Hey Leute,

seit 2 Tagen lädt mein PC nur noch ganz langsam. Beim Hochfahren gehts noch gut, doch sobald er im Windows ist, passiert alles nur noch im Schnecknetempo.
Ich habe meinen PC ordentlich defragmentiert, seitdem ist es auch ein wenig besser geworden. Wenn ich ein neues Programm starte, braucht der PC lange, um es auszuführen. Wenn das Programm mal geladen ist, gehts eigentlich. Spiele kann ich auch ruckelfrei spielen, wenn das Programm mal geladen hat. Der Ping ist 1A.
Firefox funktioniert besonders langsam. Ist eine Internetseite mal geladen, gehts. Besonders langsam ist der Internetexplorer. Bis ich damit mal in meinem Postfach bin, vergehen schon mal 1 oder 2 Zigarettenpausen. Auch das Verschieben von Dateien von einer Festplatte auf die andere oder auf eine mobile Festplatte ist merklich langsamer.
Alle unnützen Programme habe ich bereits deinstalliert und habe schon alle möglichen Programme drüber laufen lassen: Antivir, CCleaner, Spybot, TuneUp, aber hat nichts ergeben.
Hier der HiJack-This-Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:56:50, on 23.09.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\explorer.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Mozilla Firefox 4.0 Beta 6\firefox.exe
C:\Users\Chris\Downloads\HJT.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.arcor.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.arcor.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.arcor.de
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arcor AG & Co. KG
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Setfla] C:\Users\Chris\AppData\Roaming\Adobe\Update\hlpcli.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix: 
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software GmbH - C:\Windows\System32\TUProgSt.exe
O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe

--
End of file - 6073 bytes
         

Vielen Dank im Vorraus

1. deinstaliere spybot, starte neu.
2.
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Wow... scheint funktioniert zu haben. Der Rechner ist wieder merklich schneller...

Vielen Dank

ComboFix 10-09-22.06 - ***** 23.09.2010  19:46:32.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2046.923 [GMT 2:00]
ausgefьhrt von:: c:\users\*****\Downloads\ComboFix.exe
SP: Avira AntiVir PersonalEdition *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Windows-Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Weitere Lцschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\*****\AppData\Roaming\Helper\bin\liveu.exe
c:\users\*****\AppData\Roaming\inst.exe
c:\windows\system32\lsprst7.dll

.
(((((((((((((((((((((((   Dateien erstellt von 2010-08-23 bis 2010-09-23  ))))))))))))))))))))))))))))))
.

2010-09-23 08:47 . 2010-09-23 08:47	--------	d-----w-	c:\users\*****\AppData\Roaming\Malwarebytes
2010-09-23 08:47 . 2010-04-29 10:19	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-23 08:47 . 2010-09-23 08:47	--------	d-----w-	c:\programdata\Malwarebytes
2010-09-23 08:47 . 2010-04-29 10:19	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-09-23 08:47 . 2010-09-23 08:47	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-09-23 01:21 . 2010-09-23 01:21	--------	d-----w-	c:\program files\Windows Portable Devices
2010-09-23 01:03 . 2009-10-01 01:02	30208	----a-w-	c:\windows\system32\WPDShextAutoplay.exe
2010-09-23 01:03 . 2009-10-01 01:02	31232	----a-w-	c:\windows\system32\BthMtpContextHandler.dll
2010-09-23 01:03 . 2009-10-01 01:01	81920	----a-w-	c:\windows\system32\wpdbusenum.dll
2010-09-23 01:03 . 2009-10-01 01:01	60928	----a-w-	c:\windows\system32\PortableDeviceConnectApi.dll
2010-09-23 01:03 . 2009-10-01 01:02	2537472	----a-w-	c:\windows\system32\wpdshext.dll
2010-09-23 01:03 . 2009-10-01 01:02	334848	----a-w-	c:\windows\system32\PortableDeviceApi.dll
2010-09-23 01:03 . 2009-10-01 01:02	87552	----a-w-	c:\windows\system32\WPDShServiceObj.dll
2010-09-23 01:03 . 2009-10-01 01:01	546816	----a-w-	c:\windows\system32\wpd_ci.dll
2010-09-23 01:03 . 2009-10-01 01:01	160256	----a-w-	c:\windows\system32\PortableDeviceTypes.dll
2010-09-23 01:03 . 2009-10-01 01:01	350208	----a-w-	c:\windows\system32\WPDSp.dll
2010-09-23 01:03 . 2009-10-01 01:01	196608	----a-w-	c:\windows\system32\PortableDeviceWMDRM.dll
2010-09-23 01:03 . 2009-10-01 01:01	100864	----a-w-	c:\windows\system32\PortableDeviceClassExtension.dll
2010-09-23 01:02 . 2009-10-08 21:08	555520	----a-w-	c:\windows\system32\UIAutomationCore.dll
2010-09-23 01:02 . 2009-10-08 21:08	234496	----a-w-	c:\windows\system32\oleacc.dll
2010-09-23 01:02 . 2009-10-08 21:07	4096	----a-w-	c:\windows\system32\oleaccrc.dll
2010-09-22 16:14 . 2010-09-22 16:14	47876	----a-w-	c:\programdata\Blizzard Entertainment\Battle.net\Cache\Download\Scan.dll
2010-09-22 11:42 . 2010-09-22 11:43	--------	d-----w-	c:\program files\CCleaner
2010-09-22 11:18 . 2010-09-23 13:08	286208	----a-w-	c:\users\*****\AppData\Roaming\Adobe\Update\hlpcli.exe
2010-09-22 10:10 . 2010-09-22 10:11	--------	d-----w-	c:\windows\system32\ca-ES
2010-09-22 10:10 . 2010-09-22 10:11	--------	d-----w-	c:\windows\system32\eu-ES
2010-09-22 10:10 . 2010-09-22 10:11	--------	d-----w-	c:\windows\system32\vi-VN
2010-09-21 21:49 . 2010-09-21 21:49	--------	d-----w-	c:\program files\Mozilla Firefox 4.0 Beta 6
2010-09-21 19:21 . 2010-09-23 17:21	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2010-09-21 19:21 . 2010-09-23 17:21	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2010-09-21 12:31 . 2010-09-21 12:31	--------	d-----w-	c:\users\Chris\AppData\Roaming\Helper
2010-09-14 23:06 . 2010-04-05 17:02	317952	----a-w-	c:\windows\system32\MP4SDECD.DLL
2010-09-14 23:06 . 2010-08-17 14:11	128000	----a-w-	c:\windows\system32\spoolsv.exe
2010-09-14 23:06 . 2010-04-16 16:46	502272	----a-w-	c:\windows\system32\usp10.dll
2010-09-14 23:06 . 2010-05-27 20:08	739328	----a-w-	c:\windows\system32\inetcomm.dll
2010-09-10 12:10 . 2010-08-18 15:12	52224	----a-w-	c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
2010-09-10 12:10 . 2010-08-18 15:12	101376	----a-w-	c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
2010-08-25 15:34 . 2009-04-11 05:03	12240896	----a-w-	c:\windows\system32\NlsLexicons0007.dll
2010-08-25 15:34 . 2009-04-11 06:28	1081344	----a-w-	c:\windows\system32\SLCExt.dll
2010-08-25 15:34 . 2009-04-11 06:27	3408896	----a-w-	c:\windows\system32\SLsvc.exe
2010-08-25 15:34 . 2009-04-11 06:28	2134528	----a-w-	c:\windows\system32\FunctionDiscoveryFolder.dll
2010-08-25 15:34 . 2009-04-11 06:27	65536	----a-w-	c:\windows\system32\DevicePairingWizard.exe
2010-08-25 15:34 . 2009-04-11 05:03	2644480	----a-w-	c:\windows\system32\NlsLexicons0009.dll
2010-08-25 15:32 . 2009-04-11 06:28	287744	----a-w-	c:\windows\system32\Wldap32.dll
2010-08-25 15:31 . 2009-04-11 05:42	93696	----a-w-	c:\windows\system32\drivers\bridge.sys
2010-08-25 15:31 . 2009-04-11 04:46	41472	----a-w-	c:\windows\system32\drivers\raspppoe.sys
2010-08-25 15:31 . 2009-04-11 04:46	15872	----a-w-	c:\windows\system32\drivers\usb8023.sys
2010-08-25 15:31 . 2009-04-11 06:22	7168	----a-w-	c:\windows\system32\f3ahvoas.dll
2010-08-25 15:31 . 2009-04-11 04:27	2560	----a-w-	c:\windows\system32\msimsg.dll
2010-08-25 15:31 . 2009-04-11 06:28	83968	----a-w-	c:\windows\system32\wbem\wmiutils.dll
2010-08-25 15:31 . 2009-04-11 06:28	30208	----a-w-	c:\windows\system32\wbem\wbemprox.dll
2010-08-25 15:31 . 2009-04-11 06:28	189440	----a-w-	c:\windows\system32\wbem\mofd.dll
2010-08-25 15:31 . 2009-04-11 06:28	744448	----a-w-	c:\windows\system32\wbem\wbemcore.dll
2010-08-25 15:31 . 2009-04-11 06:28	265728	----a-w-	c:\windows\system32\wbem\repdrvfs.dll
2010-08-25 15:31 . 2009-04-11 06:28	614912	----a-w-	c:\windows\system32\wbem\fastprox.dll
2010-08-25 15:31 . 2009-04-11 06:28	265728	----a-w-	c:\windows\system32\wbem\esscli.dll
2010-08-25 15:30 . 2009-04-11 06:28	705536	----a-w-	c:\windows\system32\SmiEngine.dll
2010-08-25 15:30 . 2009-04-11 06:28	218624	----a-w-	c:\windows\system32\wdscore.dll
2010-08-25 15:30 . 2009-04-11 06:27	130560	----a-w-	c:\windows\system32\PkgMgr.exe
2010-08-25 15:29 . 2009-04-11 06:28	247808	----a-w-	c:\windows\system32\drvstore.dll

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-23 17:26 . 2009-12-19 11:36	135807	----a-w-	c:\programdata\nvModes.dat
2010-09-23 09:39 . 2010-07-29 13:35	--------	d-----w-	c:\program files\DVDVideoSoftTB
2010-09-23 01:32 . 2007-02-27 09:55	654650	----a-w-	c:\windows\system32\perfh007.dat
2010-09-23 01:32 . 2007-02-27 09:55	137000	----a-w-	c:\windows\system32\perfc007.dat
2010-09-23 01:21 . 2006-11-02 10:25	665600	----a-w-	c:\windows\inf\drvindex.dat
2010-09-23 01:20 . 2010-09-23 01:20	0	---ha-w-	c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-09-22 22:28 . 2008-07-31 09:32	--------	d-----w-	c:\program files\Microsoft Silverlight
2010-09-22 13:36 . 2007-02-27 01:17	118904	----a-w-	c:\users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2010-09-22 11:59 . 2008-08-07 17:55	--------	d-----r-	c:\program files\Skype
2010-09-22 11:57 . 2007-09-09 12:32	--------	d-----w-	c:\program files\Movie DVD Maker
2010-09-22 11:57 . 2007-02-27 02:39	--------	d-----w-	c:\program files\Microsoft Works
2010-09-22 11:54 . 2010-04-20 23:59	--------	d-----w-	c:\program files\Common Files\DVDVideoSoft
2010-09-22 11:53 . 2008-12-27 15:31	--------	d-----w-	c:\program files\VSO
2010-09-22 11:52 . 2008-12-27 15:31	--------	d-----w-	c:\users\*****\AppData\Roaming\Vso
2010-09-22 11:52 . 2008-12-27 15:31	47360	----a-w-	c:\users\*****\AppData\Roaming\pcouffin.sys
2010-09-22 11:52 . 2008-12-27 15:31	47360	----a-w-	c:\users\*****\AppData\Roaming\pcouffin.sys
2010-09-22 11:49 . 2009-08-25 19:40	--------	d-----w-	c:\program files\Algodoo Phun Edition
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Calendar
2010-09-22 10:12 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Sidebar
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Journal
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Collaboration
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Photo Gallery
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Defender
2010-09-21 21:30 . 2010-04-20 23:59	--------	d-----w-	c:\program files\DVDVideoSoft
2010-09-21 20:33 . 2007-07-01 10:07	--------	d-----w-	c:\program files\BearShare
2010-09-21 19:28 . 2010-05-19 16:47	--------	d-----w-	c:\program files\TeamSpeak 3 Client
2010-09-21 17:57 . 2008-06-30 22:16	--------	d-----w-	c:\users\*****\AppData\Roaming\ICQ
2010-09-15 01:05 . 2007-08-01 10:13	--------	d-----w-	c:\programdata\Microsoft Help
2010-09-11 13:28 . 2009-03-24 15:58	--------	d-----w-	c:\users\*****\AppData\Roaming\teamspeak2
2010-08-23 10:56 . 2007-02-28 15:33	--------	d-----w-	c:\users\*****\AppData\Roaming\dvdcss
2010-08-13 01:03 . 2007-07-15 11:04	--------	d-----w-	c:\program files\Movie Maker 2.6
2010-08-12 15:52 . 2010-08-12 15:52	4	----a-w-	C:\cache.dat
2010-08-06 07:21 . 2007-06-06 22:54	--------	d-----w-	c:\program files\Common Files\Blizzard Entertainment
2010-08-05 14:28 . 2010-02-08 14:29	--------	d-----w-	c:\program files\No23 Recorder
2010-07-29 13:35 . 2008-08-08 07:58	--------	d-----w-	c:\program files\Conduit
2010-07-29 13:35 . 2010-07-29 13:35	--------	d-----w-	c:\users\*****\AppData\Roaming\DVDVideoSoftIEHelpers
2010-07-27 08:38 . 2010-07-27 08:14	--------	d-----w-	c:\programdata\Blizzard Entertainment
2010-07-24 13:19 . 2010-07-24 13:19	2560	----a-w-	c:\windows\_MSRSTRT.EXE
2010-07-06 19:35 . 2010-07-06 19:34	14566424	----a-w-	c:\windows\system32\vlc-0.9.4-win32.exe
2010-06-29 15:47 . 2010-08-12 04:00	834048	----a-w-	c:\windows\system32\wininet.dll
2010-06-28 16:13 . 2010-08-12 04:00	78336	----a-w-	c:\windows\system32\ieencode.dll
2007-11-18 10:25 . 2007-11-18 10:25	16	---ha-w-	c:\program files\mxfilerelatedcache.mxc2
2000-05-15 14:50 . 2000-04-10 10:31	21473	----a-w-	c:\program files\Update.txt
2000-04-04 15:16 . 2000-04-10 10:33	27494	----a-w-	c:\program files\Troubleshooting.htm
2000-04-04 15:16 . 2000-04-10 10:31	54272	----a-w-	c:\program files\Troubleshooting.doc
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrдge & legitime Standardeintrдge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Setfla"="c:\users\*****\AppData\Roaming\Adobe\Update\hlpcli.exe" [2010-09-23 286208]
"eMuleAutoStart"="c:\program files\eMule\emule.exe" [2009-02-22 5668864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 4186112]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Setfla]
2010-09-23 13:08	286208	----a-w-	c:\users\Chris\AppData\Roaming\Adobe\Update\hlpcli.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
"ICQ"="c:\program files\ICQ6.5\ICQ.exe" silent
"ehTray.exe"=c:\windows\ehome\ehTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe"
"PDFPrint"="c:\program files\pdf24\PDFBackend.exe"
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe"  -osboot
"WinampAgent"="c:\program files\Winamp\winampa.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 554352]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2007-03-14 639224]
R4 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 544768]
S2 ACEDRV09;ACEDRV09;c:\windows\system32\drivers\ACEDRV09.sys [2007-09-09 110304]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2008-07-04 14336]
S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2006-11-17 13976]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners

2010-09-23 c:\windows\Tasks\1-Klick-Wartung.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-07 10:49]
.
.
------- Zusдtzlicher Suchlauf -------
.
mStart Page = hxxp://www.arcor.de
mWindow Title = Arcor AG & Co. KG
IE: Easy-WebPrint - Zu Druckliste hinzufugen
IE: Easy-WebPrint - Zu Druckliste hinzufugen - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Save YouTube Video
IE: Save YouTube Video as MP3
FF - ProfilePath - c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\0hkidv9q.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.spiegel.de/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=
FF - component: c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
FF - component: c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - Entfernte verwaiste Registrierungseintrдge - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)
HKCU-Run-Helper - c:\users\*****\AppData\Roaming\Helper\bin\liveu.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-23 19:54
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteintrдge... 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2010-09-23  19:57:23
ComboFix-quarantined-files.txt  2010-09-23 17:57

Vor Suchlauf: 22 Verzeichnis(se), 97.007.718.400 Bytes frei
Nach Suchlauf: 27 Verzeichnis(se), 96.928.878.592 Bytes frei

- - End Of File - - 65262100394E5BE50AD3AC8188B27DEE
         

der schein trügt
Start programme zubehör editor, kopiere rein

Killall::
Rootkit::
c:\users\*****\AppData\Roaming\Adobe\Update\hlpcli.exe
Folder::
c:\users\*****\AppData\Roaming\Helper


Datei speichern unter, typ alle dateien, ort, dort wo sich combofix.exe befindet. name
cfscript.txt
ziehe cfscript auf combofix. programm startet, log posten.
den avira guard deaktiviert lassen, öffne mein computer, c: qoobox, dort rechtsklick auf quarantain und zu quarantain.rar oder zip hinzufügen, archiv hochladen.
http://www.trojaner-board.de/54791-a...ner-board.html

ComboFix 10-09-23.01 - Chris 23.09.2010  20:59:23.2.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2046.1079 [GMT 2:00]
ausgefьhrt von:: c:\users\*****\Downloads\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\*****\Downloads\cfscript.txt
SP: Avira AntiVir PersonalEdition *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Windows-Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Weitere Lцschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Chris\AppData\Roaming\Helper

.
(((((((((((((((((((((((   Dateien erstellt von 2010-08-23 bis 2010-09-23  ))))))))))))))))))))))))))))))
.

