Computer gesperrt Ukash Trojaner

wandern · 08.09.2012, 13:22

Hallo liebes Trojaner Forum,

seit Donnerstag Abend erliege ich dem Ukash Trojaner, wie viele vor mir auch. Plötzlich geht der bekannte Screen vor mir aufm, welcher mich um eine 100Euro Strafe auffordert. Ich habe mich persönlich informiert und mein erster eigener Schritt war eine Recovery-Boot-CD zu starten, welche im Netz von Avira angeboten wird, dieser Tracker hat allerdings nichts gefunden, das Problem ist weiterhin vorhanden, nun habe ich euch gefunden und gesehen, wie ihr den Leuten helft, super Arbeit, ich habe OTL durchlaufen lassen, aber kann mit den Logs leider nichts anfangen.

Hier die OTL-File:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 08.09.2012 13:58:08 - Run 1
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\Wandern\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,92 Gb Total Physical Memory | 5,23 Gb Available Physical Memory | 66,05% Memory free
15,84 Gb Paging File | 12,72 Gb Available in Paging File | 80,32% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 199,90 Gb Total Space | 140,22 Gb Free Space | 70,14% Space Free | Partition Type: NTFS
Drive D: | 391,57 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 1663,01 Gb Total Space | 1545,07 Gb Free Space | 92,91% Space Free | Partition Type: NTFS
 
