db-8314-0800200c9a66}:0.9.5.8
FF - prefs.js..extensions.enabledItems: {68836a21-fc7d-4ea1-a065-7efabd99d414}:3.02
FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.9
FF - prefs.js..extensions.enabledItems: FirePHPExtension-Build@firephp.org:0.5.0
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: adblockpopups@jessehakanen.net:0.2.1
FF - prefs.js..extensions.enabledItems: {3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}:0.8.6.1
FF - prefs.js..extensions.enabledItems: firefox@facebook.com:1.6
FF - prefs.js..extensions.enabledItems: {20cc25e2-48c9-45e1-9a1f-1ccc1882b81b}:1.9
FF - prefs.js..extensions.enabledItems: fbdislike@doweb.fr:1.2.2
FF - prefs.js..extensions.enabledItems: {30A7232F-77C9-4bd3-A812-3036704DB7AC}:3.3.5
FF - prefs.js..extensions.enabledItems: {d7ba87f4-c901-47b7-af80-18d75313aad1}:1.5.0
FF - prefs.js..extensions.enabledItems: {01A8CA0A-4C96-465b-A49B-65C46FAD54F9}:6.0
FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.3.0244
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.4: C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5: C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: D:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2011.01.15 00:52:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmconverter@gmail.com: D:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ [2011.12.03 20:18:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: D:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012.01.16 04:40:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.10 10:13:33 | 000,000,000 | ---D | M]
 
[2011.01.14 22:22:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tom.Admin\AppData\Roaming\mozilla\Extensions
[2012.01.30 03:41:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tom.Admin\AppData\Roaming\mozilla\Firefox\Profiles\sbz74dxf.default\extensions
[2011.01.14 22:43:39 | 000,000,000 | ---D | M] ("Facebook PhotoZoom") -- C:\Users\Tom.Admin\AppData\Roaming\mozilla\Firefox\Profiles\sbz74dxf.default\extensions\{20cc25e2-48c9-45e1-9a1f-1ccc1882b81b}
[2012.01.30 03:39:31 | 000,000,000 | ---D | M] (Facebook Friend Request, Notifications & Messages Alerts + Facebook Like Button) -- C:\Users\Tom.Admin\AppData\Roaming\mozilla\Firefox\Profiles\sbz74dxf.default\extensions\{30A7232F-77C9-4bd3-A812-3036704DB7AC}
[2012.01.25 15:39:25 | 000,000,000 | ---D | M] (Html Validator) -- C:\Users\Tom.Admin\AppData\Roaming\mozilla\Firefox\Profiles\sbz74dxf.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}
[2011.02.13 17:48:10 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Tom.Admin\AppData\Roaming\mozilla\Firefox\Profiles\sbz74dxf.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.01.14 22:40:30 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\Tom.Admin\AppData\Roaming\mozilla\Firefox\Profiles\sbz74dxf.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2011.01.14 22:43:39 | 000,000,000 | ---D | M] (facebookchatbar) -- C:\Users\Tom.Admin\AppData\Roaming\mozilla\Firefox\Profiles\sbz74dxf.default\extensions\{d7ba87f4-c901-47b7-af80-18d75313aad1}
[2012.01.25 15:45:30 | 000,000,000 | ---D | M] (FDislike) -- C:\Users\Tom.Admin\AppData\Roaming\mozilla\Firefox\Profiles\sbz74dxf.default\extensions\fbdislike@doweb.fr
[2011.04.27 14:50:33 | 000,000,000 | ---D | M] (Facemoods) -- C:\Users\Tom.Admin\AppData\Roaming\mozilla\Firefox\Profiles\sbz74dxf.default\extensions\ffxtlbr@Facemoods.com
[2011.01.15 01:09:02 | 000,002,059 | ---- | M] () -- C:\Users\Tom.Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sbz74dxf.default\searchplugins\daemon-search.xml
