Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:19:09, on 30.04.2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\avmwlanstick\WLanGUI.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\DT\Speedport W 100 Stick\Wifiusb.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\XXX\Downloads\HiJackThis204.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2475029
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) -  - (no file)
R3 - URLSearchHook: MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\wlangui.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [auditask] rundll32 "C:\Users\XXX\AppData\Local\Temp\drivgini.dll",DllEntryPoint
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\steam.exe" -silent
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Speedport W 100 Stick WLAN Manager.lnk = C:\Program Files\DT\Speedport W 100 Stick\Wifiusb.exe
O8 - Extra context menu item: Free YouTube Download - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Program Files\avmwlanstick\WlanNetService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe

--
End of file - 9444 bytes
         

Edit.:
Bekomme bei jedem Systemstart eine Fehlermeldung in Form eines PopUps die lautet:
RunDLL
Fehler beim Laden von C:\Users\MeinName\AppData\Local \Temp\drivgini.dll
Das angegebene Modul wurde nicht gefunden.

habe mich damit erst an Cosmiq gewand und mir wurde geraten ein HiJackThis-Scan zu machen und hier zu posten
das is die Geschichte

Achja: Hatte ma Trojaner auf dem Rechner o.o
und die Meldung kommt schon ein Jahr lang

Hallo und

Achja: Hatte ma Trojaner auf dem Rechner o.o
und die Meldung kommt schon ein Jahr lang

scheinbar ist es dir egal, ob andere Nutzer des Internets von deinem System aus eventuell zugespammt werden...

HiJackThis Log zum auswerten

Was denkst du warum einer der oben angepinnten Beiträge heißt
"Bitte keine HijackThis Logfiles posten"?

Überprüfe dein System mit Malwarebytes und erstelle anschließend ein Log mit OTL , poste alle Logs hierher, dann sehen wir weiter.

MFG

Zitat von nochdigger

scheinbar ist es dir egal, ob andere Nutzer des Internets von deinem System aus eventuell zugespammt werden...

Tut mir Leid nicht jeder kennt sich so blendend aus wie ihr und ich ging nicht von einem Virus aus und habe die Fehlermeldung aus gewohnheit immer weggeklickt.

Zitat von nochdigger

Was denkst du warum einer der oben angepinnten Beiträge heißt
"Bitte keine HijackThis Logfiles posten"?

Nochmal tut mir Leid, habe gesagt bekommen ich solle HijackThis benutzen und habe den angepinnten Beitrag wohl in meiner Eile übersehen.
Scan mit Malwarebytes läuft und ich werde die Logs dann versuchen übersichtlich hier einzufügen.

Edit.:
Soll ich nur die Logs von OTL posten?
Oder auch von Malwarebytes?

OTL logfile created on: 30.04.2011 17:32:38 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\XXX\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 41,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 57,05 Gb Free Space | 24,50% Space Free | Partition Type: NTFS
 
Computer Name: XXX | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\XXX\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
PRC - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Unlocker\UnlockerAssistant.exe ()
PRC - C:\Program Files\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
PRC - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
PRC - C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\avmwlanstick\WLanGUI.exe (AVM Berlin)
PRC - C:\Program Files\avmwlanstick\WLanNetService.exe (AVM Berlin)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\DT\Speedport W 100 Stick\Wifiusb.exe (TECOM)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\XXX\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (TeamViewer6) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Hamachi2Svc) -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ICQ Service) -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe ()
SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (nSvcIp) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
SRV - (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
SRV - (LBTServ) -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (Stereo Service) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (AVM WLAN Connection Service) -- C:\Program Files\avmwlanstick\WLanNetService.exe (AVM Berlin)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (NVNET) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LMouKE) -- C:\Windows\System32\drivers\LMouKE.Sys (Logitech, Inc.)
DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (L8042mou) -- C:\Windows\System32\drivers\L8042mou.Sys (Logitech, Inc.)
DRV - (L8042Kbd) -- C:\Windows\System32\drivers\L8042Kbd.sys (Logitech, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (fwlanusbn) -- C:\Windows\System32\drivers\fwlanusbn.sys (AVM GmbH)
DRV - (avmeject) -- C:\Windows\System32\drivers\avmeject.sys (AVM Berlin)
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce))
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce))
DRV - (sfvfs02) StarForce Protection VFS Driver (version 2.x) -- C:\Windows\System32\drivers\sfvfs02.sys (Protection Technology)
DRV - (PRISM_A02) -- C:\Windows\System32\drivers\PRISMA02.sys (Conexant Systems, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2475029
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "QIP Search"
FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {59c81df5-4b7a-477b-912d-4e0fdf64e5f2}:0.9.86.1
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.2
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {7BDB48D1-CD94-4B99-A5A4-E418B9EE6532}:1.1.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {32a1fd71-835e-4b11-8e54-886fda0b4c89}:1.1
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&q="
FF - prefs.js..network.proxy.backup.ftp: ""
FF - prefs.js..network.proxy.backup.ftp_port: 0
FF - prefs.js..network.proxy.backup.gopher: ""
FF - prefs.js..network.proxy.backup.gopher_port: 0
FF - prefs.js..network.proxy.backup.socks: ""
FF - prefs.js..network.proxy.backup.socks_port: 0
FF - prefs.js..network.proxy.backup.ssl: ""
FF - prefs.js..network.proxy.backup.ssl_port: 0
FF - prefs.js..network.proxy.ftp: "128.220.231.4"
FF - prefs.js..network.proxy.ftp_port: 3124
FF - prefs.js..network.proxy.gopher: "128.220.231.4"
FF - prefs.js..network.proxy.gopher_port: 3124
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "128.220.231.4"
FF - prefs.js..network.proxy.socks_port: 3124
FF - prefs.js..network.proxy.ssl: "128.220.231.4"
FF - prefs.js..network.proxy.ssl_port: 3124
 
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.30 10:45:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.30 10:44:57 | 000,000,000 | ---D | M]
 