2010-09-23 08:47 . 2010-09-23 08:47	--------	d-----w-	c:\users\*****\AppData\Roaming\Malwarebytes
2010-09-23 08:47 . 2010-04-29 10:19	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-23 08:47 . 2010-09-23 08:47	--------	d-----w-	c:\programdata\Malwarebytes
2010-09-23 08:47 . 2010-04-29 10:19	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-09-23 08:47 . 2010-09-23 08:47	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-09-23 01:21 . 2010-09-23 01:21	--------	d-----w-	c:\program files\Windows Portable Devices
2010-09-23 01:03 . 2009-10-01 01:02	30208	----a-w-	c:\windows\system32\WPDShextAutoplay.exe
2010-09-23 01:03 . 2009-10-01 01:02	31232	----a-w-	c:\windows\system32\BthMtpContextHandler.dll
2010-09-23 01:03 . 2009-10-01 01:01	81920	----a-w-	c:\windows\system32\wpdbusenum.dll
2010-09-23 01:03 . 2009-10-01 01:01	60928	----a-w-	c:\windows\system32\PortableDeviceConnectApi.dll
2010-09-23 01:03 . 2009-10-01 01:02	2537472	----a-w-	c:\windows\system32\wpdshext.dll
2010-09-23 01:03 . 2009-10-01 01:02	334848	----a-w-	c:\windows\system32\PortableDeviceApi.dll
2010-09-23 01:03 . 2009-10-01 01:02	87552	----a-w-	c:\windows\system32\WPDShServiceObj.dll
2010-09-23 01:03 . 2009-10-01 01:01	546816	----a-w-	c:\windows\system32\wpd_ci.dll
2010-09-23 01:03 . 2009-10-01 01:01	160256	----a-w-	c:\windows\system32\PortableDeviceTypes.dll
2010-09-23 01:03 . 2009-10-01 01:01	350208	----a-w-	c:\windows\system32\WPDSp.dll
2010-09-23 01:03 . 2009-10-01 01:01	196608	----a-w-	c:\windows\system32\PortableDeviceWMDRM.dll
2010-09-23 01:03 . 2009-10-01 01:01	100864	----a-w-	c:\windows\system32\PortableDeviceClassExtension.dll
2010-09-23 01:02 . 2009-10-08 21:08	555520	----a-w-	c:\windows\system32\UIAutomationCore.dll
2010-09-23 01:02 . 2009-10-08 21:08	234496	----a-w-	c:\windows\system32\oleacc.dll
2010-09-23 01:02 . 2009-10-08 21:07	4096	----a-w-	c:\windows\system32\oleaccrc.dll
2010-09-22 11:42 . 2010-09-22 11:43	--------	d-----w-	c:\program files\CCleaner
2010-09-22 10:10 . 2010-09-22 10:11	--------	d-----w-	c:\windows\system32\ca-ES
2010-09-22 10:10 . 2010-09-22 10:11	--------	d-----w-	c:\windows\system32\eu-ES
2010-09-22 10:10 . 2010-09-22 10:11	--------	d-----w-	c:\windows\system32\vi-VN
2010-09-21 21:49 . 2010-09-21 21:49	--------	d-----w-	c:\program files\Mozilla Firefox 4.0 Beta 6
2010-09-21 19:21 . 2010-09-23 17:21	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2010-09-21 19:21 . 2010-09-23 17:21	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2010-09-14 23:06 . 2010-04-05 17:02	317952	----a-w-	c:\windows\system32\MP4SDECD.DLL
2010-09-14 23:06 . 2010-08-17 14:11	128000	----a-w-	c:\windows\system32\spoolsv.exe
2010-09-14 23:06 . 2010-04-16 16:46	502272	----a-w-	c:\windows\system32\usp10.dll
2010-09-14 23:06 . 2010-05-27 20:08	739328	----a-w-	c:\windows\system32\inetcomm.dll
2010-08-25 15:34 . 2009-04-11 05:03	12240896	----a-w-	c:\windows\system32\NlsLexicons0007.dll
2010-08-25 15:34 . 2009-04-11 06:28	1081344	----a-w-	c:\windows\system32\SLCExt.dll
2010-08-25 15:34 . 2009-04-11 06:27	3408896	----a-w-	c:\windows\system32\SLsvc.exe
2010-08-25 15:34 . 2009-04-11 06:28	2134528	----a-w-	c:\windows\system32\FunctionDiscoveryFolder.dll
2010-08-25 15:34 . 2009-04-11 06:27	65536	----a-w-	c:\windows\system32\DevicePairingWizard.exe
2010-08-25 15:34 . 2009-04-11 05:03	2644480	----a-w-	c:\windows\system32\NlsLexicons0009.dll
2010-08-25 15:32 . 2009-04-11 06:28	287744	----a-w-	c:\windows\system32\Wldap32.dll
2010-08-25 15:31 . 2009-04-11 05:42	93696	----a-w-	c:\windows\system32\drivers\bridge.sys
2010-08-25 15:31 . 2009-04-11 04:46	41472	----a-w-	c:\windows\system32\drivers\raspppoe.sys
2010-08-25 15:31 . 2009-04-11 04:46	15872	----a-w-	c:\windows\system32\drivers\usb8023.sys
2010-08-25 15:31 . 2009-04-11 06:22	7168	----a-w-	c:\windows\system32\f3ahvoas.dll
2010-08-25 15:31 . 2009-04-11 04:27	2560	----a-w-	c:\windows\system32\msimsg.dll
2010-08-25 15:31 . 2009-04-11 06:28	83968	----a-w-	c:\windows\system32\wbem\wmiutils.dll
2010-08-25 15:31 . 2009-04-11 06:28	30208	----a-w-	c:\windows\system32\wbem\wbemprox.dll
2010-08-25 15:31 . 2009-04-11 06:28	189440	----a-w-	c:\windows\system32\wbem\mofd.dll
2010-08-25 15:31 . 2009-04-11 06:28	744448	----a-w-	c:\windows\system32\wbem\wbemcore.dll
2010-08-25 15:31 . 2009-04-11 06:28	265728	----a-w-	c:\windows\system32\wbem\repdrvfs.dll
2010-08-25 15:31 . 2009-04-11 06:28	614912	----a-w-	c:\windows\system32\wbem\fastprox.dll
2010-08-25 15:31 . 2009-04-11 06:28	265728	----a-w-	c:\windows\system32\wbem\esscli.dll
2010-08-25 15:30 . 2009-04-11 06:28	705536	----a-w-	c:\windows\system32\SmiEngine.dll
2010-08-25 15:30 . 2009-04-11 06:28	218624	----a-w-	c:\windows\system32\wdscore.dll
2010-08-25 15:30 . 2009-04-11 06:27	130560	----a-w-	c:\windows\system32\PkgMgr.exe
2010-08-25 15:29 . 2009-04-11 06:28	247808	----a-w-	c:\windows\system32\drvstore.dll

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-23 18:51 . 2009-12-19 11:36	135807	----a-w-	c:\programdata\nvModes.dat
2010-09-23 13:08 . 2010-09-22 11:18	286208	----a-w-	c:\users\*****\AppData\Roaming\Adobe\Update\hlpcli.exe
2010-09-23 09:39 . 2010-07-29 13:35	--------	d-----w-	c:\program files\DVDVideoSoftTB
2010-09-23 01:32 . 2007-02-27 09:55	654650	----a-w-	c:\windows\system32\perfh007.dat
2010-09-23 01:32 . 2007-02-27 09:55	137000	----a-w-	c:\windows\system32\perfc007.dat
2010-09-23 01:20 . 2010-09-23 01:20	0	---ha-w-	c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-09-22 22:28 . 2008-07-31 09:32	--------	d-----w-	c:\program files\Microsoft Silverlight
2010-09-22 16:14 . 2010-09-22 16:14	47876	----a-w-	c:\programdata\Blizzard Entertainment\Battle.net\Cache\Download\Scan.dll
2010-09-22 13:36 . 2007-02-27 01:17	118904	----a-w-	c:\users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2010-09-22 11:59 . 2008-08-07 17:55	--------	d-----r-	c:\program files\Skype
2010-09-22 11:57 . 2007-09-09 12:32	--------	d-----w-	c:\program files\Movie DVD Maker
2010-09-22 11:57 . 2007-02-27 02:39	--------	d-----w-	c:\program files\Microsoft Works
2010-09-22 11:54 . 2010-04-20 23:59	--------	d-----w-	c:\program files\Common Files\DVDVideoSoft
2010-09-22 11:53 . 2008-12-27 15:31	--------	d-----w-	c:\program files\VSO
2010-09-22 11:52 . 2008-12-27 15:31	--------	d-----w-	c:\users\*****\AppData\Roaming\Vso
2010-09-22 11:52 . 2008-12-27 15:31	47360	----a-w-	c:\users\*****\AppData\Roaming\pcouffin.sys
2010-09-22 11:52 . 2008-12-27 15:31	47360	----a-w-	c:\users\*****\AppData\Roaming\pcouffin.sys
2010-09-22 11:49 . 2009-08-25 19:40	--------	d-----w-	c:\program files\Algodoo Phun Edition
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Calendar
2010-09-22 10:12 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Sidebar
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Journal
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Collaboration
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Photo Gallery
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Defender
2010-09-21 21:30 . 2010-04-20 23:59	--------	d-----w-	c:\program files\DVDVideoSoft
2010-09-21 20:33 . 2007-07-01 10:07	--------	d-----w-	c:\program files\BearShare
2010-09-21 19:28 . 2010-05-19 16:47	--------	d-----w-	c:\program files\TeamSpeak 3 Client
2010-09-21 17:57 . 2008-06-30 22:16	--------	d-----w-	c:\users\*****\AppData\Roaming\ICQ
2010-09-15 01:05 . 2007-08-01 10:13	--------	d-----w-	c:\programdata\Microsoft Help
2010-09-11 13:28 . 2009-03-24 15:58	--------	d-----w-	c:\users\*****\AppData\Roaming\teamspeak2
2010-08-23 10:56 . 2007-02-28 15:33	--------	d-----w-	c:\users\*****\AppData\Roaming\dvdcss
2010-08-18 15:12 . 2010-09-10 12:10	52224	----a-w-	c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
2010-08-18 15:12 . 2010-09-10 12:10	101376	----a-w-	c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
2010-08-13 01:03 . 2007-07-15 11:04	--------	d-----w-	c:\program files\Movie Maker 2.6
2010-08-12 15:52 . 2010-08-12 15:52	4	----a-w-	C:\cache.dat
2010-08-06 07:21 . 2007-06-06 22:54	--------	d-----w-	c:\program files\Common Files\Blizzard Entertainment
2010-08-05 14:28 . 2010-02-08 14:29	--------	d-----w-	c:\program files\No23 Recorder
2010-07-29 13:35 . 2008-08-08 07:58	--------	d-----w-	c:\program files\Conduit
2010-07-29 13:35 . 2010-07-29 13:35	--------	d-----w-	c:\users\*****\AppData\Roaming\DVDVideoSoftIEHelpers
2010-07-27 08:38 . 2010-07-27 08:14	--------	d-----w-	c:\programdata\Blizzard Entertainment
2010-07-24 13:19 . 2010-07-24 13:19	2560	----a-w-	c:\windows\_MSRSTRT.EXE
2010-07-06 19:35 . 2010-07-06 19:34	14566424	----a-w-	c:\windows\system32\vlc-0.9.4-win32.exe
2010-06-29 15:47 . 2010-08-12 04:00	834048	----a-w-	c:\windows\system32\wininet.dll
2010-06-28 16:13 . 2010-08-12 04:00	78336	----a-w-	c:\windows\system32\ieencode.dll
2007-11-18 10:25 . 2007-11-18 10:25	16	---ha-w-	c:\program files\mxfilerelatedcache.mxc2
2000-05-15 14:50 . 2000-04-10 10:31	21473	----a-w-	c:\program files\Update.txt
2000-04-04 15:16 . 2000-04-10 10:33	27494	----a-w-	c:\program files\Troubleshooting.htm
2000-04-04 15:16 . 2000-04-10 10:31	54272	----a-w-	c:\program files\Troubleshooting.doc
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrдge & legitime Standardeintrдge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Setfla"="c:\users\*****\AppData\Roaming\Adobe\Update\hlpcli.exe" [2010-09-23 286208]
"eMuleAutoStart"="c:\program files\eMule\emule.exe" [2009-02-22 5668864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 4186112]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Setfla]
2010-09-23 13:08	286208	----a-w-	c:\users\*****\AppData\Roaming\Adobe\Update\hlpcli.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
"ICQ"="c:\program files\ICQ6.5\ICQ.exe" silent
"ehTray.exe"=c:\windows\ehome\ehTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe"
"PDFPrint"="c:\program files\pdf24\PDFBackend.exe"
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe"  -osboot
"WinampAgent"="c:\program files\Winamp\winampa.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 554352]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2007-03-14 639224]
R4 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 544768]
S2 ACEDRV09;ACEDRV09;c:\windows\system32\drivers\ACEDRV09.sys [2007-09-09 110304]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2008-07-04 14336]
S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2006-11-17 13976]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners

2010-09-23 c:\windows\Tasks\1-Klick-Wartung.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-07 10:49]
.
.
------- Zusдtzlicher Suchlauf -------
.
mStart Page = hxxp://www.arcor.de
mWindow Title = Arcor AG & Co. KG
IE: Easy-WebPrint - Zu Druckliste hinzufugen
IE: Easy-WebPrint - Zu Druckliste hinzufugen - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Save YouTube Video
IE: Save YouTube Video as MP3
FF - ProfilePath - c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\0hkidv9q.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.spiegel.de/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-23 21:06
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteintrдge... 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\conime.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\System32\TUProgSt.exe
c:\windows\system32\WUDFHost.exe
c:\windows\RtHDVCpl.exe
c:\windows\ehome\ehsched.exe
c:\windows\ehome\ehRecvr.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-09-23  21:14:32 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-09-23 19:14
ComboFix2.txt  2010-09-23 17:57

Vor Suchlauf: 26 Verzeichnis(se), 94.559.694.848 Bytes frei
Nach Suchlauf: 28 Verzeichnis(se), 92.962.148.352 Bytes frei

- - End Of File - - BE33309A5B92E262554F6B56AEF3B53C
         

hmm ok noch mal.
und natürlich musst du die * durch deinen namen ersetzen.
erstelle ein combofix script wie eben beschrieben.

killall::
Rootkit::
c:\users\*****\AppData\Roaming\Adobe\Update\hlpcli.exe
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Setfla"=-


führe das script aus, poste das log

Ich habe da schon meinen Namen eingegeben.
Vielleicht liegt es daran, dass ich Antivir nicht schließen konnte, also den Dienst von Antivir.

ComboFix 10-09-23.01 - ***** 23.09.2010  22:34:13.3.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2046.1542 [GMT 2:00]
ausgefьhrt von:: c:\users\*****\Downloads\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\*****\Downloads\cfscript.txt
SP: Avira AntiVir PersonalEdition *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Windows-Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((   Dateien erstellt von 2010-08-23 bis 2010-09-23  ))))))))))))))))))))))))))))))
.