Computer Name: JASMIN | User Name: Wandern | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Wandern\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - E:\Programme\Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
PRC - C:\Users\Wandern\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd)
PRC - C:\Users\Wandern\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
PRC - E:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - E:\Spiele\LoL\League of Legends\rads\projects\lol_launcher\releases\0.0.0.95\deploy\LoLLauncher.exe ()
PRC - E:\Programme\Avira\AntiVir Desktop\avcenter.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - E:\Spiele\LoL\League of Legends\rads\system\rads_user_kernel.exe ()
PRC - E:\Programme\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Windows\V0700Mon.exe (Creative Technology Ltd.)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - E:\Spiele\LoL\League of Legends\rads\projects\lol_air_client\releases\0.0.0.198\deploy\LolClient.exe (Adobe Systems Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Users\Wandern\AppData\Roaming\Spotify\Data\libcef.dll ()
MOD - C:\Users\Wandern\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
MOD - E:\Spiele\LoL\League of Legends\rads\projects\lol_launcher\releases\0.0.0.95\deploy\LoLLauncher.exe ()
MOD - E:\Spiele\LoL\League of Legends\rads\system\rads_user_kernel.exe ()
MOD - E:\Programme\XSplit\avcodec-54.dll ()
MOD - E:\Programme\XSplit\avformat-54.dll ()
MOD - E:\Programme\XSplit\swscale-2.dll ()
MOD - E:\Programme\XSplit\avutil-51.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AppleChargerSrv) -- C:\Windows\SysNative\AppleChargerSrv.exe ()
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Hamachi2Svc) -- E:\Programme\Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (WajamUpdater) -- C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe (Wajam)
SRV - (AntiVirService) -- E:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirSchedulerService) -- E:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (cphs) -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Intel Corporation)
SRV - (TeamViewer7) -- E:\Programme\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (sesvc) -- E:\Programme\ShadowExplorer\sesvc.exe (www.shadowexplorer.com)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (tbhsd) -- C:\Windows\SysNative\drivers\tbhsd.sys (RapidSolution Software AG)
DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (LGSHidFilt) -- C:\Windows\SysNative\drivers\LGSHidFilt.Sys (Logitech Inc.)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (V0700Vid) -- C:\Windows\SysNative\drivers\V0700Vid.sys (Creative Technology Ltd.)
DRV:64bit: - (EtronXHCI) -- C:\Windows\SysNative\drivers\EtronXHCI.sys (Etron Technology Inc)
DRV:64bit: - (EtronHub3) -- C:\Windows\SysNative\drivers\EtronHub3.sys (Etron Technology Inc)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (AppleCharger) -- C:\Windows\SysNative\drivers\AppleCharger.sys ()
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (tsusbhub) -- C:\Windows\SysNative\drivers\tsusbhub.sys (Microsoft Corporation)
DRV:64bit: - (Synth3dVsc) -- C:\Windows\SysNative\drivers\Synth3dVsc.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (terminpt) -- C:\Windows\SysNative\drivers\terminpt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (LGVirHid) -- C:\Windows\SysNative\drivers\LGVirHid.sys (Logitech Inc.)
DRV:64bit: - (LGBusEnum) -- C:\Windows\SysNative\drivers\LGBusEnum.sys (Logitech Inc.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=bfaf8c19-1140-4477-a924-5af019fdb062&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=bfaf8c19-1140-4477-a924-5af019fdb062&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=bfaf8c19-1140-4477-a924-5af019fdb062&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.avira.com/?l=dis&o=APN10395&gct=hp&dc=EU&locale=de_DE
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 98 23 5A F1 FD 2A CD 01  [binary data]
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=bfaf8c19-1140-4477-a924-5af019fdb062&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=bfaf8c19-1140-4477-a924-5af019fdb062&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=bfaf8c19-1140-4477-a924-5af019fdb062&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://google.de"
FF - prefs.js..keyword.URL: "hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=bfaf8c19-1140-4477-a924-5af019fdb062&affid=111583&searchtype=ds&babsrc=lnkry&q="
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.30 00:27:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.30 00:27:26 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012.05.05 22:32:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Wandern\AppData\Roaming\mozilla\Extensions
[2012.08.18 11:30:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Wandern\AppData\Roaming\mozilla\Firefox\Profiles\7pgwdnss.default\extensions
[2012.05.25 14:01:42 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Wandern\AppData\Roaming\mozilla\Firefox\Profiles\7pgwdnss.default\extensions\ich@maltegoetz.de
[2012.08.18 11:24:33 | 000,002,474 | ---- | M] () -- C:\Users\Wandern\AppData\Roaming\Mozilla\Firefox\Profiles\7pgwdnss.default\searchplugins\Web Search.xml
[2012.05.05 22:46:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.08.30 00:27:26 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.04.21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.30 00:27:25 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.04.21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.04.21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Wajam) - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] E:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] E:\Programme\Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [V0700Mon.exe] C:\Windows\V0700Mon.exe (Creative Technology Ltd.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1445935061-1623457226-515283607-1000..\Run: [DAEMON Tools Lite] "E:\Programme\DAEMON Tools Lite\DTLite.exe" -autorun File not found
O4 - HKU\S-1-5-21-1445935061-1623457226-515283607-1000..\Run: [Spotify Web Helper] C:\Users\Wandern\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Wandern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B8F053E9-B9B8-4C43-B3C3-FADDDB8B217C}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.08 12:15:50 | 000,000,000 | ---D | C] -- C:\Users\Wandern\AppData\Roaming\www.shadowexplorer.com
[2012.09.08 12:15:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShadowExplorer
[2012.09.02 02:18:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2012.08.31 15:25:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2012.08.31 11:41:49 | 000,000,000 | ---D | C] -- C:\Users\Wandern\Documents\My Curse
[2012.08.30 00:30:23 | 000,000,000 | ---D | C] -- C:\Users\Wandern\AppData\Local\JDownloader 0.9
[2012.08.30 00:29:29 | 026,440,904 | ---- | C] (AppWork GmbH) -- C:\Users\Wandern\Desktop\JDownloaderSetup_0.9.581.exe
[2012.08.30 00:19:14 | 000,000,000 | ---D | C] -- C:\Users\Wandern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
[2012.08.30 00:19:11 | 000,000,000 | ---D | C] -- C:\Users\Wandern\AppData\Local\Wajam
[2012.08.30 00:19:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wajam
[2012.08.29 23:57:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