[2009.01.07 01:06:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Extensions
[2011.04.29 11:44:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions
[2011.02.01 00:44:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.09.18 10:16:59 | 000,000,000 | ---D | M] (QipAuthorizer) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}
[2011.04.29 09:54:13 | 000,000,000 | ---D | M] (ChatZilla [de]) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2011.02.01 00:44:50 | 000,000,000 | ---D | M] (Destroy the Web) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{7BDB48D1-CD94-4B99-A5A4-E418B9EE6532}
[2011.04.29 09:54:19 | 000,000,000 | ---D | M] (MyAshampoo Community Toolbar) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
[2010.05.31 16:58:33 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.04.29 09:54:16 | 000,000,000 | ---D | M] (myBabylon EnglishBB Community Toolbar) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}
[2011.04.22 17:50:11 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011.04.29 09:54:14 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011.04.29 09:54:18 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\engine@conduit.com
[2010.12.15 17:12:32 | 000,000,923 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\n3jvvnj1.default\searchplugins\conduit.xml
[2011.04.24 22:15:50 | 000,001,056 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\n3jvvnj1.default\searchplugins\icqplugin.xml
[2010.10.14 12:52:01 | 000,002,062 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\n3jvvnj1.default\searchplugins\qip-search.xml
[2011.04.30 10:45:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.07.16 11:56:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.21 11:14:49 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
File not found (No name found) -- 
[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.08.02 14:40:19 | 000,002,226 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (MyAshampoo Toolbar) - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\WLanGUI.exe (AVM Berlin)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [auditask]  File not found
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\steam.exe (Valve Corporation)
O4 - Startup: C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\XXX\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\XXX\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\Shell\AutoRun\command - "" = E:\pushinst.exe
O33 - MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\Shell\AutoRun\command - "" = I:\installer.exe
O33 - MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\Shell\verb\command - "" = I:\installer.exe
O33 - MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\Shell - "" = AutoRun
O33 - MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\Shell\AutoRun\command - "" = I:\installer.exe
O33 - MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\Shell\verb\command - "" = I:\installer.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\AutoRun\command - "" = L:\autorun.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\directx\command - "" = L:\DirectX9\dxsetup.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\setup\command - "" = L:\setup.exe
O33 - MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\Shell\AutoRun\command - "" = K:\pushinst.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.04.30 17:00:33 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Malwarebytes
[2011.04.30 17:00:22 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.04.30 17:00:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programme\Malwarebytes' Anti-Malware
[2011.04.30 17:00:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.04.30 17:00:18 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.04.30 17:00:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.04.30 14:14:46 | 000,000,000 | ---D | C] -- C:\Program Files\Deep Silver
[2011.04.30 14:13:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programme\Deep Silver
[2011.04.30 13:18:02 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{ADC7B78E-C2D0-4BC1-8454-C1571DBFA712}
[2011.04.30 11:49:01 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\bitComposer Games
[2011.04.30 11:48:51 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\ProtectDISC
[2011.04.30 11:45:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programme\bitComposer Games
[2011.04.30 11:39:47 | 000,000,000 | ---D | C] -- C:\Program Files\bitComposer Games
[2011.04.29 23:31:44 | 000,000,000 | --SD | C] -- C:\Users\XXX\Desktop\Feelings
[2011.04.29 22:30:30 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{5BE83DA6-9AF3-415D-81CE-182E14DE44AA}
[2011.04.27 12:42:11 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{C0EF2A53-44CD-4000-9251-86DEC5DC10FE}
[2011.04.27 11:23:59 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2011.04.27 11:23:59 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
[2011.04.27 11:23:36 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2011.04.26 10:42:23 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{05C5AE65-6FDC-4543-83BA-E69A8A629E5F}
[2011.04.25 14:02:24 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{482AC479-AEAB-4231-82FB-D4948B7A1653}
[2011.04.24 18:59:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{2B075415-F68A-444D-8F24-2FA5FF01BBFD}
[2011.04.24 15:05:59 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\100DEADRABBITS_the american wet dream_xalaniconx@DIS
[2011.04.24 14:51:31 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\100DeadRabbits - Teeth
[2011.04.24 14:18:25 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\Guardians
[2011.04.23 23:28:44 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{5AC403B2-7548-4F0C-8171-7D7E52048DB4}
[2011.04.23 11:28:08 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{8DDAC91D-E5DA-4293-A810-7187B1E60BA1}
[2011.04.22 23:27:37 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{9085AAC8-98AB-453A-AEF1-AE6DEF16C948}
[2011.04.22 11:26:03 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{D88CF7C9-F665-437C-ABE9-2DA5C71E18E9}
[2011.04.21 19:38:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{35D3369E-B044-4644-8D38-9EA34716CD37}
[2011.04.20 22:33:00 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{6E1E6C04-96E8-4ACC-A6E3-FB23F9F86367}
[2011.04.20 10:32:16 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{BC16BF92-09F2-4566-9F81-E45DE69DF619}
[2011.04.19 16:26:55 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{3FF9804E-B80D-4DFD-91C6-56CB09E907EE}
[2011.04.18 16:18:30 | 004,223,008 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\NVStWiz.exe
[2011.04.18 16:15:25 | 000,705,536 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\cohelper.dll
[2011.04.18 13:09:21 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{C88ADE74-5F43-47A1-BE6F-A9599E07B0B2}
[2011.04.17 08:54:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2011.04.17 08:54:22 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2011.04.17 08:54:21 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\Electronic Arts
[2011.04.17 08:41:59 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft WSE
[2011.04.13 18:42:45 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{F830BCC6-F6FE-4A04-BC6F-AB57CCCC0B60}
[2011.04.13 17:02:16 | 000,512,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2011.04.13 17:02:16 | 000,430,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2011.04.13 17:02:08 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011.04.13 17:02:08 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.04.13 17:02:07 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.04.13 17:02:07 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2011.04.13 17:02:07 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.04.13 17:02:07 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2011.04.13 17:02:02 | 002,041,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.04.13 17:00:59 | 000,292,864 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011.04.13 17:00:58 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011.04.13 17:00:41 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll
[2011.04.13 17:00:41 | 001,136,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll
[2011.04.13 17:00:32 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe
[2011.04.11 19:02:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{8BBF2F40-8056-457B-BB84-D590D20D6117}
[2011.04.11 15:00:31 | 000,000,000 | ---D | C] -- C:\Program Files\TeamViewer
[2011.04.10 14:27:59 | 000,000,000 | ---D | C] -- C:\Program Files\Firefly Studios
[2011.04.09 15:55:04 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\Projekt 'Gone Forever'
[2011.04.06 19:58:41 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{116E227F-EEB5-4BB3-B04B-A003F6C6F66C}
[2011.04.05 19:01:05 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{508B8996-0C4E-4F5E-9B7E-56AA9ACCC308}
[2011.04.04 20:33:25 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{219C707D-BEE3-41A1-BBAA-321FDD8F0C02}
[2011.04.03 18:52:00 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{B053FA9C-42BC-45BE-85E2-4D8544D0FC4C}
[2011.04.02 21:54:09 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{B46EE753-F79E-435F-AB28-1878D5345107}
[2011.03.31 18:02:21 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{5B2588FF-3BC2-413B-B3FE-9C281814D2B7}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.04.30 17:30:22 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.04.30 17:30:20 | 000,032,879 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011.04.30 17:30:19 | 000,032,879 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011.04.30 17:27:29 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.04.30 17:25:11 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.04.30 17:25:10 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.04.30 17:24:52 | 1878,163,456 | -HS- | M] () -- C:\hiberfil.sys
[2011.04.30 17:00:22 | 000,000,866 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.30 11:52:30 | 000,004,096 | ---- | M] () -- C:\Users\Public\Documents\00001BF6.LCS
[2011.04.30 11:45:36 | 000,001,043 | ---- | M] () -- C:\Users\XXX\Desktop\Starte Wildlife Park 3 Demo.lnk
[2011.04.30 10:41:10 | 000,670,708 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.04.30 10:41:10 | 000,631,438 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.04.30 10:41:10 | 000,143,876 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.04.30 10:41:10 | 000,118,064 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.04.27 16:46:21 | 000,511,290 | ---- | M] () -- C:\Users\XXX\Documents\WoWScrnShot_042711_164511.jpg
[2011.04.25 15:43:36 | 000,244,711 | ---- | M] () -- C:\Users\XXX\Documents\WoWScrnShot_042511_154240.jpg
[2011.04.24 23:35:13 | 000,235,916 | ---- | M] () -- C:\Users\XXX\Documents\WoWScrnShot_042411_233235.jpg
[2011.04.22 12:19:05 | 000,001,356 | ---- | M] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat
[2011.04.17 08:41:00 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Die*Sims™*Mittelalter.lnk
[2011.04.13 17:29:54 | 000,254,160 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.04.11 18:33:44 | 034,741,575 | ---- | M] () -- C:\Users\XXX\Documents\coole gang - bitte abspielen.mp4
[2011.04.11 15:00:39 | 000,000,915 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk
[2011.04.09 15:36:49 | 000,208,896 | ---- | M] () -- C:\Users\XXX\Desktop\skype remix.MSWMM
[2011.04.02 19:57:51 | 261,414,153 | ---- | M] () -- C:\Windows\MEMORY.DMP
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.04.30 17:00:22 | 000,000,866 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.30 11:48:58 | 000,004,096 | ---- | C] () -- C:\Users\Public\Documents\00001BF6.LCS
[2011.04.30 11:45:36 | 000,001,043 | ---- | C] () -- C:\Users\XXX\Desktop\Starte Wildlife Park 3 Demo.lnk
[2011.04.30 10:45:08 | 000,000,818 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.04.27 16:45:56 | 000,511,290 | ---- | C] () -- C:\Users\XXX\Documents\WoWScrnShot_042711_164511.jpg
[2011.04.25 15:43:09 | 000,244,711 | ---- | C] () -- C:\Users\XXX\Documents\WoWScrnShot_042511_154240.jpg
[2011.04.24 23:34:53 | 000,235,916 | ---- | C] () -- C:\Users\XXX\Documents\WoWScrnShot_042411_233235.jpg
[2011.04.18 16:15:25 | 000,006,136 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2011.04.17 08:41:00 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Die*Sims™*Mittelalter.lnk
[2011.04.11 18:16:56 | 034,741,575 | ---- | C] () -- C:\Users\XXX\Documents\coole gang - bitte abspielen.mp4
[2011.04.11 15:00:39 | 000,000,927 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk
[2011.04.11 15:00:39 | 000,000,915 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk
[2011.04.09 15:36:49 | 000,208,896 | ---- | C] () -- C:\Users\XXX\Desktop\skype remix.MSWMM
[2010.12.31 22:37:03 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.11.14 14:13:57 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini
[2010.10.23 16:14:44 | 000,000,222 | ---- | C] () -- C:\Users\XXX\AppData\Local\Temp1812435.dat
[2010.10.14 02:36:44 | 000,179,263 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2010.07.21 14:12:13 | 000,032,879 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.07.21 14:12:13 | 000,032,879 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.07.01 16:07:53 | 000,000,009 | ---- | C] () -- C:\Windows\ULEAD32.INI
[2010.04.07 23:09:58 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2010.04.07 23:09:57 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2010.04.07 14:19:36 | 000,015,573 | ---- | C] () -- C:\Windows\System32\drivers\fwlanusbn.bin
[2010.02.11 07:30:38 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2010.01.12 15:29:44 | 000,000,410 | ---- | C] () -- C:\Windows\{27018D57-D152-44EF-BCE0-5E3B3445EABE}_WiseFW.ini
[2009.12.28 15:13:00 | 000,000,161 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\default.rss
[2009.12.28 15:13:00 | 000,000,000 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\downloads.m3u
[2009.11.19 15:26:56 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.08.04 19:36:49 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.04 19:36:49 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.06.16 22:24:04 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2009.04.24 00:29:16 | 000,189,051 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2009.02.20 19:18:46 | 000,097,792 | ---- | C] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.01.01 22:55:13 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.12.28 12:01:04 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.12.27 12:13:43 | 000,000,713 | ---- | C] () -- C:\Windows\disney.ini
[2008.12.13 21:00:45 | 000,022,328 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\PnkBstrK.sys
[2008.12.13 21:00:30 | 000,107,832 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2008.12.12 16:52:21 | 000,045,568 | ---- | C] () -- C:\Windows\UniFish3.exe
[2008.12.12 16:22:15 | 000,001,356 | ---- | C] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat
[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008.01.21 09:15:58 | 000,670,708 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.01.21 09:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.01.21 09:15:58 | 000,143,876 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.01.21 09:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,254,160 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,631,438 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,118,064 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2002.09.18 00:45:00 | 000,119,808 | ---- | C] () -- C:\Windows\lsb_un20.exe
[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys
 
========== LOP Check ==========
 
[2011.01.27 20:17:05 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\.minecraft
[2010.08.02 14:48:01 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\AnvSoft
[2011.03.20 12:29:19 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Ashampoo
[2011.03.20 12:01:24 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Canneverbe Limited
[2009.07.14 12:49:29 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Command & Conquer 3 Kanes Rache
[2009.07.09 16:13:37 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2010.12.02 15:48:26 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1
[2011.02.18 19:19:23 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.03.26 12:34:03 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\gtk-2.0
[2011.04.26 11:09:51 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\ICQ
[2010.12.24 22:42:16 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Leadertech
[2010.07.03 22:41:33 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\LolClient
[2009.10.29 15:18:16 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\MP3Rocket
[2010.11.14 14:16:44 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\NCH Swift Sound
[2010.09.16 14:28:51 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Notepad++
[2009.02.24 21:46:15 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\OpenOffice.org
[2010.06.13 20:39:54 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\phonostar GmbH
[2009.08.22 14:08:42 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Propellerhead Software
[2011.04.30 11:48:51 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\ProtectDISC
[2010.07.13 22:14:07 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Publish Providers
[2010.09.18 10:17:42 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\QIP
[2010.07.13 22:14:50 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Sony
[2010.05.13 13:53:37 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\SPORE Creature Creator
[2011.04.11 15:01:00 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\TeamViewer
[2009.12.26 00:58:01 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Teeworlds
[2010.05.31 17:33:10 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\TS3Client
[2011.04.30 17:23:51 | 000,032,634 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\XXX\I've been looking for Grindcore.avi:TOC.WMV
@Alternate Data Stream - 24 bytes -> C:\Windows:8917AFFB20020C2F

< End of report >
         

OTL Extras logfile created on: 30.04.2011 17:32:38 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\XXX\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 41,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 57,05 Gb Free Space | 24,50% Space Free | Partition Type: NTFS
 