2010-09-23 20:45 . 2010-09-23 20:46	--------	d-----w-	c:\users\*****\AppData\Local\temp
2010-09-23 20:45 . 2010-09-23 20:45	--------	d-----w-	c:\users\Default\AppData\Local\temp
2010-09-23 08:47 . 2010-09-23 08:47	--------	d-----w-	c:\users\*****\AppData\Roaming\Malwarebytes
2010-09-23 08:47 . 2010-04-29 10:19	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-23 08:47 . 2010-09-23 08:47	--------	d-----w-	c:\programdata\Malwarebytes
2010-09-23 08:47 . 2010-04-29 10:19	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-09-23 08:47 . 2010-09-23 08:47	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-09-23 01:21 . 2010-09-23 01:21	--------	d-----w-	c:\program files\Windows Portable Devices
2010-09-23 01:03 . 2009-10-01 01:02	30208	----a-w-	c:\windows\system32\WPDShextAutoplay.exe
2010-09-23 01:03 . 2009-10-01 01:02	31232	----a-w-	c:\windows\system32\BthMtpContextHandler.dll
2010-09-23 01:03 . 2009-10-01 01:01	81920	----a-w-	c:\windows\system32\wpdbusenum.dll
2010-09-23 01:03 . 2009-10-01 01:01	60928	----a-w-	c:\windows\system32\PortableDeviceConnectApi.dll
2010-09-23 01:03 . 2009-10-01 01:02	2537472	----a-w-	c:\windows\system32\wpdshext.dll
2010-09-23 01:03 . 2009-10-01 01:02	334848	----a-w-	c:\windows\system32\PortableDeviceApi.dll
2010-09-23 01:03 . 2009-10-01 01:02	87552	----a-w-	c:\windows\system32\WPDShServiceObj.dll
2010-09-23 01:03 . 2009-10-01 01:01	546816	----a-w-	c:\windows\system32\wpd_ci.dll
2010-09-23 01:03 . 2009-10-01 01:01	160256	----a-w-	c:\windows\system32\PortableDeviceTypes.dll
2010-09-23 01:03 . 2009-10-01 01:01	350208	----a-w-	c:\windows\system32\WPDSp.dll
2010-09-23 01:03 . 2009-10-01 01:01	196608	----a-w-	c:\windows\system32\PortableDeviceWMDRM.dll
2010-09-23 01:03 . 2009-10-01 01:01	100864	----a-w-	c:\windows\system32\PortableDeviceClassExtension.dll
2010-09-23 01:02 . 2009-10-08 21:08	555520	----a-w-	c:\windows\system32\UIAutomationCore.dll
2010-09-23 01:02 . 2009-10-08 21:08	234496	----a-w-	c:\windows\system32\oleacc.dll
2010-09-23 01:02 . 2009-10-08 21:07	4096	----a-w-	c:\windows\system32\oleaccrc.dll
2010-09-22 11:42 . 2010-09-22 11:43	--------	d-----w-	c:\program files\CCleaner
2010-09-22 10:10 . 2010-09-22 10:11	--------	d-----w-	c:\windows\system32\ca-ES
2010-09-22 10:10 . 2010-09-22 10:11	--------	d-----w-	c:\windows\system32\eu-ES
2010-09-22 10:10 . 2010-09-22 10:11	--------	d-----w-	c:\windows\system32\vi-VN
2010-09-21 21:49 . 2010-09-21 21:49	--------	d-----w-	c:\program files\Mozilla Firefox 4.0 Beta 6
2010-09-21 19:21 . 2010-09-23 17:21	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2010-09-21 19:21 . 2010-09-23 17:21	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2010-09-14 23:06 . 2010-04-05 17:02	317952	----a-w-	c:\windows\system32\MP4SDECD.DLL
2010-09-14 23:06 . 2010-08-17 14:11	128000	----a-w-	c:\windows\system32\spoolsv.exe
2010-09-14 23:06 . 2010-04-16 16:46	502272	----a-w-	c:\windows\system32\usp10.dll
2010-09-14 23:06 . 2010-05-27 20:08	739328	----a-w-	c:\windows\system32\inetcomm.dll
2010-08-25 15:34 . 2009-04-11 05:03	12240896	----a-w-	c:\windows\system32\NlsLexicons0007.dll
2010-08-25 15:34 . 2009-04-11 06:28	1081344	----a-w-	c:\windows\system32\SLCExt.dll
2010-08-25 15:34 . 2009-04-11 06:27	3408896	----a-w-	c:\windows\system32\SLsvc.exe
2010-08-25 15:34 . 2009-04-11 06:28	2134528	----a-w-	c:\windows\system32\FunctionDiscoveryFolder.dll
2010-08-25 15:34 . 2009-04-11 06:27	65536	----a-w-	c:\windows\system32\DevicePairingWizard.exe
2010-08-25 15:34 . 2009-04-11 05:03	2644480	----a-w-	c:\windows\system32\NlsLexicons0009.dll
2010-08-25 15:32 . 2009-04-11 06:28	287744	----a-w-	c:\windows\system32\Wldap32.dll
2010-08-25 15:31 . 2009-04-11 05:42	93696	----a-w-	c:\windows\system32\drivers\bridge.sys
2010-08-25 15:31 . 2009-04-11 04:46	41472	----a-w-	c:\windows\system32\drivers\raspppoe.sys
2010-08-25 15:31 . 2009-04-11 04:46	15872	----a-w-	c:\windows\system32\drivers\usb8023.sys
2010-08-25 15:31 . 2009-04-11 06:22	7168	----a-w-	c:\windows\system32\f3ahvoas.dll
2010-08-25 15:31 . 2009-04-11 04:27	2560	----a-w-	c:\windows\system32\msimsg.dll
2010-08-25 15:31 . 2009-04-11 06:28	83968	----a-w-	c:\windows\system32\wbem\wmiutils.dll
2010-08-25 15:31 . 2009-04-11 06:28	30208	----a-w-	c:\windows\system32\wbem\wbemprox.dll
2010-08-25 15:31 . 2009-04-11 06:28	189440	----a-w-	c:\windows\system32\wbem\mofd.dll
2010-08-25 15:31 . 2009-04-11 06:28	744448	----a-w-	c:\windows\system32\wbem\wbemcore.dll
2010-08-25 15:31 . 2009-04-11 06:28	265728	----a-w-	c:\windows\system32\wbem\repdrvfs.dll
2010-08-25 15:31 . 2009-04-11 06:28	614912	----a-w-	c:\windows\system32\wbem\fastprox.dll
2010-08-25 15:31 . 2009-04-11 06:28	265728	----a-w-	c:\windows\system32\wbem\esscli.dll
2010-08-25 15:30 . 2009-04-11 06:28	705536	----a-w-	c:\windows\system32\SmiEngine.dll
2010-08-25 15:30 . 2009-04-11 06:28	218624	----a-w-	c:\windows\system32\wdscore.dll
2010-08-25 15:30 . 2009-04-11 06:27	130560	----a-w-	c:\windows\system32\PkgMgr.exe
2010-08-25 15:29 . 2009-04-11 06:28	247808	----a-w-	c:\windows\system32\drvstore.dll

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-23 20:47 . 2009-12-19 11:36	135807	----a-w-	c:\programdata\nvModes.dat
2010-09-23 13:08 . 2010-09-22 11:18	286208	----a-w-	c:\users\*****\AppData\Roaming\Adobe\Update\hlpcli.exe
2010-09-23 09:39 . 2010-07-29 13:35	--------	d-----w-	c:\program files\DVDVideoSoftTB
2010-09-23 01:32 . 2007-02-27 09:55	654650	----a-w-	c:\windows\system32\perfh007.dat
2010-09-23 01:32 . 2007-02-27 09:55	137000	----a-w-	c:\windows\system32\perfc007.dat
2010-09-23 01:21 . 2006-11-02 10:25	665600	----a-w-	c:\windows\inf\drvindex.dat
2010-09-23 01:20 . 2010-09-23 01:20	0	---ha-w-	c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-09-22 22:28 . 2008-07-31 09:32	--------	d-----w-	c:\program files\Microsoft Silverlight
2010-09-22 16:14 . 2010-09-22 16:14	47876	----a-w-	c:\programdata\Blizzard Entertainment\Battle.net\Cache\Download\Scan.dll
2010-09-22 13:36 . 2007-02-27 01:17	118904	----a-w-	c:\users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2010-09-22 11:59 . 2008-08-07 17:55	--------	d-----r-	c:\program files\Skype
2010-09-22 11:57 . 2007-09-09 12:32	--------	d-----w-	c:\program files\Movie DVD Maker
2010-09-22 11:57 . 2007-02-27 02:39	--------	d-----w-	c:\program files\Microsoft Works
2010-09-22 11:54 . 2010-04-20 23:59	--------	d-----w-	c:\program files\Common Files\DVDVideoSoft
2010-09-22 11:53 . 2008-12-27 15:31	--------	d-----w-	c:\program files\VSO
2010-09-22 11:52 . 2008-12-27 15:31	--------	d-----w-	c:\users\*****\AppData\Roaming\Vso
2010-09-22 11:52 . 2008-12-27 15:31	47360	----a-w-	c:\users\*****\AppData\Roaming\pcouffin.sys
2010-09-22 11:52 . 2008-12-27 15:31	47360	----a-w-	c:\users\*****\AppData\Roaming\pcouffin.sys
2010-09-22 11:49 . 2009-08-25 19:40	--------	d-----w-	c:\program files\Algodoo Phun Edition
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Calendar
2010-09-22 10:12 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Sidebar
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Journal
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Collaboration
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Photo Gallery
2010-09-22 10:12 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Defender
2010-09-21 21:30 . 2010-04-20 23:59	--------	d-----w-	c:\program files\DVDVideoSoft
2010-09-21 20:33 . 2007-07-01 10:07	--------	d-----w-	c:\program files\BearShare
2010-09-21 19:28 . 2010-05-19 16:47	--------	d-----w-	c:\program files\TeamSpeak 3 Client
2010-09-21 17:57 . 2008-06-30 22:16	--------	d-----w-	c:\users\*****\AppData\Roaming\ICQ
2010-09-15 01:05 . 2007-08-01 10:13	--------	d-----w-	c:\programdata\Microsoft Help
2010-09-11 13:28 . 2009-03-24 15:58	--------	d-----w-	c:\users\*****\AppData\Roaming\teamspeak2
2010-08-23 10:56 . 2007-02-28 15:33	--------	d-----w-	c:\users\*****\AppData\Roaming\dvdcss
2010-08-18 15:12 . 2010-09-10 12:10	52224	----a-w-	c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
2010-08-18 15:12 . 2010-09-10 12:10	101376	----a-w-	c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
2010-08-13 01:03 . 2007-07-15 11:04	--------	d-----w-	c:\program files\Movie Maker 2.6
2010-08-12 15:52 . 2010-08-12 15:52	4	----a-w-	C:\cache.dat
2010-08-06 07:21 . 2007-06-06 22:54	--------	d-----w-	c:\program files\Common Files\Blizzard Entertainment
2010-08-05 14:28 . 2010-02-08 14:29	--------	d-----w-	c:\program files\No23 Recorder
2010-07-29 13:35 . 2008-08-08 07:58	--------	d-----w-	c:\program files\Conduit
2010-07-29 13:35 . 2010-07-29 13:35	--------	d-----w-	c:\users\*****\AppData\Roaming\DVDVideoSoftIEHelpers
2010-07-27 08:38 . 2010-07-27 08:14	--------	d-----w-	c:\programdata\Blizzard Entertainment
2010-07-24 13:19 . 2010-07-24 13:19	2560	----a-w-	c:\windows\_MSRSTRT.EXE
2010-07-06 19:35 . 2010-07-06 19:34	14566424	----a-w-	c:\windows\system32\vlc-0.9.4-win32.exe
2010-06-29 15:47 . 2010-08-12 04:00	834048	----a-w-	c:\windows\system32\wininet.dll
2010-06-28 16:13 . 2010-08-12 04:00	78336	----a-w-	c:\windows\system32\ieencode.dll
2007-11-18 10:25 . 2007-11-18 10:25	16	---ha-w-	c:\program files\mxfilerelatedcache.mxc2
2000-05-15 14:50 . 2000-04-10 10:31	21473	----a-w-	c:\program files\Update.txt
2000-04-04 15:16 . 2000-04-10 10:33	27494	----a-w-	c:\program files\Troubleshooting.htm
2000-04-04 15:16 . 2000-04-10 10:31	54272	----a-w-	c:\program files\Troubleshooting.doc
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrдge & legitime Standardeintrдge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eMuleAutoStart"="c:\program files\eMule\emule.exe" [2009-02-22 5668864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 4186112]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Setfla]
2010-09-23 13:08	286208	----a-w-	c:\users\Chris\AppData\Roaming\Adobe\Update\hlpcli.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
"ICQ"="c:\program files\ICQ6.5\ICQ.exe" silent
"ehTray.exe"=c:\windows\ehome\ehTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe"
"PDFPrint"="c:\program files\pdf24\PDFBackend.exe"
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe"  -osboot
"WinampAgent"="c:\program files\Winamp\winampa.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 554352]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2007-03-14 639224]
R4 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 544768]
S2 ACEDRV09;ACEDRV09;c:\windows\system32\drivers\ACEDRV09.sys [2007-09-09 110304]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2008-07-04 14336]
S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2006-11-17 13976]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners

2010-09-23 c:\windows\Tasks\1-Klick-Wartung.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-07 10:49]
.
.
------- Zusдtzlicher Suchlauf -------
.
mStart Page = hxxp://www.arcor.de
mWindow Title = Arcor AG & Co. KG
IE: Easy-WebPrint - Zu Druckliste hinzufugen
IE: Easy-WebPrint - Zu Druckliste hinzufugen - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Save YouTube Video
IE: Save YouTube Video as MP3
FF - ProfilePath - c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\0hkidv9q.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.spiegel.de/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-23 22:47
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteintrдge... 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\conime.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\System32\TUProgSt.exe
c:\windows\RtHDVCpl.exe
c:\windows\system32\WUDFHost.exe
c:\windows\ehome\ehsched.exe
c:\windows\ehome\ehRecvr.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-09-23  22:54:08 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-09-23 20:54
ComboFix2.txt  2010-09-23 19:14
ComboFix3.txt  2010-09-23 17:57

Vor Suchlauf: 27 Verzeichnis(se), 92.988.895.232 Bytes frei
Nach Suchlauf: 28 Verzeichnis(se), 92.733.603.840 Bytes frei

- - End Of File - - FDED2367735B530076DE009E1D1DCA1F
         

scheint geklappt zu haben, bitte poste nen neues otl log.

Ja, der Rechner läuft soweit wieder gut.
Vielen vielen Dank nochmal.

OTL logfile created on: 24.09.2010 16:19:10 - Run 2
OTL by OldTimer - Version 3.2.14.1     Folder = C:\Users\*****\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 59,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 221,17 Gb Total Space | 84,96 Gb Free Space | 38,41% Space Free | Partition Type: NTFS
Drive D: | 232,88 Gb Total Space | 22,24 Gb Free Space | 9,55% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 7,05 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: *****
Current User Name: *****
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Chris\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\TUProgSt.exe (TuneUp Software GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\eMule\emule.exe (hxxp://www.emule-project.net)
PRC - C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\*****\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (stllssvr) -- C:\Program Files\Common Files\SureThing Shared\stllssvr.exe File not found
SRV - (MSSQLServerADHelper) -- C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe File not found
SRV - (CLTNetCnService) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe File not found
SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (TuneUp.ProgramStatisticsSvc) -- C:\Windows\System32\TUProgSt.exe (TuneUp Software GmbH)
SRV - (TuneUp.Defrag) -- C:\Windows\System32\TuneUpDefragService.exe (TuneUp Software GmbH)
SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (VMCService) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (LiveUpdate) -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)
SRV - (Automatisches LiveUpdate - Scheduler) -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation)
SRV - (UPnPService) -- C:\Programme\Common Files\MAGIX Shared\UPnPService\UPnPService.exe (Magix AG)
SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (x10nets) -- C:\Programme\Common Files\X10\Common\X10nets.exe (X10)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (SCREAMINGBDRIVER) -- C:\Windows\System32\drivers\ScreamingBAudio.sys File not found
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (ddxgb) -- C:\Users\Chris\AppData\Local\Temp\ddxgb.sys File not found
DRV - (catchme) -- C:\ComboFix\catchme.sys File not found
DRV - (blbdrive) -- C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (NuidFltr) -- C:\Windows\System32\drivers\nuidfltr.sys (Microsoft Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (ACEDRV09) -- C:\Windows\System32\drivers\ACEDRV09.sys (Protect Software GmbH)
DRV - (Ph3xIB32) -- C:\Windows\System32\drivers\Ph3xIB32.sys (Philips Semiconductors GmbH)
DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (XUIF) -- C:\Windows\System32\drivers\x10ufx2.sys (X10 Wireless Technology, Inc.)
DRV - (X10Hid) -- C:\Windows\System32\drivers\x10hid.sys (X10 Wireless Technology, Inc.)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (xfilt) -- C:\Windows\system32\DRIVERS\xfilt.sys (VIA Technologies,Inc)
DRV - (videX32) -- C:\Windows\system32\DRIVERS\videX32.sys (VIA Technologies, Inc.)
DRV - (Tosrfusb) -- C:\Windows\System32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (Tosrfbd) -- C:\Windows\System32\drivers\TosRfbd.sys (TOSHIBA CORPORATION)
DRV - (Tosrfhid) -- C:\Windows\System32\drivers\TosRfhid.sys (TOSHIBA Corporation.)
DRV - (TosRfSnd) Bluetooth Audio Device (WDM) -- C:\Windows\System32\drivers\TosRfSnd.sys (TOSHIBA Corporation)
DRV - (tosporte) -- C:\Windows\System32\drivers\Tosporte.sys (TOSHIBA Corporation)
DRV - (tosrfnds) -- C:\Windows\System32\drivers\tosrfnds.sys (TOSHIBA Corporation.)
DRV - (Tosrfcom) -- C:\Windows\System32\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV - (Tosrfbnp) -- C:\Windows\System32\drivers\tosrfbnp.sys (TOSHIBA Corporation)
DRV - (toshidpt) -- C:\Windows\System32\drivers\Toshidpt.sys (TOSHIBA Corporation.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.arcor.de
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.arcor.de
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - Reg Error: Key error. File not found
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Prev Search Page = hxxp://www.arcor.de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.spiegel.de/"
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7.1
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.6.6.117
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 4.0b6\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 6\components [2010.09.21 23:49:53 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0b6\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 6\plugins
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.09.24 16:19:41 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2009.12.21 15:10:43 | 000,000,000 | ---D | M]
 
[2010.09.24 16:19:46 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Extensions
[2010.09.24 16:19:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chris\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.09.22 13:52:01 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\0hkidv9q.default\extensions
[2010.06.29 10:59:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2007.07.19 23:35:23 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2008.02.18 14:15:49 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.09.10 14:10:48 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.07.29 15:35:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.09.10 14:10:44 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.09.10 14:10:45 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\0hkidv9q.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010.02.04 02:24:14 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\0hkidv9q.default\extensions\moveplayer@movenetworks.com
[2009.11.06 10:36:00 | 000,002,171 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Mozilla\FireFox\Profiles\0hkidv9q.default\searchplugins\bing.xml
[2010.07.29 15:45:54 | 000,000,873 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Mozilla\FireFox\Profiles\0hkidv9q.default\searchplugins\conduit.xml
[2009.08.17 16:29:48 | 000,000,951 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Mozilla\FireFox\Profiles\0hkidv9q.default\searchplugins\icqplugin.xml
[2010.09.22 13:59:15 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2007.06.03 22:19:55 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2008.07.01 00:16:47 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
 