[2012.01.30 03:41:17 | 000,003,915 | ---- | M] () -- C:\Users\Tom.Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sbz74dxf.default\searchplugins\sweetim.xml
[2011.04.17 22:28:47 | 000,001,864 | ---- | M] () -- C:\Users\Tom.Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sbz74dxf.default\searchplugins\{30FDA056-FE9B-439E-8D9A-F43017A6ECD4}.xml
[2011.04.17 22:28:47 | 000,002,182 | ---- | M] () -- C:\Users\Tom.Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sbz74dxf.default\searchplugins\{62F66955-9493-41B4-B8F1-F35EB89FA494}.xml
[2011.04.17 22:28:47 | 000,002,071 | ---- | M] () -- C:\Users\Tom.Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sbz74dxf.default\searchplugins\{E8514078-97C4-4E12-9565-5AF4FF6D960A}.xml
[2012.06.12 11:16:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.01.30 03:39:31 | 000,257,899 | ---- | M] () (No name found) -- C:\USERS\TOM.ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SBZ74DXF.DEFAULT\EXTENSIONS\{46551EC9-40F0-4E47-8E18-8E5CF550CFB8}.XPI
[2011.12.21 14:09:00 | 000,275,540 | ---- | M] () (No name found) -- C:\USERS\TOM.ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SBZ74DXF.DEFAULT\EXTENSIONS\{64161300-E22B-11DB-8314-0800200C9A66}.XPI
[2011.07.19 00:18:43 | 000,023,443 | ---- | M] () (No name found) -- C:\USERS\TOM.ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SBZ74DXF.DEFAULT\EXTENSIONS\{68836A21-FC7D-4EA1-A065-7EFABD99D414}.XPI
[2012.01.30 03:39:31 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\TOM.ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SBZ74DXF.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.12.21 14:09:00 | 000,434,392 | ---- | M] () (No name found) -- C:\USERS\TOM.ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SBZ74DXF.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
[2011.12.21 14:09:00 | 000,652,537 | ---- | M] () (No name found) -- C:\USERS\TOM.ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SBZ74DXF.DEFAULT\EXTENSIONS\{DC572301-7619-498C-A57D-39143191B318}.XPI
[2012.01.30 03:39:30 | 000,118,971 | ---- | M] () (No name found) -- C:\USERS\TOM.ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SBZ74DXF.DEFAULT\EXTENSIONS\ADBLOCKPOPUPS@JESSEHAKANEN.NET.XPI
[2011.11.06 17:53:43 | 000,091,081 | ---- | M] () (No name found) -- C:\USERS\TOM.ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SBZ74DXF.DEFAULT\EXTENSIONS\FIREPHPEXTENSION-BUILD@FIREPHP.ORG.XPI
[2012.06.17 15:40:45 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010.03.27 19:06:04 | 000,067,032 | ---- | M] (Adobe Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npContribute.dll
[2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2006.09.26 12:03:14 | 000,098,304 | ---- | M] (Zylom) -- C:\Program Files (x86)\mozilla firefox\plugins\npzylomgamesplayer.dll
[2012.06.01 18:33:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.01 18:33:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.01 18:33:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.04.27 14:50:33 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml
[2012.06.01 18:33:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.01 18:33:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.01 18:33:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2012.06.18 10:39:53 | 000,005,037 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts     
O1 - Hosts: #       127.0.0.1       localhost
O1 - Hosts: #       ::1             localhost
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (no name) - {64182481-4F71-486b-A045-B233BD0DA8FC} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKLM\..\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - No CLSID value found.