Computer Name: XXX | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0306F3E2-9C81-406F-A37F-7A3BBBBEA536}" = lport=8395 | protocol=6 | dir=in | name=league of legends launcher | 
"{174C0CE7-0769-447A-A02B-1D386E4EF259}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{1A59280C-1696-4CEB-BC34-A5C5D8F22363}" = rport=445 | protocol=6 | dir=out | app=system | 
"{20FADCBB-9755-4E52-93F5-BCE7B4059346}" = lport=138 | protocol=17 | dir=in | app=system | 
"{2A538D11-AAE4-473F-80EA-FD9B8A469BFD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{2D14A448-6CE3-437B-87DC-7D855E123E3B}" = lport=8395 | protocol=17 | dir=in | name=league of legends launcher | 
"{3D7BEC21-3A78-4A54-B297-CE5B8FFB66CA}" = rport=137 | protocol=17 | dir=out | app=system | 
"{5129C9C2-C1CA-4ECA-84F1-D188C5ED5D88}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{5BCC88C8-E477-4AAE-BF86-478B56A31C74}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{61C6220F-2710-45AB-843D-9C8B086365F2}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{63680296-963E-4DDB-B29F-730F80968A89}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{6C6B9830-B4AA-4A0D-B20F-9130F1EF05F0}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{6C85F2CA-C9E1-43BD-AE68-AD499E2F2492}" = lport=8396 | protocol=6 | dir=in | name=league of legends launcher | 
"{7508B32D-AFA7-4670-BA46-3ECF0C7739CE}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{76396E19-DA5D-4F85-9095-A64C740EBA23}" = lport=139 | protocol=6 | dir=in | app=system | 
"{95732DBD-26A8-466D-8DD0-CA8CC9897CF0}" = lport=445 | protocol=6 | dir=in | app=system | 
"{A7EEA845-722D-4997-93FA-84FE37C3F725}" = lport=8396 | protocol=17 | dir=in | name=league of legends launcher | 
"{BCD479E1-438D-4CAC-B7C0-0C918610E009}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher | 
"{C013AB1A-19B9-4B21-BF71-E6D2A9E5C514}" = rport=139 | protocol=6 | dir=out | app=system | 
"{C30A0653-8CEC-4D48-BD61-10E7E50B93A3}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher | 
"{C4DA8887-3DC1-433E-BF28-4BA6A5CA04F8}" = lport=137 | protocol=17 | dir=in | app=system | 
"{CDD1BD0B-323F-484F-B20E-23E3070FDAE7}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{DDA27137-DEFD-4147-B86C-9A05A3E4D119}" = rport=138 | protocol=17 | dir=out | app=system | 
"{E12D4EC0-06C8-4AE6-A19D-24012871C2C8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F1B93033-C511-449D-9347-4A55334EFE82}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 | 
"{F2A662CE-F5D6-41D0-8A8A-BB4C1D13AF2D}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe | 
"{F37D1D76-0C45-41FF-9351-0A9423C17C28}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{FFF66874-9EC2-467B-A684-B93AD924D95D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{026ED4C1-ACA5-4880-AFD6-EC42668F1FD5}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe | 
"{02D46EE0-531C-44F2-AA52-7E74DB80CE9A}" = protocol=17 | dir=in | app=c:\users\XXX\downloads\videoconverter_setup.exe | 
"{033E345A-D14A-4845-BF33-677C5C05A34D}" = protocol=17 | dir=in | app=c:\program files\xblades\xblades.exe | 
"{0DE67D9C-B036-4D2E-AF52-EAA4EFFF24DA}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforeverlauncher.exe | 
"{1192FAD7-4433-4B3C-AB71-049DF46C9682}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\counter-strike source\hl2.exe | 
"{11B34716-2180-44EB-878A-B554D58EAC8A}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{15636E99-7007-4C20-8D38-DFE3F0C70BA0}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 
"{1936A750-313A-4716-B4CC-F3CAB39E73FD}" = protocol=6 | dir=in | app=c:\program files\world of warcraft official\launcher.exe | 
"{1C050A66-4A43-4F98-BAB2-1A996251322F}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{1CEB9585-239D-4B60-A17B-046A171E67D2}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe | 
"{1FB2D413-CF84-4E5C-975B-85D702FBAEFF}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{22DFB616-4127-4B5B-B089-033B0E3F4AEB}" = protocol=6 | dir=in | app=c:\program files\xblades\xblades.exe | 
"{2723388B-69A8-4D53-B9E9-468651868567}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe | 
"{28D41F80-ABA0-478F-B2FB-B9A3F4E84A65}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-dede-downloader.exe | 
"{2F6F3C9A-1DDC-4103-8033-BE35FE37757D}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe | 
"{35FFA151-248C-4688-AA55-16EE1D26EE84}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\counter-strike source\hl2.exe | 
"{36E65C6F-E605-4639-B4D0-D34095C99C6E}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe | 
"{3AE11712-6623-4DA1-9D1C-A5D14F547812}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{3C1E1DED-8A85-4B04-82F8-9B0B62D3159C}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforeverlauncher.exe | 
"{45123B98-5E9E-4CD5-9AA5-AA6098381015}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe | 
"{4681CEF1-EDF5-430B-BE16-1D333A5B077F}" = protocol=6 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{4A8311B6-84E1-4631-8C69-27885997BD84}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe | 
"{4E8D8DC3-F2EC-4DFA-93A0-30085E0B28A3}" = protocol=17 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 
"{4EAE00CC-CC21-4AC9-A6EE-C22BF18577CC}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{5A0A1DA6-3147-48F6-B736-D41A10A02F40}" = protocol=17 | dir=in | app=c:\program files\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe | 
"{5A9AC4DA-365F-4AF4-9E58-0584FDF319A5}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{5B9D6F4A-460D-4892-8EF0-EAB9ACD70147}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{5CF91297-9EB2-4D06-A270-C59546292762}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{5F7980C2-65B0-419D-A5D3-20828EE35C5D}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe | 
"{60A16EB2-3B4B-45DD-A02B-F810E0725B4B}" = dir=in | app=c:\program files\electronic arts\command & conquer 3 kanes rache\retailexe\1.0\cnc3ep1.dat | 
"{633D1A6E-9C2C-42EB-B4C5-0B96E4008B61}" = protocol=6 | dir=in | app=c:\program files\world of warcraft official\launcher.patch.exe | 
"{63929DF8-31FD-4AB7-9A5A-905483011616}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe | 
"{68D59BB1-380A-4F9D-AE88-40E357BC9251}" = protocol=17 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{6BF52568-5F84-4D97-B213-2B9FDD329D29}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{72FEB34F-2937-4CC8-88AF-F5F36ED87A8E}" = protocol=6 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe | 
"{7812A4ED-2E36-4800-B35F-06825B62E3E7}" = protocol=6 | dir=in | app=c:\users\XXX\downloads\videoconverter_setup.exe | 
"{7882FE34-498D-4923-BF0D-B3272D19A094}" = protocol=6 | dir=in | app=c:\program files\xblades\launcher.exe | 
"{7C37BCC0-285D-41A8-AE44-3B6D8A48335C}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{80493DB6-F4F9-47FC-ADA4-EF20461E5F14}" = protocol=17 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe | 
"{893F9885-C70D-4586-BA44-C1D43EDBCD17}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{8CAD818C-11DB-4DCB-9594-B88D2A658BF4}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{8F8311A3-88A5-4DEC-A18C-49398312FFF0}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{8FF1D142-1DC0-4D1F-A611-3E91ABE3710D}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-dede-downloader.exe | 
"{90ABE924-5B74-4EC3-8A11-59A9D817C3A3}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{941E72A7-B732-48BD-86A0-74636C36AB45}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{96711F9A-9BA2-417D-8C57-939467A63F92}" = protocol=17 | dir=in | app=c:\program files\world of warcraft official\launcher.patch.exe | 
"{9804EE36-60D7-40B7-BE00-C435875ED7BA}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{A7AEEDB8-CC5F-4F38-A7AE-D0F585B2A59B}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 
"{A9794E76-5C67-485F-9343-37B2DF3FEE56}" = protocol=6 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 
"{B02FBC98-9680-4B46-9C11-B650946A4E85}" = protocol=6 | dir=in | app=c:\program files\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe | 
"{B28F880B-5827-46EA-BDB1-ECE1B1F3B141}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{B70582CF-8C63-47E8-9743-29EA07D3CD71}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{B7374434-FD22-4F78-9AF9-EB2A4F65193E}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{B9314FE6-35C8-41E3-81E5-ACFE5ECA4C7B}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe | 
"{BAE5740B-D651-4C1B-9FC3-E20EAC38EFFA}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe | 
"{BBE3DA33-6339-43B8-8EB3-7E9492CA9376}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{C9D08A51-3A75-4C0E-A951-D13F370F2394}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{CA19EF67-8578-4C94-A396-1ED3354062B2}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{CDED4011-291E-4ED0-AA1E-1DEBAF564622}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D4EE839E-628B-4408-A92C-7AEC3AA91A84}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{DA10C03B-E910-41D4-9CD1-B20E34D775CA}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{DD1C9532-CC97-4536-9D43-48D63F975EE2}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{DE2A38A0-5B97-488C-B221-B38EC1BA4E19}" = protocol=17 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{E11952CB-32EE-4869-8472-3599A0CAC40C}" = protocol=17 | dir=in | app=c:\program files\world of warcraft official\launcher.exe | 
"{E88F6BAF-A7DC-44DB-9BB0-691FE107EABF}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe | 
"{EA5476CB-0F15-4B59-BC12-C15F1C9A9208}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{F0E1C797-3798-4FD4-83BA-ECB93C4BEE02}" = protocol=6 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{F6793210-5083-44B9-BC24-6705378089C7}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe | 
"{FA23EE17-2D14-4BD0-B19A-330AC70961AB}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{FB321834-4439-42FF-B2E3-DE99071311BB}" = protocol=17 | dir=in | app=c:\program files\xblades\launcher.exe | 
"{FB543ABA-CFD2-468D-AB57-974A53DF8829}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe | 
"{FBA6D5D6-5F41-4D4D-9740-C43633D46FAE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"TCP Query User{0A7F7F1A-AFFE-4DEB-BDEC-3A683E52CCDE}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"TCP Query User{1E3EF580-4046-4AFC-8A9D-B34E8CBF5953}C:\program files\world of warcraft official\launcher.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft official\launcher.exe | 
"TCP Query User{2B1A9D42-B406-4B9F-B031-92878944A632}C:\program files\wow!!\launcher.exe" = protocol=6 | dir=in | app=c:\program files\wow!!\launcher.exe | 
"TCP Query User{30B20F6E-AA97-43B7-A4D3-56FA43827575}C:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe | 
"TCP Query User{33FBE456-D9D0-4734-93D7-2AAEAFC0AFE1}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=6 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | 
"TCP Query User{3517994D-5807-4968-B300-F93BF9761B4E}C:\program files\littlefighter2\lf2_v2.0\lf2.exe" = protocol=6 | dir=in | app=c:\program files\littlefighter2\lf2_v2.0\lf2.exe | 
"TCP Query User{4267079E-CD7F-486B-9483-5702051FF240}C:\users\public\games\world of warcraft trial\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft trial\launcher.exe | 
"TCP Query User{48C67306-C8BD-4257-AA48-6842897D0ACE}C:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe | 
"TCP Query User{509C3A5A-CCF8-4BDF-8454-3D1B908BBD93}C:\program files\gamers.irc\mirc.exe" = protocol=6 | dir=in | app=c:\program files\gamers.irc\mirc.exe | 
"TCP Query User{5B574814-344A-44BD-BE64-A72CEC694F48}C:\program files\duty calls\binaries\win32\dutycalls.exe" = protocol=6 | dir=in | app=c:\program files\duty calls\binaries\win32\dutycalls.exe | 
"TCP Query User{5CD6A04B-0325-4227-ADC0-271992D9E17E}C:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe | 
"TCP Query User{5ED840D9-C2AA-4576-B9A6-662499621B9C}C:\program files\serious sam 2\bin\sam2.exe" = protocol=6 | dir=in | app=c:\program files\serious sam 2\bin\sam2.exe | 