O1 HOSTS File: ([2010.09.23 22:46:46 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe (hxxp://www.emule-project.net)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Chris\Desktop\Desktopbilder\wall001-large.jpg
O24 - Desktop BackupWallPaper: C:\Users\Chris\Desktop\Desktopbilder\wall001-large.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010.05.25 06:16:57 | 000,000,046 | -H-- | M] () - G:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.09.23 22:54:10 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010.09.23 22:54:10 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\temp
[2010.09.23 22:46:54 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2010.09.23 22:25:13 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010.09.23 19:43:27 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010.09.23 19:43:27 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010.09.23 19:43:27 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010.09.23 19:43:00 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010.09.23 19:39:04 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.09.23 10:47:55 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Malwarebytes
[2010.09.23 10:47:37 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.09.23 10:47:27 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.09.23 10:47:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.09.23 10:47:26 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.09.23 03:21:25 | 000,000,000 | ---D | C] -- C:\Programme\Windows Portable Devices
[2010.09.23 03:04:51 | 000,092,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAnimation.dll
[2010.09.23 03:04:50 | 003,023,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbon.dll
[2010.09.23 03:04:50 | 001,164,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbonRes.dll
[2010.09.23 03:04:20 | 000,369,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMPhoto.dll
[2010.09.23 03:04:20 | 000,037,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2010.09.23 03:04:19 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecs.dll
[2010.09.23 03:04:19 | 000,829,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2010.09.23 03:04:19 | 000,828,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2010.09.23 03:04:19 | 000,667,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe
[2010.09.23 03:04:19 | 000,351,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2010.09.23 03:04:19 | 000,321,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PhotoMetadataHandler.dll
[2010.09.23 03:04:19 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2010.09.23 03:04:19 | 000,252,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxdiag.exe
[2010.09.23 03:04:19 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxdiagn.dll
[2010.09.23 03:04:19 | 000,189,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecsExt.dll
[2010.09.23 03:04:19 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll
[2010.09.23 03:04:19 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll
[2010.09.23 03:04:18 | 001,554,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xpsservices.dll
[2010.09.23 03:04:18 | 001,064,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2010.09.23 03:04:18 | 001,030,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll
[2010.09.23 03:04:18 | 000,847,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\OpcServices.dll
[2010.09.23 03:04:18 | 000,793,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll
[2010.09.23 03:04:18 | 000,519,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d11.dll
[2010.09.23 03:04:18 | 000,486,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2010.09.23 03:04:18 | 000,481,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll
[2010.09.23 03:04:18 | 000,218,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2010.09.23 03:04:18 | 000,190,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll
[2010.09.23 03:04:18 | 000,161,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2010.09.23 03:03:51 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\BthMtpContextHandler.dll
[2010.09.23 03:03:51 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDShextAutoplay.exe
[2010.09.23 03:03:47 | 000,060,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceConnectApi.dll
[2010.09.23 03:03:45 | 000,546,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wpd_ci.dll
[2010.09.23 03:03:45 | 000,350,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDSp.dll
[2010.09.23 03:03:45 | 000,334,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceApi.dll
[2010.09.23 03:03:45 | 000,196,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceWMDRM.dll
[2010.09.23 03:03:45 | 000,160,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceTypes.dll
[2010.09.23 03:03:45 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceClassExtension.dll
[2010.09.23 03:02:51 | 000,555,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAutomationCore.dll
[2010.09.23 03:02:51 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleaccrc.dll
[2010.09.22 13:42:20 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010.09.22 12:10:38 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2010.09.22 12:10:38 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2010.09.22 12:10:36 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2010.09.21 23:49:51 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox 4.0 Beta 6
[2010.09.21 21:21:40 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2010.09.21 21:21:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2010.09.15 01:06:58 | 000,317,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP4SDECD.DLL
[2010.09.02 20:19:16 | 000,000,000 | ---D | C] -- C:\Users\Chris\Desktop\Bisschen Kiffen
[2010.08.25 17:34:09 | 012,240,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NlsLexicons0007.dll
[2010.08.25 17:34:06 | 001,081,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SLCExt.dll
[2010.08.25 17:34:04 | 002,134,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FunctionDiscoveryFolder.dll
[2010.08.25 17:34:04 | 000,065,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DevicePairingWizard.exe
[2010.08.25 17:34:02 | 002,644,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NlsLexicons0009.dll
[2010.08.25 17:33:59 | 001,480,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssrch.dll
[2010.08.25 17:33:58 | 000,684,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\spsys.sys
[2010.08.25 17:33:56 | 001,576,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tquery.dll
[2010.08.25 17:33:55 | 000,928,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\scavenge.dll
[2010.08.25 17:33:55 | 000,779,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationNative_v0300.dll
[2010.08.25 17:33:53 | 002,241,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msi.dll
[2010.08.25 17:33:52 | 000,968,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wcnwiz2.dll
[2010.08.25 17:33:52 | 000,677,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imapi2fs.dll
[2010.08.25 17:33:52 | 000,291,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WscEapPr.dll
[2010.08.25 17:33:50 | 000,619,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\icardagt.exe
[2010.08.25 17:33:49 | 001,216,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\AuxiliaryDisplayCpl.dll
[2010.08.25 17:33:49 | 000,114,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EhStorShell.dll
[2010.08.25 17:33:48 | 000,978,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drmv2clt.dll
[2010.08.25 17:33:48 | 000,289,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spinstall.exe
[2010.08.25 17:33:48 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spreview.exe
[2010.08.25 17:33:47 | 000,438,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mcupdate_GenuineIntel.dll
[2010.08.25 17:33:47 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spwizui.dll
[2010.08.25 17:33:44 | 000,670,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssvp.dll
[2010.08.25 17:33:43 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSMPEG2VDEC.DLL
[2010.08.25 17:33:43 | 000,378,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imapi2.dll
[2010.08.25 17:33:43 | 000,351,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssph.dll
[2010.08.25 17:33:43 | 000,203,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssphtb.dll
[2010.08.25 17:33:42 | 001,459,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\esent.dll
[2010.08.25 17:33:42 | 000,324,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sdohlp.dll
[2010.08.25 17:33:41 | 000,729,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IMJP10K.DLL
[2010.08.25 17:33:41 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DevicePairing.dll
[2010.08.25 17:33:40 | 000,190,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sperror.dll
[2010.08.25 17:33:40 | 000,143,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\korwbrkr.dll
[2010.08.25 17:33:39 | 000,463,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IasMigReader.exe
[2010.08.25 17:33:39 | 000,231,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
[2010.08.25 17:33:39 | 000,228,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SLC.dll
[2010.08.25 17:33:37 | 001,589,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msjet40.dll
[2010.08.25 17:33:35 | 001,381,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Query.dll
[2010.08.25 17:33:34 | 001,078,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\diagperf.dll
[2010.08.25 17:33:34 | 000,883,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IMJP10.IME
[2010.08.25 17:33:34 | 000,409,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msexch40.dll
[2010.08.25 17:33:33 | 000,327,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\P2PGraph.dll
[2010.08.25 17:33:32 | 000,986,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winload.exe
[2010.08.25 17:33:32 | 000,950,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mblctr.exe
[2010.08.25 17:33:32 | 000,428,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2010.08.25 17:33:32 | 000,301,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\srchadmin.dll
[2010.08.25 17:33:31 | 001,792,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mmc.exe
[2010.08.25 17:33:31 | 000,466,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\riched20.dll
[2010.08.25 17:33:31 | 000,454,144 | ---- | C] (Microsoft) -- C:\Windows\System32\IasMigPlugin.dll
[2010.08.25 17:33:31 | 000,203,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\uDWM.dll
[2010.08.25 17:33:30 | 000,880,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RacEngn.dll
[2010.08.25 17:33:30 | 000,088,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fdBth.dll
[2010.08.25 17:33:28 | 002,012,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\milcore.dll
[2010.08.25 17:33:28 | 001,112,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CertEnroll.dll
[2010.08.25 17:33:28 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NaturalLanguage6.dll
[2010.08.25 17:33:28 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spoolss.dll
[2010.08.25 17:33:28 | 000,120,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EhStorAPI.dll
[2010.08.25 17:33:27 | 000,950,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gpedit.dll
[2010.08.25 17:33:27 | 000,406,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msvcp60.dll
[2010.08.25 17:33:27 | 000,290,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msjtes40.dll
[2010.08.25 17:33:27 | 000,115,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\AuxiliaryDisplayDriverLib.dll
[2010.08.25 17:33:27 | 000,099,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\infocardapi.dll
[2010.08.25 17:33:26 | 003,217,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WinSAT.exe
[2010.08.25 17:33:25 | 000,167,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationSettings.exe
[2010.08.25 17:33:24 | 000,710,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Magnify.exe
[2010.08.25 17:33:24 | 000,282,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstext40.dll
[2010.08.25 17:33:24 | 000,102,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\AuxiliaryDisplayServices.dll
[2010.08.25 17:33:23 | 001,209,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\comsvcs.dll
[2010.08.25 17:33:23 | 000,454,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxbde40.dll
[2010.08.25 17:33:23 | 000,339,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msexcl40.dll
[2010.08.25 17:33:23 | 000,217,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax
[2010.08.25 17:33:23 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\slwmi.dll
[2010.08.25 17:33:22 | 001,524,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsAnytimeUpgradeCPL.dll
[2010.08.25 17:33:22 | 000,461,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2010.08.25 17:33:21 | 001,985,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\authui.dll
[2010.08.25 17:33:20 | 001,086,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NetProjW.dll
[2010.08.25 17:33:20 | 000,643,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrepl40.dll
[2010.08.25 17:33:19 | 002,926,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2010.08.25 17:33:19 | 000,640,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\bthprops.cpl
[2010.08.25 17:33:19 | 000,469,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\newdev.dll
[2010.08.25 17:33:19 | 000,205,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\eudcedit.exe
[2010.08.25 17:33:19 | 000,119,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasrecst.dll
[2010.08.25 17:33:19 | 000,102,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
[2010.08.25 17:33:18 | 001,788,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d9.dll
[2010.08.25 17:33:18 | 000,398,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2010.08.25 17:33:18 | 000,368,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mspbde40.dll
[2010.08.25 17:33:17 | 000,241,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msltus40.dll
[2010.08.25 17:33:17 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\davclnt.dll
[2010.08.25 17:33:16 | 001,135,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll
[2010.08.25 17:33:16 | 001,053,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdtctm.dll
[2010.08.25 17:33:16 | 000,344,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrd3x40.dll
[2010.08.25 17:33:16 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EhStorPwdMgr.dll
[2010.08.25 17:33:15 | 000,250,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wevtapi.dll
[2010.08.25 17:33:15 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nlhtml.dll
[2010.08.25 17:33:14 | 000,614,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ci.dll
[2010.08.25 17:33:14 | 000,483,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\samsrv.dll
[2010.08.25 17:33:13 | 000,582,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SLCommDlg.dll
[2010.08.25 17:33:13 | 000,443,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32spl.dll
[2010.08.25 17:33:13 | 000,165,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WcnNetsh.dll
[2010.08.25 17:33:12 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\compcln.exe
[2010.08.25 17:33:11 | 001,730,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\apds.dll
[2010.08.25 17:33:11 | 000,618,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mswstr10.dll
[2010.08.25 17:33:10 | 000,223,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\netio.sys
[2010.08.25 17:33:10 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xmlfilter.dll
[2010.08.25 17:33:08 | 001,160,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll
[2010.08.25 17:33:08 | 000,524,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sqlsrv32.dll
[2010.08.25 17:33:08 | 000,361,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SLUI.exe
[2010.08.25 17:33:08 | 000,319,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrd2x40.dll
[2010.08.25 17:33:08 | 000,183,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\eapphost.dll
[2010.08.25 17:33:07 | 000,926,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winresume.exe
[2010.08.25 17:33:07 | 000,409,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbc32.dll
[2010.08.25 17:33:07 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\propdefs.dll
[2010.08.25 17:33:05 | 001,856,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dbgeng.dll
[2010.08.25 17:33:04 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wevtutil.exe
[2010.08.25 17:33:03 | 000,087,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssitlb.dll
[2010.08.25 17:33:02 | 002,167,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mmcndmgr.dll
[2010.08.25 17:33:01 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drvinst.exe
[2010.08.25 17:33:00 | 000,592,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netlogon.dll
[2010.08.25 17:33:00 | 000,485,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\evr.dll
[2010.08.25 17:33:00 | 000,378,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\devmgr.dll
[2010.08.25 17:33:00 | 000,199,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\adsldpc.dll
[2010.08.25 17:33:00 | 000,084,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msctfp.dll
[2010.08.25 17:33:00 | 000,054,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DevicePairingProxy.dll
[2010.08.25 17:33:00 | 000,035,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscb.dll
[2010.08.25 17:33:00 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fdBthProxy.dll
[2010.08.25 17:32:59 | 001,533,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wcnwiz.dll
[2010.08.25 17:32:59 | 001,382,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVSDECD.DLL
[2010.08.25 17:32:59 | 000,124,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quick.ime
[2010.08.25 17:32:59 | 000,124,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qintlgnt.ime
[2010.08.25 17:32:59 | 000,124,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\phon.ime
[2010.08.25 17:32:59 | 000,124,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cintlgnt.ime
[2010.08.25 17:32:59 | 000,124,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\chajei.ime
[2010.08.25 17:32:58 | 001,143,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wercon.exe
[2010.08.25 17:32:58 | 000,617,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\adtschema.dll
[2010.08.25 17:32:58 | 000,323,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certcli.dll
[2010.08.25 17:32:58 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mimefilt.dll
[2010.08.25 17:32:57 | 000,856,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mswdat10.dll
[2010.08.25 17:32:57 | 000,799,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certutil.exe
[2010.08.25 17:32:57 | 000,560,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdtcprx.dll
[2010.08.25 17:32:57 | 000,396,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ipsmsnap.dll
[2010.08.25 17:32:57 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\reg.exe
[2010.08.25 17:32:57 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msjter40.dll
[2010.08.25 17:32:57 | 000,038,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtffilt.dll
[2010.08.25 17:32:57 | 000,035,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\infocardcpl.cpl
[2010.08.25 17:32:56 | 000,996,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMNetMgr.dll
[2010.08.25 17:32:56 | 000,704,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PhotoScreensaver.scr
[2010.08.25 17:32:56 | 000,274,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\bcrypt.dll
[2010.08.25 17:32:56 | 000,226,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbport.sys
[2010.08.25 17:32:56 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshooks.dll
[2010.08.25 17:32:55 | 000,332,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msihnd.dll
[2010.08.25 17:32:55 | 000,241,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rsaenh.dll
[2010.08.25 17:32:55 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscntrs.dll
[2010.08.25 17:32:54 | 000,310,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mtxclu.dll
[2010.08.25 17:32:54 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MMDevAPI.dll
[2010.08.25 17:32:54 | 000,122,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetpp.dll
[2010.08.25 17:32:54 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msstrc.dll
[2010.08.25 17:32:54 | 000,035,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TsWpfWrp.exe
[2010.08.25 17:32:53 | 000,343,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
[2010.08.25 17:32:53 | 000,153,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fundisc.dll
[2010.08.25 17:32:53 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dhcpcsvc6.dll
[2010.08.25 17:32:53 | 000,080,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscories.dll
[2010.08.25 17:32:52 | 001,671,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\chsbrkr.dll
[2010.08.25 17:32:52 | 001,020,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wdc.dll
[2010.08.25 17:32:52 | 000,125,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\Classpnp.sys
[2010.08.25 17:32:52 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imapi.dll
[2010.08.25 17:32:52 | 000,093,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Kswdmcap.ax
[2010.08.25 17:32:51 | 001,823,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pnidui.dll
[2010.08.25 17:32:51 | 000,636,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\autofmt.exe
[2010.08.25 17:32:51 | 000,252,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iassdo.dll
[2010.08.25 17:32:51 | 000,009,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\icardres.dll
[2010.08.25 17:32:50 | 000,757,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\azroles.dll
[2010.08.25 17:32:50 | 000,633,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CertEnrollUI.dll
[2010.08.25 17:32:50 | 000,242,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pdh.dll
[2010.08.25 17:32:50 | 000,122,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\Storport.sys
[2010.08.25 17:32:50 | 000,109,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ataport.sys
[2010.08.25 17:32:50 | 000,050,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PSHED.DLL
[2010.08.25 17:32:50 | 000,035,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\crashdmp.sys
[2010.08.25 17:32:49 | 001,107,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pidgenx.dll
[2010.08.25 17:32:49 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sysmon.ocx
[2010.08.25 17:32:48 | 002,205,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SyncCenter.dll
[2010.08.25 17:32:48 | 000,867,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll
[2010.08.25 17:32:47 | 001,502,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certmgr.dll
[2010.08.25 17:32:47 | 000,627,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sethc.exe
[2010.08.25 17:32:47 | 000,593,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\comuid.dll
[2010.08.25 17:32:47 | 000,324,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\untfs.dll
[2010.08.25 17:32:47 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2010.08.25 17:32:47 | 000,182,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iassam.dll
[2010.08.25 17:32:47 | 000,180,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\scrobj.dll
[2010.08.25 17:32:47 | 000,017,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\kd1394.dll
[2010.08.25 17:32:46 | 000,413,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imkr80.ime
[2010.08.25 17:32:46 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
[2010.08.25 17:32:46 | 000,244,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wisptis.exe
[2010.08.25 17:32:46 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasnap.dll
[2010.08.25 17:32:46 | 000,099,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\FWPKCLNT.SYS
[2010.08.25 17:32:45 | 000,656,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\autoconv.exe
[2010.08.25 17:32:44 | 001,541,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\onex.dll
[2010.08.25 17:32:44 | 000,375,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2010.08.25 17:32:44 | 000,273,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wow32.dll
[2010.08.25 17:32:44 | 000,182,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\osk.exe
[2010.08.25 17:32:44 | 000,135,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cscript.exe
[2010.08.25 17:32:44 | 000,130,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\basecsp.dll
[2010.08.25 17:32:44 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\audiodg.exe
[2010.08.25 17:32:44 | 000,027,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\Dumpata.sys
[2010.08.25 17:32:44 | 000,017,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\kdcom.dll
[2010.08.25 17:32:43 | 000,019,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\kdusb.dll
[2010.08.25 17:32:43 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spcmsg.dll
[2010.08.25 17:32:42 | 000,340,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RelMon.dll
[2010.08.25 17:32:41 | 000,612,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpencom.dll
[2010.08.25 17:32:40 | 000,564,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msftedit.dll
[2010.08.25 17:32:40 | 000,115,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WinSCard.dll
[2010.08.25 17:32:39 | 000,860,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WerFaultSecure.exe
[2010.08.25 17:32:39 | 000,194,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\offfilt.dll
[2010.08.25 17:32:38 | 001,827,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2010.08.25 17:32:38 | 000,638,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Utilman.exe
[2010.08.25 17:32:38 | 000,217,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WerFault.exe
[2010.08.25 17:32:38 | 000,208,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfplat.dll
[2010.08.25 17:32:38 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsepno.dll
[2010.08.25 17:32:37 | 000,852,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mcmde.dll
[2010.08.25 17:32:37 | 000,230,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\diskraid.exe
[2010.08.25 17:32:37 | 000,197,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SndVol.exe
[2010.08.25 17:32:36 | 000,551,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\prnntfy.dll
[2010.08.25 17:32:36 | 000,391,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscms.dll
[2010.08.25 17:32:36 | 000,179,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msnetobj.dll
[2010.08.25 17:32:36 | 000,114,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbccp32.dll
[2010.08.25 17:32:36 | 000,103,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sysclass.dll
[2010.08.25 17:32:36 | 000,075,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\adsmsext.dll
[2010.08.25 17:32:36 | 000,047,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasdatastore.dll
[2010.08.25 17:32:35 | 000,444,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dsound.dll
[2010.08.25 17:32:35 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ulib.dll
[2010.08.25 17:32:34 | 000,091,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IPHLPAPI.DLL
[2010.08.25 17:32:33 | 000,223,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wscntfy.dll
[2010.08.25 17:32:33 | 000,181,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pnpsetup.dll
[2010.08.25 17:32:33 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rastapi.dll
[2010.08.25 17:32:32 | 001,342,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\brcpl.dll
[2010.08.25 17:32:32 | 000,759,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ipsecsnp.dll
[2010.08.25 17:32:32 | 000,507,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vdsdyn.dll
[2010.08.25 17:32:32 | 000,399,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlangpui.dll
[2010.08.25 17:32:32 | 000,119,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\diskpart.exe
[2010.08.25 17:32:32 | 000,075,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gpapi.dll
[2010.08.25 17:32:32 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iashlpr.dll
[2010.08.25 17:32:32 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\logman.exe
[2010.08.25 17:32:32 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fdProxy.dll
[2010.08.25 17:32:31 | 001,575,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVENCOD.DLL
[2010.08.25 17:32:31 | 000,286,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rasapi32.dll
