Hallo! Zu erst möchte ich mich entschuldigen, da ich nicht genau gewusst habe in welchem Subforum ich dieses Thema erstellen sollte.

Mein Problem ist folgendes (Symptome: Nachricht "moin, kaum zu glauben was für schöne fotos von dir auf deinem profil? hxxp://goo.gl/FYA9t?foto=SKYPENAME" an alle meine Skypekontakte. Mehr eigentlich nicht. Ich habe mich aber ein bisschen umgehört und die Meinungen gehen auseinander. Die Einen sagen er sei NOCH harmlos, die anderen dass dieser Virus deine Tasten.. mir fällt das Wort nicht ein, dass er jedenfalls sehen kann was du schreibst und so eine Passwörter herausfinden kann. Ich habe mich deswegen nur in Yahoo.de eingeloggt um mich in diesem Forum zu registrieren.)
Ich habe mir gestern aus Versehen den Skype-Wurm, der gerade in Umlauf ist, heruntergeladen. Ich bin dann sofort ins Netz und habe gegoogelt wie man den denn entfernen kann. Ich bin dann auf folgendes gestoßen (Quelle: www.stern.de): Man sollte zuerst in Skype selber unter Aktionen - Optionen - Erweitert - Zugriffsverwaltung alle entfernen, was ich auch gemacht habe. Danach sollte ich mit "Malwarebytes" einen Scan durchführen, was ich dann auch gemacht habe. Herausgekommen ist:

 Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.10.27.06

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Margareth :: MARGARETH-PC [Administrator]

27.10.2012 21:53:16
mbam-log-2012-10-27 (21-53-16).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 394444
Laufzeit: 1 Stunde(n), 22 Minute(n), 49 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\Program Files (x86)\BrowserCompanion\BCHelper.exe (PUP.Blabbers) -> 8600 -> Löschen bei Neustart.

Infizierte Speichermodule: 1
C:\Program Files (x86)\BrowserCompanion\sqlite3.dll (PUP.Blabbers) -> Löschen bei Neustart.

Infizierte Registrierungsschlüssel: 23
HKCR\CLSID\{00cbb66b-1d3b-46d3-9577-323a336acb50} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{8830DDF0-3042-404D-A62C-384A85E34833} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{817923CB-4744-4216-B250-CF7EDA8F1767} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\wit4ie.WitBHO.2 (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\wit4ie.WitBHO (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00CBB66B-1D3B-46D3-9577-323A336ACB50} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00CBB66B-1D3B-46D3-9577-323A336ACB50} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{830B56CB-FD22-44AA-9887-7898F4F4158D} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\tdataprotocol.CTData.1 (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\tdataprotocol.CTData (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{963B125B-8B21-49A2-A3A8-E37092276531} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{955B782E-CDC8-4CEE-B6F6-AD7D541A8D8A} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{9F0C17EB-EF2C-4278-9136-2D547656BC03} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\updatebho.TimerBHO.1 (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\updatebho.TimerBHO (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{963B125B-8B21-49A2-A3A8-E37092276531} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{963B125B-8B21-49A2-A3A8-E37092276531} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrowserCompanion (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\PROTOCOLS\HANDLER\BASE64 (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\PROTOCOLS\HANDLER\CHROME (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\PROTOCOLS\HANDLER\PROX (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Google\chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki (PUP.Funmoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 4
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Browser companion helper (PUP.Blabbers) -> Daten: C:\Program Files (x86)\BrowserCompanion\BCHelper.exe /T=3 /CHI=ibgfbdggapddbjjbopabhlhianklajie -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\protocols\Handler\base64|CLSID (PUP.Blabbers) -> Daten: {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\protocols\Handler\chrome|CLSID (PUP.Blabbers) -> Daten: {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\protocols\Handler\prox|CLSID (PUP.Blabbers) -> Daten: {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Program Files (x86)\BrowserCompanion (PUP.Blabbers) -> Löschen bei Neustart.

Infizierte Dateien: 17
C:\Program Files (x86)\BrowserCompanion\BCHelper.exe (PUP.Blabbers) -> Löschen bei Neustart.
C:\Program Files (x86)\BrowserCompanion\jsloader.dll (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\updatebhoWin32.dll (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\HappyCloud\Application\hcwebwindow.exe (Trojan.FakeAlert) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Margareth\AppData\Local\Temp\coupish.exe (PUP.Blabbers.H) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Margareth\AppData\Local\Temp\coupondropdown.exe (PUP.CrossRider.CDD) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Margareth\AppData\LocalLow\bbrs_002.tb\content\BCHelper.exe (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Margareth\Desktop\Terraria 1.1.2\TDU.exe (Packer.ModifiedUPX) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\blabbers-ff-full.xpi (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\blabbers-ch.crx (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\logo.ico (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\sqlite3.dll (PUP.Blabbers) -> Löschen bei Neustart.
C:\Program Files (x86)\BrowserCompanion\toolbar.dll (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\uninstall.exe (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\updater.ini (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\widgetserv.exe (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
         

Ich habe alle in die Quarantäne verschoben und sie nicht endgültig gelöscht.

Ein Freund hat mir dann empfohlen das Programm "HiJackThis204" zu benutzen, was ich auch getan habe. (Leider kein Logfile vorhanden)! Dieser Freund sagte mir dann, dass ich alles mit "(no name)" löschen sollte. Er sagte er kennt sich ein bisschen damit aus, und so habe ich das auch gemacht.

