Hi,
hab mir heute leider den Ultimate Defragger Trojaner hinzugezogen und diesen mittlerweile nach Anweisung (Super Thread!!!!!) auch entfernt. Leider will nach dem Hochfahren von Windows weiterhin irgendein Programm ausgeführt werden, so dass ich jedoch als Admin weiterhin auf nicht zulassen klicken kann (ich benutze Windows Visa). Auch nach einem Scan von Anti-Malware sind noch 2 Störungen zu finden, die sich nicth beheben lassen. Hier der dazu erscheinende Log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 5127

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18975

16.11.2010 18:58:35
mbam-log-2010-11-16 (18-58-35).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 151960
Laufzeit: 5 Minute(n), 17 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> Delete on reboot.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)




Hoffe die Art und Weise meines Posts war okay.
Vielleicht kann mir ja einer von euch Genies weiterhelfen. Vielen Dank

hi, ne ahnung wo du dir das eingefangen hast? wenn ja, link an mich per privater nachicht.
ootl:
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
beide posten.

...ist irgendwie ganz schön viel!
Hoffe das war so richtig
OTL Logfile:

OTL logfile created on: 16.11.2010 19:25:50 - Run 1
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Users\Haenz\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
6,00 Gb Total Physical Memory | 4,00 Gb Available Physical Memory | 66,00% Memory free
12,00 Gb Paging File | 10,00 Gb Available in Paging File | 80,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 688,88 Gb Total Space | 449,03 Gb Free Space | 65,18% Space Free | Partition Type: NTFS
Drive D: | 688,85 Gb Total Space | 77,22 Gb Free Space | 11,21% Space Free | Partition Type: NTFS
 
Computer Name: HOMEBASE | User Name: Haenz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Haenz\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Haenz\AppData\Local\Temp\eftupknfqf.exe ()
PRC - C:\Program Files (x86)\Uniblue\RegistryBooster\registrybooster.exe (Uniblue Systems Limited)
PRC - C:\Program Files (x86)\Uniblue\RegistryBooster\rbmonitor.exe (Uniblue Systems Limited)
PRC - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
PRC - C:\Program Files (x86)\UseNeXT\UseNeXT.exe ()
PRC - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10i_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Winamp\winamp.exe (Nullsoft, Inc.)
PRC - C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
PRC - C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe (G DATA Software AG)
PRC - C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe (G Data Software AG)
PRC - C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe (G Data Software AG)
PRC - C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe (G Data Software AG)
PRC - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Microsoft Corporation)
PRC - C:\Windows\SysWOW64\conime.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (EgisTec Inc.)
PRC - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe (EgisTec Inc.)
PRC - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (EgisTec Inc.)
PRC - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe (PostgreSQL Global Development Group)
PRC - C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe (PostgreSQL Global Development Group)
PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Haenz\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (ICQ Service) -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe ()
SRV - (Apple Mobile Device) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AVKWCtl) -- C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlX64.exe (G Data Software AG)
SRV - (AVKProxy) -- C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe (G DATA Software AG)
SRV - (AVKService) -- C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe (G Data Software AG)
SRV - (GDScan) -- C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe (G Data Software AG)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (IAANTMON) Intel(R) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
SRV - (MWLService) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe ()
SRV - (NTISchedulerSvc) -- C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech Infosystems, Inc.)
SRV - (NTIBackupSvc) -- C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)
SRV - (pgsql-8.3) -- C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe (PostgreSQL Global Development Group)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (NwlnkFwd) -- C:\Windows\SysNative\DRIVERS\nwlnkfwd.sys File not found
DRV:64bit: - (NwlnkFlt) -- C:\Windows\SysNative\DRIVERS\nwlnkflt.sys File not found
DRV:64bit: - (IpInIp) -- C:\Windows\SysNative\DRIVERS\ipinip.sys File not found
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\Drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\DRIVERS\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\DRIVERS\lirsgt.sys ()
DRV:64bit: - (GRD) -- C:\Windows\SysNative\drivers\GRD.sys (G Data Software)
DRV:64bit: - (GDMnIcpt) -- C:\Windows\SysNative\drivers\MiniIcpt.sys (G Data Software AG)
DRV:64bit: - (HookCentre) -- C:\Windows\SysNative\drivers\HookCentre.sys (G Data Software AG)
DRV:64bit: - (gdwfpcd) -- C:\Windows\SysNative\DRIVERS\gdwfpcd64.sys (G DATA Software AG)
DRV:64bit: - (GDBehave) -- C:\Windows\SysNative\drivers\GDBehave.sys (G Data Software AG)
DRV:64bit: - (WpdUsb) -- C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (HCW85BDA) -- C:\Windows\SysNative\drivers\HCW85BDA.sys (Hauppauge Computer Works)
DRV:64bit: - (GearAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (WDC_SAM) -- C:\Windows\SysNative\DRIVERS\wdcsam64.sys (Western Digital Technologies)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\DRIVERS\iaStor.sys (Intel Corporation)
DRV:64bit: - (mwlPSDVDisk) -- C:\Windows\SysNative\DRIVERS\mwlPSDVDisk.sys (Egis Incorporated.)
DRV:64bit: - (mwlPSDFilter) -- C:\Windows\SysNative\DRIVERS\mwlPSDFilter.sys (Egis Incorporated.)
DRV:64bit: - (mwlPSDNServ) -- C:\Windows\SysNative\DRIVERS\mwlPSDNServ.sys (Egis Incorporated.)
DRV:64bit: - (e1yexpress) Intel(R) -- C:\Windows\SysNative\DRIVERS\e1y60x64.sys (Intel Corporation)
DRV:64bit: - (NTIDrvr) -- C:\Windows\SysNative\Drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV:64bit: - (netr7364) -- C:\Windows\SysNative\DRIVERS\netr7364.sys (Ralink Technology Inc.)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\Wbem\ntfs.mof ()
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp64&d=0809&m=aspire_m3800
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp64&d=0809&m=aspire_m3800
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp64&d=0809&m=aspire_m3800
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp64&d=0809&m=aspire_m3800
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=1&o=vp64&d=0809&m=aspire_m3800
IE - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.web.de/ [binary data]
IE - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
 