[2010.08.25 17:32:31 | 000,216,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntprint.dll
[2010.08.25 17:32:31 | 000,155,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscorier.dll
[2010.08.25 17:32:30 | 002,225,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netcenter.dll
[2010.08.25 17:32:30 | 001,580,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wpccpl.dll
[2010.08.25 17:32:30 | 000,158,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasrad.dll
[2010.08.25 17:32:30 | 000,140,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wusa.exe
[2010.08.25 17:32:30 | 000,060,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\findstr.exe
[2010.08.25 17:32:29 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wer.dll
[2010.08.25 17:32:29 | 000,825,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rasdlg.dll
[2010.08.25 17:32:29 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iassvcs.dll
[2010.08.25 17:32:28 | 001,152,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\themecpl.dll
[2010.08.25 17:32:28 | 000,050,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsnmp32.dll
[2010.08.25 17:32:27 | 000,777,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\slcc.dll
[2010.08.25 17:32:27 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\scansetting.dll
[2010.08.25 17:32:27 | 000,163,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msutb.dll
[2010.08.25 17:32:27 | 000,135,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wshom.ocx
[2010.08.25 17:32:27 | 000,084,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstlsapi.dll
[2010.08.25 17:32:27 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasads.dll
[2010.08.25 17:32:27 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssprxy.dll
[2010.08.25 17:32:26 | 003,072,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\networkmap.dll
[2010.08.25 17:32:26 | 001,248,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PerfCenterCPL.dll
[2010.08.25 17:32:26 | 000,723,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\powercpl.dll
[2010.08.25 17:32:26 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ks.sys
[2010.08.25 17:32:26 | 000,098,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\powrprof.dll
[2010.08.25 17:32:26 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasacct.dll
[2010.08.25 17:32:25 | 001,645,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\connect.dll
[2010.08.25 17:32:25 | 001,224,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sud.dll
[2010.08.25 17:32:25 | 000,842,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\systemcpl.dll
[2010.08.25 17:32:25 | 000,464,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pcaui.dll
[2010.08.25 17:32:25 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\newdev.exe
[2010.08.25 17:32:24 | 002,515,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\accessibilitycpl.dll
[2010.08.25 17:32:24 | 001,123,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\usercpl.dll
[2010.08.25 17:32:24 | 000,516,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\autoplay.dll
[2010.08.25 17:32:24 | 000,497,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll
[2010.08.25 17:32:24 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mmci.dll
[2010.08.25 17:32:23 | 001,671,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanpref.dll
[2010.08.25 17:32:23 | 000,532,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wpcao.dll
[2010.08.25 17:32:23 | 000,408,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msinfo32.exe
[2010.08.25 17:32:23 | 000,230,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2010.08.25 17:32:23 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\scksp.dll
[2010.08.25 17:32:23 | 000,128,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vdsutil.dll
[2010.08.25 17:32:23 | 000,127,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rpchttp.dll
[2010.08.25 17:32:23 | 000,089,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pintlgnt.ime
[2010.08.25 17:32:23 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\regapi.dll
[2010.08.25 17:32:23 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\feclient.dll
[2010.08.25 17:32:22 | 000,306,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\scesrv.dll
[2010.08.25 17:32:22 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll
[2010.08.25 17:32:22 | 000,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Faultrep.dll
[2010.08.25 17:32:22 | 000,115,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\AudioSes.dll
[2010.08.25 17:32:22 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleprn.dll
[2010.08.25 17:32:22 | 000,075,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dot3msm.dll
[2010.08.25 17:32:22 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rekeywiz.exe
[2010.08.25 17:32:22 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iaspolcy.dll
[2010.08.25 17:32:22 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wscisvif.dll
[2010.08.25 17:32:21 | 001,689,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wscui.cpl
[2010.08.25 17:32:21 | 001,169,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sdclt.exe
[2010.08.25 17:32:21 | 000,407,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpapimig.exe
[2010.08.25 17:32:21 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DeviceEject.exe
[2010.08.25 17:32:20 | 000,642,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rasgcw.dll
[2010.08.25 17:32:20 | 000,595,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FWPUCLNT.DLL
[2010.08.25 17:32:20 | 000,542,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pnpui.dll
[2010.08.25 17:32:20 | 000,505,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qedit.dll
[2010.08.25 17:32:20 | 000,445,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncryptui.dll
[2010.08.25 17:32:20 | 000,215,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certreq.exe
[2010.08.25 17:32:20 | 000,177,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\scecli.dll
[2010.08.25 17:32:20 | 000,080,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\hdwwiz.exe
[2010.08.25 17:32:20 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\perfdisk.dll
[2010.08.25 17:32:19 | 000,376,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rasplap.dll
[2010.08.25 17:32:19 | 000,170,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tcpipcfg.dll
[2010.08.25 17:32:19 | 000,167,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\portcls.sys
[2010.08.25 17:32:19 | 000,135,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tcpmon.dll
[2010.08.25 17:32:19 | 000,134,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SmartcardCredentialProvider.dll
[2010.08.25 17:32:19 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fdWSD.dll
[2010.08.25 17:32:19 | 000,058,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PnPUnattend.exe
[2010.08.25 17:32:19 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cmmon32.exe
[2010.08.25 17:32:19 | 000,038,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TSTheme.exe
[2010.08.25 17:32:19 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\whealogr.dll
[2010.08.25 17:32:19 | 000,025,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\USBCAMD2.sys
[2010.08.25 17:32:19 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spwinsat.dll
[2010.08.25 17:32:18 | 000,657,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVXENCD.DLL
[2010.08.25 17:32:18 | 000,547,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wiaaut.dll
[2010.08.25 17:32:18 | 000,481,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cmdial32.dll
[2010.08.25 17:32:18 | 000,378,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\srcore.dll
[2010.08.25 17:32:18 | 000,281,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\raschap.dll
[2010.08.25 17:32:18 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\unimdm.tsp
[2010.08.25 17:32:18 | 000,275,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SnippingTool.exe
[2010.08.25 17:32:18 | 000,202,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanui.dll
[2010.08.25 17:32:18 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
[2010.08.25 17:32:18 | 000,025,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\USBCAMD.sys
[2010.08.25 17:32:17 | 000,425,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\shwebsvc.dll
[2010.08.25 17:32:17 | 000,259,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rasppp.dll
[2010.08.25 17:32:17 | 000,137,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dsprop.dll
[2010.08.25 17:32:17 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PnPutil.exe
[2010.08.25 17:32:16 | 002,153,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oobefldr.dll
[2010.08.25 17:32:16 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\modemui.dll
[2010.08.25 17:32:16 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscandui.dll
[2010.08.25 17:32:16 | 000,155,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rasmontr.dll
[2010.08.25 17:32:16 | 000,101,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\shsetup.dll
[2010.08.25 17:32:16 | 000,054,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dimsroam.dll
[2010.08.25 17:32:15 | 006,103,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\chtbrkr.dll
[2010.08.25 17:32:15 | 000,542,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\blackbox.dll
[2010.08.25 17:32:15 | 000,533,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmdrmsdk.dll
[2010.08.25 17:32:15 | 000,083,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlgpclnt.dll
[2010.08.25 17:32:15 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dataclen.dll
[2010.08.25 17:32:14 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010.08.25 17:32:14 | 000,303,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpeffects.dll
[2010.08.25 17:32:14 | 000,178,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\credui.dll
[2010.08.25 17:32:14 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSDMon.dll
[2010.08.25 17:32:14 | 000,113,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\rmcast.sys
[2010.08.25 17:32:14 | 000,107,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2010.08.25 17:32:13 | 002,226,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\networkexplorer.dll
[2010.08.25 17:32:13 | 000,058,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cipher.exe
[2010.08.25 17:32:13 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ifmon.dll
[2010.08.25 17:32:12 | 000,414,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscp.dll
[2010.08.25 17:32:12 | 000,313,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\thawbrkr.dll
[2010.08.25 17:32:12 | 000,217,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\InkEd.dll
[2010.08.25 17:32:12 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2010.08.25 17:32:12 | 000,128,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gpresult.exe
[2010.08.25 17:32:12 | 000,094,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\logagent.exe
[2010.08.25 17:32:12 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wscapi.dll
[2010.08.25 17:32:12 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\watchdog.sys
[2010.08.25 17:32:12 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msimtf.dll
[2010.08.25 17:32:11 | 000,356,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MediaMetadataHandler.dll
[2010.08.25 17:32:11 | 000,125,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\softkbd.dll
[2010.08.25 17:32:11 | 000,105,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dmsynth.dll
[2010.08.25 17:32:11 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msctfui.dll
[2010.08.25 17:32:10 | 000,284,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drmmgrtn.dll
[2010.08.25 17:32:10 | 000,200,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\input.dll
[2010.08.25 17:32:10 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax
[2010.08.25 17:32:10 | 000,166,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\puiapi.dll
[2010.08.25 17:32:10 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ExplorerFrame.dll
[2010.08.25 17:32:08 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SLLUA.exe
[2010.08.25 17:32:08 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mprapi.dll
[2010.08.25 17:32:08 | 000,080,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax
[2010.08.25 17:32:08 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fc.exe
[2010.08.25 17:32:08 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msisip.dll
[2010.08.25 17:32:07 | 000,187,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\eapp3hst.dll
[2010.08.25 17:32:07 | 000,125,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tintlgnt.ime
[2010.08.25 17:32:07 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dmusic.dll
[2010.08.25 17:32:07 | 000,083,456 | ---- | C] (Microsoft) -- C:\Windows\System32\SMBHelperClass.dll
[2010.08.25 17:32:07 | 000,068,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fdSSDP.dll
[2010.08.25 17:32:07 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\l2nacp.dll
[2010.08.25 17:32:07 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\bthci.dll
[2010.08.25 17:32:07 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ftp.exe
[2010.08.25 17:32:07 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cscapi.dll
[2010.08.25 17:32:07 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msjint40.dll
[2010.08.25 17:32:07 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsdchngr.dll
[2010.08.25 17:32:07 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MsCtfMonitor.dll
[2010.08.25 17:32:06 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\eappcfg.dll
[2010.08.25 17:32:06 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nslookup.exe
[2010.08.25 17:32:06 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fdWCN.dll
[2010.08.25 17:32:06 | 000,063,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tscupgrd.exe
[2010.08.25 17:32:06 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Storprop.dll
[2010.08.25 17:32:06 | 000,052,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rasdiag.dll
[2010.08.25 17:32:06 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2010.08.25 17:32:06 | 000,049,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dot3cfg.dll
[2010.08.25 17:32:06 | 000,042,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\slcinst.dll
[2010.08.25 17:32:06 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\networkitemfactory.dll
[2010.08.25 17:32:06 | 000,034,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\bthudtask.exe
[2010.08.25 17:32:06 | 000,026,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ipconfig.exe
[2010.08.25 17:32:06 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rasdial.exe
[2010.08.25 17:32:06 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CHxReadingStringIME.dll
[2010.08.25 17:32:05 | 000,093,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\eappgnui.dll
[2010.08.25 17:32:05 | 000,053,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fdeploy.dll
[2010.08.25 17:32:05 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\hbaapi.dll
[2010.08.25 17:32:05 | 000,039,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\hidclass.sys
[2010.08.25 17:32:05 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ocsetup.exe
[2010.08.25 17:32:05 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FwRemoteSvr.dll
[2010.08.25 17:32:04 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PNPXAssoc.dll
[2010.08.25 17:32:04 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cbsra.exe
[2010.08.25 17:32:04 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gpupdate.exe
[2010.08.25 17:32:04 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mmcico.dll
[2010.08.25 17:32:03 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxg.sys
[2010.08.25 17:32:03 | 000,046,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrstub.exe
[2010.08.25 17:32:03 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbcconf.dll
[2010.08.25 17:32:03 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\bitsigd.dll
[2010.08.25 17:32:03 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NcdProp.dll
[2010.08.25 17:32:03 | 000,017,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vdmdbg.dll
[2010.08.25 17:32:03 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iscsilog.dll
[2010.08.25 17:32:02 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\Diskdump.sys
[2010.08.25 17:32:02 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetppui.dll
[2010.08.25 17:32:02 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\slwga.dll
[2010.08.25 17:32:00 | 000,052,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\stream.sys
[2010.08.25 17:32:00 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\RNDISMP.sys
[2010.08.25 17:31:59 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2010.08.25 17:31:59 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usb8023.sys
[2010.08.25 17:31:58 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\f3ahvoas.dll
[2010.08.25 17:31:58 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msimsg.dll
[2010.08.25 17:30:59 | 000,705,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SmiEngine.dll
[2010.08.25 17:30:29 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wdscore.dll
[2010.08.25 17:30:28 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PkgMgr.exe
[2010.08.25 17:29:45 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drvstore.dll
[2008.12.27 17:31:19 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\Chris\AppData\Roaming\pcouffin.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Chris\Desktop\*.tmp files -> C:\Users\Chris\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.09.24 16:22:22 | 004,980,736 | ---- | M] () -- C:\Users\Chris\ntuser.dat
[2010.09.24 16:17:23 | 000,135,807 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.09.24 16:17:21 | 000,135,807 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.09.24 16:17:08 | 000,000,500 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job
[2010.09.24 16:17:02 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.09.24 16:17:01 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.09.24 16:16:55 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.09.24 16:16:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.09.24 16:15:55 | 000,524,288 | -HS- | M] () -- C:\Users\Chris\ntuser.dat{36c4e9bc-9269-11df-8dcc-0019db31987c}.TMContainer00000000000000000001.regtrans-ms
[2010.09.24 16:15:55 | 000,065,536 | -HS- | M] () -- C:\Users\Chris\ntuser.dat{36c4e9bc-9269-11df-8dcc-0019db31987c}.TM.blf
[2010.09.24 16:14:21 | 002,780,395 | -H-- | M] () -- C:\Users\Chris\AppData\Local\IconCache.db
[2010.09.24 16:08:12 | 000,000,116 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2010.09.24 16:07:21 | 000,019,456 | ---- | M] () -- C:\Users\Chris\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.09.23 22:46:56 | 000,000,263 | ---- | M] () -- C:\Windows\system.ini
[2010.09.23 22:46:46 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010.09.23 14:02:20 | 000,003,083 | ---- | M] () -- C:\Users\Chris\Desktop\resetdma.vbs
[2010.09.23 10:47:43 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.23 03:32:05 | 001,512,574 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.09.23 03:32:05 | 000,654,650 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.09.23 03:32:05 | 000,616,532 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.09.23 03:32:05 | 000,137,000 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.09.23 03:32:05 | 000,112,060 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.09.23 03:20:51 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2010.09.22 16:09:04 | 000,417,312 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.09.22 15:36:55 | 000,118,904 | ---- | M] () -- C:\Users\Chris\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.09.22 13:52:49 | 000,047,360 | ---- | M] (VSO Software) -- C:\Users\Chris\AppData\Roaming\pcouffin.sys
[2010.09.22 13:52:49 | 000,007,887 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\pcouffin.cat
[2010.09.22 13:52:48 | 000,001,144 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\pcouffin.inf
[2010.09.22 13:48:07 | 000,050,876 | ---- | M] () -- C:\Users\Chris\Documents\cc_20100922_134735.reg
[2010.09.22 13:43:05 | 000,000,810 | ---- | M] () -- C:\Users\Chris\Desktop\CCleaner.lnk
[2010.09.21 23:49:56 | 000,001,934 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox 4.0 Beta 6.lnk
[2010.09.21 22:33:51 | 000,000,402 | ---- | M] () -- C:\Windows\wininit.ini
[2010.09.21 10:40:49 | 000,411,721 | ---- | M] () -- C:\Users\Chris\Desktop\diplomarbeit_endversion.pdf
[2010.09.21 00:18:45 | 000,000,321 | ---- | M] () -- C:\Windows\homeDVD-Fotos5_5.INI
[2010.09.18 23:55:42 | 006,392,926 | ---- | M] () -- C:\Users\Chris\Desktop\[Vimeo-6913208] Daniel Lanois - White Mustang II.mp4
[2010.09.01 18:11:06 | 180,974,464 | ---- | M] () -- C:\Users\Chris\Desktop\kentucky.flv
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Chris\Desktop\*.tmp files -> C:\Users\Chris\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.09.23 19:43:27 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010.09.23 19:43:27 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010.09.23 19:43:27 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010.09.23 19:43:27 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010.09.23 19:43:27 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010.09.23 14:02:15 | 000,003,083 | ---- | C] () -- C:\Users\Chris\Desktop\resetdma.vbs
[2010.09.23 10:47:43 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.23 03:20:51 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2010.09.22 13:47:38 | 000,050,876 | ---- | C] () -- C:\Users\Chris\Documents\cc_20100922_134735.reg
[2010.09.22 13:43:05 | 000,000,810 | ---- | C] () -- C:\Users\Chris\Desktop\CCleaner.lnk
[2010.09.21 23:49:53 | 000,001,934 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox 4.0 Beta 6.lnk
[2010.09.21 10:40:49 | 000,411,721 | ---- | C] () -- C:\Users\Chris\Desktop\diplomarbeit_endversion.pdf
[2010.09.19 19:35:38 | 180,974,464 | ---- | C] () -- C:\Users\Chris\Desktop\kentucky.flv
[2010.09.19 19:30:35 | 733,956,096 | ---- | C] () -- C:\Users\Chris\Desktop\Pirates.of.Ghost.Island.German.2007.FS..avi
[2010.09.18 23:55:32 | 006,392,926 | ---- | C] () -- C:\Users\Chris\Desktop\[Vimeo-6913208] Daniel Lanois - White Mustang II.mp4
[2010.09.02 21:29:44 | 006,763,308 | ---- | C] () -- C:\Users\Chris\Desktop\03-yolanda_be_cool_and_dcup_-_we_no_speak_americano.mp3
[2010.08.29 20:35:39 | 244,332,544 | ---- | C] () -- C:\Users\Chris\Desktop\atg-dlah.avi
[2010.08.25 17:33:30 | 000,130,008 | ---- | C] () -- C:\Windows\System32\systemsf.ebd
[2010.08.25 17:33:28 | 000,009,239 | ---- | C] () -- C:\Windows\System32\spcinstrumentation.man
[2010.08.25 17:33:19 | 000,442,788 | ---- | C] () -- C:\Windows\System32\dot3.tmf
[2010.08.25 17:33:17 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010.08.25 17:33:16 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010.08.25 17:33:14 | 003,662,128 | ---- | C] () -- C:\Windows\System32\locale.nls
[2010.08.25 17:33:13 | 000,392,170 | ---- | C] () -- C:\Windows\System32\onex.tmf
[2010.08.25 17:33:08 | 000,344,698 | ---- | C] () -- C:\Windows\System32\eaphost.tmf
[2010.08.25 17:32:52 | 000,208,966 | ---- | C] () -- C:\Windows\System32\WFP.TMF
[2010.08.25 17:32:50 | 000,092,918 | ---- | C] () -- C:\Windows\System32\slmgr.vbs
[2010.08.25 17:32:02 | 000,009,212 | ---- | C] () -- C:\Windows\System32\RacUR.xml
[2010.08.25 17:31:54 | 000,000,153 | ---- | C] () -- C:\Windows\System32\RacUREx.xml
[2010.04.02 17:17:34 | 000,179,091 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2009.12.29 02:25:39 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2009.12.19 13:36:31 | 000,135,807 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.12.19 13:36:30 | 000,135,807 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.06.19 20:06:22 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2009.03.24 18:19:25 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2009.03.24 18:19:24 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2009.03.24 18:19:24 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2008.12.28 19:37:03 | 000,000,671 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\vso_ts_preview.xml
[2008.12.27 17:34:30 | 000,000,033 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\pcouffin.log
[2008.12.27 17:31:19 | 000,007,887 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\pcouffin.cat
[2008.12.27 17:31:19 | 000,001,144 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\pcouffin.inf
[2008.08.27 02:01:40 | 000,001,025 | ---- | C] () -- C:\Windows\System32\sysprs7.dll
[2008.08.27 02:00:40 | 000,001,024 | ---- | C] () -- C:\Windows\System32\clauth2.dll
[2008.08.27 02:00:40 | 000,001,024 | ---- | C] () -- C:\Windows\System32\clauth1.dll
[2008.08.27 02:00:40 | 000,000,000 | ---- | C] () -- C:\Windows\System32\ssprs.dll
[2008.08.27 02:00:40 | 000,000,000 | ---- | C] () -- C:\Windows\System32\serauth2.dll
[2008.08.27 02:00:40 | 000,000,000 | ---- | C] () -- C:\Windows\System32\serauth1.dll
[2008.08.27 02:00:40 | 000,000,000 | ---- | C] () -- C:\Windows\System32\nsprs.dll
[2008.06.23 14:02:02 | 000,097,410 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4
[2008.05.31 12:23:51 | 000,138,184 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2008.05.23 18:48:50 | 000,020,270 | ---- | C] () -- C:\ProgramData\DeviceInstaller.xml
[2008.05.15 17:46:34 | 000,000,000 | ---- | C] () -- C:\Windows\tosOBEX.INI
[2008.05.15 17:46:25 | 000,000,098 | ---- | C] () -- C:\Windows\WirelessFTP.INI
[2008.04.01 16:56:08 | 000,271,360 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2008.04.01 16:56:06 | 000,018,048 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2007.12.14 17:32:08 | 000,000,321 | ---- | C] () -- C:\Windows\homeDVD-Fotos5_5.INI
[2007.11.30 18:08:17 | 000,000,025 | ---- | C] () -- C:\Windows\cdplayer.ini
[2007.11.22 14:53:48 | 000,000,016 | -H-- | C] () -- C:\ProgramData\mxfilerelatedcache.mxc2
[2007.11.18 12:25:48 | 000,000,016 | -H-- | C] () -- C:\Programme\mxfilerelatedcache.mxc2
[2007.09.26 22:17:59 | 000,394,240 | ---- | C] () -- C:\Windows\System32\Smab.dll
[2007.09.26 22:17:59 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2007.09.09 14:32:52 | 000,135,168 | ---- | C] () -- C:\Windows\System32\DVDEncoder.dll
[2007.09.08 16:30:29 | 000,006,768 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2007.08.03 16:29:58 | 000,065,536 | ---- | C] () -- C:\Windows\System32\DVDKeyAuth.dll
[2007.05.29 08:55:10 | 000,008,220 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2007.05.28 18:52:17 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2007.04.08 19:51:16 | 000,000,116 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2007.04.08 19:12:41 | 000,000,000 | ---- | C] () -- C:\Windows\Irremote.ini
[2007.04.08 16:45:56 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib
[2007.03.09 00:32:11 | 000,000,552 | ---- | C] () -- C:\Users\Chris\AppData\Local\d3d8caps.dat
[2007.03.01 22:58:48 | 000,008,704 | ---- | C] () -- C:\Windows\System32\CNMVS78.DLL
[2007.02.28 17:44:53 | 000,000,680 | ---- | C] () -- C:\Users\Chris\AppData\Local\d3d9caps.dat
[2007.02.27 16:05:43 | 000,000,646 | ---- | C] () -- C:\Windows\ODBC.INI
[2007.02.27 04:47:14 | 000,000,632 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\wklnhst.dat
[2007.02.27 04:38:15 | 000,000,402 | ---- | C] () -- C:\Windows\wininit.ini
[2007.02.27 03:32:35 | 000,019,456 | ---- | C] () -- C:\Users\Chris\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.10.27 09:26:56 | 000,069,632 | ---- | C] () -- C:\Windows\System32\vuins32.dll
[2006.04.13 11:30:06 | 001,073,152 | ---- | C] () -- C:\Windows\System32\libmysql_c.dll
[2004.12.14 13:04:48 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2004.12.14 13:02:49 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2004.12.02 15:20:18 | 000,114,688 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll
[2004.09.22 10:09:06 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll
[2004.08.30 13:26:16 | 000,389,120 | ---- | C] () -- C:\Windows\System32\xvid.dll
[2004.07.20 17:04:02 | 000,094,208 | ---- | C] () -- C:\Windows\System32\TosBtHcrpAPI.dll
[2004.01.15 14:43:28 | 000,114,688 | ---- | C] () -- C:\Windows\System32\TBTMonUI.dll
[2003.07.29 15:33:26 | 000,061,440 | ---- | C] () -- C:\Windows\System32\TosHidAPI.dll
[2000.04.10 12:33:28 | 000,027,494 | ---- | C] () -- C:\Programme\Troubleshooting.htm
[2000.04.10 12:31:42 | 000,054,272 | ---- | C] () -- C:\Programme\Troubleshooting.doc
[2000.04.10 12:31:42 | 000,021,473 | ---- | C] () -- C:\Programme\Update.txt
 