Zur Info, ich habe ein 64bit System. Bei der Hilfe zum erstellen eines Themas, stand dass ich noch die Logfiles von "OTL" ins Thema schreiben sollte:

OTL.txt

OTL logfile created on: 28.10.2012 10:52:13 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Margareth\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00001407 | Country: Liechtenstein | Language: DEC | Date Format: dd.MM.yyyy
 
3.86 Gb Total Physical Memory | 2.07 Gb Available Physical Memory | 53.54% Memory free
7.73 Gb Paging File | 5.28 Gb Available in Paging File | 68.31% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 225.33 Gb Total Space | 37.22 Gb Free Space | 16.52% Space Free | Partition Type: NTFS
Drive D: | 225.33 Gb Total Space | 225.24 Gb Free Space | 99.96% Space Free | Partition Type: NTFS
 
Computer Name: MARGARETH-PC | User Name: Margareth | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Margareth\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
PRC - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
PRC - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (SEC)
PRC - C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe (SAMSUNG Electronics)
PRC - C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Windows\SysWOW64\Rezip.exe ()
PRC - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Steam\bin\libcef.dll ()
MOD - C:\Program Files (x86)\Steam\bin\avcodec-53.dll ()
MOD - C:\Program Files (x86)\Steam\bin\chromehtml.DLL ()
MOD - C:\Program Files (x86)\Steam\bin\avformat-53.dll ()
MOD - C:\Program Files (x86)\Steam\bin\avutil-51.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\PepperFlash\pepflashplayer.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\pdf.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\libglesv2.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\libegl.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\avutil-51.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\avformat-54.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\avcodec-54.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()
MOD - C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Rezip) -- C:\Windows\SysWOW64\Rezip.exe ()
SRV - (IJPLMSVC) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (Fs_Rec) -- C:\windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (ScreamBAudioSvc) -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys (Screaming Bee LLC)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys ()
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (SABI) -- C:\Windows\SysNative\drivers\SABI.sys (SAMSUNG ELECTRONICS)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (scramby_out) -- C:\Windows\SysNative\drivers\scramby_out.sys (RapidSolution Software AG)
DRV:64bit: - (scramby) -- C:\Windows\SysNative\drivers\scramby.sys (RapidSolution Software AG)
DRV - (rtport) -- C:\Windows\SysWOW64\drivers\rtport.sys (Windows (R) 2003 DDK 3790 provider)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&AF=110000&babsrc=SP_ss&mntrId=26a5f3b60000000000004c0f6e67113a
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search"
FF - prefs.js..browser.search.defaultthis.engineName: "DVDVideoSoftTB Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search"
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.6
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.5.0.12
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}:7.0.01
FF - prefs.js..extensions.enabledItems: ffxtlbr@babylon.com:1.2.0
FF - prefs.js..extensions.enabledItems: ffxtlbr@funmoods.com:1.5.0
FF - prefs.js..extensions.enabledItems: bbrs_002@blabbers.com:1.0.5
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.0: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Margareth\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Margareth\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll File not found
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Margareth\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\thehappycloud.com/HappyCloudPlugin: C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.08.29 11:38:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.02.09 21:47:09 | 000,000,000 | ---D | M]
 