[2012.08.29 23:13:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard
[2012.08.29 21:48:28 | 000,000,000 | ---D | C] -- C:\ProgramData\RapidSolution
[2012.08.29 21:46:26 | 000,000,000 | ---D | C] -- C:\Users\Wandern\AppData\Local\RapidSolution
[2012.08.20 19:12:19 | 000,000,000 | ---D | C] -- C:\Users\Wandern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Athene-Orga
[2012.08.20 11:48:46 | 000,047,208 | ---- | C] (RapidSolution Software AG) -- C:\Windows\SysNative\drivers\tbhsd.sys
[2012.08.18 12:28:40 | 000,000,000 | ---D | C] -- C:\Users\Wandern\AppData\Local\Deployment
[2012.08.18 12:28:40 | 000,000,000 | ---D | C] -- C:\Users\Wandern\AppData\Local\Apps
[2012.08.16 13:19:24 | 000,000,000 | ---D | C] -- C:\Users\Wandern\AppData\Roaming\WinRAR
[2012.08.16 13:19:24 | 000,000,000 | ---D | C] -- C:\Users\Wandern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.08.16 13:19:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.08.16 13:19:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinRAR
[2012.08.16 10:59:54 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Blizzard Entertainment
[2012.08.13 20:00:09 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe
[2012.08.13 19:58:35 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.08.13 19:58:35 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.08.13 19:58:35 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.08.13 19:58:35 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.08.13 19:58:34 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.08.13 19:58:34 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.08.13 19:58:34 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.08.13 19:58:34 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.08.13 19:58:33 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.08.13 19:58:33 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.08.13 19:58:33 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.08.13 19:58:33 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.08.13 19:58:33 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.08.13 19:57:51 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012.08.13 19:57:50 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2012.08.13 19:57:50 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2012.08.13 19:57:41 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2012.08.13 19:57:41 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2012.08.11 18:41:05 | 000,000,000 | ---D | C] -- C:\Users\Wandern\AppData\Local\CrashRpt
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.08 14:01:32 | 004,503,728 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.09.08 13:48:08 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.08 12:15:37 | 000,000,734 | ---- | M] () -- C:\Users\Wandern\Desktop\ShadowExplorer.lnk
[2012.09.08 12:05:33 | 000,021,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.08 12:05:33 | 000,021,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.08 12:01:35 | 001,641,884 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.09.08 12:01:35 | 000,707,234 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.09.08 12:01:35 | 000,660,852 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.09.08 12:01:35 | 000,152,826 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.09.08 12:01:35 | 000,125,042 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.09.08 11:56:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.08 11:56:42 | 2082,299,903 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.06 23:57:44 | 000,001,895 | ---- | M] () -- C:\Users\Wandern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.09.03 14:05:17 | 000,696,520 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.09.03 14:05:17 | 000,073,416 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.08.31 15:25:47 | 000,000,626 | ---- | M] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2012.08.31 11:41:47 | 000,000,000 | ---- | M] () -- C:\Users\Wandern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip
[2012.08.30 00:30:44 | 000,002,077 | ---- | M] () -- C:\Users\Wandern\Desktop\JDownloader.lnk
[2012.08.30 00:29:58 | 026,440,904 | ---- | M] (AppWork GmbH) -- C:\Users\Wandern\Desktop\JDownloaderSetup_0.9.581.exe
[2012.08.29 23:59:20 | 000,000,895 | ---- | M] () -- C:\Users\Public\Desktop\World of Warcraft.lnk
[2012.08.20 11:48:46 | 000,047,208 | ---- | M] (RapidSolution Software AG) -- C:\Windows\SysNative\drivers\tbhsd.sys
[2012.08.17 01:13:08 | 000,049,554 | ---- | M] () -- C:\Users\Wandern\Desktop\Entwurf_Erfassungmaske.jpg
[2012.08.15 09:51:03 | 000,282,656 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2012.09.08 12:15:37 | 000,000,734 | ---- | C] () -- C:\Users\Wandern\Desktop\ShadowExplorer.lnk
[2012.09.06 23:57:44 | 004,503,728 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.09.06 23:57:44 | 000,001,895 | ---- | C] () -- C:\Users\Wandern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.08.31 15:25:47 | 000,000,626 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2012.08.31 11:41:47 | 000,000,000 | ---- | C] () -- C:\Users\Wandern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip
[2012.08.30 00:30:44 | 000,002,077 | ---- | C] () -- C:\Users\Wandern\Desktop\JDownloader.lnk
[2012.08.30 00:30:43 | 000,002,029 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader.lnk
[2012.08.30 00:19:37 | 000,002,078 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Deinstallationsprogramm.lnk
[2012.08.30 00:19:37 | 000,002,064 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Update.lnk
[2012.08.29 23:00:14 | 000,000,895 | ---- | C] () -- C:\Users\Public\Desktop\World of Warcraft.lnk
[2012.08.17 01:13:06 | 000,049,554 | ---- | C] () -- C:\Users\Wandern\Desktop\Entwurf_Erfassungmaske.jpg
[2012.07.23 23:23:50 | 000,103,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.07.23 23:23:48 | 000,669,184 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2012.07.23 23:23:48 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.05.25 04:46:03 | 000,000,403 | ---- | C] () -- C:\Windows\ODBC.INI
[2012.05.06 15:46:09 | 000,021,840 | ---- | C] () -- C:\Windows\SysWow64\SIntfNT.dll
[2012.05.06 15:46:09 | 000,017,212 | ---- | C] () -- C:\Windows\SysWow64\SIntf32.dll
[2012.05.06 15:46:09 | 000,012,067 | ---- | C] () -- C:\Windows\SysWow64\SIntf16.dll
[2012.05.06 15:20:10 | 000,030,920 | ---- | C] () -- C:\Windows\DIIUnin.dat
[2012.05.06 04:27:22 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll
[2012.05.06 04:24:45 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2012.05.06 04:23:21 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
[2012.05.05 22:40:29 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.04.06 03:29:34 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.04.06 03:29:34 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.03.19 23:31:16 | 000,963,912 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2012.03.19 23:31:16 | 000,261,208 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2012.03.19 23:25:58 | 000,058,880 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2012.03.19 22:21:14 | 013,212,672 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2012.03.09 14:06:14 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.02.14 19:39:50 | 001,668,246 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== LOP Check ==========
 
