Hallo liebe Helfer in Not,

ich habe ein mehr oder weniger großes Problem.

Nachdem Hochfahren des Rechners erscheint, nach einiger Zeit, die Meldung: "Achtung Windows wurde aus Sicherheitsgründen blockiert". Ich werde mit einem Button aufgefordet, Geld zu bezahlen. Der Bildschirm ist schwarz und ich kann nichts anklicken, der Task-Manager lässt sich auch nicht starten. Ich habe ein bisschen im Forum nachschaut und festgestellt, dass einige dieses Problem haben, jedoch ist eine angepasste Hilfe von nöten.

Den Scan mit OTL habe ich durchgeführt hier die zwei Textdateien:
OLT.txt

OTL logfile created on: 08.12.2011 18:43:12 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\hasenbraten\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
6,00 Gb Total Physical Memory | 5,07 Gb Available Physical Memory | 84,52% Memory free
12,00 Gb Paging File | 11,11 Gb Available in Paging File | 92,62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 596,07 Gb Total Space | 265,80 Gb Free Space | 44,59% Space Free | Partition Type: NTFS
 
Computer Name: hasenbraten-PC | User Name: hasenbraten | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\hasenbraten\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\hasenbraten\AppData\Roaming\Mozilla\Firefox\Profiles\id5tvacc.default\extensions\{542e4d79-1970-4e95-9862-fdb96f61b280}\components\RadioWMPCoreGecko8.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (TeamViewer6) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (pgsql-8.3) -- C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe (PostgreSQL Global Development Group)
SRV - (StarWindServiceAE) -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
SRV - (PLFlash DeviceIoControl Service) -- C:\Windows\SysWOW64\IoctlSvc.exe (Prolific Technology Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (ATI Technologies, Inc.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64j.sys (Nokia)
DRV:64bit: - (nmwcdcx64) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia)
DRV:64bit: - (nmwcdx64) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (xnacc) -- C:\Windows\SysNative\drivers\xnacc.sys (Microsoft Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (Razerlow) -- C:\Windows\SysNative\drivers\DB3G.sys (Razer (Asia-Pacific) Pte Ltd)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {542e4d79-1970-4e95-9862-fdb96f61b280} - C:\Program Files (x86)\Messenger_Plus_Live_Germany\tbMes1.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2567732
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = BD C5 DF 8C 77 D5 CA 01  [binary data]
IE - HKCU\..\URLSearchHook: {542e4d79-1970-4e95-9862-fdb96f61b280} - C:\Program Files (x86)\Messenger_Plus_Live_Germany\tbMes1.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "Messenger Plus Live Germany Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2567732&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.readmore.de/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {542e4d79-1970-4e95-9862-fdb96f61b280}:3.2.5.2
FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 5
FF - prefs.js..extensions.enabledItems: 3
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.6.9.99999
FF - prefs.js..extensions.enabledItems: fastYoutubeDownloader@yevgenyandrov.net:1.2.2
FF - prefs.js..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:4.0
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: cctvplayer-plugin@www.cctv.com:0.11
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..extensions.enabledItems: {b749fc7c-e949-447f-926c-3f4eed6accfe}:0.7.0.2
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2567732&q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@idsoftware.com/QuakeLive: C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Program Files (x86)\TVUPlayer\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@rayv.com/rayvplugin: C:\Program Files (x86)\RayV\RayV\plugins\nprayvplugin.dll (RayV)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.10: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKCU\Software\MozillaPlugins\@octoshape.com/Octoshape Streaming Services,version=1.0: C:\Users\hasenbraten\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1101262-0-npoctoshape.dll (Octoshape ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.12 20:53:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.03.22 18:50:40 | 000,000,000 | ---D | M]
 
[2010.04.06 12:05:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\hasenbraten\AppData\Roaming\mozilla\Extensions