[2011.03.10 16:55:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\Extensions
[2011.03.10 16:55:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\Extensions\contact@callgraph.in
[2012.10.22 19:55:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\Firefox\Profiles\uctw6efl.default\extensions
[2011.07.23 21:28:15 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Margareth\AppData\Roaming\mozilla\Firefox\Profiles\uctw6efl.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2011.02.17 22:16:32 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Margareth\AppData\Roaming\mozilla\Firefox\Profiles\uctw6efl.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.07.19 09:13:10 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Margareth\AppData\Roaming\mozilla\Firefox\Profiles\uctw6efl.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2012.06.06 16:54:07 | 000,000,000 | ---D | M] (Browser Companion Helper) -- C:\Users\Margareth\AppData\Roaming\mozilla\Firefox\Profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com
[2012.02.11 15:18:03 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Margareth\AppData\Roaming\mozilla\Firefox\Profiles\uctw6efl.default\extensions\ffxtlbr@babylon.com
[2012.02.08 19:54:47 | 000,000,000 | ---D | M] (Funmoods.com) -- C:\Users\Margareth\AppData\Roaming\mozilla\Firefox\Profiles\uctw6efl.default\extensions\ffxtlbr@funmoods.com
[2012.10.22 19:56:07 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\0324adea3b6ec02af09ea4ae9424591b_expire
[2012.10.22 19:56:07 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\292124057d00cb0fa73db6b90d079658_expire
[2012.08.03 16:20:08 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\2e74403c227112bec523796d5a77d77e_expire
[2012.08.31 17:18:29 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\2fb0a694851c14e47b9ee5c9511cfaf5_expire
[2012.08.31 17:18:28 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\35c5ead7c694459d2b46d88482247348_expire
[2012.08.24 18:33:25 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\4d3d10bd28ff623813254a49b26be41f_expire
[2012.08.31 17:18:27 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\529625b7c75cf58a3cad03424e45f9cd_expire
[2012.08.31 17:18:29 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\5496a80fec56909d677fa574ae75bd3d_expire
[2012.08.31 17:18:29 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\61e2ae11ba3d1cbe8887ea80f192e299_expire
[2012.10.22 19:56:08 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\79fb7d8c9c120c501ff74f2666f1ed76_expire
[2012.08.03 16:20:07 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\7cf04ffc65c19302872f4c23faa25a61_expire
[2012.08.31 17:18:30 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\96ca486780f97d365b7d374b46961f04_expire
[2012.08.03 16:20:08 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\9bde9efdf90ba55e6cf180b948c7e658_expire
[2012.08.31 17:18:28 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\ab78b9d1464f2721b3a46dd11838baaf_expire
[2012.08.31 17:18:28 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\c5538e5049ca9b04ad62d9a930947369_expire
[2012.08.31 17:18:27 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\c73c08546fe29ea012835721d47970c4_expire
[2012.08.24 18:33:26 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\e7215b147326809c45f6cf0952274624_expire
[2012.08.31 17:18:27 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\e919434ec29526b28593c426e4264271_expire
[2012.10.22 19:56:08 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\ee1ab4cb8e86769e288abaa46407a623_expire
[2012.08.31 17:18:27 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\f03527c67e08602d2e4c18ae7867300d_expire
[2012.08.24 18:33:24 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\fa74672918974682c82b8d91dfbe0d6b_expire
[2012.08.24 18:33:24 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\ff4d692d5e7cccbc4b3e9ef4062b1c6f_expire
[2011.06.22 13:15:18 | 000,000,931 | ---- | M] () -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\searchplugins\conduit.xml
[2012.02.08 19:54:42 | 000,001,800 | ---- | M] () -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\searchplugins\funmoods.xml
[2012.09.04 13:35:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.09.05 20:30:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.02.17 22:11:09 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011.11.23 21:20:39 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}
[2011.04.09 17:44:57 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.11 15:17:56 | 000,002,310 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2011.04.09 17:44:57 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.04.09 17:44:57 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.04.09 17:44:57 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.04.09 17:44:57 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.de/
CHR - default_search_provider: Search the web (Babylon) (Enabled)
CHR - default_search_provider: search_url = hxxp://search.babylon.com/?q={searchTerms}&AF=110000&babsrc=SP_ss&mntrId=26a5f3b60000000000004c0f6e67113a
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.de/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\pdf.dll
CHR - plugin:  (Enabled) = C:\Users\Margareth\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibgfbdggapddbjjbopabhlhianklajie\1.0.5_0\chromeNPAPI.dll
CHR - plugin: Skype Click to Call (Enabled) = C:\Users\Margareth\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.2.0.10687_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Happy Cloud Plugin (Enabled) = C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Margareth\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Java Deployment Toolkit 7.0.40.255 (Enabled) = C:\windows\SysWOW64\npDeployJava1.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\windows\system32\Adobe\Director\np32dsw.dll
CHR - Extension: YouTube = C:\Users\Margareth\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Margareth\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Skype Click to Call = C:\Users\Margareth\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.2.0.10687_0\
CHR - Extension: Google Mail = C:\Users\Margareth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No CLSID value found.
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APLangApp] C:\Program Files (x86)\AnyPC Client\APLangApp.exe (DoctorSoft)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKCU..\Run: [Google Update] "C:\Users\Margareth\AppData\Local\Google\Update\GoogleUpdate.exe" /c File not found
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Margareth\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Margareth\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Reg Error: Value error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5EA4E7F6-1118-49BB-AEC5-38655195B26B}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{63406458-B492-4731-B533-D14ACCF1F96D}: DhcpNameServer = 192.168.105.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{92D8A13D-4F94-466F-AAC1-EA1CF853EA42}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O27:64bit: - HKLM IFEO\utilman.exe: Debugger - C:\Windows\SysNative\cmd.exe (Microsoft Corporation)
O27 - HKLM IFEO\utilman.exe: Debugger - C:\Windows\SysWOW64\cmd.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{28741ccc-53df-11e1-8676-002454c19d98}\Shell - "" = AutoRun
O33 - MountPoints2\{28741ccc-53df-11e1-8676-002454c19d98}\Shell\AutoRun\command - "" = G:\INSTALL.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.28 10:48:35 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Margareth\Desktop\OTL.exe
[2012.10.27 21:10:26 | 000,000,000 | ---D | C] -- C:\Users\Margareth\Desktop\backups
[2012.10.27 20:43:16 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Margareth\Desktop\HiJackThis204.exe