========== LOP Check ==========
 
[2007.07.01 12:06:22 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Azureus
[2009.03.04 03:19:15 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\BitTorrent
[2007.03.01 23:13:01 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\CD-LabelPrint
[2010.06.04 17:46:53 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\cerasus.media
[2008.10.17 11:52:40 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2010.07.29 15:35:45 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\DVDVideoSoftIEHelpers
[2007.04.03 01:38:43 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\EBookSys
[2010.07.12 07:09:34 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\gtk-2.0
[2010.09.21 19:57:25 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\ICQ
[2007.03.01 19:20:41 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\ICQLite
[2008.11.21 18:16:03 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Leadertech
[2010.05.12 21:55:50 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\LolClient
[2009.12.14 17:40:19 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\LolClient.F24C99354F615F3BAB18AE7B93E3F9B9E8784FA6.1
[2007.11.29 20:51:49 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\MAGIX
[2007.07.22 15:07:14 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\My Games
[2007.05.03 12:38:42 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Pegasys Inc
[2008.03.27 00:22:45 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Screaming Bee
[2007.05.05 18:58:39 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\SlySoft
[2007.02.27 04:59:53 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Template
[2010.09.24 16:19:46 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Thunderbird
[2010.07.18 18:15:33 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\TS3Client
[2007.04.08 19:21:20 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\TuneUp Software
[2010.07.24 15:27:18 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\uTorrent
[2009.10.26 17:49:35 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Vodafone
[2010.09.22 13:52:51 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Vso
[2010.09.24 16:17:08 | 000,000,500 | ---- | M] () -- C:\Windows\Tasks\1-Klick-Wartung.job
[2010.09.24 16:15:23 | 000,032,560 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2007.02.25 10:27:30 | 000,904,439 | ---- | C] ()(C:\Umweltbewu?tsein 2006.pdf) -- C:\Umweltbewußtsein 2006.pdf
[2007.02.22 22:57:32 | 000,904,439 | ---- | M] ()(C:\Umweltbewu?tsein 2006.pdf) -- C:\Umweltbewußtsein 2006.pdf
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:9AEE100C
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:94A19129
< End of report >
         