O1 HOSTS File: ([2006.09.18 22:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2:64bit: - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\AntiVirus\Webfilter\AVKWebIEx64.dll (G Data Software AG)
O2 - BHO: (C:\Windows\SysWow64\glwjv4.dll) - {B1BA20C1-A503-59BD-F412-03B53A2C8951} - C:\Windows\SysWOW64\glwjv4.dll ()
O3:64bit: - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\AntiVirus\Webfilter\AVKWebIEx64.dll (G Data Software AG)
O3 - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\AntiVirus\Webfilter\AVKWebIE.dll (G Data Software AG)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (EgisTec Inc.)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.DLL (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [BrMfcWnd] C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (EgisTec Inc.)
O4 - HKLM..\Run: [G DATA AntiVirus Trayapplication] C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe (G Data Software AG)
O4 - HKLM..\Run: [Lvahhfnglxqc] C:\Users\Haenz\AppData\Local\Temp\eftupknfqf.exe ()
O4 - HKLM..\Run: [Lvahhfngotd] C:\Users\Haenz\AppData\Local\Temp\install.exe ()
O4 - HKLM..\Run: [ Malwarebytes Anti-Malware  (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000..\Run: [ICQ] C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000..\Run: [Lvahhfnglxqc] C:\Users\Haenz\AppData\Local\Temp\eftupknfqf.exe ()
O4 - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000..\Run: [msnmsgr] C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe File not found
O4 - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000..\Run: [RegistryBooster] C:\Program Files (x86)\Uniblue\RegistryBooster\launcher.exe (Uniblue Systems Limited)
O4 - HKU\S-1-5-21-1577962275-2861703630-4009606616-1001..\Run: [ProductReg] C:\Programme\Acer\WR_PopUp\ProductReg.exe (Acer)
O4 - HKU\S-1-5-21-1577962275-2861703630-4009606616-1001..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1577962275-2861703630-4009606616-1001..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1577962275-2861703630-4009606616-1001..\RunOnce: [RUN] C:\Windows\Acer_Normal\run_DT.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O7 - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFolderOptions = 1
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Poker\Installation\Party Poker\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Poker\Installation\Party Poker\PartyPoker\RunApp.exe ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} hxxp://static.ak.facebook.com/fbplugin/win32/axfbootloader.cab (Reg Error: Key error.)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O22 - SharedTaskScheduler: {B1BA20C1-A503-59BD-F412-03B53A2C8951} - uawhr987ry38w7rhawuig673fef - C:\Windows\SysWOW64\glwjv4.dll ()
O24 - Desktop WallPaper: D:\Pictures\Desktophintergrundbilder\img18.jpg
O24 - Desktop BackupWallPaper: D:\Pictures\Desktophintergrundbilder\img18.jpg
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{41042016-d469-11df-84c7-0025113d5ed6}\Shell\AutoRun\command - "" = K:\TranscendService(JF).exe -- File not found
O33 - MountPoints2\{755d8c28-d15e-11df-b5d4-0025113d5ed6}\Shell - "" = AutoRun
O33 - MountPoints2\{755d8c28-d15e-11df-b5d4-0025113d5ed6}\Shell\AutoRun\command - "" = M:\WD SmartWare.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
 
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: WudfPf - Driver
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.11.16 19:21:30 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Haenz\Desktop\OTL.exe
[2010.11.16 19:11:05 | 000,000,000 | ---D | C] -- C:\Users\Haenz\AppData\Roaming\Uniblue
[2010.11.16 19:10:58 | 000,000,000 | -H-D | C] -- C:\ProgramData\{6DAA3B20-D487-4FA2-81D5-50404CCB868D}
[2010.11.16 19:10:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Uniblue
[2010.11.16 19:10:46 | 000,000,000 | ---D | C] -- C:\Users\Haenz\AppData\Local\PackageAware
[2010.11.16 17:17:19 | 007,235,792 | ---- | C] (Uniblue Systems Ltd                                                                                                                                                                                                                                                                                         ) -- C:\Users\Haenz\Desktop\registrybooster.exe
[2010.11.16 17:07:58 | 000,000,000 | ---D | C] -- C:\Users\Haenz\AppData\Roaming\Malwarebytes
[2010.11.16 17:07:47 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.11.16 17:07:46 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2010.11.16 17:07:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010.11.16 17:07:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.11.16 17:06:50 | 006,153,648 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Haenz\Desktop\mbam-setup.exe
[2010.11.16 16:06:56 | 000,000,000 | ---D | C] -- C:\Users\Haenz\AppData\Local\{57C1AB0D-E07A-4278-942A-F21DA12414CF}
[2010.11.04 20:52:44 | 000,000,000 | ---D | C] -- C:\Users\Haenz\Desktop\Deutsche Polizei-meisterschaften 10.2010
[2010.11.03 19:17:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ6Toolbar
[2010.11.03 19:17:28 | 000,000,000 | ---D | C] -- C:\ProgramData\ICQ
[2010.11.03 19:17:16 | 000,000,000 | ---D | C] -- C:\Users\Haenz\AppData\Local\AOL
[2010.11.03 19:17:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ7.2
[2010.11.01 17:06:24 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2010.11.01 17:06:24 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2010.11.01 17:06:24 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2010.10.27 14:51:15 | 001,927,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gameux.dll
[2010.10.27 14:51:15 | 001,696,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\gameux.dll
[2010.10.27 14:51:14 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\GameUXLegacyGDFs.dll
[2010.10.27 14:51:14 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\SysNative\GameUXLegacyGDFs.dll
[2010.10.27 14:51:14 | 000,032,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Apphlpdm.dll
[2010.10.27 14:51:14 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Apphlpdm.dll
[2009.07.28 22:05:17 | 000,049,152 | R--- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll
 
========== Files - Modified Within 30 Days ==========
 
[2010.11.16 19:21:32 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Haenz\Desktop\OTL.exe
[2010.11.16 19:11:09 | 000,000,344 | ---- | M] () -- C:\Windows\tasks\RegistryBooster.job
[2010.11.16 18:54:57 | 001,445,310 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.11.16 18:54:57 | 000,628,504 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.11.16 18:54:57 | 000,595,798 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.11.16 18:54:57 | 000,126,248 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.11.16 18:54:57 | 000,103,872 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.11.16 18:49:00 | 000,092,883 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.11.16 18:48:56 | 000,092,883 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.11.16 18:48:49 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.11.16 18:48:49 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.11.16 18:48:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.11.16 17:17:23 | 007,235,792 | ---- | M] (Uniblue Systems Ltd                                                                                                                                                                                                                                                                                         ) -- C:\Users\Haenz\Desktop\registrybooster.exe
[2010.11.16 17:06:52 | 006,153,648 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Haenz\Desktop\mbam-setup.exe
[2010.11.16 17:03:20 | 000,364,032 | ---- | M] () -- C:\Users\Haenz\Desktop\rkill.com
[2010.11.16 16:06:57 | 000,000,120 | ---- | M] () -- C:\Users\Haenz\AppData\Local\Mqaki.dat
[2010.11.16 16:06:57 | 000,000,000 | ---- | M] () -- C:\Users\Haenz\AppData\Local\Spewofaxacu.bin
[2010.11.16 16:02:17 | 000,030,000 | ---- | M] () -- C:\Windows\SysWow64\glwjv4.dll
[2010.11.15 19:33:31 | 000,022,528 | ---- | M] () -- C:\Users\Haenz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.27 22:32:38 | 000,053,453 | ---- | M] () -- C:\Users\Haenz\AppData\Roaming\Done.exe
[2010.10.23 18:58:35 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI
[2010.10.18 10:44:53 | 001,601,470 | ---- | M] () -- C:\Users\Haenz\Desktop\CIMG7664.JPG
 