[2012.10.27 19:43:58 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Roaming\Malwarebytes
[2012.10.27 19:42:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.10.27 19:42:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.10.27 19:42:32 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[2012.10.27 19:42:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.10.22 20:24:28 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.10.22 20:17:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.10.21 13:51:00 | 000,000,000 | ---D | C] -- C:\Users\Margareth\Documents\GTA San Andreas User Files
[2012.10.21 13:43:12 | 000,000,000 | ---D | C] -- C:\Users\Margareth\Desktop\fsace
[2012.10.03 20:04:13 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Roaming\TIPP10
[2012.10.03 20:04:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TIPP10
[2012.10.03 20:04:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Tipp10
[2012.10.03 14:39:32 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Roaming\MTE
[2012.10.03 14:39:10 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft Texturepack Editor
[2012.10.03 14:39:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Minecraft Texturepack Editor
[2012.10.03 14:39:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Minecraft Texturepack Editor
[2012.10.02 17:30:37 | 000,000,000 | ---D | C] -- C:\Users\Margareth\Documents\The Lord of the Rings Online
[2012.10.02 17:30:37 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Local\The Lord of the Rings Online
[2012.10.02 17:23:52 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud
[2012.10.02 17:23:50 | 000,000,000 | ---D | C] -- C:\ProgramData\HappyCloud
[2012.10.01 20:58:49 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Local\Turbine
[2012.10.01 20:58:46 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Local\ApplicationHistory
[2012.10.01 20:21:12 | 000,000,000 | ---D | C] -- C:\windows\SysWow64\URTTEMP
[2012.10.01 15:29:01 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
[6 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.28 10:48:41 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Margareth\Desktop\OTL.exe
[2012.10.28 10:48:12 | 000,000,000 | ---- | M] () -- C:\Users\Margareth\defogger_reenable
[2012.10.28 10:23:15 | 000,014,144 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.28 10:23:15 | 000,014,144 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.28 10:22:09 | 001,528,340 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2012.10.28 10:22:09 | 000,665,014 | ---- | M] () -- C:\windows\SysNative\perfh007.dat
[2012.10.28 10:22:09 | 000,625,156 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2012.10.28 10:22:09 | 000,135,150 | ---- | M] () -- C:\windows\SysNative\perfc007.dat
[2012.10.28 10:22:09 | 000,110,794 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2012.10.28 10:18:00 | 000,001,136 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1087647220-443236407-352421928-1000UA.job
[2012.10.28 10:15:25 | 000,001,112 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.10.28 10:15:13 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.10.28 10:15:08 | 4148,744,192 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.28 10:08:01 | 000,001,116 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.10.27 22:31:08 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.27 20:43:26 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Margareth\Desktop\HiJackThis204.exe
[2012.10.27 20:18:00 | 000,001,084 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1087647220-443236407-352421928-1000Core.job
[2012.10.27 16:28:14 | 000,000,572 | ---- | M] () -- C:\Users\Margareth\Desktop\gta_sa - Verknüpfung.lnk
[2012.10.22 20:17:24 | 000,002,247 | ---- | M] () -- C:\Users\Margareth\Desktop\Google Chrome.lnk
[2012.10.03 20:04:04 | 000,000,979 | ---- | M] () -- C:\Users\Margareth\Desktop\TIPP10.lnk
[2012.10.03 14:39:10 | 000,001,116 | ---- | M] () -- C:\Users\Margareth\Desktop\Minecraft Texturepack Editor.lnk
[2012.10.01 20:58:47 | 000,000,097 | ---- | M] () -- C:\Users\Margareth\AppData\Local\fusioncache.dat
[2012.10.01 20:23:36 | 001,555,638 | ---- | M] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2012.09.29 18:54:26 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[6 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.10.28 10:48:12 | 000,000,000 | ---- | C] () -- C:\Users\Margareth\defogger_reenable
[2012.10.27 20:33:48 | 000,000,392 | ---- | C] () -- C:\Users\Margareth\Desktop\Utilman-System.reg
[2012.10.27 20:33:48 | 000,000,304 | ---- | C] () -- C:\Users\Margareth\Desktop\Utilman-System entfernen.reg
[2012.10.27 19:42:37 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.27 16:28:14 | 000,000,572 | ---- | C] () -- C:\Users\Margareth\Desktop\gta_sa - Verknüpfung.lnk
[2012.10.22 20:17:24 | 000,002,247 | ---- | C] () -- C:\Users\Margareth\Desktop\Google Chrome.lnk
[2012.10.03 20:04:04 | 000,000,979 | ---- | C] () -- C:\Users\Margareth\Desktop\TIPP10.lnk
[2012.10.03 14:39:10 | 000,001,116 | ---- | C] () -- C:\Users\Margareth\Desktop\Minecraft Texturepack Editor.lnk
[2012.10.01 20:58:47 | 000,000,097 | ---- | C] () -- C:\Users\Margareth\AppData\Local\fusioncache.dat
[2012.10.01 20:21:56 | 001,555,638 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2012.06.04 20:15:49 | 000,001,487 | ---- | C] () -- C:\Users\Margareth\AppData\Local\RecConfig.xml
[2012.05.05 11:37:31 | 000,003,421 | ---- | C] () -- C:\Users\Margareth\AppData\Local\recently-used.xbel
[2011.08.26 11:45:01 | 000,004,096 | ---- | C] () -- C:\windows\d3dx.dat
[2011.02.17 22:12:01 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.02.17 20:08:15 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:30:56 | 014,165,504 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.10.25 18:54:19 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\.minecraft
[2012.06.17 22:02:43 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Audacity
[2012.02.11 15:17:51 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Babylon
[2012.02.10 20:18:07 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\DAEMON Tools Lite
[2011.07.23 21:28:27 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\DVDVideoSoft
[2011.02.17 22:16:32 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.11.16 15:46:56 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Guitar Pro 6
[2011.08.07 15:23:54 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\LEGO Company
[2012.06.21 20:41:46 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\LolClient2
[2012.02.05 00:21:27 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Minemapper
[2011.02.28 22:07:05 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Mount&Blade
[2011.12.15 19:19:41 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Mount&Blade Warband
[2011.10.07 10:45:28 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Mount&Blade With Fire and Sword
[2012.10.03 14:39:35 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\MTE
[2012.07.03 17:28:12 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Origin
[2012.01.17 22:25:45 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Screaming Bee
[2011.11.27 15:39:07 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\TeamViewer
[2012.10.03 20:05:38 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\TIPP10
[2012.08.30 22:03:22 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\TS3Client
[2012.03.14 17:25:53 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\ts3overlay
[2011.02.19 13:41:15 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Unity
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:6FB93194
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:798A3728
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:E36F5B57
@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:8530A643