[2012.08.31 11:31:29 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\.minecraft
[2012.05.11 16:59:09 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\Awesomium
[2012.07.24 23:01:41 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\Bioshock
[2012.07.08 21:31:38 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\Canneverbe Limited
[2012.08.02 19:25:46 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\DAEMON Tools Lite
[2012.07.20 18:11:08 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\fltk.org
[2012.08.02 23:51:45 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\ImgBurn
[2012.05.06 13:34:56 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\Leadertech
[2012.05.06 00:16:55 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\LolClient
[2012.06.01 19:06:03 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\LolClient2
[2012.08.02 19:23:18 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\OpenCandy
[2012.05.15 19:47:30 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\SplitMediaLabs
[2012.09.08 13:21:21 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\Spotify
[2012.07.02 19:51:36 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\TeamViewer
[2012.07.23 00:00:59 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\Trine2
[2012.09.08 12:15:50 | 000,000,000 | ---D | M] -- C:\Users\Wandern\AppData\Roaming\www.shadowexplorer.com
[2009.07.14 07:08:49 | 000,014,238 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---
und hier der Extra-Log:OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 08.09.2012 13:58:08 - Run 1
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\Wandern\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,92 Gb Total Physical Memory | 5,23 Gb Available Physical Memory | 66,05% Memory free
15,84 Gb Paging File | 12,72 Gb Available in Paging File | 80,32% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 199,90 Gb Total Space | 140,22 Gb Free Space | 70,14% Space Free | Partition Type: NTFS
Drive D: | 391,57 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 1663,01 Gb Total Space | 1545,07 Gb Free Space | 92,91% Space Free | Partition Type: NTFS
 