========== Files Created - No Company Name ==========
 
[2010.11.16 19:11:06 | 000,000,344 | ---- | C] () -- C:\Windows\tasks\RegistryBooster.job
[2010.11.16 17:03:18 | 000,364,032 | ---- | C] () -- C:\Users\Haenz\Desktop\rkill.com
[2010.11.16 16:06:57 | 000,000,120 | ---- | C] () -- C:\Users\Haenz\AppData\Local\Mqaki.dat
[2010.11.16 16:06:57 | 000,000,000 | ---- | C] () -- C:\Users\Haenz\AppData\Local\Spewofaxacu.bin
[2010.11.16 16:02:17 | 000,030,000 | ---- | C] () -- C:\Windows\SysWow64\glwjv4.dll
[2010.11.15 18:30:57 | 001,581,684 | ---- | C] () -- C:\Users\Haenz\Desktop\CIMG1128.JPG
[2010.11.15 18:26:24 | 001,582,421 | ---- | C] () -- C:\Users\Haenz\Desktop\CIMG1068.JPG
[2010.11.15 18:21:10 | 001,681,464 | ---- | C] () -- C:\Users\Haenz\Desktop\CIMG1008.JPG
[2010.11.15 18:19:59 | 001,624,878 | ---- | C] () -- C:\Users\Haenz\Desktop\CIMG2477.JPG
[2010.11.15 18:19:29 | 001,592,155 | ---- | C] () -- C:\Users\Haenz\Desktop\CIMG2468.JPG
[2010.11.15 18:18:52 | 001,583,482 | ---- | C] () -- C:\Users\Haenz\Desktop\CIMG2438.JPG
[2010.11.15 18:18:26 | 001,597,265 | ---- | C] () -- C:\Users\Haenz\Desktop\CIMG2416.JPG
[2010.11.15 18:17:52 | 001,577,920 | ---- | C] () -- C:\Users\Haenz\Desktop\CIMG2397.JPG
[2010.11.15 18:03:30 | 001,601,470 | ---- | C] () -- C:\Users\Haenz\Desktop\CIMG7664.JPG
[2010.10.27 22:32:38 | 000,053,453 | ---- | C] () -- C:\Users\Haenz\AppData\Roaming\Done.exe
[2010.10.19 17:49:12 | 001,572,484 | ---- | C] () -- C:\Users\Haenz\Desktop\CIMG1443.JPG
[2010.05.19 15:24:35 | 000,407,758 | ---- | C] () -- C:\Users\Haenz\AppData\Local\dd_vcredistMSI472F.txt
[2010.05.19 15:24:35 | 000,011,188 | ---- | C] () -- C:\Users\Haenz\AppData\Local\dd_vcredistUI472F.txt
[2010.05.05 18:13:03 | 000,435,392 | ---- | C] () -- C:\Users\Haenz\AppData\Local\dd_vcredistMSI0242.txt
[2010.05.05 18:13:03 | 000,011,396 | ---- | C] () -- C:\Users\Haenz\AppData\Local\dd_vcredistUI0242.txt
[2010.03.23 12:34:37 | 000,417,402 | ---- | C] () -- C:\Users\Haenz\AppData\Local\dd_vcredistMSI5F80.txt
[2010.03.23 12:34:36 | 000,011,462 | ---- | C] () -- C:\Users\Haenz\AppData\Local\dd_vcredistUI5F80.txt
[2010.02.13 16:28:28 | 000,000,073 | ---- | C] () -- C:\Users\Haenz\AppData\Roaming\AVSMediaPlayer.m3u
[2009.12.03 17:44:54 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009.12.03 17:44:12 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.10.10 15:56:54 | 000,004,985 | ---- | C] () -- C:\ProgramData\ojvzdisj.xda
[2009.10.08 21:46:44 | 000,001,125 | ---- | C] () -- C:\Windows\winamp.ini
[2009.10.08 21:45:35 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2009.10.08 20:50:42 | 000,022,528 | ---- | C] () -- C:\Users\Haenz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.10.08 20:39:16 | 000,000,090 | ---- | C] () -- C:\ProgramData\PS.log
[2009.10.08 20:31:19 | 000,000,000 | ---- | C] () -- C:\Users\Haenz\AppData\Roaming\wklnhst.dat
[2009.10.08 19:41:38 | 000,092,883 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.10.08 19:40:26 | 000,092,883 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.08.07 23:40:02 | 000,007,231 | ---- | C] () -- C:\ProgramData\ArcadeDeluxe2.log
[2009.08.07 23:33:35 | 000,003,800 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2009.07.28 14:23:47 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2009.07.28 14:23:46 | 000,007,283 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2008.01.21 03:50:05 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
 
========== LOP Check ==========
 
[2009.10.08 20:35:20 | 000,000,000 | -HSD | M] -- C:\Users\Haenz\AppData\Roaming\.#
[2009.08.07 23:48:46 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Acer GameZone Console
[2010.03.23 12:35:26 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\elsterformular
[2009.10.08 20:37:21 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\eSobi
[2010.05.11 10:00:16 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Facebook
[2009.10.08 20:40:00 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\HomeMedia Connect
[2010.11.16 18:47:33 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\ICQ
[2009.10.08 20:42:47 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\PowerCinema
[2009.12.17 16:03:01 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Red Kawa
[2010.11.16 19:11:05 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Uniblue
[2010.11.16 19:29:33 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\UseNeXT
[2010.11.16 19:11:09 | 000,000,344 | ---- | M] () -- C:\Windows\Tasks\RegistryBooster.job
[2010.11.16 18:47:43 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2009.10.08 20:35:20 | 000,000,000 | -HSD | M] -- C:\Users\Haenz\AppData\Roaming\.#
[2009.08.07 23:48:46 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Acer GameZone Console
[2009.10.08 21:16:31 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Adobe
[2009.12.15 18:37:55 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Apple Computer
[2009.12.10 12:40:49 | 000,000,000 | R--D | M] -- C:\Users\Haenz\AppData\Roaming\Brother
[2009.10.08 20:59:50 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\CyberLink
[2010.06.15 16:44:43 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\DivX
[2010.11.03 14:58:29 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\dvdcss
[2010.03.23 12:35:26 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\elsterformular
[2009.10.08 20:37:21 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\eSobi
[2010.05.11 10:00:16 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Facebook
[2009.10.08 19:41:22 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Google
[2009.10.08 20:40:00 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\HomeMedia Connect
[2010.11.16 18:47:33 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\ICQ
[2009.10.08 19:41:10 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Identities
[2009.10.08 21:42:21 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\InstallShield
[2009.10.08 19:41:30 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Macromedia
[2010.11.16 17:07:58 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Malwarebytes
[2006.11.02 16:07:25 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Media Center Programs
[2010.05.02 12:01:40 | 000,000,000 | --SD | M] -- C:\Users\Haenz\AppData\Roaming\Microsoft
[2010.11.03 19:17:28 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Mozilla
[2010.08.05 18:11:29 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Mozilla-Cache
[2009.12.15 18:53:03 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Nero
[2009.10.08 20:42:47 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\PowerCinema
[2009.12.17 16:03:01 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Red Kawa
[2010.11.16 19:11:05 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Uniblue
[2010.11.16 19:29:33 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\UseNeXT
[2010.09.06 20:03:08 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\vlc
[2010.11.16 18:52:53 | 000,000,000 | ---D | M] -- C:\Users\Haenz\AppData\Roaming\Winamp
 