< End of report >
         

Extras.txt:

OTL Extras logfile created on: 28.10.2012 10:52:13 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Margareth\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00001407 | Country: Liechtenstein | Language: DEC | Date Format: dd.MM.yyyy
 
3.86 Gb Total Physical Memory | 2.07 Gb Available Physical Memory | 53.54% Memory free
7.73 Gb Paging File | 5.28 Gb Available in Paging File | 68.31% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 225.33 Gb Total Space | 37.22 Gb Free Space | 16.52% Space Free | Partition Type: NTFS
Drive D: | 225.33 Gb Total Space | 225.24 Gb Free Space | 99.96% Space Free | Partition Type: NTFS
 
Computer Name: MARGARETH-PC | User Name: Margareth | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09D771F1-06DE-4CB9-A216-71B3A460C0EF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{0D227CED-4C3E-40DB-8123-EC3AB47112DD}" = rport=139 | protocol=6 | dir=out | app=system | 
"{0D356886-7F68-4B89-88B2-97FA1F64F200}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{16B7FB56-4436-486D-9350-33D97B7DDDE2}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{16C75EFF-CC2E-47FE-ABF9-1DD40D9A0741}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{1706B488-C0CC-4F32-977F-0B0656D21C0D}" = lport=25565 | protocol=17 | dir=in | name=minecraft server 1 | 
"{17531B1E-D06F-4777-829B-FC83C0D5C826}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{2FC38466-1A7A-4C0B-8112-C22FEF180C8A}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{42162787-F4C3-4494-AC49-49A02F388AFF}" = lport=138 | protocol=17 | dir=in | app=system | 
"{45B6635C-7FAD-469F-BE30-C9F941B3E281}" = rport=137 | protocol=17 | dir=out | app=system | 
"{4C0252F9-8735-4926-991F-6B762C618058}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{52F7F83B-FC6A-40AC-B723-9F2CC338C9C7}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{56968EE8-F120-4555-8A73-1907E24A4815}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{5C7423B8-BC9D-4D99-838F-87E1F64890D3}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{5CA4E214-61C0-491E-9AD7-8B87A570F448}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{67A41746-2F07-4CA3-B793-CA2F409DC932}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{6A3CC717-FA15-4443-AD04-727FE8994021}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{6B706B23-174A-49E8-8956-5FABCD984847}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{6B907028-FCF9-4E77-89F3-2E12684BAEEF}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{726036DF-6209-4C61-98BE-A7F506C499FD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{728C1BBA-20F7-4214-8FE6-7F2B45A8B300}" = rport=445 | protocol=6 | dir=out | app=system | 
"{73A2686E-A87C-4E32-9787-201488B370B9}" = lport=25565 | protocol=6 | dir=in | name=minecraft_server | 
"{74E85873-6A1C-44CA-95A7-4DF6EA03EFDA}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{820C5540-5392-4A13-B9A8-879EC35D0D59}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{82529585-402D-4446-8120-A3206A8ABBC2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{8572AE83-8BC4-4636-95BF-9DB636364A1B}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe | 
"{85A336E0-EFE7-453C-9A6B-4D42C44EED6D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{86FD0180-32A7-4BB1-B5D1-46F6B6088801}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{888C9FB1-7C15-4671-9342-963E1D1588A1}" = lport=25565 | protocol=17 | dir=in | name=minecraft_server1 | 
"{9DF5C29C-0BFC-4551-AE28-0831E2C94B46}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{A5CD5EED-EADE-489E-A183-AF81391FF4C9}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{B0A83FBA-011E-46F9-9796-0E6A02952E3A}" = lport=445 | protocol=6 | dir=in | app=system | 
"{B44CCA61-4134-4638-BAF2-DAA5F8DBA84D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{B5B7DFAF-A215-470D-AA6D-F893DDB57291}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{B86997BA-7193-4246-92CD-F3BB47CE1144}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{B8725EAF-F639-47D0-AF2B-74525BBC9D86}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{C27AF3C7-E26A-4447-9512-68032488077D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C41AB00C-D58B-4045-87D6-46DE8774BE91}" = lport=139 | protocol=6 | dir=in | app=system | 
"{C5B749FC-6FDB-41C7-8A32-A410C9BB2F70}" = lport=137 | protocol=17 | dir=in | app=system | 
"{CB799D32-7AAF-4DF9-9D57-A313E63A97A0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{D1F354FC-AF16-4136-BDBE-BAF60667306E}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{DAE6F264-3FB0-4563-89CA-EA326068FB42}" = rport=138 | protocol=17 | dir=out | app=system | 
"{ED1BC11E-85D9-4DA2-9E59-E44297404E0A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{F1772043-DA60-41B9-B859-C0B8FACB4191}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{F2B38E23-A803-433F-A8C4-6CC1CCA5EF90}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{081F8FB3-7D2E-4116-A209-450CD02BB6A3}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mountblade warband\mb_warband.exe | 
"{0AEA0A7C-1E17-4DC7-AB01-45844F445284}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe | 
"{1279EC52-87F7-49BC-B690-C24C5E3024FF}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{16819A63-044C-4ACF-B1A9-8F6FC7F2EAC2}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{18BD60BA-DF0F-4720-9DB7-FC62F3C6EDD0}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mountblade warband\mb_warband.exe | 
"{1C0EC85B-4037-4D13-86B2-D60E2930C114}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{1FD0F53E-D34B-47F1-B03D-34D071FB49C9}" = protocol=58 | dir=in | app=system | 
"{21FFED53-C485-478F-A8B3-36106D7E9120}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{22C77A34-8056-4F08-8B8D-452E924EB0F8}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mountblade warband\mb_warband.exe | 
"{24AFC90D-12F3-485E-A3C2-E97F9164E1A1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{3911C9DC-2AC6-42B8-9F17-3BEB956A60A5}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\lord of the rings online\turbineinvoker.exe | 
"{3DEFB91B-BF59-45CE-88B4-CCEDB865487D}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{41D8AA01-BA03-44CE-BAAF-70C4FD7CD37F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\lord of the rings online\turbineinvoker.exe | 
"{46323FE0-9940-44FF-96CD-1225217E6902}" = protocol=6 | dir=out | app=system | 
"{46B02F0B-8AF9-401C-BBC2-9B63E4156FE7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{4B3C933C-C57C-4C27-A756-684A21836CA5}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mount & blade with fire and sword\mb_wfas.exe | 
"{51A179CD-D24F-4C60-828E-29F1B79A2EE2}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{53FAC91C-9173-4001-8E67-8B45D039CB0D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{5D48C1C7-70C7-49E9-A483-68ED08478795}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{6C68C274-0782-4955-BD22-54FD6BE67DBE}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{6CDA8567-1BF8-4318-ACDB-59439AD4040C}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{6F17A09C-31AC-41A1-925E-85005000FCF1}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe | 
"{72CF875C-1B15-4EDF-BE69-00016678DE7C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{738F1BFB-3567-4EAE-ACE7-836FAB99E744}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 