"TCP Query User{72129B08-58E0-49AA-96C5-5A53408B38F2}C:\program files\java\jre1.6.0_01\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_01\bin\javaw.exe | 
"TCP Query User{72C9792B-9F0B-421A-B504-68CA3FDB1C28}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"TCP Query User{8220C040-DA0E-4A77-8EA8-8946645D1ABD}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=6 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"TCP Query User{84B5DDB1-DD3B-43AE-8D46-97148A8C48C3}C:\program files\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\launcher.exe | 
"TCP Query User{8E066FF7-75F3-404F-9D77-BD616A6CE6DF}C:\program files\team17\worms armageddon\wa.exe" = protocol=6 | dir=in | app=c:\program files\team17\worms armageddon\wa.exe | 
"TCP Query User{B900FD0D-2EC9-4C64-98A5-95451A119353}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{C762DB23-97E0-4515-B723-7CFAFF4B65F4}C:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe | 
"TCP Query User{C7D26486-55DC-4E02-941D-3DA3246CE344}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"TCP Query User{C9B404A0-1EA7-49EC-8FFF-6B66FF17F24A}C:\program files\empire interactive\flatout2\flatout2.exe" = protocol=6 | dir=in | app=c:\program files\empire interactive\flatout2\flatout2.exe | 
"TCP Query User{DDD412BA-714F-48E0-8B36-4D08A9B1FB3A}C:\program files\thq\dawn of war - dark crusade\darkcrusade.exe" = protocol=6 | dir=in | app=c:\program files\thq\dawn of war - dark crusade\darkcrusade.exe | 
"TCP Query User{E105AABD-474C-4A8A-9643-2AB97AAF2ECE}C:\program files\electronic arts\armies of exigo\exigo.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\armies of exigo\exigo.exe | 
"TCP Query User{EC6B5404-064C-43AA-B441-1E91F3C0DBBF}C:\program files\wow!!!\dark-thunder\launcher.exe" = protocol=6 | dir=in | app=c:\program files\wow!!!\dark-thunder\launcher.exe | 
"TCP Query User{EF9BB07E-8868-4A67-B258-DD80C184BF80}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=6 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | 
"TCP Query User{FE3C417D-E0C6-4CC6-950F-7A1574F3CD98}C:\program files\unreal tournament 3 (lg)\binaries\ut3.exe" = protocol=6 | dir=in | app=c:\program files\unreal tournament 3 (lg)\binaries\ut3.exe | 
"UDP Query User{0E4B664C-2F7F-4079-8B76-47D25CC92D9B}C:\program files\team17\worms armageddon\wa.exe" = protocol=17 | dir=in | app=c:\program files\team17\worms armageddon\wa.exe | 
"UDP Query User{1A194E0A-557C-4BC4-A94B-FDDD43E76D12}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{2BF720B7-D3CC-4459-B078-5587C3433836}C:\program files\world of warcraft official\launcher.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft official\launcher.exe | 
"UDP Query User{2EF47BD3-7CD5-4622-9FFC-DA877C2FC2A5}C:\program files\unreal tournament 3 (lg)\binaries\ut3.exe" = protocol=17 | dir=in | app=c:\program files\unreal tournament 3 (lg)\binaries\ut3.exe | 
"UDP Query User{3C2A5A80-28FD-4E56-B7F6-0AF2F31DE6DC}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=17 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | 
"UDP Query User{3EA1DB5B-999A-4B96-BF1C-CC2529BD8880}C:\program files\serious sam 2\bin\sam2.exe" = protocol=17 | dir=in | app=c:\program files\serious sam 2\bin\sam2.exe | 
"UDP Query User{47C9E7F5-6D1C-4951-8D70-47D662A2F224}C:\program files\electronic arts\armies of exigo\exigo.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\armies of exigo\exigo.exe | 
"UDP Query User{509C7ECC-B927-4912-A9BF-D392F4F045C6}C:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe | 
"UDP Query User{5F4DE307-1049-40C9-9C9B-79DC2C5D720F}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=17 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"UDP Query User{6E5926F5-740B-464F-B49A-82D6CAEB1DCC}C:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe | 
"UDP Query User{753C0D5E-8AE4-4823-8187-5300BD1F9A5F}C:\program files\littlefighter2\lf2_v2.0\lf2.exe" = protocol=17 | dir=in | app=c:\program files\littlefighter2\lf2_v2.0\lf2.exe | 
"UDP Query User{784BCB21-66C5-4DA6-85FE-14B86E464B54}C:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe | 
"UDP Query User{79704B58-23A6-431E-842F-140B3F018B2B}C:\users\public\games\world of warcraft trial\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft trial\launcher.exe | 
"UDP Query User{7DC24D1B-25C7-4870-8C26-552066C0DE24}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"UDP Query User{85145550-EF6C-433E-9AF0-6C356E4B62A0}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"UDP Query User{8E55ED00-C2ED-4FE4-8F53-08ACF5F346F8}C:\program files\thq\dawn of war - dark crusade\darkcrusade.exe" = protocol=17 | dir=in | app=c:\program files\thq\dawn of war - dark crusade\darkcrusade.exe | 
"UDP Query User{91CDE51B-CAC0-40A1-AEC8-8089DA2DE7D2}C:\program files\java\jre1.6.0_01\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_01\bin\javaw.exe | 
"UDP Query User{A80B53FD-002D-4C41-94AE-B69361E5D66A}C:\program files\wow!!\launcher.exe" = protocol=17 | dir=in | app=c:\program files\wow!!\launcher.exe | 
"UDP Query User{AD0AD7E4-9EF2-4251-BFC6-DA44B684B83F}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{AFB0FA4D-A7FA-4484-A515-D2FE470EBB01}C:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe | 
"UDP Query User{B084B04E-6142-4FA5-970E-95604CDE2C42}C:\program files\gamers.irc\mirc.exe" = protocol=17 | dir=in | app=c:\program files\gamers.irc\mirc.exe | 
"UDP Query User{B665952B-7990-43DE-BFEE-E3D1B52573BD}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=17 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | 
"UDP Query User{B894E9CB-C207-49AF-B787-849D364475D5}C:\program files\duty calls\binaries\win32\dutycalls.exe" = protocol=17 | dir=in | app=c:\program files\duty calls\binaries\win32\dutycalls.exe | 
"UDP Query User{C9E0E35A-9F73-4091-97F2-17E482EDAE7A}C:\program files\empire interactive\flatout2\flatout2.exe" = protocol=17 | dir=in | app=c:\program files\empire interactive\flatout2\flatout2.exe | 
"UDP Query User{CCAA270A-C7F1-481E-8356-BF42EA1796D5}C:\program files\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\launcher.exe | 
"UDP Query User{FE47344A-4F02-44F0-98AC-67AF7A7FFB7A}C:\program files\wow!!!\dark-thunder\launcher.exe" = protocol=17 | dir=in | app=c:\program files\wow!!!\dark-thunder\launcher.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04B45310-A5FE-4425-BFCA-1A6D8920DE74}" = OpenOffice.org 3.0
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0AEB967F-1D12-43C8-A59C-D93DA8EE4A4E}" = Duty Calls
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1D328E11-3B0C-388C-835D-C9C20E8C7734}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{1FDA5A37-B22D-43FF-B582-B8964050DC13}" = Microsoft Games for Windows - LIVE Redistributable
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 21
"{27018D57-D152-44EF-BCE0-5E3B3445EABE}" = X-Blades
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{47FDEFC7-BFE6-FD75-41D1-28DD572BD2D9}" = ATI Catalyst Install Manager
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5EE3204B-EF7D-4D3E-91A8-5863910CDF6C}" = Speedport W 100 Stick
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{72263053-50D1-4598-9502-51ED64E54C51}" = Borland Delphi 7
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = Die Sims 2: Open For Business
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{7E641E46-81DB-4D1D-906A-48342523051C}" = FlatOut2
"{80464ABC-A520-453F-A383-6E7B92E0C3B3}" = Armies of Exigo
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83BEEFB4-8C28-4F4F-8A9D-E0D1ADCE335B}" = Die*Sims*Mittelalter
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86A4C6D9-29EE-4719-AFA1-BA3341862B83}" = Microsoft Games for Windows - LIVE
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A06714C-F24B-4144-9BA2-788B5DD4F270}_is1" = ICQ Ignore Checker 1.3
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8AF3E926-ED59-11D4-A44B-0000E86D2305}" = Ulead GIF Animator 5 Test
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90687432-4103-416F-B0C9-649D8CBD986F}" = Wildlife Park 2 Demo
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9DBCF44B-77AC-81D8-0F8E-1E60D6330AC2}" = Catalyst Control Center InstallProxy
"{9E012857-0B5E-40A0-A36A-36751966A79B}_is1" = ICQ Status Checker 1.7
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.4 - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{B83FC356-B7C0-441F-8A4D-D71E088E7974}" = NVIDIA PhysX
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C580908C-B3BA-4C19-BD60-16F02F272201}" = BattleForge™
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE4A3D0F-D1B0-47D1-BF99-3E957C548D12}" = LogMeIn Hamachi
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D81641E8-ABF1-3D07-803B-60E8FC619368}" = Microsoft Visual C# 2010 Express - DEU
"{DA507A38-4B2A-40C0-90AC-E30AAA0B757C}" = Vegas Movie Studio Platinum 9.0
"{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}" = Die Sims™ 2 Vier Jahreszeiten
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ECEE0279-785F-4CB3-9F28-E69813234BF8}" = SPORE™ Labor Basisversion
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = Die Sims 2: Nightlife
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{F9D54D77-01A4-7D34-6F3C-EDC9F8F466E3}" = Fragen-Lern-CD 4.0
"7-Zip" = 7-Zip 9.14 beta
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AnalogX AutoTune" = AnalogX AutoTune
"Any Video Converter_is1" = Any Video Converter 3.0.3
"Ashampoo Burning Studio 2010 Advanced_is1" = Ashampoo Burning Studio 2010 Advanced 9.25
"Audiograbber" = Audiograbber 1.83 SE 
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMWLANCLI" = AVM FRITZ!WLAN
"CABAL Online (Europe)_is1" = CABAL Online
"CABAL Online: Illusion Castle Patch_is1" = Cabal Online Europe - Illusion Castle
"CABAL Online_is1" = CABAL Online
"conduitEngine" = Conduit Engine
"de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1" = Fragen-Lern-CD 4.0
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Fraps" = Fraps (remove only)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Video to Flash Converter_is1" = Free Video to Flash Converter version 4.2
"Free Video to JPG Converter_is1" = Free Video to JPG Converter version 1.5
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 3.2
"Free YouTube Download_is1" = Free YouTube Download 2.10
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.35.324
"GoldWave v5.56" = GoldWave v5.56
"ICQToolbar" = ICQ Toolbar
"InstallShield_{5EE3204B-EF7D-4D3E-91A8-5863910CDF6C}" = Speedport W 100 Stick
"InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"League of Legends_is1" = League of Legends
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft Visual C# 2010 Express - DEU" = Microsoft Visual C# 2010 Express - DEU
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mortal Kombat_is1" = Mortal Kombat
"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)
"MyAshampoo Toolbar" = MyAshampoo Toolbar
"Notepad++" = Notepad++
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Pivot 2.3.0 Deutsch" = Pivot 2.3.0 Deutsch
"Plants vs. Zombies" = Plants vs. Zombies
"Steam App 11020" = TrackMania Nations Forever
"Steam App 240" = Counter-Strike: Source
"Steam App 300" = Day of Defeat: Source
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 6" = TeamViewer 6
"Tunatic" = Tunatic
"Ulead GIF Animator Lite Edition 1.0" = Ulead GIF Animator Lite Edition 1.0
"Uninstall_is1" = Uninstall 1.0.0.1
"Unlocker" = Unlocker 1.9.0
"VLC media player" = VLC media player 1.1.7
"WavePad" = WavePad Sound Editor
"Wildlife Park 3 Demo_is1" = Wildlife Park 3 Demo v1.03
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"World of Warcraft" = World of Warcraft
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GeoGebra WebStart" = GeoGebra WebStart
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 01.10.2010 09:22:14 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 01.10.2010 09:22:14 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 01.10.2010 09:22:15 | Computer Name = XXX | Source = WinMgmt | ID = 10
Description = 
 