< %APPDATA%\*.exe /s >
[2010.10.27 22:32:38 | 000,053,453 | ---- | M] () -- C:\Users\Haenz\AppData\Roaming\Done.exe
[2010.05.11 10:00:16 | 000,050,354 | ---- | M] (Facebook, Inc.) -- C:\Users\Haenz\AppData\Roaming\Facebook\uninstall.exe
[2009.10.09 13:10:05 | 000,010,134 | R--- | M] () -- C:\Users\Haenz\AppData\Roaming\Microsoft\Installer\{DB6823F8-490F-46ED-9778-F1B2DD9032E5}\ARPPRODUCTICON.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:46:51 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_163188bf770e4ab0\AGP440.sys
[2008.01.21 03:46:51 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_181d01cb743015fc\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.01.21 03:46:50 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=1898FAE8E07D97F2F6C2D5326C633FAC -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_3956c39dd9e73fd2\atapi.sys
[2009.04.11 08:15:00 | 000,020,952 | ---- | M] (Microsoft Corporation) MD5=E68D9B3A3905619732F7FE039466A623 -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_3b423ca9d7090b1e\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 12:16:48 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_424bc4aceb06de1c\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\SysWOW64\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\SysWOW64\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2007.05.17 20:34:04 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files (x86)\CyberLink\PowerDirector\EventLog.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_b5f700fe698beb14\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_b7eb106e66a7ac19\explorer.exe
[2008.10.29 07:15:50 | 003,087,360 | ---- | M] (Microsoft Corporation) MD5=50514057C28A74BAC2BD04B7B990D615 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_aba256ac352b2919\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_b8583e9d7fda0512\explorer.exe
[2009.04.11 08:10:17 | 003,079,168 | ---- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 -- C:\Windows\explorer.exe
[2009.04.11 08:10:17 | 003,079,168 | ---- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_afbebba22f3bab41\explorer.exe
[2008.10.28 03:30:12 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=72B9990E45C25AA3C75C4FB50A9D6CE0 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_ac5266dd4e2b0a41\explorer.exe
[2008.10.29 07:49:22 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=BBD8E74F23D7605CB0CDB57A1B25D826 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_ad96661c3246ea1e\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\SysWOW64\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\SysWOW64\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_ba1365f4639c6d3c\explorer.exe
[2008.10.30 06:30:07 | 003,081,216 | ---- | M] (Microsoft Corporation) MD5=E404A65EF890140410E9F3D405841C95 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_ae03944b4b794317\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_b6a7112f828bcc3c\explorer.exe
[2008.01.21 03:48:44 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=F6D765FB6B457542D954682F50C26E4F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_add342963219dff5\explorer.exe
[2008.01.21 03:49:23 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_b827ece8667aa1f0\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2008.12.04 05:48:52 | 000,407,064 | ---- | M] (Intel Corporation) MD5=8EACF469269FB1509561961A3188F670 -- C:\ACER\Preload\Autorun\DRV\Intel RAID ICH10R\IaStor.sys
[2008.12.04 11:48:52 | 000,407,064 | ---- | M] (Intel Corporation) MD5=8EACF469269FB1509561961A3188F670 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2008.12.04 11:34:52 | 000,328,728 | ---- | M] (Intel Corporation) MD5=BAABB0301949774A66B955C65319635A -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:46:59 | 000,290,872 | ---- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_0b2fedfc40256bc5\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.01.21 03:51:03 | 000,716,800 | ---- | M] (Microsoft Corporation) MD5=5D0A4891F8CD0E9E64FF57A6A34044F5 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_59d652c6f057598d\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SysWOW64\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SysWOW64\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_6616762521d9e6d4\netlogon.dll
[2009.04.11 08:11:16 | 000,717,312 | ---- | M] (Microsoft Corporation) MD5=A3F1B171702CA04744EE514243B45BFB -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_5bc1cbd2ed7924d9\netlogon.dll
[2008.01.21 03:48:28 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_642afd1924b81b88\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2008.01.21 03:46:54 | 000,054,328 | ---- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_95f95eab775c159d\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:50:28 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_9e812831c5d9a243\scecli.dll
[2008.01.21 03:49:49 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=35F1DD99F9903BC267C2AF16B09F9BF7 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_942c7ddf9178e048\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SysWOW64\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SysWOW64\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_a06ca13dc2fb6d8f\scecli.dll
[2009.04.11 08:11:23 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=9922ADB6DCA8F0F5EA038BEFF339C08B -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_9617f6eb8e9aab94\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 03:48:29 | 000,820,224 | ---- | M] (Microsoft Corporation) MD5=32B87D215905F648EBE36A621978442C -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_295707c525b9f068\user32.dll
[2008.01.21 03:49:14 | 000,648,192 | ---- | M] (Microsoft Corporation) MD5=3D691030DBD3BD75DE1501BE54F0D425 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_33abb2175a1ab263\user32.dll
[2009.04.11 07:26:45 | 000,648,704 | ---- | M] (Microsoft Corporation) MD5=D29FDB5DEDBDC1BD882164DC6DC4DD53 -- C:\Windows\SysWOW64\user32.dll
[2009.04.11 07:26:45 | 000,648,704 | ---- | M] (Microsoft Corporation) MD5=D29FDB5DEDBDC1BD882164DC6DC4DD53 -- C:\Windows\SysWOW64\user32.dll
[2009.04.11 07:26:45 | 000,648,704 | ---- | M] (Microsoft Corporation) MD5=D29FDB5DEDBDC1BD882164DC6DC4DD53 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_35972b23573c7daf\user32.dll
[2009.04.11 08:11:27 | 000,820,224 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_2b4280d122dbbbb4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SysWOW64\userinit.exe
[2008.01.21 03:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SysWOW64\userinit.exe
[2008.01.21 03:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2008.01.21 03:49:46 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_384755998a0d6941\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:11:08 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_cdcd15a68a70b877\winlogon.exe
[2008.01.21 03:49:47 | 000,406,016 | ---- | M] (Microsoft Corporation) MD5=856491FCED98093D824B9EB2892F564A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_cbe19c9a8d4eed2b\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SysWOW64\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SysWOW64\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:50:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:49:42 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=8A900348370E359B6BFF6A550E4649E1 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_aba53c58802b1777\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.03.08 12:31:42 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\dxtmsft.dll
[2009.03.08 12:31:37 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\dxtrans.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:4CF61E54
@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:2634FC95

< End of report >
         

--- --- ---

OTL EXTRAS Logfile:

OTL Extras logfile created on: 16.11.2010 19:25:50 - Run 1
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Users\Haenz\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
6,00 Gb Total Physical Memory | 4,00 Gb Available Physical Memory | 66,00% Memory free
12,00 Gb Paging File | 10,00 Gb Available in Paging File | 80,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 688,88 Gb Total Space | 449,03 Gb Free Space | 65,18% Space Free | Partition Type: NTFS
Drive D: | 688,85 Gb Total Space | 77,22 Gb Free Space | 11,21% Space Free | Partition Type: NTFS
 
Computer Name: HOMEBASE | User Name: Haenz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01  [binary data]
"VistaSp2" = E3 7D C9 36 50 74 CA 01  [binary data]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
 