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Launch LCDMon] C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Ocs_SM] C:\Users\Tom.Admin\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] D:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] D:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe (cyberlink)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [LifeCam] C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Razer Imperator Driver] C:\Program Files (x86)\Razer\Imperator\RazerImperatorTray.exe (Razer USA Ltd)
O4 - HKLM..\Run: [SweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [Okozo] C:\Program Files\Okozo\Okozo Desktop\Tom.Admin\OkozoDesktop.exe ()
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - Startup: C:\Users\Tom.Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C2DtoG15.lnk = D:\Program Files (x86)\C2DtoG15\C2DtoG15.exe (Andreas Sammann)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Tom.Admin\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Web-Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html ()
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Tom.Admin\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Web-Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html ()
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D2627B10-124E-4764-B51B-86BF851D4712}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{c66953d0-203d-11e0-9833-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{c66953d0-203d-11e0-9833-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.exe
O33 - MountPoints2\{e5171cf7-2034-11e0-9a58-e0cb4e1f7d76}\Shell - "" = AutoRun
O33 - MountPoints2\{e5171cf7-2034-11e0-9a58-e0cb4e1f7d76}\Shell\AutoRun\command - "" = I:\feprog.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.14 14:55:35 | 000,000,000 | ---D | C] -- C:\Users\Tom.Admin\AppData\Roaming\Malwarebytes
[2012.07.14 14:55:22 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[2012.07.14 14:55:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.14 14:55:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.07.14 14:55:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.13 19:52:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
[2012.07.13 19:52:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CrystalDiskInfo
[2012.07.13 18:12:18 | 000,000,000 | ---D | C] -- C:\Users\Tom.Admin\AppData\Roaming\GlarySoft
[2012.07.13 18:11:53 | 000,000,000 | ---D | C] -- C:\Users\Tom.Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Glarysoft
[2012.07.13 18:11:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Glarysoft
[2012.07.13 16:07:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar Phoenix JPEG Repair
[2012.07.13 16:07:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Stellar Phoenix JPEG Repair
[2012.07.13 14:27:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Repair File
[2012.07.13 14:27:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\File Repair
[2012.07.11 15:15:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MiniTool Partition Wizard Home Edition 7.5
[2012.07.11 15:15:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MiniTool Partition Wizard Home Edition 7.5
[2012.07.11 15:02:09 | 000,000,000 | ---D | C] -- C:\Users\Tom.Admin\AppData\Roaming\vlc
[2012.07.11 15:02:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.07.08 16:19:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Age of Empires 3
[2012.07.08 12:59:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Microsoft Games
[2012.07.08 12:57:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games
[2012.07.08 00:58:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2012.07.05 20:22:16 | 000,000,000 | ---D | C] -- C:\Program Files\Media Preview
[2012.07.05 20:22:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BabelSoft
[2012.07.05 16:07:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recuva
[2012.07.05 16:07:15 | 000,000,000 | ---D | C] -- C:\Program Files\Recuva
[2012.07.03 20:26:59 | 000,000,000 | ---D | C] -- C:\Users\Tom.Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Convar
[2012.06.23 13:39:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ubi Soft
[2012.06.23 13:34:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blue Byte
[2012.06.19 21:52:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAXON
[2012.06.19 21:38:22 | 000,000,000 | ---D | C] -- C:\Program Files\MAXON
[2012.06.18 11:17:57 | 000,000,000 | ---D | C] -- C:\Users\Tom.Admin\Adobe Flash Builder 4.6