Computer Name: JASMIN | User Name: **** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-1445935061-1623457226-515283607-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0CFC7AD3-DE89-4B0F-B123-F44416323ECB}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{38425009-D76E-45EF-9DC8-C99AC8845CC6}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3A6FBE39-2B84-4922-BDB5-71471AF5441B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3DDB4090-1124-458F-8641-35B3B0919296}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{43D04698-B888-4EAB-AE33-9C1065AD9B35}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{537FC8F8-A479-4299-9B5E-D8076A126C8A}" = lport=58280 | protocol=6 | dir=in | name=pando media booster | 
"{6B605A4E-331B-4DF1-BC7C-885270385979}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6CAF462C-24FC-4BFD-B6C4-9DA152D96B47}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{748F1739-C419-4B0C-87B7-4900CB367A39}" = lport=58280 | protocol=6 | dir=in | name=pando media booster | 
"{B67AAAB1-3E91-4A6E-81D6-B154A1397CDB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{C02C7AA7-7D85-4CA8-AECD-E7801F221B30}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{C7BCB323-CC4D-474D-93B7-67B4948D06F3}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{CD4C40EB-60AF-4421-8BC9-833C956A5DB0}" = lport=58280 | protocol=17 | dir=in | name=pando media booster | 
"{DCC0991B-BD84-41F7-A360-78A6620927B2}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{E8CC9515-E23F-4C98-85E2-50555DD25C92}" = lport=58280 | protocol=17 | dir=in | name=pando media booster | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{036B8D45-D6FF-4BAB-97BE-69D471CF7D6A}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe | 
"{0392839D-625A-4152-97FF-396AFEFAC092}" = protocol=17 | dir=in | app=e:\programme\version7\teamviewer_service.exe | 
"{085F8EDD-DD02-4023-B05E-C43EF34B45F0}" = protocol=17 | dir=in | app=e:\spiele\world of warcraft\launcher.patch.exe | 
"{0A068854-2B19-4551-A535-DE80D892514E}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe | 
"{0AC9D14C-EC47-4DA8-BCA0-986CCA88A7B8}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe | 
"{12B524DE-D2CD-4650-84BE-F9FCB85070DD}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{14D79BF4-C774-4E87-80B6-F22CF52DF375}" = protocol=6 | dir=in | app=e:\spiele\world of warcraft\launcher.exe | 
"{163A5D68-DD3E-4DBE-8A93-37435E483788}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\awesomenauts\awesomenautslauncher.exe | 
"{16FB0692-6BAB-42D2-B803-B926E3BA14DD}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\trine 2\trine2_32bit.exe | 
"{1855999A-304B-4E93-A413-84B6B7018A98}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe | 
"{188E4712-63E4-4094-BE06-9B5999DF4B16}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe | 
"{18FF7542-AA26-4354-8D6C-8E61E8BD1A50}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\crysis\bin32\crysis.exe | 
"{194006EC-2E8A-4390-8795-D5AA3C593E09}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\trine 2\trine2_launcher.exe | 
"{1AE15515-8277-4AD4-B948-6D1A279826EC}" = protocol=17 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe | 
"{1B6BF573-09BF-41CF-97AA-A6612EEA2F2A}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{1F0DD46F-FE42-4540-917F-61F38969DDD5}" = protocol=58 | dir=in | app=system | 
"{22534F62-0EA4-4439-BF0B-0445EFC1F6FF}" = protocol=6 | dir=in | app=e:\spiele\world of warcraft\wow-x.x.x.x-4.0.0.12911-eu-downloader.exe | 
"{2581070E-D9F7-435C-B392-7A98BBBD32FD}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe | 
"{287501AC-CD92-4420-8C28-E9F1AA1F621E}" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"{2975AF30-8578-4BBB-B09B-6818471D909D}" = protocol=17 | dir=in | app=e:\spiele\steam\steam.exe | 
"{2A23E902-3920-4880-B567-8F00267A2885}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\magicka\magicka.exe | 
"{36658846-6D6B-4BD6-81C5-5E53370B46D7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{372C63EE-B418-4926-890C-BEBFB2DDD575}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\bioshock\builds\release\bioshock.exe | 
"{38B1C41E-DE32-47B4-BC07-A343B9D048E9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{390ADD91-19E4-4B83-B6C9-167E0AD61FFF}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\just cause 2\justcause2.exe | 
"{418F93B1-259C-49C0-A050-FF7BE9CC211F}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{47642381-BE48-4A27-8050-ECFC6D25A7E2}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{4F70A82D-907D-42DB-8E21-7783295B6525}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe | 
"{502CA59C-8915-4D91-9CE0-24B4C7546662}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{546A1BE4-C838-4EFF-B465-6C00B5890D29}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\brawl busters\bin\pbclient.exe | 
"{553047DA-D84B-4B4F-97F1-AC6FAE3652A4}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\brawl busters\bin\pbclient.exe | 
"{558B3F9C-7B8B-460D-B7B6-8CA331D8E0F3}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{5823AF09-3536-4B0D-AF50-01DF1CF92759}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\portal 2\portal2.exe | 
"{5A987C7B-0527-4226-95D4-91F2769E8B8A}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\dungeon defenders\binaries\win32\dungeondefenders.exe | 
"{5D00E82C-CDE4-460E-8355-BAFCD6883A16}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1199\agent.exe | 
"{618BCD16-7F81-419D-9912-2789F68D3AA8}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{65100C5C-8580-47CB-9617-27CCB89EC328}" = protocol=17 | dir=in | app=e:\spiele\world of warcraft\launcher.exe | 
"{6606579F-8C15-4624-8D6D-42494E763C57}" = protocol=17 | dir=in | app=e:\spiele\world of warcraft\wow-x.x.x.x-4.0.0.12911-eu-downloader.exe | 
"{6807C90C-8396-4DEC-B5C9-9DD103D995A4}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{68EE7471-D39E-4119-8611-4438137AEB17}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe | 
"{6B700A9F-AD5A-4279-BA2B-94605948C457}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\trine 2\trine2_32bit.exe | 
"{6EE2D957-0771-4031-BBD5-F818720773FA}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\magicka\magicka.exe | 
"{6FE9A46B-48B2-4CCD-AB8D-1B05A2DCFE97}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe | 