[2011.12.08 18:15:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\hasenbraten\AppData\Roaming\mozilla\Firefox\Profiles\id5tvacc.default\extensions
[2011.12.05 18:10:41 | 000,000,000 | ---D | M] (Messenger Plus Live Germany Community Toolbar) -- C:\Users\hasenbraten\AppData\Roaming\mozilla\Firefox\Profiles\id5tvacc.default\extensions\{542e4d79-1970-4e95-9862-fdb96f61b280}
[2010.07.26 00:24:12 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\hasenbraten\AppData\Roaming\mozilla\Firefox\Profiles\id5tvacc.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.09.09 12:34:30 | 000,000,000 | ---D | M] (CCTV player plugin for Firefox) -- C:\Users\hasenbraten\AppData\Roaming\mozilla\Firefox\Profiles\id5tvacc.default\extensions\cctvplayer-plugin@www.cctv.com
[2011.03.24 06:55:30 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\hasenbraten\AppData\Roaming\mozilla\Firefox\Profiles\id5tvacc.default\extensions\engine@conduit.com
[2010.07.26 00:16:31 | 000,000,000 | ---D | M] (Fast Youtube Downloader) -- C:\Users\hasenbraten\AppData\Roaming\mozilla\Firefox\Profiles\id5tvacc.default\extensions\fastYoutubeDownloader@yevgenyandrov.net
[2010.05.18 00:01:47 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Users\hasenbraten\AppData\Roaming\mozilla\Firefox\Profiles\id5tvacc.default\extensions\firefox@tvunetworks.com
[2011.06.15 21:53:12 | 000,000,000 | ---D | M] ("Nero Toolbar") -- C:\Users\hasenbraten\AppData\Roaming\mozilla\Firefox\Profiles\id5tvacc.default\extensions\toolbar@ask.com
[2010.03.17 09:59:20 | 000,000,957 | ---- | M] () -- C:\Users\hasenbraten\AppData\Roaming\Mozilla\Firefox\Profiles\id5tvacc.default\searchplugins\conduit.xml
[2011.01.12 13:34:52 | 000,001,945 | ---- | M] () -- C:\Users\hasenbraten\AppData\Roaming\Mozilla\Firefox\Profiles\id5tvacc.default\searchplugins\kinoto.xml
[2011.11.12 20:53:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.10.29 11:58:29 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
File not found (No name found) -- C:\USERS\hasenbraten\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ID5TVACC.DEFAULT\EXTENSIONS\{542E4D79-1970-4E95-9862-FDB96F61B280}
File not found (No name found) -- C:\USERS\hasenbraten\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ID5TVACC.DEFAULT\EXTENSIONS\{B749FC7C-E949-447F-926C-3F4EED6ACCFE}.XPI
File not found (No name found) -- C:\USERS\hasenbraten\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ID5TVACC.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
File not found (No name found) -- C:\USERS\hasenbraten\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ID5TVACC.DEFAULT\EXTENSIONS\YOUTUBE2MP3@MONDAYX.DE.XPI
[2011.11.12 20:53:06 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.04.14 04:08:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.09.30 14:56:06 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.09.30 14:56:06 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.09.30 14:56:06 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.09.30 14:56:06 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.30 14:56:06 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.09.30 14:56:06 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\15.0.874.121\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java(TM) Platform SE 6 U20 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Octoshape Streaming Services (Enabled) = C:\Users\hasenbraten\u00FCl\u00FCnk\AppData\Roaming\Mozilla\plugins\npoctoshape.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: RayV Plugin (Enabled) = C:\Program Files (x86)\RayV\RayV\plugins\nprayvplugin.dll
CHR - plugin: TVU Web Player for FireFox (Enabled) = C:\Program Files (x86)\TVUPlayer\npTVUAx.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Nexon Game Controller (Enabled) = C:\ProgramData\NexonUS\NGM\npNxGameUS.dll
CHR - plugin: QUAKE LIVE (Enabled) = C:\ProgramData\id Software\QuakeLive\npquakezero.dll
CHR - plugin: Octoshape Streaming Services (Enabled) = C:\Users\hasenbraten\u00FCl\u00FCnk\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1010120-0-npoctoshape.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.50917.0\npctrl.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Skype Click to Call = C:\Users\hasenbraten\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7018.1622\swg64.dll (Google Inc.)
O2 - BHO: (Messenger Plus Live Germany Toolbar) - {542e4d79-1970-4e95-9862-fdb96f61b280} - C:\Program Files (x86)\Messenger_Plus_Live_Germany\tbMes1.dll (Conduit Ltd.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.)