[2012.06.18 11:15:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Master Collection CS6
[2012.06.17 21:13:46 | 000,000,000 | ---D | C] -- C:\Users\Tom.Admin\Documents\CAPCOM
[2012.06.17 18:35:15 | 000,000,000 | ---D | C] -- C:\Users\Tom.Admin\AppData\Local\C2DtoG15
[2012.06.17 18:35:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\C2DtoG15
[2012.06.17 13:17:05 | 000,000,000 | ---D | C] -- C:\Users\Tom.Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Blades of Time
[2012.06.16 18:27:39 | 000,000,000 | ---D | C] -- C:\windows\rescache
[2012.06.16 16:18:17 | 000,000,000 | ---D | C] -- C:\windows\pss
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.15 01:09:40 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.07.15 01:09:35 | 529,879,039 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.15 01:08:31 | 000,000,188 | ---- | M] () -- C:\Users\Tom.Admin\defogger_reenable
[2012.07.15 00:57:00 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012.07.14 15:00:57 | 000,014,928 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.14 15:00:57 | 000,014,928 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.14 15:00:06 | 001,800,066 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2012.07.14 15:00:06 | 000,764,898 | ---- | M] () -- C:\windows\SysNative\perfh007.dat
[2012.07.14 15:00:06 | 000,718,880 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2012.07.14 15:00:06 | 000,174,044 | ---- | M] () -- C:\windows\SysNative\perfc007.dat
[2012.07.14 15:00:06 | 000,146,902 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2012.07.14 14:55:22 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.13 19:52:18 | 000,001,984 | ---- | M] () -- C:\Users\Tom.Admin\Desktop\CrystalDiskInfo.lnk
[2012.07.13 18:11:53 | 000,001,228 | ---- | M] () -- C:\Users\Tom.Admin\Desktop\Registry Repair.lnk
[2012.07.13 17:51:00 | 000,000,974 | ---- | M] () -- C:\Users\Tom.Admin\Desktop\PC Inspector File Recovery.lnk
[2012.07.13 16:07:12 | 000,001,018 | ---- | M] () -- C:\Users\Tom.Admin\Desktop\Stellar Phoenix JPEG Repair.lnk
[2012.07.13 14:27:15 | 000,001,199 | ---- | M] () -- C:\Users\Tom.Admin\Desktop\File Repair.lnk
[2012.07.13 00:07:16 | 005,178,840 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[2012.07.11 15:15:35 | 000,001,286 | ---- | M] () -- C:\Users\Public\Desktop\MiniTool Partition Wizard Home Edition.lnk
[2012.07.11 15:02:05 | 000,001,070 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.07.08 12:57:01 | 000,001,035 | ---- | M] () -- C:\Users\Public\Desktop\Age of Empires III.lnk
[2012.07.05 20:22:16 | 000,001,896 | ---- | M] () -- C:\Users\Public\Desktop\Media Preview Configuration.lnk
[2012.07.05 16:07:16 | 000,001,658 | ---- | M] () -- C:\Users\Public\Desktop\Recuva.lnk
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[2012.06.23 13:40:03 | 000,002,102 | ---- | M] () -- C:\Users\Tom.Admin\Desktop\Ubi Soft Product Registration.lnk
[2012.06.18 13:34:44 | 000,019,032 | ---- | M] () -- C:\windows\SysNative\pwdrvio.sys
[2012.06.18 13:34:42 | 002,966,720 | ---- | M] () -- C:\windows\SysNative\pwNative.exe
[2012.06.18 13:34:42 | 000,012,384 | ---- | M] () -- C:\windows\SysNative\pwdspio.sys
[2012.06.17 18:35:15 | 000,000,717 | ---- | M] () -- C:\Users\Tom.Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C2DtoG15.lnk
[2012.06.17 13:17:05 | 000,000,759 | ---- | M] () -- C:\Users\Tom.Admin\Desktop\Blades of Time.lnk
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.15 01:08:31 | 000,000,188 | ---- | C] () -- C:\Users\Tom.Admin\defogger_reenable
[2012.07.14 14:55:22 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.13 19:52:18 | 000,001,984 | ---- | C] () -- C:\Users\Tom.Admin\Desktop\CrystalDiskInfo.lnk
[2012.07.13 18:11:53 | 000,001,228 | ---- | C] () -- C:\Users\Tom.Admin\Desktop\Registry Repair.lnk
[2012.07.13 16:07:12 | 000,001,018 | ---- | C] () -- C:\Users\Tom.Admin\Desktop\Stellar Phoenix JPEG Repair.lnk
[2012.07.13 14:27:15 | 000,001,199 | ---- | C] () -- C:\Users\Tom.Admin\Desktop\File Repair.lnk
[2012.07.11 15:15:36 | 002,966,720 | ---- | C] () -- C:\windows\SysNative\pwNative.exe
[2012.07.11 15:15:36 | 000,019,032 | ---- | C] () -- C:\windows\SysNative\pwdrvio.sys
[2012.07.11 15:15:36 | 000,012,384 | ---- | C] () -- C:\windows\SysNative\pwdspio.sys
[2012.07.11 15:15:35 | 000,001,286 | ---- | C] () -- C:\Users\Public\Desktop\MiniTool Partition Wizard Home Edition.lnk
[2012.07.11 15:02:05 | 000,001,070 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.07.08 12:57:01 | 000,001,035 | ---- | C] () -- C:\Users\Public\Desktop\Age of Empires III.lnk