Error - 01.10.2010 11:04:53 | Computer Name = XXX | Source = Application Hang | ID = 1002
Description = Programm battleforge.exe, Version 1.2.0.0 arbeitet nicht mehr mit 
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet 
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 17fc  Anfangszeit: 01cb616e57efe5ef  Zeitpunkt der
 Beendigung: 1725
 
Error - 02.10.2010 03:32:49 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 02.10.2010 03:32:49 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 02.10.2010 03:33:16 | Computer Name = XXX | Source = WinMgmt | ID = 10
Description = 
 
Error - 02.10.2010 07:51:42 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 02.10.2010 07:51:42 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 02.10.2010 07:52:42 | Computer Name = XXX | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 30.04.2011 11:38:06 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
 
< End of report >
         

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6478

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

30.04.2011 17:21:45
mbam-log-2011-04-30 (17-21-45).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 151646
Laufzeit: 11 Minute(n), 18 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\XXX\AppData\Local\Temp\comver.dll (Adware.GameSpyArcade) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Roaming\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Roaming\fvgqad.dat (Malware.Trace) -> Quarantined and deleted successfully.
         

Hallo

Fixen mit OTL

• Starte bitte die OTL.exe.
  Vista und Win7 User: mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die Textbox.

:OTL
O4 - HKCU..\Run: [auditask]  File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O33 - MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\Shell\AutoRun\command - "" = E:\pushinst.exe
O33 - MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\Shell\AutoRun\command - "" = I:\installer.exe
O33 - MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\Shell\verb\command - "" = I:\installer.exe
O33 - MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\Shell - "" = AutoRun
O33 - MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\Shell\AutoRun\command - "" = I:\installer.exe
O33 - MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\Shell\verb\command - "" = I:\installer.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\AutoRun\command - "" = L:\autorun.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\directx\command - "" = L:\DirectX9\dxsetup.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\setup\command - "" = L:\setup.exe
O33 - MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\Shell\AutoRun\command - "" = K:\pushinst.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

@Alternate Data Stream - 64 bytes -> C:\Users\XXX\I've been looking for Grindcore.avi:TOC.WMV
@Alternate Data Stream - 24 bytes -> C:\Windows:8917AFFB20020C2F
:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[Reboot]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument.
  Kopiere nun den Inhalt hier in Deinen Thread

Bitte den MBRCheck durchführen
http://www.trojaner-board.de/88319-mbrcheck-exe.html

Anschließend Antivir updaten und mit diesen Einstellungen scannen lassen
http://www.trojaner-board.de/54192-a...tellungen.html
poste die enstandenen Logs bitte wieder hierher.

MFG

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\auditask deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {D0C0F75C-683A-4390-A791-1ACFD5599AB8}
C:\Windows\Downloaded Program Files\OberonGameHost_dbg.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D0C0F75C-683A-4390-A791-1ACFD5599AB8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0C0F75C-683A-4390-A791-1ACFD5599AB8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D0C0F75C-683A-4390-A791-1ACFD5599AB8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0C0F75C-683A-4390-A791-1ACFD5599AB8}\ not found.
Starting removal of ActiveX control {D27CDB6E-AE6D-11CF-96B8-444553540000}
C:\Windows\Downloaded Program Files\swflash.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\ not found.
File E:\pushinst.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27a4deb1-eca6-11de-9468-001c4afc5051}\ not found.
File I:\installer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27a4deb1-eca6-11de-9468-001c4afc5051}\ not found.
File I:\installer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3606af13-828e-11de-bdcc-001c4afc5051}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3606af13-828e-11de-bdcc-001c4afc5051}\ not found.
File E:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{823e65cf-ca16-11de-9806-00191548cc45}\ not found.
File I:\installer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{823e65cf-ca16-11de-9806-00191548cc45}\ not found.
File I:\installer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
File L:\autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
File L:\DirectX9\dxsetup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
File L:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\ not found.
File K:\pushinst.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.
File E:\pushinst.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
Unable to delete ADS C:\Users\XXX\I've been looking for Grindcore.avi:TOC.WMV .
ADS C:\Windows:8917AFFB20020C2F deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: XXX
->Temp folder emptied: 5249620176 bytes
->Temporary Internet Files folder emptied: 133794396 bytes
->Java cache emptied: 28676661 bytes
->FireFox cache emptied: 247081134 bytes
->Flash cache emptied: 877905 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56502 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 684836841 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 6.051,00 mb
 
 
OTL by OldTimer - Version 3.2.22.3 log created on 05032011_000753

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
         

Die anderen Logs folgen...
PS: Nach dem Neustart erscheint ein PopUp - JavaUpdate verfügbar
Sollte ich das intallieren oder eher nicht?
Danke schonmal

Edit.:
Kann auf den Link http://www.trojaner-board.de/88319-mbrcheck-exe.html nicht zugreifen - habe keine Berechtigung - bitte um Alternative
Werde den PC jetzt runterfahren, hoffe das macht nichts

Hallo

Kann auf den Link http://www.trojaner-board.de/88319-mbrcheck-exe.html nicht zugreifen - habe keine Berechtigung - bitte um Alternative

Ja hab ich verpennt, nun aber so
Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

• Doppelklick auf die MBRCheck.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Das Tool braucht nur eine Sekunde.
• Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Deinstalliere bitte erstmal alle vorhandenen Javaversionen und lade dir anschließend die aktuelle Version von hier
Download der kostenlosen Java-Software

Werde den PC jetzt runterfahren, hoffe das macht nichts

Ich denke nicht, kommt die Fehlermeldung noch?

EDIT:denk bitte an Antivir

MFG

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows Vista Home Premium Edition
Windows Information:		Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer:	ECS
BIOS Manufacturer:		American Megatrends Inc.
System Manufacturer:		ECS
System Product Name:		GeForce 8000 series
Logical Drives Mask:		0x00000d9d