"{71C301E7-F263-4994-9976-76B2C2EB9BF9}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\brawl busters\bin\pblauncher.exe | 
"{7828990D-69E8-4339-99ED-95119601E661}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{78676D00-AA54-4024-B9ED-588A5A97D213}" = protocol=6 | dir=in | app=e:\spiele\world of warcraft\temp\wow-4.3-5.0.15890-enus-downloader.exe | 
"{79AF3E3F-9362-4858-B791-FA3B48FC10BC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{7ACC8E75-9ED6-4E80-BC89-F1ADF360FF0D}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe | 
"{7C83AD62-AF1F-4928-B362-782C576A7326}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe | 
"{7F624916-7536-4F1A-9A9F-E1B7B6B614BD}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{81BC4F29-6ABE-4122-BCA7-E67B156C6B12}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe | 
"{8645312E-9F03-4FB0-BC45-601DB60BC0FA}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{88BD9C8E-1324-44F8-875D-0A1849B14995}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 | 
"{88E677E0-AC96-4F1A-8973-2ABEA1CDDD66}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\just cause 2\justcause2.exe | 
"{8A04EDEC-5DA7-4DD5-8F45-5C51780CD06F}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{8B722DB6-AFE8-4A3D-AAE7-680DC0988388}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 
"{903C2569-D7A9-444D-AFC0-4F82F171DB14}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\amnesia the dark descent\launcher.exe | 
"{91E5068F-CFD3-409B-9F30-3AB903BCD49D}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\bioshock\builds\release\bioshock.exe | 
"{98065A97-31BD-416A-A09B-1E723E4B83CA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{9CB438C5-71A1-4E7B-B0D0-153623B0847B}" = protocol=6 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe | 
"{A2D2C782-264E-41D2-865A-79E61DD78535}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\bmlauncher.exe | 
"{A557274A-FAC9-41F1-AB50-EDE9FF747F60}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1199\agent.exe | 
"{A76A2E00-CB67-440B-AA74-5FECFD7B9F0F}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 
"{ADE7F064-989D-461D-9250-20893D114463}" = protocol=17 | dir=in | app=e:\spiele\world of warcraft\temp\wow-4.3-5.0.15890-enus-downloader.exe | 
"{AEEA9567-DDCC-4FB5-B194-0F9F64185F2A}" = protocol=17 | dir=in | app=e:\programme\version7\teamviewer.exe | 
"{B3AEDDEB-BA94-407F-934E-545D79A09BCA}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{B527247E-B331-414A-A338-0E566B135B9A}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\portal 2\portal2.exe | 
"{B6F4692C-5B32-4781-BBA8-208AAF06EB18}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{B77CA0E6-B416-4825-96BA-38FF835C3DE3}" = protocol=6 | dir=in | app=e:\spiele\world of warcraft\launcher.patch.exe | 
"{B978D408-C944-42FC-AD0A-E4C0DAA183EF}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 
"{BB88F87C-503E-4719-9CCD-D94BD4FD125A}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\brawl busters\bin\pblauncher.exe | 
"{BF074F09-832F-4BF6-BDE1-5FE797DBFDD4}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{CB0D3791-B58F-4249-9AB1-D0EE515FD992}" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"{CD43CCB9-E428-45B3-999A-29526D4432C5}" = protocol=6 | dir=out | app=system | 
"{CE0420BF-C3D2-4E5F-8A37-7F6F8F81978E}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe | 
"{CFB9846B-E7A1-415E-9469-38919BC8C20A}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{DBD92A81-C927-4325-9577-6EC2EE7B6D20}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\trine 2\trine2_launcher.exe | 
"{DED10CBB-EF51-4192-90B3-062345FEB349}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{DEEFEFB5-C200-44AB-B348-5770CC183C76}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe | 
"{E2B03BEB-3538-49E4-8659-AD9A3B662595}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{E4E6C73E-FB80-40CA-B000-7EB49091AF39}" = protocol=6 | dir=in | app=e:\programme\version7\teamviewer_service.exe | 
"{E53CC5D7-F526-4800-961A-CDF0AF7F76E2}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\bmlauncher.exe | 
"{E6C297C9-D031-4A6B-AA0C-0FC8F58EBA8C}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\awesomenauts\awesomenautslauncher.exe | 
"{E8360539-8843-4DC4-A208-D5D9AF37E097}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E96984DD-9178-4C14-B4FE-E13CC1DD3E37}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\amnesia the dark descent\launcher.exe | 
"{EB9B7BCD-03FE-43B5-94C7-157109414775}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\dungeon defenders\binaries\win32\dungeondefenders.exe | 
"{EBAE171A-086E-41A1-9494-BF3CD227C537}" = protocol=6 | dir=in | app=e:\programme\version7\teamviewer.exe | 
"{F11BB84D-7EAF-4B84-8DA4-7900A3780ADC}" = protocol=6 | dir=in | app=e:\spiele\steam\steam.exe | 
"{F13D6456-CBC9-4613-8BCF-782FED6BBA2A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{F355400E-DB33-4F0E-B798-00AF3B49194F}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\crysis\bin32\crysis.exe | 
"{F7227F75-40C9-46FC-B849-B616582DB807}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 
"{F82AA53D-FE3D-4DF1-909C-DCD70F683A25}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{FD10FD70-78F5-43CE-B272-1DECF486384A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"TCP Query User{2CA32761-3E27-4487-BC31-3D0E083F0437}E:\spiele\world of warcraft\temp\wow-4.3-5.0.15890-enus-downloader.exe" = protocol=6 | dir=in | app=e:\spiele\world of warcraft\temp\wow-4.3-5.0.15890-enus-downloader.exe | 
"TCP Query User{576ED9F3-F928-4F7E-BB44-852DCCAC2350}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 
"TCP Query User{7D661B0A-3463-4771-8894-7C95BFB15FF0}E:\spiele\steam\steamapps\common\trine 2\trine2_32bit.exe" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\trine 2\trine2_32bit.exe | 
"TCP Query User{7FF1F4ED-D6AD-4F78-BE3A-ADD787B546E8}E:\spiele\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe | 
"TCP Query User{C8282783-04AE-4135-B3CF-276E89035895}C:\users\wandern\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\wandern\appdata\roaming\spotify\spotify.exe | 
"TCP Query User{CC2228DC-A15F-401E-BEB3-DBC7A070FCD0}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"TCP Query User{D55568CD-8197-44EE-9E1C-CF98320F6325}E:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe | 