OTL Extras logfile created on: 24.09.2010 16:19:10 - Run 2
OTL by OldTimer - Version 3.2.14.1     Folder = C:\Users\*****\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 59,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 221,17 Gb Total Space | 84,96 Gb Free Space | 38,41% Space Free | Partition Type: NTFS
Drive D: | 232,88 Gb Total Space | 22,24 Gb Free Space | 9,55% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 7,05 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: *****
Current User Name: *****
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox 4.0 Beta 6\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" File not found
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- File not found
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03EE9235-A150-4C48-A164-D96B2F99AFB7}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{066D68DE-63AF-43A9-9012-9FEF7D48F5E3}" = lport=6956 | protocol=17 | dir=in | name=league of legends launcher | 
"{0A703FF0-EFBB-4968-A2C9-C493CBE64386}" = lport=6952 | protocol=6 | dir=in | name=league of legends launcher | 
"{0C95C3C9-0CFB-4159-A246-C8688714ED7A}" = lport=6956 | protocol=6 | dir=in | name=league of legends launcher | 
"{0DF2FD9B-4513-46F6-9B76-6C4989FEBF3A}" = lport=6901 | protocol=17 | dir=in | name=league of legends launcher | 
"{140689CA-D425-4CE6-967B-058BA9C1CF53}" = lport=6995 | protocol=6 | dir=in | name=league of legends launcher | 
"{1497D9C3-3E35-4C3C-9EDC-BE7B7DC3854D}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher | 
"{190466B0-5961-4BAC-BB81-7EB15C82B4CE}" = lport=8370 | protocol=17 | dir=in | name=league of legends launcher | 
"{1CC74DCB-51A2-444A-9E5B-FE4FAC925AC2}" = lport=6949 | protocol=6 | dir=in | name=league of legends launcher | 
"{20F9B4B5-7759-4A5B-BA2F-B527650A64CC}" = lport=6889 | protocol=6 | dir=in | name=league of legends launcher | 
"{22FE3D0A-B97C-4066-A25E-15F06353160D}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{2448302D-E526-409C-B8BE-BD3525E5113E}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher | 
"{25B61A8C-5486-40B1-921E-378312EB772E}" = lport=6986 | protocol=17 | dir=in | name=league of legends launcher | 
"{27240012-512C-47DB-B4DC-A92A79A58956}" = lport=6895 | protocol=17 | dir=in | name=league of legends launcher | 
"{2D4031D5-BE66-4D98-9339-C7A96B8268B4}" = lport=6986 | protocol=6 | dir=in | name=league of legends launcher | 
"{329C30BD-1177-474F-B6D9-8EA02B2BA784}" = lport=6895 | protocol=6 | dir=in | name=league of legends launcher | 
"{35E21838-828B-4A7B-9CBB-ABE4E5FC3761}" = lport=6898 | protocol=6 | dir=in | name=league of legends launcher | 
"{37730209-90A4-434F-A350-3E714E9FBC35}" = lport=6901 | protocol=6 | dir=in | name=league of legends launcher | 
"{37774D1E-BE44-4D62-924A-EE6837E7BFEC}" = lport=6893 | protocol=6 | dir=in | name=league of legends launcher | 
"{39406F6B-C809-4471-BAB5-E9C21F66EBE7}" = lport=6908 | protocol=17 | dir=in | name=league of legends launcher | 
"{3BC42903-9C7A-49FA-90EF-82A837185643}" = lport=6953 | protocol=17 | dir=in | name=league of legends launcher | 
"{3DAC5C44-F917-42D8-AFD0-35DE83269FE1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{41EFC53D-ECDE-44AD-8184-F650D3C8AC0D}" = lport=8393 | protocol=17 | dir=in | name=league of legends lobby | 
"{432F34CA-8AF7-4E92-9692-BF35A74F0231}" = lport=8372 | protocol=17 | dir=in | name=league of legends launcher | 
"{4C6A5397-29EF-4C6B-AFDD-B2D39177EDFB}" = lport=6972 | protocol=6 | dir=in | name=league of legends launcher | 
"{4EB3712A-6AF0-45BD-80E7-AF24F9A6B3F6}" = lport=6977 | protocol=17 | dir=in | name=league of legends launcher | 
"{5087BBAD-24ED-4907-A689-F4B0DA66B3B8}" = lport=6908 | protocol=6 | dir=in | name=league of legends launcher | 
"{50D2B35C-471D-4D8D-AE01-69585A6AD79C}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{50D54AE2-05C7-4B67-85F5-CAC63FCDB9F7}" = lport=6960 | protocol=6 | dir=in | name=league of legends launcher | 
"{61C11934-9246-4A90-A661-9D450E550D54}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher | 
"{629FD325-4BAD-4146-A33B-77D4C2B0894E}" = lport=6903 | protocol=6 | dir=in | name=league of legends launcher | 
"{634498EB-2F64-4FBE-9249-0736C6698BBE}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 | 
"{6388FD9A-1579-4A80-9C12-908A192EDEBE}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{64C34451-83E4-447C-A4F7-DF1B5D5D1CC7}" = lport=6969 | protocol=6 | dir=in | name=league of legends launcher | 
"{65FAE782-6C85-4555-B857-7FF406AABCFF}" = lport=6933 | protocol=17 | dir=in | name=league of legends launcher | 
"{67689128-4BF1-451A-BE43-4803F7D8C543}" = lport=6903 | protocol=17 | dir=in | name=league of legends launcher | 
"{69A341C9-2A4E-4F22-864C-EF08D8A1DA68}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{69FF6524-D405-419C-AEAD-69C0358E9A09}" = lport=6972 | protocol=17 | dir=in | name=league of legends launcher | 
"{6E79D311-3E3C-4EAF-AD69-DB3EA343FB20}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{6F7E3855-003D-4DB2-920C-21AC1EFE52C8}" = lport=6952 | protocol=17 | dir=in | name=league of legends launcher | 
"{7010BC55-C976-429B-8720-46A5D205C49B}" = lport=8370 | protocol=6 | dir=in | name=league of legends launcher | 
"{70BDAFDB-BDD7-4220-B0DB-FF96F70A8728}" = lport=6969 | protocol=17 | dir=in | name=league of legends launcher | 
"{72B4E501-7A25-4723-956D-03D7856B8713}" = lport=6932 | protocol=17 | dir=in | name=league of legends launcher | 
"{74BF6771-F133-40FA-B57A-77EA0C9D32CA}" = lport=6933 | protocol=6 | dir=in | name=league of legends launcher | 
"{78E77159-0415-4E46-A363-7413CA375D7F}" = lport=8390 | protocol=6 | dir=in | name=league of legends game client | 
"{79FE29E1-74D3-4DB0-BE56-97C325EEC35D}" = lport=6893 | protocol=17 | dir=in | name=league of legends launcher | 
"{7D653BBD-BDC0-4CBB-AF60-2D4B00FE9618}" = lport=6948 | protocol=6 | dir=in | name=league of legends launcher | 
"{82325836-2C71-47CF-B2C3-453AC886A82C}" = lport=6886 | protocol=17 | dir=in | name=league of legends launcher | 
"{85B6533F-47C2-4D30-8115-88CEDDFFCEAB}" = lport=6968 | protocol=6 | dir=in | name=league of legends launcher | 
"{8C0B1A97-626A-4128-8AE6-EF0D49359D4E}" = lport=8390 | protocol=17 | dir=in | name=league of legends game client | 
"{90AB24DB-AA5D-43E5-8076-09C3B1DD3E0B}" = lport=6966 | protocol=17 | dir=in | name=league of legends launcher | 
"{92A6B4DA-7142-45BB-B30E-C649167E41EB}" = lport=6982 | protocol=6 | dir=in | name=league of legends launcher | 
"{98F06DDC-81B7-4D1D-9752-4F908867DFA7}" = lport=6932 | protocol=6 | dir=in | name=league of legends launcher | 
"{9BF3B182-F4F3-4342-9F5D-9DAB6358338F}" = lport=6886 | protocol=6 | dir=in | name=league of legends launcher | 
"{9DE16A41-901F-4DFF-953B-2F1114798904}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{A1ADB777-0581-4E24-A8BD-4D85C0D4D94B}" = lport=6995 | protocol=17 | dir=in | name=league of legends launcher | 
"{A24C12D6-16A3-4687-9525-D886B855B4AC}" = lport=6893 | protocol=17 | dir=in | name=league of legends launcher | 
"{A5DAD4AB-C8EA-43CD-9F2C-6314A4D23F12}" = lport=6955 | protocol=17 | dir=in | name=league of legends launcher | 
"{ABED8504-24C2-4671-9876-1CFF0AB4ED17}" = lport=6898 | protocol=17 | dir=in | name=league of legends launcher | 
"{AE2748A2-BC31-4EC0-BE71-4E263F1784DB}" = lport=6889 | protocol=17 | dir=in | name=league of legends launcher | 
"{AE94D441-BDD6-43E2-8D6C-4FB13EC117F8}" = lport=6898 | protocol=17 | dir=in | name=league of legends launcher | 
"{B25CFF3C-7D7F-479B-B75C-FAD4A06B7099}" = lport=6949 | protocol=17 | dir=in | name=league of legends launcher | 
"{B319DE6A-02CA-4167-BECA-592842D323C9}" = lport=6926 | protocol=17 | dir=in | name=league of legends launcher | 
"{BB3E3E37-2CFD-4BB0-A798-D200A731D037}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{BE3B86A2-F85B-409A-AA46-F568AE7B6339}" = lport=6893 | protocol=6 | dir=in | name=league of legends launcher | 
"{C2C87750-8095-4B86-9D7B-90D1E5244151}" = lport=6926 | protocol=6 | dir=in | name=league of legends launcher | 
"{C68E58A0-A46C-4DAD-8721-C3F3342A0C7A}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher | 
"{CC2C1915-8E8C-44D7-BF79-C28295C52A53}" = lport=8372 | protocol=6 | dir=in | name=league of legends launcher | 
"{D1B504F8-0CD7-431E-9401-A274913C17C9}" = lport=6948 | protocol=17 | dir=in | name=league of legends launcher | 
"{D31B0531-28F6-4BCA-957B-B555AC63EAB6}" = lport=6977 | protocol=6 | dir=in | name=league of legends launcher | 
"{D43F9610-B6D3-43D6-99A5-6CA950530A3A}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{D690293F-836B-499A-A5AC-E1FCF76BA61B}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{DB39D2EE-B31C-47CD-B9A9-1E948EFC15AA}" = lport=8393 | protocol=6 | dir=in | name=league of legends lobby | 
"{DC96DD37-5A62-4EF3-A1F3-CD722F733930}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{DE52A8E6-6757-4B30-A8BA-B96A8DD9F37C}" = lport=6968 | protocol=17 | dir=in | name=league of legends launcher | 
"{E0E5B66C-46DC-40AC-864C-6332D5564183}" = lport=6982 | protocol=17 | dir=in | name=league of legends launcher | 
"{E46CD9B4-47E8-4104-8B5A-1F74A5AE50E4}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{E48E2B8F-9F38-4331-B30C-19A5F78CC624}" = lport=6955 | protocol=6 | dir=in | name=league of legends launcher | 
"{E8D68D16-4752-4C1E-B23D-A11A252E3740}" = lport=6953 | protocol=6 | dir=in | name=league of legends launcher | 
"{EEC63557-7470-4DC5-AD58-39C0058573CD}" = lport=6898 | protocol=6 | dir=in | name=league of legends launcher | 
"{F3A4F7B3-A437-499A-8FEB-86233F6AF431}" = lport=6960 | protocol=17 | dir=in | name=league of legends launcher | 
"{F731FD1A-0BAE-4766-9370-99CA32A4216F}" = lport=6966 | protocol=6 | dir=in | name=league of legends launcher | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07F62CEE-6AEF-4F79-A718-34CE011DDB29}" = protocol=17 | dir=in | app=d:\spiele\league of legends\game\league of legends.exe | 
"{1379B3FF-4C5A-498C-873B-43565A590422}" = protocol=6 | dir=in | app=d:\spiele\starcraft ii\starcraft ii.exe | 
"{17E2A48C-3958-4C35-8F9B-BFE2B0DE41C9}" = protocol=6 | dir=in | app=d:\spiele\league of legends\air\lolclient.exe | 
"{2550D536-1344-48DA-9506-C810EE4CEE09}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{28B3E006-97EA-48F2-B7BD-9E1F31351DB4}" = protocol=17 | dir=in | app=d:\spiele\league of legends\game\league of legends.exe | 
"{372E5534-7339-4982-B844-19E689910AE1}" = protocol=17 | dir=in | app=d:\spiele\dragon age\bin_ship\daorigins.exe | 
"{38928C89-A4BD-4EB3-8B91-A628A0B03CE8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{394EE65D-DBB3-4A65-9417-070957B8F3AF}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{4C923F51-D18D-4990-8764-881554747138}" = protocol=17 | dir=in | app=d:\spiele\dragon age\daoriginslauncher.exe | 
"{5A5FB2BA-88A1-4A6A-BFF7-FA20839DC33B}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{7AD3582C-E708-47A4-B048-8850BB9395E2}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{813262D8-E91A-4446-80AA-4F8163723AD7}" = protocol=6 | dir=in | app=d:\spiele\starcraft ii\versions\base15405\sc2.exe | 
"{97D38BD9-818E-410D-A21B-073E417AD70B}" = protocol=17 | dir=in | app=d:\spiele\dragon age\bin_ship\daupdatersvc.service.exe | 
"{9893DA45-6328-4687-83F7-D187EE8E4F44}" = protocol=17 | dir=in | app=d:\spiele\league of legends\lol.launcher.exe | 
"{9965532F-5337-49C8-8252-5A432723051B}" = protocol=6 | dir=in | app=d:\spiele\dragon age\bin_ship\daorigins.exe | 
"{A107F0B3-ECA6-43CA-B9BE-833B8A009B98}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A13DE1C4-2BF7-4CEF-A2B8-DCFCA8736CE0}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{A3D2D957-7B3B-4AE5-8BDC-ABBA17CFFAF0}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{A4A37CD0-6017-4BC2-8F2B-7B0016D76701}" = protocol=17 | dir=in | app=d:\spiele\league of legends\air\lolclient.exe | 
"{B0D39F97-F027-4EAC-BB63-8D7C9BC7E6D1}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 
"{B5F1BD3E-7295-48B0-9872-22649D58BA5F}" = protocol=6 | dir=in | app=d:\spiele\league of legends\game\league of legends.exe | 
"{B67E0E20-6533-4634-9C9A-AB514847AFB6}" = protocol=17 | dir=in | app=d:\spiele\league of legends\air\lolclient.exe | 
"{B710CCBC-64D5-4D34-89DC-AF7551F9A475}" = protocol=6 | dir=in | app=d:\spiele\league of legends\air\lolclient.exe | 
"{C3D9D5FE-15D7-4A4B-904D-EE3784921E23}" = protocol=17 | dir=in | app=d:\spiele\starcraft ii\versions\base15405\sc2.exe | 
"{C7340AB6-5E19-4C92-895E-8410BD607DD2}" = dir=in | app=d:\spiele\command and conquere\retailexe\1.8\cnc3game.dat | 
"{CC890FC2-263B-4799-BCCD-8F41A2F92938}" = protocol=6 | dir=in | app=d:\spiele\dragon age\bin_ship\daupdatersvc.service.exe | 
"{CE545EE2-38AD-4FFB-9781-0FD795CB5341}" = protocol=6 | dir=in | app=d:\spiele\league of legends\game\league of legends.exe | 
"{CEC4059A-802C-4D6F-B56A-A4868D799940}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{CF361CC8-E4E8-4E3B-BE96-E003AF482698}" = protocol=6 | dir=in | app=d:\spiele\dragon age\daoriginslauncher.exe | 
"{D080B646-1E48-4279-9E54-733C392DF89F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D3FE7C61-C54E-43DE-A040-B2E17E319363}" = protocol=17 | dir=in | app=d:\spiele\starcraft ii\starcraft ii.exe | 
"{E112543F-F499-4AAE-9601-4804A1E8294E}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{EFA26686-299F-44EA-94D8-30223483E885}" = protocol=6 | dir=in | app=d:\spiele\league of legends\lol.launcher.exe | 
"{F21B3CF8-F97A-402C-BA7F-CC3D39204D6E}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"TCP Query User{0BE1FAE7-0C91-4B6D-AF0D-E2D7DE34B1BB}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"TCP Query User{16FCE762-C13B-4155-8514-B439E7D667C8}C:\program files\nero\nero 7\nero showtime\showtime.exe" = protocol=6 | dir=in | app=c:\program files\nero\nero 7\nero showtime\showtime.exe | 
"TCP Query User{51B7DED7-678E-42CA-88B9-B9A7BEEA9857}D:\spiele\warcraft iii\war3.exe" = protocol=6 | dir=in | app=d:\spiele\warcraft iii\war3.exe | 
"TCP Query User{68FA9294-1778-451F-98F8-1B2EC1AA17EE}C:\spiele\starcraft\starcraft.exe" = protocol=6 | dir=in | app=c:\spiele\starcraft\starcraft.exe | 
"TCP Query User{76AC685F-E5B7-4AF0-B772-8A24AA5B3D7F}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{7BC59B46-D2CD-4E04-9108-1736C4249688}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{7C4FF448-A5B9-4218-919F-D283FEE022F2}D:\spiele\warcraft iii\war3.exe" = protocol=6 | dir=in | app=d:\spiele\warcraft iii\war3.exe | 
"TCP Query User{B0A71885-3E7B-41D1-8F71-1294B5D5AE6D}C:\program files\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files\emule\emule.exe | 
"TCP Query User{C563C1C0-A7D8-4F73-9BC7-53A67AAE0F26}C:\program files\nero\nero 7\nero showtime\showtime.exe" = protocol=6 | dir=in | app=c:\program files\nero\nero 7\nero showtime\showtime.exe | 
"TCP Query User{E1242A39-59FC-4A63-BCA7-CD5041731657}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"TCP Query User{F204888F-6643-44C7-824A-990D2EE9EF58}C:\program files\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files\emule\emule.exe | 
"TCP Query User{FA0EFE10-EF40-42CC-B08E-2814779D63BE}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{FC5B7BEB-5F55-482B-BFA4-94C50ADD7996}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{236BEEB4-6086-4F4C-8704-57A77BB026BE}D:\spiele\warcraft iii\war3.exe" = protocol=17 | dir=in | app=d:\spiele\warcraft iii\war3.exe | 
"UDP Query User{241D85B1-D2AB-46F0-9E3A-959221CF9926}C:\program files\nero\nero 7\nero showtime\showtime.exe" = protocol=17 | dir=in | app=c:\program files\nero\nero 7\nero showtime\showtime.exe | 
"UDP Query User{40491C1C-6392-454D-BE3E-C5620F74D2E4}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{45EF7D8F-2AD0-40C2-BAEE-DB59D37501EF}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{7A286520-51BF-46C4-9DF4-FE4F696E270F}D:\spiele\warcraft iii\war3.exe" = protocol=17 | dir=in | app=d:\spiele\warcraft iii\war3.exe | 
"UDP Query User{98E2F8E0-FFDC-408F-98C6-87A23E534C04}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{A02ADCB3-9F9F-4228-B3BD-45ADB7217C6F}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{A2CECF86-662B-4C41-9599-CB5C49594A09}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{B387DD6D-1448-4B0F-8B58-F67D08610AAE}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"UDP Query User{BE7DB92B-FBA0-4B8A-A796-F70CE8F9D301}C:\program files\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files\emule\emule.exe | 
"UDP Query User{D4AFBC30-D21F-46F4-B7C7-DB64F0F1A2D7}C:\program files\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files\emule\emule.exe | 
"UDP Query User{EA16B840-770F-4ED5-8BE3-997FD7B2D170}C:\spiele\starcraft\starcraft.exe" = protocol=17 | dir=in | app=c:\spiele\starcraft\starcraft.exe | 
"UDP Query User{F296A832-2C0B-4F55-985A-6FE8C57CDC4D}C:\program files\nero\nero 7\nero showtime\showtime.exe" = protocol=17 | dir=in | app=c:\program files\nero\nero 7\nero showtime\showtime.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{200F584F-848D-4B6B-B1A1-C74D735F18A4}" = InstallRTC
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2CCBABCB-6427-4A55-B091-49864623C43F}" = Google Toolbar for Firefox
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5DB65884-C963-4454-AABA-4CA3089281FA}" = NVIDIA PhysX
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{62B002C5-1AB3-11D8-8092-00E018B21FC0}" = USB Mass Storage Toolbox
"{6DED41BC-C9EF-4330-B4E5-46CB2C5C6E2D}" = No23 Recorder
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = pdf24
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{868EC22E-7E82-4760-9265-3F2E705BF24B}" = League of Legends
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}_VISPRO_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_VISPRO_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_VISPRO_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}_VISPRO_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007
"{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{0FD405D3-CAF8-4CA6-8BFD-911D2F8A6585}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0054-0407-0000-0000000FF1CE}" = Microsoft Office Visio MUI (German) 2007
"{90120000-0054-0407-0000-0000000FF1CE}_VISPRO_{60CC0F2D-BFA0-4851-903D-809D876DD87B}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}_VISPRO_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.3 - Deutsch
"{B136F351-BF1E-4948-9557-FA6524302ACA}" = SPSS 14.0 für Windows
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{C656142F-EFE1-44CD-BFAD-6CBC6DCB9860}" = Vodafone Mobile Connect Lite
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Sitecom Europe
"{CF097717-F174-4144-954A-FBC4BF301031}" = Nero 7 Premium
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D48EAA77-E526-41EB-894C-BD6A17EABD95}" = TMPGEnc 3.0 XPress
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EF4EA1D8-E44E-41BA-B4C4-B4BEFDFCF2AC}" = DaViDeo 4 professional
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{F97E3841-CA9D-4964-9D64-26066241D26F}" = Microsoft Games for Windows - LIVE
"{FD54066C-59C6-475B-B8A0-A0D26969D8E2}" = Pinnacle PCTV MCE
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AVI & MPEG Splitter_is1" = AVI & MPEG Splitter 1.48
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon Setup Utility 2.0" = Canon Setup Utility 2.0
"CANONBJ_Deinstall_CNMCP78.DLL" = Canon iP4200
"CCleaner" = CCleaner
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DVD Shrink_is1" = DVD Shrink 3.2
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"Easy-PrintToolBox" = Canon Utilities Easy-PrintToolBox
"eMule" = eMule
"ENTERPRISE" = Microsoft Office Enterprise 2007
"HijackThis" = HijackThis 2.0.2
"HyperCam 2" = HyperCam 2
"InstallShield_{EF4EA1D8-E44E-41BA-B4C4-B4BEFDFCF2AC}" = DaViDeo 4 professional
"IsoBuster_is1" = IsoBuster 2.4
"League of Legends_is1" = League of Legends
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"MAGIX Foto Clinic 5.5 D" = MAGIX Foto Clinic 5.5 (D)
"MAGIX Fotos auf CD & DVD 5.5 e-version D" = MAGIX Fotos auf CD & DVD 5.5 e-version (D)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 4.0b6 (x86 de)" = Mozilla Firefox 4.0b6 (x86 de)
"Mozilla Thunderbird (3.1.4)" = Mozilla Thunderbird (3.1.4)
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"ratDVD" = ratDVD 0.78.1444
"RealPlayer 6.0" = RealPlayer
"SolveigMM AVI Trimmer" = SolveigMM AVI Trimmer
"Starcraft" = Starcraft
"StarCraft II" = StarCraft II
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Uninstall_is1" = Uninstall 1.0.0.1
"VISPRO" = Microsoft Office Visio Professional 2007
"VLC media player" = VLC media player 0.9.4
"Warcraft III" = Warcraft III
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR Archivierer
"X10Hardware" = X10 Hardware(TM)
"XviD" = XviD MPEG-4 Codec
"Xvid_is1" = Xvid 1.1.3 final uninstall
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Warcraft III" = Warcraft III: All Products
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 23.09.2010 15:06:18 | Computer Name = Chris-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
 