[2012.07.05 20:22:16 | 000,001,896 | ---- | C] () -- C:\Users\Public\Desktop\Media Preview Configuration.lnk
[2012.07.05 16:07:16 | 000,001,658 | ---- | C] () -- C:\Users\Public\Desktop\Recuva.lnk
[2012.07.03 20:26:59 | 000,000,974 | ---- | C] () -- C:\Users\Tom.Admin\Desktop\PC Inspector File Recovery.lnk
[2012.06.23 13:39:21 | 000,002,102 | ---- | C] () -- C:\Users\Tom.Admin\Desktop\Ubi Soft Product Registration.lnk
[2012.06.23 13:39:07 | 000,069,632 | R--- | C] () -- C:\windows\SysWow64\xmltok.dll
[2012.06.23 13:39:07 | 000,036,864 | R--- | C] () -- C:\windows\SysWow64\xmlparse.dll
[2012.06.23 13:39:07 | 000,035,840 | R--- | C] () -- C:\windows\SysWow64\comdlg32.oca
[2012.06.23 13:39:07 | 000,029,184 | R--- | C] () -- C:\windows\SysWow64\MSINET.oca
[2012.06.18 11:16:52 | 000,001,097 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Widget Browser.lnk
[2012.06.17 18:35:15 | 000,000,717 | ---- | C] () -- C:\Users\Tom.Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C2DtoG15.lnk
[2012.06.17 13:17:05 | 000,000,759 | ---- | C] () -- C:\Users\Tom.Admin\Desktop\Blades of Time.lnk
[2012.05.15 02:21:50 | 000,423,744 | ---- | C] () -- C:\windows\SysWow64\nvStreaming.exe
[2012.03.08 16:39:32 | 000,007,604 | ---- | C] () -- C:\Users\Tom.Admin\AppData\Local\Resmon.ResmonCfg
[2012.01.30 03:50:35 | 000,925,184 | ---- | C] () -- C:\windows\expstart.exe
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\windows\SysWow64\xlive.dll.cat
[2011.09.04 14:14:11 | 001,780,768 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2011.05.15 02:42:06 | 000,134,132 | ---- | C] () -- C:\windows\ColorPic Uninstaller.exe
[2011.05.06 18:33:19 | 000,065,536 | ---- | C] () -- C:\windows\TADSUINS.EXE
[2011.03.11 15:58:19 | 000,075,136 | ---- | C] () -- C:\windows\SysWow64\PnkBstrA.exe
[2011.03.11 15:57:20 | 000,189,248 | ---- | C] () -- C:\windows\SysWow64\PnkBstrB.exe
[2011.01.15 03:01:28 | 000,000,000 | ---- | C] () -- C:\windows\Bench32.INI
[2011.01.15 01:32:49 | 000,000,079 | ---- | C] () -- C:\Users\Tom.Admin\AppData\Local\CrystalDiskMark30.ini
 
========== LOP Check ==========
 
[2011.07.19 01:18:07 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\Ableton
[2011.07.04 16:38:54 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\Auslogics
[2012.06.08 13:39:48 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\DAEMON Tools Lite
[2012.06.08 13:36:13 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\Dropbox
[2012.03.03 18:21:03 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\DVDVideoSoft
[2011.02.13 17:48:10 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.07.13 18:12:18 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\GlarySoft
[2012.02.19 19:32:05 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\ImgBurn
[2011.10.03 18:49:16 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\LolClient
[2012.06.19 21:38:21 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\MAXON
[2011.04.17 22:28:46 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\OCS
[2011.11.17 15:29:37 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\OpenCandy
[2011.04.17 22:28:47 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\Opera
[2012.01.16 04:08:35 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\pdfforge
[2011.08.24 18:34:08 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\PunkBuster
[2011.01.15 14:40:59 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\TerraTec
[2011.07.19 00:33:37 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\Thinstall
[2011.05.19 17:08:18 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\Wacom
[2011.05.19 17:08:20 | 000,000,000 | ---D | M] -- C:\Users\Tom.Admin\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
[2012.07.02 00:18:20 | 000,032,640 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:07BF512B
@Alternate Data Stream - 142 bytes -> C:\ProgramData\Temp:FC595E85

< End of report >
         

bitte warne freunde, bekannte etc vor solchen fake mails, und diese an mich weiterleiten, wie das geht, steht in meiner signatur
wo sind die logs der scans mit funden? poste diese bitte

Leider nichts mehr da... dachte ich hätte ihn früh genug aufgehalten, mir ist erst ein paar Tage später aufgefallen, dass der was an meinen Dateien rumgepfuscht hat. Ne richtige Meldung gabs bei den Antiviren nie... daher gibts die mail auch nicht mehr... Das ist grade mein Problem ich hab nur nen ganzen Batzen verschlüsselter Daten und dazu ein paar unverschlüsselte aus alten Sicherungen.

schau mal hier rein:
http://www.trojaner-board.de/116851-...tml#post851585