"UDP Query User{0B25E7AA-092F-488C-8B75-D2B244FFA2AF}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"UDP Query User{0E068E9E-B6D2-4D5A-B27D-C11BAC07A463}E:\spiele\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe | 
"UDP Query User{12434D5D-575F-4B80-B62B-A63E824F586B}E:\spiele\steam\steamapps\common\trine 2\trine2_32bit.exe" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\trine 2\trine2_32bit.exe | 
"UDP Query User{254E5E12-BE20-4D21-AF90-036701B17376}E:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe | 
"UDP Query User{7136305A-E521-4FE1-B7A4-E1C8488E451F}E:\spiele\world of warcraft\temp\wow-4.3-5.0.15890-enus-downloader.exe" = protocol=17 | dir=in | app=e:\spiele\world of warcraft\temp\wow-4.3-5.0.15890-enus-downloader.exe | 
"UDP Query User{9FE53B8B-747A-448E-9804-F61B7EC2AD55}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 
"UDP Query User{E1133911-BB81-4F57-859A-FA4718F2159E}C:\users\wandern\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\wandern\appdata\roaming\spotify\spotify.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{119B2F5A-2A06-DB96-FF28-992EC2A10BDF}" = AMD Accelerated Video Transcoding
"{2E8D6204-D656-8355-1ED3-2988AC52EB0F}" = ccc-utility64
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{3ABFAF33-D6EE-9348-CE96-AF51E9D6D2FF}" = AMD Drag and Drop Transcoding
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5831C6D6-309D-DBB5-14F7-FEE57086CEE7}" = AMD Catalyst Install Manager
"{63CE6C32-1EB3-4C51-89FC-9FD96A661A9C}" = AMD Media Foundation Decoders
"{690285C2-2481-44FB-8402-162EA970A6DD}" = Logitech Gaming Software
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Creative VF0700" = Creative Live! Cam Chat HD (VF0700) (1.00.06.00)
"Logitech Gaming Software" = Logitech Gaming Software 8.20
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{03D4C700-2BFE-43E0-A0B4-9512B43C5B9F}" = Catalyst Control Center - Branding
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{19D614EB-D62A-AEE7-2391-E74126601D59}" = CCC Help Italian
"{1C373820-B9C8-0F7F-8F84-FC1B76A85F27}" = CCC Help Portuguese
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java(TM) 7 Update 5
"{2D35BC33-7D08-D529-DF91-8A15FBF2600E}" = CCC Help Polish
"{337788D1-43D1-9A0F-9787-DD00DB512D41}" = Catalyst Control Center Localization All
"{3DECD372-76A1-4483-BF10-B547790A3261}" = ON_OFF Charge B11.0110.1
"{4725833D-4325-5C34-57D4-1FE23E5AE578}" = CCC Help Chinese Standard
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B271648-43CB-DD31-FF24-E7B06D3EE72A}" = Catalyst Control Center InstallProxy
"{4DC37F33-7AEC-A4CB-56B1-69A402828763}" = CCC Help Japanese
"{5710DAC2-8F2A-503C-CFC2-A973ADE0EA4C}" = CCC Help Czech
"{5C763682-4C40-86DA-9C46-31924D7D2C34}" = CCC Help Thai
"{60E5022D-FA4B-C6A2-1E80-B46EC39096F3}" = CCC Help Chinese Traditional
"{60F34FDF-267C-408F-290E-EC90D841C8CB}" = CCC Help German
"{64029508-2587-4D39-AB83-2AC722FBFCC2}" = XSplit
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{66B79AE1-C6E2-B958-689C-D0812DE86BAB}" = CCC Help Greek
"{6B39BE0F-0F5E-A8FA-33E4-8481AE39D96C}" = CCC Help Russian
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8E19F2AF-7145-51DE-E395-7729A9374973}" = Catalyst Control Center Graphics Previews Common
"{918A9082-6287-4D25-9002-5E5D5E4971CB}" = League of Legends
"{91CB5B8B-4EC8-DBA1-A88D-99FD480567B0}" = CCC Help English
"{924FBAC4-60D2-7981-3C3E-979DF9CBB346}" = CCC Help Finnish
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DC939DC-B7A4-D0E2-C582-A442DF1B3EBE}" = CCC Help Spanish
"{A1BD938B-F006-6E6D-70B2-47E1DD56F7DE}" = CCC Help Swedish
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{B45FABE7-D101-4D99-A671-E16DA40AF7F0}" = Microsoft Games for Windows - LIVE
"{B578C85A-A84C-4230-A177-C5B2AF565B8C}" = Microsoft Games for Windows - LIVE Redistributable
"{B8ABD8C7-991E-4A70-B5A3-20C6FC680680}" = LogMeIn Hamachi
"{BABF7852-C2DD-6A8A-9956-101720C715C7}" = CCC Help Turkish
"{BB7C2A56-9706-43B8-5A8C-210AF5816106}" = CCC Help French
"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CFC2CB60-5654-05A7-4D30-C661800A3A92}" = CCC Help Korean
"{D04CE005-D1D2-80F3-84C8-B3524FCD39C3}" = CCC Help Norwegian
"{D544AE4C-4152-225B-A897-6756C8986B14}" = Catalyst Control Center
"{D81E9069-3CCC-4405-3751-71E4AFEACC52}" = CCC Help Hungarian
"{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}" = Etron USB3.0 Host Controller
"{E93FF166-DF14-2537-8FB4-96BB5810A96C}" = CCC Help Danish
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FA9827E1-8A8E-C176-4923-0840A67ED4DE}" = CCC Help Dutch
"7289-1030-5602-7421" = JDownloader 0.9
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"DAEMON Tools Lite" = DAEMON Tools Lite
"Diablo II" = Diablo II
"Diablo III" = Diablo III
"ImgBurn" = ImgBurn
"LogMeIn Hamachi" = LogMeIn Hamachi
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PunkBusterSvc" = PunkBuster Services
"ShadowExplorer_is1" = ShadowExplorer 0.8
"Steam App 17300" = Crysis
"Steam App 204300" = Awesomenauts
"Steam App 35140" = Batman: Arkham Asylum GOTY Edition
"Steam App 35720" = Trine 2
"Steam App 40800" = Super Meat Boy
"Steam App 42910" = Magicka
"Steam App 440" = Team Fortress 2
"Steam App 48000" = LIMBO
"Steam App 550" = Left 4 Dead 2
"Steam App 57300" = Amnesia: The Dark Descent
"Steam App 620" = Portal 2
"Steam App 65800" = Dungeon Defenders
"Steam App 7670" = BioShock
"Steam App 8190" = Just Cause 2
"TeamViewer 7" = TeamViewer 7
"Wajam" = Wajam
"WinRAR archiver" = WinRAR 4.20 (32-Bit)
"World of Warcraft" = World of Warcraft
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1445935061-1623457226-515283607-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"02b03e6fe9596702" = Athene-Orga
"Spotify" = Spotify
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 03.07.2012 00:29:27 | Computer Name = Jasmin | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "E:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 03.07.2012 13:57:37 | Computer Name = Jasmin | Source = Application Hang | ID = 1002
Description = Programm LolClient.exe, Version 2.0.2.12610 kann nicht mehr unter 
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in
 der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem 
zu suchen.    Prozess-ID: 944    Startzeit: 01cd5941a23639ee    Endzeit: 0    Anwendungspfad: E:\Spiele\LoL\League
 of Legends\RADS\projects\lol_air_client\releases\0.0.0.158\deploy\LolClient.exe