Error - 23.09.2010 15:06:37 | Computer Name = Chris-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 23.09.2010 15:06:37 | Computer Name = Chris-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 23.09.2010 16:34:55 | Computer Name = Chris-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
 
Error - 23.09.2010 16:46:54 | Computer Name = Chris-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
 
Error - 23.09.2010 16:47:36 | Computer Name = Chris-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 23.09.2010 16:47:36 | Computer Name = Chris-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 24.09.2010 10:17:14 | Computer Name = Chris-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
 
Error - 24.09.2010 10:17:42 | Computer Name = Chris-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 24.09.2010 10:17:42 | Computer Name = Chris-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
[ Media Center Events ]
Error - 07.03.2008 14:31:04 | Computer Name = Chris-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerAccumulate failed;
 Win32 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center
 Guide 
 
Error - 13.03.2008 23:26:30 | Computer Name = Chris-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
Error - 30.03.2008 21:10:38 | Computer Name = Chris-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
Error - 21.04.2008 13:16:22 | Computer Name = Chris-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerAccumulate failed;
 Win32 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center
 Guide 
 
Error - 09.02.2009 10:54:01 | Computer Name = Chris-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
 Uberprufen Sie die Internetverbindungseinstellungen. Wenn die Verbindung uber einen
 Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgema?
 konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 09.02.2009 10:54:02 | Computer Name = Chris-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
 Uberprufen Sie die Internetverbindungseinstellungen. Wenn die Verbindung uber einen
 Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgema?
 konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 21.04.2009 10:42:06 | Computer Name = Chris-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
 Uberprufen Sie die Internetverbindungseinstellungen. Wenn die Verbindung uber einen
 Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgema?
 konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 21.04.2009 10:42:06 | Computer Name = Chris-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
 Uberprufen Sie die Internetverbindungseinstellungen. Wenn die Verbindung uber einen
 Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgema?
 konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 28.06.2009 06:51:36 | Computer Name = Chris-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
 Uberprufen Sie die Internetverbindungseinstellungen. Wenn die Verbindung uber einen
 Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgema?
 konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 28.06.2009 06:51:36 | Computer Name = Chris-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
 Uberprufen Sie die Internetverbindungseinstellungen. Wenn die Verbindung uber einen
 Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgema?
 konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
[ System Events ]
Error - 23.09.2010 16:33:50 | Computer Name = Chris-PC | Source = Service Control Manager | ID = 7031
Description = 
 
Error - 23.09.2010 16:33:50 | Computer Name = Chris-PC | Source = Service Control Manager | ID = 7034
Description = 
 
Error - 23.09.2010 16:33:53 | Computer Name = Chris-PC | Source = Service Control Manager | ID = 7031
Description = 
 
Error - 23.09.2010 16:33:54 | Computer Name = Chris-PC | Source = Service Control Manager | ID = 7031
Description = 
 
Error - 23.09.2010 16:33:54 | Computer Name = Chris-PC | Source = Service Control Manager | ID = 7031
Description = 
 
Error - 23.09.2010 16:36:26 | Computer Name = Chris-PC | Source = Service Control Manager | ID = 7031
Description = 
 
Error - 23.09.2010 16:45:27 | Computer Name = Chris-PC | Source = Service Control Manager | ID = 7030
Description = 
 
Error - 24.09.2010 10:17:11 | Computer Name = Chris-PC | Source = Microsoft-Windows-ResourcePublication | ID = 1002
Description = 
 
Error - 24.09.2010 10:20:17 | Computer Name = Chris-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 24.09.2010 10:20:17 | Computer Name = Chris-PC | Source = Service Control Manager | ID = 7009
Description = 
 
[ TuneUp Events ]
Error - 05.08.2009 06:29:48 | Computer Name = Chris-PC | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "t": syntax error; when executing SQL: INSERT INTO
 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2009-08-05 12:29:48', '\device\harddiskvolume3\spiele\you
 don't know jack 4\setup.exe','5104',0)
 
Error - 23.09.2010 04:47:54 | Computer Name = Chris-PC | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-09-23 10:47:54', '\device\harddiskvolume2\program
 files\malwarebytes' anti-malware\mbam.exe','2244',0)
 
Error - 23.09.2010 04:48:44 | Computer Name = Chris-PC | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-09-23 10:48:44', '\device\harddiskvolume2\program
 files\malwarebytes' anti-malware\mbam.exe','1628',0)
 
Error - 23.09.2010 05:12:51 | Computer Name = Chris-PC | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-09-23 11:12:51', '\device\harddiskvolume2\program
 files\malwarebytes' anti-malware\mbam.exe','3456',0)
 
 
< End of report >
         

avira
http://www.trojaner-board.de/54192-a...tellungen.html
avira 10 so instalieren bzw. dann konfigurieren. wenn du die konfiguration übernommen hast, update das programm.
klicke dann auf "lokaler schutz" "lokale laufwerke" eventuelle funde in quarantäne, log posten.

Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Freitag, 24. September 2010  23:15

Es wird nach 2874959 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer   : Avira AntiVir Personal - FREE Antivirus
Seriennummer   : 0000149996-ADJIE-0000001
Plattform      : Windows Vista
Windowsversion : (Service Pack 2)  [6.0.6002]
Boot Modus     : Normal gebootet
Benutzername   : *****
Computername   : *****

Versionsinformationen:
BUILD.DAT      : 10.0.0.567     32097 Bytes  19.04.2010 15:50:00
AVSCAN.EXE     : 10.0.3.0      433832 Bytes  01.04.2010 11:37:35
AVSCAN.DLL     : 10.0.3.0       56168 Bytes  30.03.2010 10:42:16
LUKE.DLL       : 10.0.2.3      104296 Bytes  07.03.2010 17:32:59
LUKERES.DLL    : 10.0.0.0       13672 Bytes  14.01.2010 10:59:47
VBASE000.VDF   : 7.10.0.0    19875328 Bytes  06.11.2009 08:05:36
VBASE001.VDF   : 7.10.1.0     1372672 Bytes  19.11.2009 18:27:49
VBASE002.VDF   : 7.10.3.1     3143680 Bytes  20.01.2010 16:37:42
VBASE003.VDF   : 7.10.3.75     996864 Bytes  26.01.2010 15:37:42
VBASE004.VDF   : 7.10.4.203   1579008 Bytes  05.03.2010 10:29:03
VBASE005.VDF   : 7.10.6.82    2494464 Bytes  15.04.2010 18:41:45
VBASE006.VDF   : 7.10.7.218   2294784 Bytes  02.06.2010 18:41:48
VBASE007.VDF   : 7.10.9.165   4840960 Bytes  23.07.2010 18:41:55
VBASE008.VDF   : 7.10.11.133  3454464 Bytes  13.09.2010 18:42:03
VBASE009.VDF   : 7.10.11.134     2048 Bytes  13.09.2010 18:42:03
VBASE010.VDF   : 7.10.11.135     2048 Bytes  13.09.2010 18:42:03
VBASE011.VDF   : 7.10.11.136     2048 Bytes  13.09.2010 18:42:03
VBASE012.VDF   : 7.10.11.137     2048 Bytes  13.09.2010 18:42:03
VBASE013.VDF   : 7.10.11.165   172032 Bytes  15.09.2010 18:42:04
VBASE014.VDF   : 7.10.11.202   144384 Bytes  18.09.2010 18:42:04
VBASE015.VDF   : 7.10.11.231   129024 Bytes  21.09.2010 18:42:04
VBASE016.VDF   : 7.10.12.4     126464 Bytes  23.09.2010 18:42:04
VBASE017.VDF   : 7.10.12.5       2048 Bytes  23.09.2010 18:42:04
VBASE018.VDF   : 7.10.12.6       2048 Bytes  23.09.2010 18:42:04
VBASE019.VDF   : 7.10.12.7       2048 Bytes  23.09.2010 18:42:04
VBASE020.VDF   : 7.10.12.8       2048 Bytes  23.09.2010 18:42:05
VBASE021.VDF   : 7.10.12.9       2048 Bytes  23.09.2010 18:42:05
VBASE022.VDF   : 7.10.12.10      2048 Bytes  23.09.2010 18:42:05
VBASE023.VDF   : 7.10.12.11      2048 Bytes  23.09.2010 18:42:05
VBASE024.VDF   : 7.10.12.12      2048 Bytes  23.09.2010 18:42:05
VBASE025.VDF   : 7.10.12.13      2048 Bytes  23.09.2010 18:42:05
VBASE026.VDF   : 7.10.12.14      2048 Bytes  23.09.2010 18:42:05
VBASE027.VDF   : 7.10.12.15      2048 Bytes  23.09.2010 18:42:05
VBASE028.VDF   : 7.10.12.16      2048 Bytes  23.09.2010 18:42:05
VBASE029.VDF   : 7.10.12.17      2048 Bytes  23.09.2010 18:42:05
VBASE030.VDF   : 7.10.12.18      2048 Bytes  23.09.2010 18:42:05
VBASE031.VDF   : 7.10.12.30     73728 Bytes  24.09.2010 18:42:05
Engineversion  : 8.2.4.66  
AEVDF.DLL      : 8.1.2.1       106868 Bytes  24.09.2010 18:42:11
AESCRIPT.DLL   : 8.1.3.45     1368443 Bytes  24.09.2010 18:42:10
AESCN.DLL      : 8.1.6.1       127347 Bytes  24.09.2010 18:42:10
AESBX.DLL      : 8.1.3.1       254324 Bytes  24.09.2010 18:42:11
AERDL.DLL      : 8.1.9.2       635252 Bytes  24.09.2010 18:42:10
AEPACK.DLL     : 8.2.3.7       471413 Bytes  24.09.2010 18:42:09
AEOFFICE.DLL   : 8.1.1.8       201081 Bytes  24.09.2010 18:42:09
AEHEUR.DLL     : 8.1.2.27     2933110 Bytes  24.09.2010 18:42:08
AEHELP.DLL     : 8.1.13.4      242038 Bytes  24.09.2010 18:42:07
AEGEN.DLL      : 8.1.3.22      401780 Bytes  24.09.2010 18:42:06
AEEMU.DLL      : 8.1.2.0       393588 Bytes  24.09.2010 18:42:06
AECORE.DLL     : 8.1.17.0      196982 Bytes  24.09.2010 18:42:06
AEBB.DLL       : 8.1.1.0        53618 Bytes  24.09.2010 18:42:06
AVWINLL.DLL    : 10.0.0.0       19304 Bytes  14.01.2010 10:59:10
AVPREF.DLL     : 10.0.0.0       44904 Bytes  14.01.2010 10:59:07
AVREP.DLL      : 10.0.0.8       62209 Bytes  18.02.2010 15:47:40
AVREG.DLL      : 10.0.3.0       53096 Bytes  01.04.2010 11:35:44
AVSCPLR.DLL    : 10.0.3.0       83816 Bytes  01.04.2010 11:39:49
AVARKT.DLL     : 10.0.0.14     227176 Bytes  01.04.2010 11:22:11
AVEVTLOG.DLL   : 10.0.0.8      203112 Bytes  26.01.2010 08:53:25
SQLITE3.DLL    : 3.6.19.0      355688 Bytes  28.01.2010 11:57:53
AVSMTP.DLL     : 10.0.0.17      63848 Bytes  16.03.2010 14:38:54
NETNT.DLL      : 10.0.0.0       11624 Bytes  19.02.2010 13:40:55
RCIMAGE.DLL    : 10.0.0.26    2550120 Bytes  28.01.2010 12:10:08
RCTEXT.DLL     : 10.0.53.0      98152 Bytes  09.04.2010 13:14:28

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\program files\avira\antivir desktop\alldrives.avp
Protokollierung.......................: niedrig
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, I:, J:, K:, L:, M:, G:, H:, 
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Optimierter Suchlauf..................: ein
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 10
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: hoch
Abweichende Gefahrenkategorien........: +PCK,+PFS,+SPR,

Beginn des Suchlaufs: Freitag, 24. September 2010  23:15

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'plugin-container.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehRecvr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehsched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mobsync.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnscfg.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'VMCService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'TUProgSt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'emule.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MSASCui.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht

Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Die Systemdateien wurden durchsucht ('21' Dateien)

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD1
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD2
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD3
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD4
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD5
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD6
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'D:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'I:\'
    [INFO]      Im  Laufwerk 'I:\' ist kein Datenträger eingelegt!
Bootsektor 'J:\'
    [INFO]      Im  Laufwerk 'J:\' ist kein Datenträger eingelegt!
Bootsektor 'K:\'
    [INFO]      Im  Laufwerk 'K:\' ist kein Datenträger eingelegt!
Bootsektor 'L:\'
    [INFO]      Im  Laufwerk 'L:\' ist kein Datenträger eingelegt!
Bootsektor 'M:\'
    [INFO]      Im  Laufwerk 'M:\' ist kein Datenträger eingelegt!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '1783' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <SYSTEM>
C:\Users\Chris\AppData\Roaming\Adobe\Update\hlpcli.exe
    [FUND]      Ist das Trojanische Pferd TR/Riner.YG
Beginne mit der Suche in 'D:\' <000000>
Beginne mit der Suche in 'I:\'
Der zu durchsuchende Pfad I:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'J:\'
Der zu durchsuchende Pfad J:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'K:\'
Der zu durchsuchende Pfad K:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'L:\'
Der zu durchsuchende Pfad L:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'M:\'
Der zu durchsuchende Pfad M:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'G:\' <SC2-L100-D1>
Beginne mit der Suche in 'H:\'
Der zu durchsuchende Pfad H:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.

Beginne mit der Desinfektion:
C:\Users\Chris\AppData\Roaming\Adobe\Update\hlpcli.exe
    [FUND]      Ist das Trojanische Pferd TR/Riner.YG
    [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '48228373.qua' verschoben!


Ende des Suchlaufs: Samstag, 25. September 2010  00:34
Benötigte Zeit:  1:18:45 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  30633 Verzeichnisse wurden überprüft
 618553 Dateien wurden geprüft
      1 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      1 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 618552 Dateien ohne Befall
   4391 Archive wurden durchsucht
      0 Warnungen
      1 Hinweise
 115536 Objekte wurden beim Rootkitscan durchsucht
      0 Versteckte Objekte wurden gefunden
         

rechtsklick auf hijackthis.exe, als admin ausführen, scan and safe log, dieses posten.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:33:13, on 26.09.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Users\*****\Downloads\HJT.exe
C:\Program Files\Mozilla Firefox 4.0 Beta 6\firefox.exe
C:\Program Files\Mozilla Firefox 4.0 Beta 6\plugin-container.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.arcor.de
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software GmbH - C:\Windows\System32\TUProgSt.exe
O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe

--
End of file - 4813 bytes
         

toobars stellen ein sicherheitsrisiko dar, da sie nutzerdaten ausspähen können, deinstaliere die google toolbar.
bitte besuche die windows update site, spiele alle wichtigen updates + den internet explorer 8 auf.
Updates sind für dein system genauso wichtig, wie ein antivirenscanner. Sehr häufig gelangen schädlinge nur aufs system, weil der user veraltete software nutzt.
instaliere die folgenden update checker.
Secunia:
http://www.trojaner-board.de/83959-s...ector-psi.html
und file hippo update checker:
FileHippo.com Update Checker - FileHippo.com
das file Hippo Symbol wird im infobereich neben der uhr auftauchen, mache bitte nen rechtsklick darauf, wähle settings, results, setze einen haken bei "hide beta updates" klicke ok.
dann doppelklicke file hippo, eine Internetseite wird geöffnet, auf der dier die aktuellsten updates gezeigt werden, diese downloaden und instalieren.

Beide programme sollten im autostart bleiben, und sobald eines der programme updates anzeigt sollten diese umgehend instaliert werden.
wenn fertig, gib bitte bescheid.