"{76C61C53-80A2-4E61-A3F8-BD4958139D47}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{7BEAB1CD-780B-4253-B417-0C0F7444EF6A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{8110C62E-8438-4020-9B9D-64E1E9907B2A}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{8801B9B7-7901-4072-9FBA-8126ADF35F33}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{88F9B3FA-3C4D-41E0-A2AB-F27CC67B39F5}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{8C26345A-2855-41D5-A0DC-49B974D5623E}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 
"{8CF7CCB8-5C8B-4EC9-B5A5-B4FBB04A4B07}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{91F59BF1-F955-4D9B-982B-157116D0CEAA}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mount & blade with fire and sword\mb_wfas.exe | 
"{A12D49A9-759E-4DA8-8B8B-CFFD5B10ED91}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{A1AAFA39-4774-4994-814C-5B830FCAF600}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{A26D4712-4981-4F9C-8B35-0698D98BBBC5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{B6008E78-55B0-440F-95F4-D3EB5FB095FE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{BB710319-5E67-4AD5-B083-9384889DE22B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mountblade warband\mb_warband.exe | 
"{BC57A43A-94B5-4C86-B8F0-A433A6009BCD}" = protocol=6 | dir=in | app=c:\users\margareth\desktop\terraria 1.1.2\terrariaserver.exe | 
"{BE4E0C01-5788-4ABB-B4C3-D361149E3D2D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{C20E181A-73C5-438D-B49F-9F4DDE8DCD09}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | 
"{C2C94DE6-8D10-4ED0-BC23-2987592804DF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{D77FD254-D975-49D5-8B2A-92C521D5B172}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe | 
"{D9B2993A-D986-4214-9FB0-09240A118FFF}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe | 
"{DBAE2C39-4439-4959-A576-D1A46047B700}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{F043997A-D643-496A-8B3C-BCC7A6F2C88C}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{F19DBBEC-6923-4B88-BE58-74DC0A0FB870}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{F411B29C-C4BD-4047-AFAE-E806B9C5FB01}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{F78BDBD9-65D8-4F6A-BDAB-DD522B5BEB50}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{FA1C62FC-0759-4D59-85DF-9AB7727969C0}" = protocol=17 | dir=in | app=c:\users\margareth\desktop\terraria 1.1.2\terrariaserver.exe | 
"{FAFC6FFB-2033-467C-9623-8C5E5F52B5AC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{FB5A713B-E128-4273-A299-1DCABEC9166A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{FDE0727D-DD74-47DB-9F4A-5F3BE377B77C}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 | 
"TCP Query User{33E4389F-E749-4D34-9330-24BA1770C44D}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"TCP Query User{3A3B2A95-7EBB-4D50-B4FC-3644D576EBB8}C:\users\margareth\desktop\terraria 1.1.2\terrariaserver.exe" = protocol=6 | dir=in | app=c:\users\margareth\desktop\terraria 1.1.2\terrariaserver.exe | 
"TCP Query User{68901C89-1533-4D3F-85B4-F0630EECA631}C:\program files (x86)\steam\steamapps\common\lord of the rings online\lotroclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\lord of the rings online\lotroclient.exe | 
"TCP Query User{D2CA81DF-CBC3-4CDE-B8B5-48385CAC5860}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"UDP Query User{02B94005-94EB-4E0E-852D-7F4627543C1D}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"UDP Query User{1E252867-7A01-47BF-8DE4-537B1FA4FD51}C:\users\margareth\desktop\terraria 1.1.2\terrariaserver.exe" = protocol=17 | dir=in | app=c:\users\margareth\desktop\terraria 1.1.2\terrariaserver.exe | 
"UDP Query User{8117B771-34E3-4E98-88E3-8E8AF8F67395}C:\program files (x86)\steam\steamapps\common\lord of the rings online\lotroclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\lord of the rings online\lotroclient.exe | 
"UDP Query User{A4351C0A-5603-40E9-A32D-0844177E3E5F}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP3500_series" = Canon iP3500 series
"{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}" = iTunes
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86417005FF}" = Java(TM) 7 Update 5 (64-bit)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}" = Apple Mobile Device Support
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{F0A36649-873E-4832-A5F1-BF5DF8600BDB}" = Windows Live Family Safety
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"GIMP-2_is1" = GIMP 2.8.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR 4.01 (64-bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0A353130-D22C-41DD-8C67-1B02A05F2CE0}" = Samsung Support Center
"{0F796312-289C-40CA-856C-9FBCF5E83342}" = REALTEK Wireless LAN Software
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution 4
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}" = EasyBatteryManager
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1AFA1FEF-8CF9-4A51-AC46-64FAA7F3D9E2}" = AnyPC Client
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{34B76DCB-BF7C-440F-B058-C84172C1E338}" = Easy Network Manager
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3EED7541-55F8-4DC6-B9CD-28762D71310E}" = Samsung R-Series
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}" = BatteryLifeExtender
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUSR_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{B8ABD8C7-991E-4A70-B5A3-20C6FC680680}" = LogMeIn Hamachi
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D1434266-0486-4469-B338-A60082CC04E1}" = Atheros Client Installation Program
"{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}" = Samsung Update Plus
"{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}" = Intel(R) Turbo Boost Technology Driver
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"12bbe590-c890-11d9-9669-0800200c9a66_is1" = The Lord of the Rings Online™ v03.07.01.8015
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon iP3500 series Benutzerregistrierung" = Canon iP3500 series Benutzerregistrierung
"CANONIJPLM100" = PIXMA Extended Survey Program
"Fraps" = Fraps (remove only)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.5.722
"Google Chrome" = Google Chrome
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Marvell Miniport Driver" = Marvell Miniport Driver
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Minecraft Texturepack Editor" = Minecraft Texturepack Editor
"Mount&Blade" = Mount&Blade
"Mozilla Firefox (3.6.20)" = Mozilla Firefox (3.6.20)
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"Revo Uninstaller" = Revo Uninstaller 1.93
"Steam App 212500" = The Lord of the Rings Online™
"Steam App 48700" = Mount & Blade: Warband
"Steam App 48720" = Mount & Blade: With Fire and Sword
"TeamViewer 7" = TeamViewer 7
"TIPP10_is1" = TIPP10 Version 2.1.0
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.7
"WinLiveSuite_Wave3" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"HappyCloud" = Happy Cloud Client
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"UnityWebPlayer" = Unity Web Player
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 12.04.2012 09:12:45 | Computer Name = Margareth-PC | Source = Bonjour Service | ID = 100
Description = DNS Message from «ZERO ADDRESS»:0 to «ZERO ADDRESS»:0 length 0
 too short
 