========== System Restore Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 1
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{009D8A8B-4BA7-4770-9F48-2D5333245905}" = lport=137 | protocol=17 | dir=in | app=system | 
"{06166218-0ECC-4D2D-A1B3-82310923C71C}" = lport=138 | protocol=17 | dir=in | app=system | 
"{15A30250-3A9E-4F90-B1E1-FA6C0B7002DB}" = lport=139 | protocol=6 | dir=in | app=system | 
"{62AEA112-A6A7-4201-8DD0-ECC8A7003C40}" = rport=445 | protocol=6 | dir=out | app=system | 
"{7A34C875-701D-4F60-9EC0-F164DA881E79}" = rport=138 | protocol=17 | dir=out | app=system | 
"{AA338373-0F09-48A7-B748-C663EBFDF82E}" = lport=445 | protocol=6 | dir=in | app=system | 
"{B39A28F8-149B-4528-9696-D81F56C64FDB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{D957054E-7996-422D-AF72-747E851BF78F}" = rport=137 | protocol=17 | dir=out | app=system | 
"{DD8295BD-6038-48A4-A4FD-2134BF5E5C6B}" = rport=139 | protocol=6 | dir=out | app=system | 
"{FD7496AB-C61A-4DF6-957B-0C95235741B6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0EBF778F-00DA-4EE4-8449-935912B7E299}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\die siedler 7\data\base\_dbg\bin\release\settlers7r.exe | 
"{0F13B522-3C3B-4FC6-8852-A481070B9955}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{13FD0A8E-8B17-4015-916E-2DE708ADFEFB}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr.exe | 
"{18756067-65B8-41B6-A014-7556C7AB68B6}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{1F6821A6-84B7-43F4-A150-F201573105E1}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\die siedler 7\data\base\_dbg\bin\release\settlers7r.exe | 
"{22A4A13E-FD5C-458A-B8EA-98925C3F45B3}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{2A6B9C15-F3AE-44A3-85BA-9FCF477630B7}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{338BEC1E-81E3-48C0-BE3E-26BB916CDC3B}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{50BFBF3C-F67F-4792-A9FA-08349D6FD9C7}" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{578059B7-5E9F-4CED-9F00-7990AB52C23D}" = protocol=17 | dir=in | app=c:\program files (x86)\newtech infosystems\nti backup now 5\schedulersvc.exe | 
"{5C4B1F5A-805C-4328-9701-CCB85DD72EA8}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{5E6FFA1D-E9E9-4AC5-8DD8-EBD24843C107}" = protocol=17 | dir=in | app=d:\spiele\age of empires iii\age3y.exe | 
"{63B059DB-0208-4AF1-8355-DA1E99921BE5}" = protocol=6 | dir=in | app=d:\spiele\civilization iv\warlords\civ4warlords.exe | 
"{64FD2679-3EC2-48EE-ADD8-E206551251D7}" = protocol=6 | dir=in | app=d:\spiele\civilization iv\civilization4.exe | 
"{863C32CF-DF05-402B-BA56-5899C5BE652A}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{86F05800-B0DC-4342-A5CF-99E01A6C1C7A}" = protocol=17 | dir=in | app=d:\spiele\age of empires iii\age3.exe | 
"{91547D73-F720-48B9-835B-C6E7B1016CCD}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{920E4BF8-D910-40F4-A157-3B3BEA686D8D}" = protocol=6 | dir=in | app=d:\spiele\age of empires iii\age3y.exe | 
"{A3F7637D-CEA6-4244-BED8-298CD474B14A}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{A674CC16-A850-45DE-AA12-DF8E7148C7ED}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{A9C49917-C882-4D56-B15A-284E3D44CCCD}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{AC1BAD5D-E018-4D58-9023-C4C70D393471}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{B0F4F561-EB24-4E56-97B7-25EA20FFC76C}" = protocol=6 | dir=in | app=d:\spiele\civilization iv\beyond the sword\civ4beyondsword.exe | 
"{BD00B399-74AE-4925-834A-0F64BF9BB456}" = protocol=6 | dir=in | app=d:\spiele\age of empires iii\age3.exe | 
"{C05413B3-D768-41E0-AE66-C066535C35D8}" = protocol=6 | dir=in | app=c:\program files (x86)\newtech infosystems\nti backup now 5\backupsvc.exe | 
"{C2317A65-AB04-439B-8ED8-21A5430D896A}" = protocol=17 | dir=in | app=d:\spiele\civilization iv\beyond the sword\civ4beyondsword.exe | 
"{C8AB6354-6882-46E7-803A-1A841136099E}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{CE3ADD37-5466-4EB3-98D0-E9ADBCD396F6}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{D7248B39-F80D-4B0F-A751-AE0E4607F94A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{DF91525B-E909-479F-99C2-24E9009EB2C5}" = dir=in | app=c:\program files (x86)\acer arcade deluxe\acer homemedia connect\homemedia connect.exe | 
"{E167E1E3-D0F7-4046-B2E2-6C41BFF03312}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{EA56E91C-3B78-4BD1-BD85-228889357D8D}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{EBAFE89E-1637-42F7-9235-DD04E4C27642}" = protocol=17 | dir=in | app=c:\program files (x86)\newtech infosystems\nti backup now 5\backupsvc.exe | 
"{ED8F48D2-F383-4AC7-B3F6-FFBAB5027A19}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{EFD35A0D-C6B1-4EC5-BF34-A80D09958190}" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{F49C2F37-8296-4B42-B6A1-2514324A24BC}" = protocol=17 | dir=in | app=d:\spiele\civilization iv\warlords\civ4warlords.exe | 
"{F70A7CD5-198A-4490-A77A-B5651144A28D}" = protocol=17 | dir=in | app=d:\spiele\civilization iv\civilization4.exe | 
"{F915CDBD-6A22-438A-AD15-250E3D1C5565}" = protocol=6 | dir=in | app=c:\program files (x86)\newtech infosystems\nti backup now 5\schedulersvc.exe | 
"TCP Query User{068205F7-3FA2-40D3-9C9B-BD85C49B264C}C:\program files (x86)\ubisoft\die siedler 7\data\base\_dbg\bin\release\uplaybrowser.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\die siedler 7\data\base\_dbg\bin\release\uplaybrowser.exe | 
"TCP Query User{28566887-BC94-49F7-B263-AD176D93723B}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 
"TCP Query User{2C6AC3FA-1555-491B-A60F-08414FCA1890}C:\program files (x86)\pokerstrategy\pokerstrategy equilator\equilator.exe" = protocol=6 | dir=in | app=c:\program files (x86)\pokerstrategy\pokerstrategy equilator\equilator.exe | 
"TCP Query User{37BDB547-49B8-43CA-8EF3-DE14FF7A1AA6}D:\spiele\die siedler 7\data\base\_dbg\bin\release\uplaybrowser.exe" = protocol=6 | dir=in | app=d:\spiele\die siedler 7\data\base\_dbg\bin\release\uplaybrowser.exe | 
"TCP Query User{7898267D-C65B-43FB-A8BE-7B0EFDC39FE6}D:\spiele\c & c generals\patchget.dat" = protocol=6 | dir=in | app=d:\spiele\c & c generals\patchget.dat | 
"TCP Query User{8DE2B645-3174-4C51-A646-8C1C846BED20}C:\program files (x86)\pokerstrategy\pokerstrategy equilator\equilator.exe" = protocol=6 | dir=in | app=c:\program files (x86)\pokerstrategy\pokerstrategy equilator\equilator.exe | 
"TCP Query User{980706C0-DC87-4889-A8E5-51D243A27E2F}D:\spiele\anno 1701\anno1701.exe" = protocol=6 | dir=in | app=d:\spiele\anno 1701\anno1701.exe | 
"TCP Query User{ACA18A9D-0008-4A86-8CB4-D02DD1A3E991}D:\spiele\anno 1701\anno1701.exe" = protocol=6 | dir=in | app=d:\spiele\anno 1701\anno1701.exe | 
"TCP Query User{E07A9B0E-B157-4513-8164-837D6EED5CC5}C:\program files (x86)\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq6.5\icq.exe | 
"TCP Query User{FA46F621-AFF5-4777-B60F-70FA61026D7E}C:\program files (x86)\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq6.5\icq.exe | 
"UDP Query User{07BF1112-EB8D-4A51-96D0-737A0F5AE838}D:\spiele\anno 1701\anno1701.exe" = protocol=17 | dir=in | app=d:\spiele\anno 1701\anno1701.exe | 
"UDP Query User{21384BD8-B2E0-4DA3-AB11-10A9ADE0B93B}C:\program files (x86)\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq6.5\icq.exe | 
"UDP Query User{51325433-2E7A-4E67-B9D7-E50517E6F146}D:\spiele\anno 1701\anno1701.exe" = protocol=17 | dir=in | app=d:\spiele\anno 1701\anno1701.exe | 