Berichts-ID:
 915d3e7d-c538-11e1-8742-50e549c9669b  
 
Error - 05.07.2012 18:22:28 | Computer Name = Jasmin | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: League of Legends.exe, Version: 1.0.0.141,
 Zeitstempel: 0x4fed3204  Name des fehlerhaften Moduls: League of Legends.exe, Version:
 1.0.0.141, Zeitstempel: 0x4fed3204  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00023157
ID
 des fehlerhaften Prozesses: 0x1418  Startzeit der fehlerhaften Anwendung: 0x01cd5af8121b3115
Pfad
 der fehlerhaften Anwendung: E:\Spiele\LoL\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.0.162\deploy\League
 of Legends.exe  Pfad des fehlerhaften Moduls: E:\Spiele\LoL\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.0.162\deploy\League
 of Legends.exe  Berichtskennung: e718a6fa-c6ef-11e1-8742-50e549c9669b
 
Error - 06.07.2012 19:32:57 | Computer Name = Jasmin | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "E:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 08.07.2012 19:41:38 | Computer Name = Jasmin | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "E:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 11.07.2012 19:05:09 | Computer Name = Jasmin | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "E:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 12.07.2012 19:51:43 | Computer Name = Jasmin | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "E:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 19.07.2012 19:55:57 | Computer Name = Jasmin | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "E:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.07.2012 12:48:47 | Computer Name = Jasmin | Source = Application Hang | ID = 1002
Description = Programm LolClient.exe, Version 2.0.2.12610 kann nicht mehr unter 
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in
 der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem 
zu suchen.    Prozess-ID: 840    Startzeit: 01cd6825d9f78138    Endzeit: 2    Anwendungspfad: E:\Spiele\LoL\League
 of Legends\RADS\projects\lol_air_client\releases\0.0.0.175\deploy\LolClient.exe

Berichts-ID:
 19d56953-d41d-11e1-8742-50e549c9669b  
 
Error - 23.07.2012 18:50:55 | Computer Name = Jasmin | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "E:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
[ System Events ]
Error - 06.07.2012 16:41:13 | Computer Name = Jasmin | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1053
 
Error - 08.07.2012 15:43:33 | Computer Name = Jasmin | Source = cdrom | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.
 
Error - 08.07.2012 15:45:42 | Computer Name = Jasmin | Source = cdrom | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.
 
Error - 08.07.2012 15:45:48 | Computer Name = Jasmin | Source = cdrom | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.
 
Error - 09.08.2012 17:06:47 | Computer Name = Jasmin | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Steam Client Service erreicht.
 
Error - 09.08.2012 17:06:47 | Computer Name = Jasmin | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1053
 
Error - 16.08.2012 20:13:48 | Computer Name = Jasmin | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 22.08.2012 00:06:14 | Computer Name = Jasmin | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.
 
Error - 22.08.2012 00:06:15 | Computer Name = Jasmin | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.
 
Error - 22.08.2012 00:06:15 | Computer Name = Jasmin | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.
 
 
< End of report >

--- --- ---

Ich bedanke mich für das Interesse an meinem Problem, mfg Wandern.

t'john · 09.09.2012, 01:58

Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen.
Diese Nacheinander abarbeiten und die 4 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen.

Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern mede dies bitte.

1. Schritt

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.

Code:

ATTFilter

:OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} 
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=bfaf8c19-1140-4477-a924-5af019fdb062&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=bfaf8c19-1140-4477-a924-5af019fdb062&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} 
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} 
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=bfaf8c19-1140-4477-a924-5af019fdb062&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} 
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKU\S-1-5-21-1445935061-1623457226-515283607-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF - prefs.js..browser.startup.homepage: "http://google.de" 
FF - prefs.js..keyword.URL: "http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=bfaf8c19-1140-4477-a924-5af019fdb062&affid=111583&searchtype=ds&babsrc=lnkry&q=" 
FF - prefs.js..network.proxy.type: 0 
FF - user.js - File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found 
O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. 
O4 - HKU\S-1-5-21-1445935061-1623457226-515283607-1000..\Run: [DAEMON Tools Lite] "E:\Programme\DAEMON Tools Lite\DTLite.exe" -autorun File not found 
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O4 - Startup: C:\Users\Wandern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip () 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 

[2012.09.08 14:01:32 | 004,503,728 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad 
[2012.09.06 23:57:44 | 000,001,895 | ---- | M] () -- C:\Users\Wandern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk 
[2
[2012.08.18 11:24:33 | 000,002,474 | ---- | M] () -- C:\Users\Wandern\AppData\Roaming\Mozilla\Firefox\Profiles\7pgwdnss.default\searchplugins\Web Search.xml 
[2012.04.21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml 
[2012.04.21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml 
[2012.04.21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml 
[2012.04.21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml 
[2012.04.21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml 

[2012.08.31 11:41:47 | 000,000,000 | ---- | M] () -- C:\Users\Wandern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip 

:Files
C:\ProgramData\*.exe
C:\ProgramData\TEMP
C:\Users\Wandern\AppData\Local\{*}
C:\Users\Wandern\AppData\Local\Temp\*.exe
C:\Users\Wandern\AppData\LocalLow\Sun\Java\Deployment\cache
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

2. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

3. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

4. Schritt

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

t'john · 24.04.2013, 16:33

Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.

Computer gesperrt Ukash Trojaner

Plagegeister aller Art und deren Bekämpfung: Computer gesperrt Ukash Trojaner