Error - 12.04.2012 09:32:25 | Computer Name = Margareth-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 12.04.2012 09:32:25 | Computer Name = Margareth-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1139
 
Error - 12.04.2012 09:32:25 | Computer Name = Margareth-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1139
 
Error - 12.04.2012 09:32:26 | Computer Name = Margareth-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 12.04.2012 09:32:26 | Computer Name = Margareth-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2153
 
Error - 12.04.2012 09:32:26 | Computer Name = Margareth-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2153
 
Error - 12.04.2012 15:11:35 | Computer Name = Margareth-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16421,
 Zeitstempel: 0x4d76255d  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0xf4977fd9  ID des fehlerhaften
 Prozesses: 0x2434  Startzeit der fehlerhaften Anwendung: 0x01cd18dd0055ae83  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe  Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: 52124eaf-84d3-11e1-9af7-8a7c5ddd869b
 
Error - 13.04.2012 16:33:04 | Computer Name = Margareth-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16421,
 Zeitstempel: 0x4d76255d  Name des fehlerhaften Moduls: Flash10x.ocx, Version: 10.3.183.10,
 Zeitstempel: 0x4e764622  Ausnahmecode: 0xc0000005  Fehleroffset: 0x002b00e0  ID des fehlerhaften
 Prozesses: 0x2da0  Startzeit der fehlerhaften Anwendung: 0x01cd19b11b35a742  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe  Pfad
 des fehlerhaften Moduls: C:\windows\SysWOW64\Macromed\Flash\Flash10x.ocx  Berichtskennung:
 de16a4a9-85a7-11e1-9c16-8ebeeb3e5995
 