"UDP Query User{72D100A8-53FB-4B6F-B5B5-D9E43489BAC9}D:\spiele\c & c generals\patchget.dat" = protocol=17 | dir=in | app=d:\spiele\c & c generals\patchget.dat | 
"UDP Query User{966A1FCE-546E-4BEE-84E4-800468352D5B}C:\program files (x86)\ubisoft\die siedler 7\data\base\_dbg\bin\release\uplaybrowser.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\die siedler 7\data\base\_dbg\bin\release\uplaybrowser.exe | 
"UDP Query User{9E80B7E7-5C1F-4626-B99D-204C8571CFB0}D:\spiele\die siedler 7\data\base\_dbg\bin\release\uplaybrowser.exe" = protocol=17 | dir=in | app=d:\spiele\die siedler 7\data\base\_dbg\bin\release\uplaybrowser.exe | 
"UDP Query User{A77B6E1C-C80A-4770-AE0F-83688E8BA9D8}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 
"UDP Query User{C6EDAAD4-C3F0-431B-9F13-ECF256215985}C:\program files (x86)\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq6.5\icq.exe | 
"UDP Query User{E34BD774-0765-4ED4-9FA4-24F6C0F980FC}C:\program files (x86)\pokerstrategy\pokerstrategy equilator\equilator.exe" = protocol=17 | dir=in | app=c:\program files (x86)\pokerstrategy\pokerstrategy equilator\equilator.exe | 
"UDP Query User{F80FB96B-CABC-4A4F-90B2-FAA93A85E9AE}C:\program files (x86)\pokerstrategy\pokerstrategy equilator\equilator.exe" = protocol=17 | dir=in | app=c:\program files (x86)\pokerstrategy\pokerstrategy equilator\equilator.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{33EB1061-ABF1-4470-A540-32E97A610536}" = Apple Mobile Device Support
"{5F02C14D-A630-4771-8409-0BA89FCCA8D6}" = iTunes
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{B91110FB-33B4-468B-90C2-4D5E8AE3FAE1}" = Bonjour
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}" = Uniblue RegistryBooster
"{0FDB2D25-D880-4E10-868F-8C64EFE155F1}" = G Data AntiVirus SE
"{1122AAC4-AAAA-43BF-B2D4-3C8C12378952}" = Nero InfoTool
"{11A84FCA-C3C7-4AFD-A797-111DB8569DBC}" = Nero BurningROM
"{12345674-DE9A-677A-CCEE-666356D89777}" = Nero BurnRights
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{1B040683-C390-4711-ABC7-DA8D85E470E7}" = NeroBurningROM
"{20cda24d-2d40-4ddc-a9af-fe13cec2410c}" = Nero 9
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 22
"{2D3455A8-3B15-41A8-99F8-0D4215746463}" = Nero StartSmart
"{3097B151-1F61-4211-A4CC-D70127B226AE}" = SoundTrax
"{30D1F3D2-54CF-481D-A005-F94B0E98FEEC}" = Sid Meier's Civilization 4 Complete
"{3E6F0CAD-EE38-42A5-9EEA-AE17A55BF2D4}" = Firebird SQL Server - MAGIX Edition
"{3F30CC51-0788-487B-AA83-7214A239C0C0}" = Nero Disc Copy Gadget Help
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E8C27C2-D727-4C00-A90E-C3F6376EEE70}" = Nero ControlCenter
"{56BE5CC9-95E6-4128-ABEA-968414CA9C80}" = DolbyFiles
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5AE12194-3EAA-40DF-B2BF-FE1D6B78BBF4}" = Nero Vision
"{5C2E8A0F-80E2-4C68-8CC0-D8D16E7196BF}" = Nero RescueAgent Help
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{68301905-2DEA-41CE-A4D4-E8B443B099BA}" = MyWinLocker
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{70F8B183-99EB-4304-BA35-080E2DFFD2A3}" = Age of Empires III
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{75321954-2589-11DC-DDCC-E98356D81493}" = Nero DriveSpeed
"{753973C4-B961-43BF-B2D4-3C8C92F7216E}" = Nero DriveSpeed
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78523651-D8B1-11DC-CCEE-741589645873}" = Nero DiscSpeed
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_STANDARDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_STANDARDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_STANDARDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_STANDARDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_STANDARDR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_STANDARDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_STANDARDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_STANDARDR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_STANDARDR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0407-1000-0000000FF1CE}_STANDARDR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_STANDARDR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0012-0000-0000-0000000FF1CE}" = Microsoft Office Standard 2007
"{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{943CC0C0-2253-4FE0-9493-DD386F7857FD}" = Nero Express
"{961D53EA-40DC-4156-AD74-25684CE05F81}" = Nero Installer
"{9A875B56-A35C-46BA-A3AA-DF8D03EE9F2F}" = Nero ControlCenter
"{9C916142-C18C-429D-BFED-40094A7E0BEB}" = Die Siedler 7
"{9F3523F8-DAD7-AE52-6DA7-45CDDDF33726}" = Advertising Center
"{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701
"{A73BEC3C-40A0-480E-87EF-EFCD33629088}" = NeroExpress
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AAA12554-2589-11DC-92EF-E98356D81493}" = Nero InfoTool
"{AABBCC54-D8B1-11DC-92EF-E98356D81493}" = Nero DiscSpeed
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.0 - Deutsch
"{AC76BA86-7AD7-5760-0000-900000000003}" = Japanese Fonts Support For Adobe Reader 9
"{B2C12C8D-65DC-40BD-B309-5ADB0C6C8D8F}" = Nero WaveEditor
"{B823632F-3B72-4514-8861-B961CE263224}" = PostgreSQL 8.3
"{B96C2601-52F5-4D5D-816A-63469EA311EF}" = "Nero SoundTrax Help
"{BCD82AB5-670D-4242-90FA-1F97103C16CD}" = Movie Templates - Starter Kit
"{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties
"{C99C89A3-119A-45E6-B26E-DD5643CAA0C5}" = Menu Templates - Starter Kit
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CD1826A5-CFCC-4C6E-9F9D-E181876162EA}" = Nero Rescue Agent
"{D4EB3763-9586-405D-B376-DE98C8C9285E}" = PokerStrategy Equilator
"{D7C206B6-1A63-4389-A8B1-8F607D0BFF1F}" = Nero StartSmart Help
"{D83BD5E2-5AF4-49F6-B5C1-484A9760E73D}" = Brother MFL-Pro Suite
"{DA20E1A8-07CB-4EE7-9B72-A7E28C953F0E}" = Acer Product Registration
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DB6823F8-490F-46ED-9778-F1B2DD9032E5}" = Hama WLAN USB Stick
"{E4A8DD87-A746-4443-BF25-CAF99CED6767}" = Nero Disc Copy Gadget
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E86156E5-9859-440D-8876-26CED1349802}" = Nero WaveEditor Help
"{EA9FFE54-D8B1-11DC-92EF-E98356D81493}" = Nero BurnRights
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F53F6769-AC46-49E3-ABE3-2C8AFD39D0DD}" = Nero Vision
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AviSynth" = AviSynth 2.5
"AVS Media Player_is1" = AVS Media Player 3.1
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"DivX Setup.divx.com" = DivX-Setup
"ElsterFormular 11.2.0.4074" = ElsterFormular
"Hauppauge MCE2005 Software Encoder" = Hauppauge MCE XP/Vista Software Encoder (2.0.27022)
"ICQToolbar" = ICQ Toolbar
"InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{70F8B183-99EB-4304-BA35-080E2DFFD2A3}" = Age of Empires III
"InstallShield_{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"MAGIX Foto Manager 8 D" = MAGIX Foto Manager 8
"MAGIX Fotobuch" = MAGIX Fotobuch 3.6
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"PartyPoker" = PartyPoker
"PokerTracker3" = PokerTracker 3 (remove only)
"STANDARDR" = Microsoft Office Standard 2007
"TDD-Swimming_is1" = TDD-Swimming V6.0
"Uniblue RegistryBooster" = Uniblue RegistryBooster
"UseNeXT_is1" = UseNeXT
"Videora iPod Converter" = Videora iPod Converter 4.06
"VLC media player" = VLC media player 1.1.4
"Winamp" = Winamp
"WinRAR archiver" = WinRAR archiver
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1577962275-2861703630-4009606616-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         