Kernel Drivers (total 150):
  0x82443000 \SystemRoot\system32\ntkrnlpa.exe
  0x82410000 \SystemRoot\system32\hal.dll
  0x8040B000 \SystemRoot\system32\kdcom.dll
  0x80412000 \SystemRoot\system32\PSHED.dll
  0x80423000 \SystemRoot\system32\BOOTVID.dll
  0x8042B000 \SystemRoot\system32\CLFS.SYS
  0x8046C000 \SystemRoot\system32\CI.dll
  0x8054C000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x805C8000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x80609000 \SystemRoot\system32\drivers\acpi.sys
  0x8064F000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x80658000 \SystemRoot\system32\drivers\msisadrv.sys
  0x80660000 \SystemRoot\system32\drivers\pci.sys
  0x80687000 \SystemRoot\System32\drivers\partmgr.sys
  0x80696000 \SystemRoot\system32\drivers\volmgr.sys
  0x806A5000 \SystemRoot\System32\drivers\volmgrx.sys
  0x806EF000 \SystemRoot\system32\drivers\pciide.sys
  0x806F6000 \SystemRoot\system32\drivers\PCIIDEX.SYS
  0x80704000 \SystemRoot\System32\drivers\mountmgr.sys
  0x80714000 \SystemRoot\system32\drivers\atapi.sys
  0x8071C000 \SystemRoot\system32\drivers\ataport.SYS
  0x8073A000 \SystemRoot\system32\drivers\fltmgr.sys
  0x8076C000 \SystemRoot\system32\drivers\fileinfo.sys
  0x8077C000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x82A03000 \SystemRoot\system32\drivers\ndis.sys
  0x82B0E000 \SystemRoot\system32\drivers\msrpc.sys
  0x82B39000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8760F000 \SystemRoot\System32\drivers\tcpip.sys
  0x876F9000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x87808000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x87918000 \SystemRoot\system32\drivers\volsnap.sys
  0x87951000 \SystemRoot\System32\Drivers\spldr.sys
  0x8796C000 \SystemRoot\System32\drivers\sfhlp02.sys
  0x87986000 \SystemRoot\System32\Drivers\mup.sys
  0x87995000 \SystemRoot\System32\drivers\ecache.sys
  0x879BC000 \SystemRoot\system32\drivers\disk.sys
  0x879CD000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x879EE000 \SystemRoot\system32\drivers\crcdisk.sys
  0x87714000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x8771F000 \SystemRoot\system32\DRIVERS\tunmp.sys
  0x87728000 \SystemRoot\system32\DRIVERS\amdk8.sys
  0x87738000 \SystemRoot\system32\DRIVERS\fdc.sys
  0x87743000 \SystemRoot\system32\DRIVERS\parport.sys
  0x8775B000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x87800000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys
  0x8776E000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x87779000 \SystemRoot\system32\DRIVERS\nvsmu.sys
  0x87782000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0x8778C000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x877CA000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x877D9000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8B40F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8B49C000 \SystemRoot\system32\DRIVERS\nvmfdx32.sys
  0x8B601000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
  0x8BF1F000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
  0x8BF21000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8BFC1000 \SystemRoot\System32\drivers\watchdog.sys
  0x8BFCD000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0x8B4E0000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8B50F000 \SystemRoot\system32\DRIVERS\storport.sys
  0x8BFD6000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8BFE1000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x8B550000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x8B55B000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x8B57E000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x8B58D000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x8B5A1000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x8BFF8000 \SystemRoot\system32\DRIVERS\hamachi.sys
  0x8B5B6000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8B5C6000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8BFFD000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8B5D1000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8B400000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x877F1000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x87600000 \SystemRoot\system32\DRIVERS\flpydisk.sys
  0x82B74000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x82BA9000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x82BBA000 \SystemRoot\system32\drivers\HdAudio.sys
  0x8C60A000 \SystemRoot\system32\drivers\portcls.sys
  0x8C637000 \SystemRoot\system32\drivers\drmk.sys
  0x8C65C000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8C665000 \SystemRoot\System32\Drivers\Null.SYS
  0x8C66C000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8C673000 \SystemRoot\System32\drivers\vga.sys
  0x8C67F000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8C6A0000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8C6A8000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8C6B0000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8C6BB000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8C6C9000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x8C6D2000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x8C6E8000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8C6FC000 \SystemRoot\system32\drivers\afd.sys
  0x8C744000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x8C776000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8C78C000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8C79A000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8C7AD000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0x8C7B3000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x8C7EF000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x805D5000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8C80A000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0x8C830000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
  0x8C832000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0x8C848000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8C855000 \SystemRoot\System32\Drivers\dump_dumpata.sys
  0x8C860000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0x8C868000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0x8C87D000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8C87F000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x8C896000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
  0x8C89C000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x8C8A5000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x8C8B5000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8C8BC000 \SystemRoot\system32\drivers\usbaudio.sys
  0x8C8CE000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
  0x8C8D6000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x8C8DE000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
  0x8C8E6000 \SystemRoot\system32\DRIVERS\fwlanusbn.sys
  0x81670000 \SystemRoot\System32\win32k.sys
  0x8C949000 \SystemRoot\System32\drivers\Dxapi.sys
  0x8C953000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x81890000 \SystemRoot\System32\TSDDD.dll
  0x818B0000 \SystemRoot\System32\cdd.dll
  0x8C962000 \SystemRoot\system32\drivers\luafv.sys
  0x8C97D000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0x9AA0B000 \SystemRoot\system32\drivers\spsys.sys
  0x9AABB000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x9AACB000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x9AAF5000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x9AAFF000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x9AB12000 \SystemRoot\system32\DRIVERS\asyncmac.sys
  0x9AB1B000 \SystemRoot\system32\drivers\HTTP.sys
  0x9AB88000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x9ABA5000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x9ABBE000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x9ABD3000 \SystemRoot\system32\drivers\mrxdav.sys
  0x8C992000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x8C9B1000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x9C60B000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x9C623000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x9C64B000 \SystemRoot\System32\DRIVERS\srv.sys
  0x9C69A000 \SystemRoot\system32\DRIVERS\parvdm.sys
  0x9C6A1000 \SystemRoot\system32\DRIVERS\atksgt.sys
  0x9C6E4000 \SystemRoot\system32\DRIVERS\lirsgt.sys
  0x9C6E9000 \SystemRoot\system32\drivers\peauth.sys
  0x9C7C7000 \SystemRoot\System32\drivers\tcpipreg.sys
  0x9C7D3000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
  0x9C7E8000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
  0x77500000 \Windows\System32\ntdll.dll

Processes (total 73):
       0 System Idle Process
       4 System
     384 C:\Windows\System32\smss.exe
     512 csrss.exe
     572 C:\Windows\System32\wininit.exe
     584 csrss.exe
     616 C:\Windows\System32\services.exe
     628 C:\Windows\System32\lsass.exe
     636 C:\Windows\System32\lsm.exe
     748 C:\Windows\System32\winlogon.exe
     832 C:\Windows\System32\svchost.exe
     896 C:\Windows\System32\nvvsvc.exe
     928 C:\Windows\System32\svchost.exe
     964 C:\Windows\System32\svchost.exe
    1056 C:\Windows\System32\Ati2evxx.exe
    1080 C:\Windows\System32\svchost.exe
    1108 C:\Windows\System32\svchost.exe
    1120 C:\Windows\System32\svchost.exe
    1232 C:\Windows\System32\audiodg.exe
    1280 C:\Windows\System32\SLsvc.exe
    1316 C:\Windows\System32\svchost.exe
    1396 C:\Windows\System32\Ati2evxx.exe
    1412 C:\Windows\System32\nvvsvc.exe
    1516 C:\Windows\System32\svchost.exe
    1740 C:\Windows\System32\spoolsv.exe
    1836 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1848 C:\Windows\System32\svchost.exe
    2044 C:\Windows\System32\taskeng.exe
    1216 C:\Windows\System32\dwm.exe
    1296 C:\Windows\System32\taskeng.exe
    1248 C:\Windows\explorer.exe
    1388 C:\Program Files\Windows Defender\MSASCui.exe
     304 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
     288 C:\Program Files\avmwlanstick\WLanGUI.exe
    1464 C:\Program Files\Unlocker\UnlockerAssistant.exe
    2124 C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
    2172 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    2184 C:\Windows\ehome\ehtray.exe
    2192 C:\Program Files\Skype\Phone\Skype.exe
    2208 C:\Program Files\Logitech\SetPoint\SetPoint.exe
    2236 C:\Program Files\DT\Speedport W 100 Stick\Wifiusb.exe
    2292 C:\Windows\ehome\ehmsas.exe
    2368 C:\Program Files\OpenOffice.org 3\program\soffice.exe
    2424 C:\Program Files\OpenOffice.org 3\program\soffice.bin
    2708 C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
    2788 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    2808 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    2972 C:\Program Files\Skype\Plugin Manager\skypePM.exe
    3164 C:\Program Files\avmwlanstick\WLanNetService.exe
    3520 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
    3644 C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
    3676 C:\Program Files\ICQ6Toolbar\ICQ Service.exe
    3724 C:\Windows\System32\svchost.exe
    3892 C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    3912 C:\Windows\System32\svchost.exe
    3928 C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
    2640 C:\Windows\System32\svchost.exe
    1024 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
    1432 C:\Windows\System32\SearchIndexer.exe
    1892 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
    2832 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
    1096 WUDFHost.exe
    1792 WmiPrvSE.exe
    2264 C:\Windows\System32\svchost.exe
    2096 C:\Windows\System32\taskeng.exe
    3028 C:\Program Files\Mozilla Firefox\firefox.exe
    5004 C:\Windows\System32\SearchProtocolHost.exe
     276 <unknown>
    4428 C:\Windows\servicing\TrustedInstaller.exe
    5804 C:\Windows\System32\SearchFilterHost.exe
    5420 C:\Windows\System32\conime.exe
    4348 C:\Windows\System32\wuauclt.exe
    2552 C:\Users\XXX\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00100000  (NTFS)

PhysicalDrive0 Model Number: ExcelStorTechnologyJ9250S, Rev: GM2OA52A

      Size  Device Name          MBR Status
  --------------------------------------------
    232 GB  \\.\PhysicalDrive0   Windows 2008 MBR code detected
            SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!
         

Zitat von nochdigger

Ich denke nicht, kommt die Fehlermeldung noch?

Hab garnich drauf geachtet aber ich glaube sie is nich gekommen o.o
Scheint also funktioniert zu haben
was war das jetzt genau, wenn ich fragen darf?

Zitat von nochdigger

EDIT:denk bitte an Antivir

MFG

in Bearbeitung...

Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Dienstag, 3. Mai 2011  17:50

Es wird nach 2660475 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer   : Avira AntiVir Personal - FREE Antivirus
Seriennummer   : 0000149996-ADJIE-0000001
Plattform      : Windows Vista
Windowsversion : (Service Pack 2)  [6.0.6002]
Boot Modus     : Normal gebootet
Benutzername   : SYSTEM
Computername   : XXX

Versionsinformationen:
BUILD.DAT      : 10.0.0.648     31823 Bytes  01.04.2011 18:23:00
AVSCAN.EXE     : 10.0.4.2      442024 Bytes  02.05.2011 14:55:14
AVSCAN.DLL     : 10.0.3.0       56168 Bytes  30.03.2010 11:42:16
LUKE.DLL       : 10.0.3.2      104296 Bytes  10.12.2010 14:07:51
LUKERES.DLL    : 10.0.0.0       13672 Bytes  14.01.2010 11:59:47
VBASE000.VDF   : 7.10.0.0    19875328 Bytes  06.11.2009 13:35:50
VBASE001.VDF   : 7.11.0.0    13342208 Bytes  14.12.2010 16:25:13
VBASE002.VDF   : 7.11.3.0     1950720 Bytes  09.02.2011 13:40:00
VBASE003.VDF   : 7.11.5.225   1980416 Bytes  07.04.2011 15:38:56
VBASE004.VDF   : 7.11.5.226      2048 Bytes  07.04.2011 15:38:56
VBASE005.VDF   : 7.11.5.227      2048 Bytes  07.04.2011 15:38:57
VBASE006.VDF   : 7.11.5.228      2048 Bytes  07.04.2011 15:38:57
VBASE007.VDF   : 7.11.5.229      2048 Bytes  07.04.2011 15:38:57
VBASE008.VDF   : 7.11.5.230      2048 Bytes  07.04.2011 15:38:58
VBASE009.VDF   : 7.11.5.231      2048 Bytes  07.04.2011 15:38:58
VBASE010.VDF   : 7.11.5.232      2048 Bytes  07.04.2011 15:38:58
VBASE011.VDF   : 7.11.5.233      2048 Bytes  07.04.2011 15:38:58
VBASE012.VDF   : 7.11.5.234      2048 Bytes  07.04.2011 15:38:58
VBASE013.VDF   : 7.11.6.28     158208 Bytes  11.04.2011 15:38:59
VBASE014.VDF   : 7.11.6.74     116224 Bytes  13.04.2011 08:27:01
VBASE015.VDF   : 7.11.6.113    137728 Bytes  14.04.2011 08:27:01
VBASE016.VDF   : 7.11.6.150    146944 Bytes  18.04.2011 08:27:02
VBASE017.VDF   : 7.11.6.192    138240 Bytes  20.04.2011 08:27:02
VBASE018.VDF   : 7.11.6.237    156160 Bytes  22.04.2011 19:04:01
VBASE019.VDF   : 7.11.7.45     427520 Bytes  27.04.2011 14:55:12
VBASE020.VDF   : 7.11.7.64     192000 Bytes  28.04.2011 14:55:12
VBASE021.VDF   : 7.11.7.97     182272 Bytes  02.05.2011 14:55:12
VBASE022.VDF   : 7.11.7.98       2048 Bytes  02.05.2011 14:55:12
VBASE023.VDF   : 7.11.7.99       2048 Bytes  02.05.2011 14:55:12
VBASE024.VDF   : 7.11.7.100      2048 Bytes  02.05.2011 14:55:12
VBASE025.VDF   : 7.11.7.101      2048 Bytes  02.05.2011 14:55:12
VBASE026.VDF   : 7.11.7.102      2048 Bytes  02.05.2011 14:55:12
VBASE027.VDF   : 7.11.7.103      2048 Bytes  02.05.2011 14:55:12
VBASE028.VDF   : 7.11.7.104      2048 Bytes  02.05.2011 14:55:12
VBASE029.VDF   : 7.11.7.105      2048 Bytes  02.05.2011 14:55:12
VBASE030.VDF   : 7.11.7.106      2048 Bytes  02.05.2011 14:55:12
VBASE031.VDF   : 7.11.7.121    116224 Bytes  03.05.2011 15:43:38
Engineversion  : 8.2.4.226 
AEVDF.DLL      : 8.1.2.1       106868 Bytes  29.11.2010 17:05:47
AESCRIPT.DLL   : 8.1.3.60     1249658 Bytes  03.05.2011 15:43:39
AESCN.DLL      : 8.1.7.2       127349 Bytes  29.11.2010 17:05:47
AESBX.DLL      : 8.1.3.2       254324 Bytes  29.11.2010 17:05:47
AERDL.DLL      : 8.1.9.9       639347 Bytes  28.03.2011 13:56:21
AEPACK.DLL     : 8.2.6.0       549237 Bytes  12.04.2011 15:39:11
AEOFFICE.DLL   : 8.1.1.21      205179 Bytes  02.05.2011 14:55:14
AEHEUR.DLL     : 8.1.2.112    3473784 Bytes  02.05.2011 14:55:14
AEHELP.DLL     : 8.1.16.1      246134 Bytes  07.02.2011 16:31:53
AEGEN.DLL      : 8.1.5.4       397684 Bytes  04.04.2011 13:40:38
AEEMU.DLL      : 8.1.3.0       393589 Bytes  29.11.2010 17:05:45
AECORE.DLL     : 8.1.20.2      196982 Bytes  12.04.2011 15:39:04
AEBB.DLL       : 8.1.1.0        53618 Bytes  29.11.2010 17:05:45
AVWINLL.DLL    : 10.0.0.0       19304 Bytes  14.01.2010 11:59:10
AVPREF.DLL     : 10.0.0.0       44904 Bytes  14.01.2010 11:59:07
AVREP.DLL      : 10.0.0.9      174120 Bytes  02.05.2011 14:55:20
AVREG.DLL      : 10.0.3.2       53096 Bytes  29.11.2010 17:05:48
AVSCPLR.DLL    : 10.0.4.2       84840 Bytes  02.05.2011 14:55:14
AVARKT.DLL     : 10.0.22.6     231784 Bytes  10.12.2010 14:07:48
AVEVTLOG.DLL   : 10.0.0.8      203112 Bytes  26.01.2010 09:53:25
SQLITE3.DLL    : 3.6.19.0      355688 Bytes  28.01.2010 12:57:53
AVSMTP.DLL     : 10.0.0.17      63848 Bytes  16.03.2010 15:38:54
NETNT.DLL      : 10.0.0.0       11624 Bytes  19.02.2010 14:40:55
RCIMAGE.DLL    : 10.0.0.26    2550120 Bytes  28.01.2010 13:10:08
RCTEXT.DLL     : 10.0.58.0      98152 Bytes  29.11.2010 17:05:44

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files\avira\antivir desktop\sysscan.avp
Protokollierung.......................: niedrig
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, 
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Optimierter Suchlauf..................: ein
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: mittel
Abweichende Gefahrenkategorien........: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR,

Beginn des Suchlaufs: Dienstag, 3. Mai 2011  17:50

Der Suchlauf nach versteckten Objekten wird begonnen.
HKEY_USERS\S-1-5-21-872799893-1625556276-1146311162-1001\Software\SecuROM\License information\datasecu
    [HINWEIS]   Der Registrierungseintrag ist nicht sichtbar.
HKEY_USERS\S-1-5-21-872799893-1625556276-1146311162-1001\Software\SecuROM\License information\rkeysecu
    [HINWEIS]   Der Registrierungseintrag ist nicht sichtbar.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'SearchProtocolHost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'plugin-container.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'conime.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '114' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'nSvcIp.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '7' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeamViewer_Service.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'ICQ Service.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'hamachi-2.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'nSvcAppFlt.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'WlanNetService.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'skypePM.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'KHALMNPR.EXE' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.bin' - '92' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehmsas.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'Wifiusb.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'SetPoint.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'Skype.exe' - '144' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehtray.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'hamachi-2-ui.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'UnlockerAssistant.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLanGUI.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'MSASCui.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '151' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '94' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'Ati2evxx.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '155' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '116' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'Ati2evxx.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD1
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD2
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD3
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD4
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD5
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '390' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\Users\XXX\Documents\ICQ\400257117\ReceivedFiles\379960813 Raziel\Bild.exe
    [FUND]      Enthält Erkennungsmuster des Scherzprogrammes JOKE/WinFun
C:\Users\XXX\Documents\ICQ\400257117\ReceivedFiles\379960813 Raziel\funny.exe
[0] Archivtyp: AutoIt
[FUND]      Enthält Erkennungsmuster des Scherzprogrammes JOKE/MouseMove.A

Beginne mit der Desinfektion:
C:\Users\XXX\Documents\ICQ\400257117\ReceivedFiles\379960813 Raziel\funny.exe
    [FUND]      Enthält Erkennungsmuster des Scherzprogrammes JOKE/MouseMove.A
    [WARNUNG]   Die Datei wurde ignoriert.
C:\Users\XXX\Documents\ICQ\400257117\ReceivedFiles\379960813 Raziel\Bild.exe
    [FUND]      Enthält Erkennungsmuster des Scherzprogrammes JOKE/WinFun
    [WARNUNG]   Die Datei wurde ignoriert.


Ende des Suchlaufs: Dienstag, 3. Mai 2011  21:11
Benötigte Zeit:  3:19:46 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  30464 Verzeichnisse wurden überprüft
 690501 Dateien wurden geprüft
      2 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      0 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 690499 Dateien ohne Befall
   3409 Archive wurden durchsucht
      2 Warnungen
      2 Hinweise
 777975 Objekte wurden beim Rootkitscan durchsucht
      2 Versteckte Objekte wurden gefunden
         

Wurde nichts gefunden bis auf 2 Programme die mir n Kumpel ma geschickt hatte
Es handelt sich hierbei um .exe Dateien, die bei der ausführung einmal ein Flimmern des Desktops und öffnen des Laufwerks und zum zweiten, irgendwas anderes habs vergessen
hab die beiden exen ma gelöscht ^^
Also alles sauber
Vielen, vielen Dank
Würd mich trotzdem interessieren was genau das war

Hallo

Würd mich trotzdem interessieren was genau das war

neben der Adware die auf dem System war vermutlich ein Fakeprogramm auf deinem System unterwegs.
Sind die Proxyeinstellungen von dir so gewollt?
Gibt es sonst noch Auffälligkeiten am System?

MFG

Zitat von nochdigger

Sind die Proxyeinstellungen von dir so gewollt?

hmm um welche Einstellungen gehts? sry hab da nich so wirklich Ahnung von...
bei Firefox hab ich 'Proxy Einstellungen des Systems verwenden'

Zitat von nochdigger

Gibt es sonst noch Auffälligkeiten am System?

Nun manchmal stürzt mein Rechner einfach so ab.... also ob man den Stecker ziehen würde...
In letzter Zeit passiert dies öfter - ziemlich regelmäßig 10-15 minuten nach systemstart..
Weiß nich woran das liegt - vllt Netzteil?

Hallo

Nun manchmal stürzt mein Rechner einfach so ab.... also ob man den Stecker ziehen würde...
In letzter Zeit passiert dies öfter - ziemlich regelmäßig 10-15 minuten nach systemstart..
Weiß nich woran das liegt - vllt Netzteil?

könnte sein, kann aber auch Temperaturproblem sein
Poste mal eine Übersicht mit HWInfo32
Programm starten -> Report -> wähle "Text Logfile" -> wähle "Fertig stellen" -> Logfile wird im Programmordner unter deinem Namen abgelegt.
Gehe bis ans Ende des Logs und poste nur den Abschnitt der Sensoren hieher.
Eventuell kann man dann eine Aussage treffen.

MFG

meinste das?