O2 - BHO: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask.com)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Messenger Plus Live Germany Toolbar) - {542e4d79-1970-4e95-9862-fdb96f61b280} - C:\Program Files (x86)\Messenger_Plus_Live_Germany\tbMes1.dll⤀ File not found
O3 - HKLM\..\Toolbar: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask.com)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Messenger Plus Live Germany Toolbar) - {542E4D79-1970-4E95-9862-FDB96F61B280} - C:\Program Files (x86)\Messenger_Plus_Live_Germany\tbMes1.dll⤀ File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Diamondback] C:\Program Files (x86)\Razer\Diamondback 3G\razerhid.exe ()
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [{4EC3EFB5-419B-11DF-A4EA-806E6F6E6963}] C:\Users\hasenbraten\AppData\Roaming\Microsoft\hostrun.exe (Mozilla Foundation)
O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files (x86)\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [EPSON SX110 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFBE.EXE /FU "C:\Windows\TEMP\E_S563A.tmp" /EF "HKCU" File not found
O4 - HKCU..\Run: [Octoshape Streaming Services] C:\Users\hasenbraten\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe (Octoshape ApS)
O4 - HKCU..\Run: [PC Suite Tray] C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKCU..\Run: [PPAP] C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.EXE (PPLive Corporation)
O4 - HKCU..\Run: [RayV] C:\Program Files (x86)\RayV\RayV\RayV.exe (RayV)
O4 - HKCU..\Run: [RGSC] C:\Program Files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\hasenbraten\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\hasenbraten\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files (x86)\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files (x86)\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPTV\PPLive.exe (PPLive Corporation)
O9 - Extra 'Tools' menuitem : PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPTV\PPLive.exe (PPLive Corporation)
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Windows\SysWOW64\PrxerNsp.dll (Initex Software)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWOW64\PrxerDrv.dll (Initex Software)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\SysWOW64\PrxerDrv.dll (Initex Software)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {EF0D1A14-1033-41A2-A589-240C01EDC078} hxxp://dl.pplive.com/PluginSetup.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C1154DDF-EF05-44F2-8BC8-3A0166FE588C}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{135fc143-69f3-11df-9a63-6cf04976b23d}\Shell - "" = AutoRun
O33 - MountPoints2\{135fc143-69f3-11df-9a63-6cf04976b23d}\Shell\AutoRun\command - "" = E:\autorun.exe -auto
O33 - MountPoints2\{27527bc1-e2d6-11df-950e-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{27527bc1-e2d6-11df-950e-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.12.08 18:42:51 | 000,000,000 | ---D | C] -- C:\Users\hasenbraten\AppData\Local\ElevatedDiagnostics
[2011.12.08 18:42:10 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\hasenbraten\Desktop\OTL.exe
[2011.12.04 18:48:29 | 000,000,000 | ---D | C] -- C:\Users\hasenbraten\Desktop\Prinz Pi - Hallo Musik (2011)
[2011.12.02 21:46:27 | 000,000,000 | ---D | C] -- C:\Users\hasenbraten\Desktop\CRO_EASY_MIXTAPE
[2011.11.30 12:09:58 | 000,000,000 | ---D | C] -- C:\Users\hasenbraten\Desktop\Dolphin
[2011.11.17 16:03:17 | 000,000,000 | ---D | C] -- C:\Users\hasenbraten\Documents\Saves
[2011.11.17 15:54:36 | 000,358,400 | ---- | C] (vasiliy73@mail.ru) -- C:\Users\hasenbraten\Desktop\bsacmd.exe
[2011.11.17 15:54:36 | 000,000,000 | ---D | C] -- C:\Users\hasenbraten\Desktop\Data
[2011.11.15 12:38:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SystemRequirementsLab
[2011.11.11 16:41:58 | 000,000,000 | ---D | C] -- C:\Users\hasenbraten\AppData\Local\Skyrim
[2011.11.11 16:41:58 | 000,000,000 | ---D | C] -- C:\Users\hasenbraten\Documents\My Games
[2011.11.11 16:41:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Elder Scrolls V - Skyrim
[2011.11.11 16:30:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Black_Box
[2011.11.11 15:05:48 | 000,000,000 | ---D | C] -- C:\Users\hasenbraten\Desktop\Maeckes-Manx-EP-DE-2011-NOiR
[2011.11.10 17:42:34 | 000,000,000 | ---D | C] -- C:\Users\hasenbraten\AppData\Roaming\EPSON
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.12.08 18:42:11 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\hasenbraten\Desktop\OTL.exe