--- --- ---

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
PRC - C:\Users\Haenz\AppData\Local\Temp\eftupknfqf.exe ()
O2 - BHO: (C:\Windows\SysWow64\glwjv4.dll) - {B1BA20C1-A503-59BD-F412-03B53A2C8951} - C:\Windows\SysWOW64\glwjv4.dll ()
O4 - HKLM..\Run: [Lvahhfnglxqc] C:\Users\Haenz\AppData\Local\Temp\eftupknfqf.exe ()
O4 - HKLM..\Run: [Lvahhfngotd] C:\Users\Haenz\AppData\Local\Temp\install.exe ()
O4 - HKU\S-1-5-21-1577962275-2861703630-4009606616-1000..\Run: [Lvahhfnglxqc] C:\Users\Haenz\AppData\Local\Temp\eftupknfqf.exe ()
O22 - SharedTaskScheduler: {B1BA20C1-A503-59BD-F412-03B53A2C8951} - uawhr987ry38w7rhawuig673fef - C:\Windows\SysWOW64\glwjv4.dll ()
[2010.11.16 16:06:57 | 000,000,120 | ---- | M] () -- C:\Users\Haenz\AppData\Local\Mqaki.dat
[2010.11.16 16:06:57 | 000,000,000 | ---- | M] () -- C:\Users\Haenz\AppData\Local\Spewofaxacu.bin
[2010.11.16 16:02:17 | 000,030,000 | ---- | M] () -- C:\Windows\SysWow64\glwjv4.dll
[2010.10.27 22:32:38 | 000,053,453 | ---- | M] () -- C:\Users\Haenz\AppData\Roaming\Done.exe
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort posten.


öffne mein computer, c: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
archiv zu uns hochladen.
http://www.trojaner-board.de/54791-a...ner-board.html

Hier der Logfile:

Was genau ist denn jetzt eigtl. passiert? Damit ich das auch ein bißchen nachvollziehen kann....


All processes killed
========== OTL ==========
No active process named eftupknfqf.exe was found!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B1BA20C1-A503-59BD-F412-03B53A2C8951}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B1BA20C1-A503-59BD-F412-03B53A2C8951}\ deleted successfully.
C:\Windows\SysWOW64\glwjv4.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Lvahhfnglxqc deleted successfully.
C:\Users\Haenz\AppData\Local\Temp\eftupknfqf.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Lvahhfngotd deleted successfully.
C:\Users\Haenz\AppData\Local\Temp\install.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-1577962275-2861703630-4009606616-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Lvahhfnglxqc deleted successfully.
File C:\Users\Haenz\AppData\Local\Temp\eftupknfqf.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{B1BA20C1-A503-59BD-F412-03B53A2C8951} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B1BA20C1-A503-59BD-F412-03B53A2C8951}\ not found.
File C:\Windows\SysWOW64\glwjv4.dll not found.
C:\Users\Haenz\AppData\Local\Mqaki.dat moved successfully.
C:\Users\Haenz\AppData\Local\Spewofaxacu.bin moved successfully.
File C:\Windows\SysWow64\glwjv4.dll not found.
C:\Users\Haenz\AppData\Roaming\Done.exe moved successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Haenz
->Flash cache emptied: 93274 bytes

User: postgres

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Haenz
->Temp folder emptied: 446510849 bytes
->Temporary Internet Files folder emptied: 146345761 bytes
->Java cache emptied: 867990 bytes
->Flash cache emptied: 0 bytes

User: postgres
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 528667700 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 29241259672 bytes

Total Files Cleaned = 28.957,00 mb


OTL by OldTimer - Version 3.2.17.3 log created on 11162010_205007

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\TMP0000006D1D47133ED569716C not found!

Registry entries deleted on Reboot...


Vielen Dank, das andere habe ich auch hochgeladen...

wir haben ein browser helper objekt entfernt, + datei. und noch ein paar autostart einträge + datei.
+ 30 gb tempdateien, die deinen pc nutzloserweise voll gemüllt haben.
nutze den kaspersky tdss killer, log posten
Wie werden Schadprogramme der Familie Rootkit.Win32.TDSS bekämpft?

Hi,
so scheint alles wieder tadellos zu funktionieren, weil der tdsskiller gesagt hat, dass keine infektionen vorliegen. somit gab es auch keinen log!

Also nochmal vielen lieben Dank! Hat ja echt alles einwandfrei so geklappt wie du gesagt hast

Oder muss ich sonst noch was machen?

Achso...du wolltest mir noch zeigen, wie ich beim Arbeitsplatz das wieder umstelle, so dass auch die versteckten Dateien etc. wieder angezeigt werden.

jo, wir sind aber noch nicht durch.
lade den CCleaner slim:
Piriform - Builds
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Hier die Liste:

Acer eRecovery Management Acer Incorporated 07.08.2009 11,7MB 4.00.3008 unbekannt
Acer Product Registration Acer Incorporated 07.10.2009 5,93MB 3.0.0.10 unbekannt
Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 19.08.2010 10.1.82.76 ich denke notwendig
Adobe Reader 9.4.0 - Deutsch Adobe Systems Incorporated 09.10.2010 164,0MB 9.4.0 ich denke notwendig
Age of Empires III Microsoft Game Studios 19.06.2010 2.148MB 1.00.0000 notwendig
Age of Empires III - The Asian Dynasties Microsoft Game Studios 18.07.2010 2.928MB 1.00.0000 notwendig
Anno 1701 Sunflowers 17.04.2010 2.114MB 1.04 notwendig
Apple Application Support Apple Inc. 16.09.2010 42,8MB 1.3.2 best. für ipod-notwendig
Apple Mobile Device Support Apple Inc. 16.09.2010 20,7MB 3.2.0.47 " "
Apple Software Update Apple Inc. 14.12.2009 2,16MB 2.1.1.116 ""
AviSynth 2.5 16.12.2009 3,02MB unbekannt
AVS Media Player 3.1 Online Media Technologies Ltd. 12.02.2010 17,0MB ich benutze nur vlc player zum filme gucken - evtl. unwichtig
AVS Update Manager 1.0 Online Media Technologies Ltd. 12.02.2010 9,64MB ""
AVS4YOU Software Navigator 1.3 Online Media Technologies Ltd. 12.02.2010 8,97MB ""
Bonjour Apple Inc. 02.08.2010 1,15MB 2.0.2.0 unbekannt - ich brauche egitl. nur itunes für den ipod
Brother MFL-Pro Suite Brother Industries, Ltd. 07.10.2009 1,06MB 1.00 evtl. treiber für den drucker!?
CCleaner Piriform 16.11.2010 5,96MB 3.00 wird ausgeführt...
Command & Conquer Generals Electronic Arts 01.12.2009 0.50.0000 notwendig
CyberLink PowerDirector CyberLink Corp. 27.07.2009 445MB 7.0.2514 unbekannt
Die Siedler 7 Ubisoft 18.05.2010 4.914MB 1.04.1234 ich glaube unwichtig, da vlc divx nicht benötigt...
DivX-Setup DivX, Inc. 17.09.2010 2,05MB 2.0.4.2 ""
ElsterFormular Landesfinanzdirektion Thüringen 22.03.2010 132,5MB 11.2.0.4074
Facebook Plug-In Facebook, Inc. 10.05.2010 6,26MB unbekannt
Firebird SQL Server - MAGIX Edition MAGIX AG 27.07.2009 10,1MB 2.1.23.0 unbekannt
G Data AntiVirus SE G Data Software AG 27.07.2009 220MB 20.0.3.0 mein virus programm
Hama WLAN USB Stick Hama GmbH & Co KG 08.10.2009 0,32MB 1.00.0000 notwendig
Hauppauge MCE XP/Vista Software Encoder (2.0.27022) Hauppauge Computer Works, Inc. 06.08.2009 0,15MB 2.0.27022 unbekannt
ICQ Toolbar ICQ 02.11.2010 3.0.0 unwichtig
ICQ7.2 ICQ 02.11.2010 46,1MB 7.2 notwendig
Intel® Matrix Storage Manager Intel Corporation 06.08.2009 59,4MB unbekannt
iTunes Apple Inc. 16.09.2010 136,9MB 10.0.0.68 notwendig
Japanese Fonts Support For Adobe Reader 9 Adobe Systems Incorporated 19.10.2010 16,5MB 9.0.0 unbekannt
Java(TM) 6 Update 22 Sun Microsystems, Inc. 13.06.2010 94,5MB 6.0.220 notwendig glaube ich
MAGIX Foto Manager 8 MAGIX AG 27.07.2009 62,5MB 6.0.1.471 unbekannt
MAGIX Fotobuch 3.6 MAGIX AG 06.08.2009 14,4MB 3.6 unbekannt
Malwarebytes' Anti-Malware Malwarebytes Corporation 15.11.2010 3,91MB notwendig
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU Microsoft Corporation 10.10.2009 42,1MB unbekannt
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 08.10.2009 42,1MB unbekannt
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 05.07.2010 189,3MB 4.0.30319 unbekannt
Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 05.07.2010 46,5MB 4.0.30319 unbekannt
Microsoft Office Standard 2007 Microsoft Corporation 08.10.2009 273MB 12.0.6425.1000 unbekannt
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 08.10.2009 0,25MB 8.0.50727.4053 unbek.
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 27.07.2009 0,41MB 8.0.56336 unbek.
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Corporation 22.03.2010 0,19MB 9.0.30729.4148 unbek.
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Corporation 04.05.2010 1,41MB 9.0.21022 unbek.
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Corporation 22.03.2010 0,59MB 9.0.30729 unbek.
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 08.10.2009 1,28MB 4.20.9870.0 unbek.
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 30.11.2009 1,34MB 4.20.9876.0 unbek.
MyWinLocker EgisTec 27.07.2009 35,2MB 3.1.36.0 unbek.
Nero 9 Nero AG 08.11.2009 864MB notwendig
NTI Backup Now 5 NewTech Infosystems 27.07.2009 29,5MB 5.1.2.616 unbek.
NTI Media Maker 8 NewTech Infosystems 27.07.2009 187,4MB 8.0.2.6509 unbek.
NVIDIA Drivers NVIDIA Corporation 06.08.2009 2.814MB 1.3 notwendig
PartyPoker PartyGaming 09.10.2009 700MB 136 notwendig
PlayReady PC Runtime amd64 Microsoft Corporation 27.07.2009 2,07MB 1.3.0 unbek.
PokerStrategy Equilator PokerStrategy 14.02.2010 25,0MB 1.7 notwendig
PokerTracker 3 (remove only) 09.10.2009 241MB notwendig
PostgreSQL 8.3 PostgreSQL Global Development Group 09.10.2009 68,1MB 8.3 notwendig
QuickTime Apple Inc. 16.09.2010 73,7MB 7.68.75.0 nicht wichtig
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 27.07.2009 10,6MB 6.0.1.5807 notwendig
Sid Meier's Civilization 4 Complete Firaxis Games 16.07.2010 62,0MB 1.74 nicht wichtig
TDD-Swimming V6.0 Sportlicht GmbH 31.01.2010 12,7MB V6.0 nicht wichtig
Ubisoft Game Launcher UBISOFT 04.05.2010 52,5MB 1.0.0.0 unbekannt
Uniblue RegistryBooster Uniblue Systems Ltd 15.11.2010 17,6MB 4.7.7.19 unbekannt (i.was. von gestern abend oder?)
UseNeXT Tangysoft Ltd. 31.10.2010 5,02MB notwendig
Videora iPod Converter 4.06 Red Kawa 16.12.2009 12,7MB 4.06 notwendig
VLC media player 1.1.4 VideoLAN 05.09.2010 76,5MB 1.1.4 notwendig
Winamp Nullsoft, Inc 19.07.2010 28,0MB 5.581 notwendig
Winamp Erkennungs-Plug-in Nullsoft, Inc 19.07.2010 0,13MB 1.0.0.1 unbekannt
Windows Live Anmelde-Assistent Microsoft Corporation 08.10.2009 1,93MB 5.000.818.6 unbekannt
WinRAR archiver 07.10.2009 3,33MB notwendig





Ich habe auch noch 2 Laptops, die irgendwie von der Leistung und Geschwindigkeit nicth mehr das sind was sie mal waren. Kann ich die denn auch ohne sie zu formatieren wieder flüssig laufen lassen? Bzw. welches Programm würdest du mir da empfehlen?

öffne den adobe reader, bearbeiten, voreinstellungen, javascript, dort den haken raus, internet, ebenfalls alle haken raus.
so werden keine pdfs mehr automatisch geladen und es kann dir kein schadcode mehr auf diese weise untergeschoben werden.
bitte noch unnötige plugins verschieben:
Adobe Reader schneller starten
behalte aber:
EScript.api
Escript.deu
Search.api
Search.DEU
deinstaliere:
AVS Media Player
AVS Update Manager
AVS4YOU Software Navigator
Bonjour wird von 99,99 % aller user nicht benötigt, deinstalieren.
CyberLink PowerDirector
DivX-Setup falls nicht benötigt, weg.
ElsterFormular Landesfinanzdirektion steht ebenfalls nichts dabei
Facebook Plug-In
Firebird SQL Server
G Data
gehe mal auf deren homepage, dort gibts bereits ne 2011 version, du hängst schon ganz schön nach, bitte upgraden!
ICQ Toolbar
ICQ7.2 dieser client macht werbung etc, würde ich deinstalieren und ersetzen:
Miranda Fusion
Japanese Fonts Support
MAGIX Foto Manager
MAGIX Fotobuch
Microsoft Office Standard (schreibprogramme) falls unnötig, weg.
MyWinLocker
QuickTime
Sid Meier's Civilization
TDD-Swimming
Uniblue RegistryBooster war schon instaliert, aber weg damit.
Windows Live Anmelde-Assistent
wenn das fertig ist, bereinige mit dem CCleaner dateien + registry und scanne mit gdata.
um die andern pcs kümmern wir uns später.

...bin dabei!

Reicht die Testversion vom GData Antivirus oder soll ich den Internetsecurity von GData herunterladen (mit Firewall). Antivirus reicht oder?

Und zu ICQ find ich auf der Miranda Fusion Seite aber nix... oder wo soll ich ICQ ohne Werbeträger herunterladen?

du sollst anstelle von icq miranda nutzen.
miranda unterstützt das icq protokoll und noch viele mehr, ist aber kleiner und schneller.
du hast doch ne gdata lizenz, in dieser steht dir das upgrade zu. wenn du im moment antivirus nutzt, dann upgrade auf 2011.

So habe jetzt alles erledigt und neu gescannt. Hier das Ergebnis:

hxxp://www.pic-upload.de/view-7798708/Unbenannt.jpg.html

i, kann das nicht erkennen, gdata sollte ein log erstellen, dessen inhalt posten bitte.