Error - 14.04.2012 04:26:06 | Computer Name = Margareth-PC | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
 (x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
 "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile  8.  Die 
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
 überein.  Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
 WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".  Verwenden Sie
 das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 
[ System Events ]
Error - 27.10.2012 17:25:33 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 27.10.2012 18:15:17 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 27.10.2012 18:15:21 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 30013
Description = 
 
Error - 28.10.2012 04:46:41 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 34001
Description = 
 
Error - 28.10.2012 04:46:41 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 30013
Description = 
 
Error - 28.10.2012 04:47:52 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 28.10.2012 04:47:53 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 28.10.2012 04:59:13 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 28.10.2012 05:16:53 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 34001
Description = 
 
Error - 28.10.2012 05:16:53 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 30013
Description = 
 
 
< End of report >
         

Meine letztendliche Frage ist, ob der Virus/Wurm/Trojaner von meinem PC gelöscht ist, oder ob ich noch etwas tun muss.
Ich entschuldige mich noch einmal, falls ich etwas vergessen oder voreilige Schlüsse gezogen habe. Ich (14, weiblich) kann nicht von mir sagen, dass ich mich besonders gut auskenne, ich wollte ihn nur so schnell wie möglich loswerden.

Danke für die Hilfe!

Es reicht mir nur die Frage, ob ich ihn noch habe oder nicht.. Wenn möglich, bitte bald. Ich müsste mich nämlich bei einer Seite einloggen, aber mit der Angst, dass die "Macher" das Passwort herauskriegen, traue ich mich nicht ...

C:\Users\Margareth\Desktop\Terraria 1.1.2\TDU.exe

Was soll das genau sein? Aus welcher Quelle?

Was genau meinst du damit? Das ist ein Spiel, anscheinend war da eine infizierte Datei.

Was genau meinst du damit?

Steht doch in meiner Frage
Was genau für eine Spiel nd mit Quelle ist die Herkunft gemeint
Oder ist das für dich selbstverständlich, dass in einem Spiel offensichtlich malware steckt?

Nein, für mich ist das nicht selbstverständlich. Es ist ein Spiel das Minecraft sehr ähnelt, ich kann dir aber nicht sagen woher ich es habe, da ich nicht mehr weiß wo ich es gedownloadet habe.
Das ist momentan aber auch nicht wirklich das, was mich interessiert. Ich will mehr wissen ob dieser Skype-Wurm noch auf meiner Festplatte ist, oder ob ich beruhigt meinen Alltag aufnehmen kann ...

Das ist momentan aber auch nicht wirklich das, was mich interessiert

Ich seh da einen kräftigen Widerspruch. Du postest hier weil du offensichtlich Schdälingsbefall hast, ich geh dem nach in einer womöglichen infizierten Spieledatei und will das klären aber das interessiert dich nicht. Ist dir das völlig egal oder was?

C:\Users\Margareth\Desktop\Terraria 1.1.2\TDU.exe
         

Bitte diese Datei bei Virustotal auswerten lassen und den Ergebnislink posten. Falls Du die Datei nicht siehst, musst Du sie evtl. vorher sichtbar machen.
Wenn die Datei schon ausgewertet sein sollte, bitte eine weitere Auswertung starten.

Ich konnte diese Datei nicht sehen, hab alles gemacht um sie sichtbar zu machen, kann sie jetzt aber immer noch nicht sehen.

Und noch eine Frage: Was ist dieses PUP:Blabbers ?

Na sicher weil MBAM die in die Q gesteckt hat - du musst sie vorher aus der Quarantäne von MBAM wieder rausholen

Und PUP bedeutet potentiell ungewolltes Programm

https://www.virustotal.com/file/c339f14d7980375e12b92e501e612e0102d2d0ba34e0d21200130d335e703602/analysis/

Das Teil ist ein Crack

Sry aber bei illegaler Software gibt es hier nur noch Hilfe zur Datensicherung + Neuinstallation von Windows

Siehe auch => http://www.trojaner-board.de/95393-c...-software.html

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support ohne jegliche Diskussion beenden.

Cracks/Keygens sind zu 99,9% gefährliche Schädlinge, mit denen man nicht spaßen sollte. Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf Anleitung zur kompletten Neuinstallation!!

Dass illegale Cracks und Keygens im Wesentlichen dazu dienen, Malware zu verbreiten ist kein Geheimnis und muss jedem klar sein!


In Zukunft Finger weg von: Softonic, Registry-Bereinigern und illegalem Zeugs Cracks/Keygens/Serials

Also könnt ihr/du mir auch nicht bei diesem Skype-Wurm helfen?
Und zu dieser Datei. Kann/soll ich sie wieder in die Quarantäne verschieben? Und die ganze Quarantäne auch löschen oder sie so lassen?

Hast du meinen Beitrag nicht gelesen? Du sollst dein System neuaufsetzen
Da ist es völlig egal ob die die Datei jetzt löscht oder nicht

Wenn ich aber jetzt meine Daten sichere, kann es dann nicht sein, dass ich Daten mitsichere die infiziert sind? Wie gesagt, ich kenne mich hier nicht aus ...

Wird mal ein Blick auf meine Signatur, da ist ein Link zu einem Artikel => http://www.trojaner-board.de/82533-d...ted-magic.html