AMD Hammer - Miscellaneous Control ----------------------------------------

 [General Information]
  Original Device Name:                   AMD Hammer - Miscellaneous Control
  Device Class:                           Host-to-PCI Bridge
  Revision ID:                            0
  Bus Number:                             0
  Device Number:                          24
  Function Number:                        3
  PCI Latency Timer:                      0
  Hardware ID:                            PCI\VEN_1022&DEV_1103&SUBSYS_00000000&REV_00
 [System Resources]
  Interrupt Line:                         N/A
  Interrupt Pin:                          N/A
 [Features]
  Bus Mastering:                          Disabled
  Running At 66 MHz:                      Not Capable
  Fast Back-to-Back Transactions:         Not Capable
 [MCA NB Control]
  DRAM Parity Error Reporting [F]:        Enabled
  Watchdog Timer Error Reporting:         Enabled
  Atomic Read-Modify-Write Error Reporting: Enabled
  GART Table Walk Error Reporting:        Disabled
  Target Abort Error Reporting:           Enabled
  Master Abort Error Reporting:           Enabled
  HyperTransport Link 2 Sync Packet Error Reporting: Enabled
  HyperTransport Link 1 Sync Packet Error Reporting: Enabled
  HyperTransport Link 0 Sync Packet Error Reporting: Enabled
  HyperTransport Link 2 CRC Error Reporting: Enabled
  HyperTransport Link 1 CRC Error Reporting: Enabled
  HyperTransport Link 0 CRC Error Reporting: Enabled
  Uncorrectable ECC Error Reporting:      Enabled
  Correctable ECC Error Reporting:        Enabled
 [MCA NB Configuration]
  Sync Flood on DRAM Address Parity Error [F]: Disabled
  Master Abort CPU Error Response [F]:    Enabled
  Target Abort CPU Error Response [F]:    Enabled
  Northbridge MCA to CPU 0:               Enabled
  PCI Configuration CPU Error Response:   Disabled
  I/O Read Data Error Log:                Disabled
  Chip-Kill ECC Mode:                     Disabled
  ECC:                                    Disabled
  Sync Flood On Any Error:                Disabled
  Sync Flood on Watchdog Timer Error:     Enabled
  HyperTransport Link Select for CRC Error Generation: Link 0
  Watchdog Timer Time Base:               1 ms
  Watchdog Timer Count:                   4095
  Watchdog Timer:                         Enabled
  I/O Error Response:                     Enabled
  CPU Error Response:                     Disabled
  I/O Master Abort Error Response:        Enabled
  Sync Packet Propagation:                Enabled
  Sync Packet Generation:                 Enabled
  Sync Flood on Uncorrectable ECC Error:  Disabled
  CPU Read Data Error Log:                Disabled
  CPU ECC Error Log:                      Disabled
 [SRI-to-XBAR Buffer Count]
  Downstream Posted Request Buffer Count: 1
  Downstream Request Buffer Count:        1
  Upstream Response Data Buffer Count:    1
  Display Refresh Request Buffer Count:   3
  Request Data Buffer Count:              0
  Upstream Response Buffer Count:         1
  Upstream Posted Request Buffer Count:   1
  Upstream Request Buffer Count:          1
 [XBAR-to-SRI Buffer Count]
  Downstream Posted Request Buffer Count: 1
  Downstream Request Buffer Count:        1
  Display Refresh Request Buffer Count:   7
  Probe Buffer Count:                     4
  Upstream Posted Request Buffer Count:   2
  Upstream Request Buffer Count:          1
 [MCT-to-XBAR Buffer Count]
  Response Data Buffer Count:             8
  Probe Buffer Count:                     2
  Response Buffer Count:                  10
 [Free List Buffer Count]
  SRI to XBAR Free Response Data Buffer Count: 2
  SRI to XBAR Free Response Buffer Count: 1
  SRI to XBAR Free Request Buffer Count:  1
  SRI Free Command Buffer Count:          7
 [Power Management Control]
  Power Management Mode 7 Clock Divisor:  32
  Power Management Mode 7 Alternate VID Change: Disabled
  Power Management Mode 7 FID/VID Change: Disabled
  Power Management Mode 7 NB Low Power:   Disabled
  Power Management Mode 7 CPU Low Power:  Enabled
  Power Management Mode 6 Clock Divisor:  16
  Power Management Mode 6 Alternate VID Change: Disabled
  Power Management Mode 6 FID/VID Change: Disabled
  Power Management Mode 6 NB Low Power:   Enabled
  Power Management Mode 6 CPU Low Power:  Enabled
  Power Management Mode 5 Clock Divisor:  32
  Power Management Mode 5 Alternate VID Change: Disabled
  Power Management Mode 5 FID/VID Change: Disabled
  Power Management Mode 5 NB Low Power:   Disabled
  Power Management Mode 5 CPU Low Power:  Enabled
  Power Management Mode 4 Clock Divisor:  16
  Power Management Mode 4 Alternate VID Change: Disabled
  Power Management Mode 4 FID/VID Change: Disabled
  Power Management Mode 4 NB Low Power:   Enabled
  Power Management Mode 4 CPU Low Power:  Enabled
  Power Management Mode 3 Clock Divisor:  32
  Power Management Mode 3 Alternate VID Change: Disabled
  Power Management Mode 3 FID/VID Change: Disabled
  Power Management Mode 3 NB Low Power:   Enabled
  Power Management Mode 3 CPU Low Power:  Enabled
  Power Management Mode 2 Clock Divisor:  8
  Power Management Mode 2 Alternate VID Change: Disabled
  Power Management Mode 2 FID/VID Change: Enabled
  Power Management Mode 2 NB Low Power:   Enabled
  Power Management Mode 2 CPU Low Power:  Enabled
  Power Management Mode 1 Clock Divisor:  8
  Power Management Mode 1 Alternate VID Change: Disabled
  Power Management Mode 1 FID/VID Change: Disabled
  Power Management Mode 1 NB Low Power:   Disabled
  Power Management Mode 1 CPU Low Power:  Disabled
  Power Management Mode 0 Clock Divisor:  8
  Power Management Mode 0 Alternate VID Change: Disabled
  Power Management Mode 0 FID/VID Change: Disabled
  Power Management Mode 0 NB Low Power:   Disabled
  Power Management Mode 0 CPU Low Power:  Disabled
 [GART Aperture Control]
  GART Table Walk Probes:                 Enabled
  GART I/O Accesses:                      Enabled
  GART CPU Accesses:                      Enabled
  GART Size:                              32 MBytes
  GART:                                   Disabled
 [GART Aperture Base]
  GART Aperture Base Address:             FF80000000
 [GART Table Base]
  GART Table Base Address:                FEAABBF000
 [Clock Power/Timing]
  HyperTransport CLK PLL Lock Counter:    13
  Link Reconnect Delay:                   10 us
  Clock Ramp Hysteresis:                  2000 ns
  Time to Drive Sleep VID:                0 system clocks
  Good Phase Error:                       400(B)/200(C) system clocks
  Ramp VID Offset:                        0 mV
  Alternate VID:                          7
  Voltage Regulator Stabilization Time:   0 ns
 [HyperTransportt FIFO Read Pointer Optimization]
  Change Read Pointer For HyperTransport Link 2 Transmitter: Move RdPtr closer to WrPtr by 2 HyperTransport clock periods
  Change Read Pointer For HyperTransport Link 2 Receiver: RdPtr assigned by hardware
  Change Read Pointer For HyperTransport Link 1 Transmitter: Move RdPtr closer to WrPtr by 2 HyperTransport clock periods
  Change Read Pointer For HyperTransport Link 1 Receiver: RdPtr assigned by hardware
  Change Read Pointer For HyperTransport Link 0 Transmitter: Move RdPtr closer to WrPtr by 2 HyperTransport clock periods
  Change Read Pointer For HyperTransport Link 0 Receiver: Move RdPtr closer to WrPtr by 5 HyperTransport clock periods
 [Thermtrip Status]
  Case Temperature Specification (TCaseMax) [Rev E]: Not defined
  Diode Offset Sign [Rev E]:              Positive
  Tj Offset [Rev F]:                      0 °C
  Current Temperature [Rev F]:            19 °C
  Diode Offset:                           32 °C
  Thermtrip Enabled:                      Enabled
  Thermtrip Sense (Core1):                Doesn't occur
  Thermtrip Sense (Core0):                Doesn't occur
  Thermtrip Status:                       Doesn't occur
 [Northbridge Capabilities]
  Multi-Core Capability:                  Dual-Core
  HTC (Hardware Thermal Control):         Capable
  On-chip Memory Controller:              Capable
  Maximum DRAM Frequency:                 No limit
  Chip-Kill ECC:                          Capable
  ECC:                                    Capable
  Big MP:                                 Not capable
  MP:                                     Not capable
  128-Bit DRAM:                           Capable
         

Ansonstn bitte ich um Aufklärung
Auffällig ist eben dass der Computer nach 10 minuten ausgeht und wenn ich ihn dann wieder anschalte läuft er ohne Probleme durch bis ich ihn von selbst ausschalte.
Eigentlich gibt es da keine Ausnahme es ist genau DIESES Muster
naja... in 8 von 10 Fällen geht er nach 10 Minuten aus.

Hallo

nee, das wars nicht
Da steht im Bericht direkt

Sensors @ Datum Uhrzeit  ---------------------------------------------
         

versuchs bitte mal so:
Starte direkt nach dem Rechnerstartstart HWInfo und lass die Sensoren auslesen.
Wenn der Rechner pünktlich ist dann erstelle nach ca. 8 min den Bericht
Setze beim Bericht bitte nur Häckchen bei Computer, Computername und Sensors alle anderen Häckchen raus.
Aus dem Bericht bitte bloß den ersten und letzten Meßpunkt posten.

Hast du dir mal dein System von innen angeschaut?

MFG

soo war das WE über weg und bin jetzt erst wieder an PC gekommen

Das gleiche is wieder passiert nach 10 Minuten
Das Wort 'Sensors' steht definitiv NICHT im Bericht - habs hier eingefügt und per Strg+F gesucht

Wenn ich wüsste wie das geht o.o
wenn ich das Programm starte werd ich zunächst gefragt:
Sensor -only - das kann man dann anhaken oder auch nicht dann auf RUN dann geht das prog auf und wenn man den haken nicht gemacht hat kann man eben nen report starten bei dem nix von sensors steht ._.'
vllt sollte ich ma updaten... werde ich jetzt mal tun..

Mein System kenn ich von innen, aber viel weiter bringt mich das auch nicht
Also es is ma keine Maus drin oder so
lediglich ein Lüfter 'rattert' weshalb ich meinen Rechner schief stehen habe..