[2011.12.08 18:33:37 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.12.08 18:33:37 | 000,696,832 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.12.08 18:33:37 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.12.08 18:33:37 | 000,148,128 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.12.08 18:33:37 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.12.08 18:29:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.08 18:29:18 | 535,683,071 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.08 18:23:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.12.08 18:21:34 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.08 18:21:34 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.08 17:44:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.12.08 14:44:26 | 000,130,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2011.11.21 04:02:53 | 000,000,219 | ---- | M] () -- C:\Users\hasenbraten\Desktop\Dota 2.url
[2011.11.17 15:54:26 | 000,750,989 | ---- | M] () -- C:\Users\hasenbraten\Desktop\Skyrim_Repack_fix.rar
[2011.11.13 14:43:07 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011.11.11 18:42:34 | 000,326,656 | ---- | M] () -- C:\Users\hasenbraten\Desktop\SBW.exe
[2011.11.11 16:41:22 | 000,001,315 | ---- | M] () -- C:\Users\Public\Desktop\The Elder Scrolls V - Skyrim.lnk
[2011.11.11 15:04:38 | 068,377,395 | ---- | M] () -- C:\Users\hasenbraten\Desktop\Maeck-MaEP.rar
[2011.11.11 12:05:37 | 075,184,231 | ---- | M] () -- C:\Users\hasenbraten\Desktop\SotGEP56.mp3
[2011.11.11 09:59:54 | 000,003,152 | ---- | M] () -- C:\Users\hasenbraten\Desktop\Setup.bat
[2011.11.10 10:41:46 | 000,422,272 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.11.09 15:40:06 | 000,024,629 | ---- | M] () -- C:\Users\hasenbraten\Desktop\Unbenannt.png
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.11.21 04:02:53 | 000,000,219 | ---- | C] () -- C:\Users\hasenbraten\Desktop\Dota 2.url
[2011.11.17 15:54:36 | 000,003,152 | ---- | C] () -- C:\Users\hasenbraten\Desktop\Setup.bat
[2011.11.17 15:54:24 | 000,750,989 | ---- | C] () -- C:\Users\hasenbraten\Desktop\Skyrim_Repack_fix.rar
[2011.11.11 19:17:42 | 000,326,656 | ---- | C] () -- C:\Users\hasenbraten\Desktop\SBW.exe
[2011.11.11 16:41:22 | 000,001,315 | ---- | C] () -- C:\Users\Public\Desktop\The Elder Scrolls V - Skyrim.lnk
[2011.11.11 14:42:23 | 068,377,395 | ---- | C] () -- C:\Users\hasenbraten\Desktop\Maeck-MaEP.rar
[2011.11.11 12:04:55 | 075,184,231 | ---- | C] () -- C:\Users\hasenbraten\Desktop\SotGEP56.mp3
[2011.11.09 15:40:06 | 000,024,629 | ---- | C] () -- C:\Users\hasenbraten\Desktop\Unbenannt.png
[2011.04.13 18:42:13 | 000,000,383 | ---- | C] () -- C:\Users\hasenbraten\AppData\Local\postgresinstall.bat
[2011.04.13 18:34:21 | 001,590,298 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.01.04 19:08:47 | 000,000,350 | ---- | C] () -- C:\Users\hasenbraten\AppData\Roaming\Current.prx
[2010.09.11 05:13:38 | 000,000,089 | ---- | C] () -- C:\Windows\winDecrypt.INI
[2010.06.23 18:32:00 | 000,111,928 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2010.06.23 18:31:42 | 002,373,712 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2010.06.23 18:31:42 | 000,075,064 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2010.06.15 23:28:54 | 000,002,857 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2010.04.17 23:04:09 | 000,000,906 | ---- | C] () -- C:\Users\hasenbraten\AppData\Roaming\MPQEditor.ini
[2010.04.14 16:02:16 | 000,111,932 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat
[2010.04.14 16:02:16 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat
[2010.04.14 16:02:16 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat
[2010.04.14 16:02:16 | 000,026,154 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat
[2010.04.14 16:02:16 | 000,024,903 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat
[2010.04.14 16:02:16 | 000,021,390 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat
[2010.04.14 16:02:16 | 000,020,148 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat
[2010.04.14 16:02:16 | 000,011,811 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat
[2010.04.14 16:02:16 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat
[2010.04.14 16:02:16 | 000,001,146 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_DU.dat
[2010.04.14 16:02:16 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat
[2010.04.14 16:02:16 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat
[2010.04.14 16:02:16 | 000,001,136 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat
[2010.04.14 16:02:16 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat
[2010.04.14 16:02:16 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat
[2010.04.14 16:02:16 | 000,001,120 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_IT.dat
[2010.04.14 16:02:16 | 000,001,107 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_GE.dat
[2010.04.14 16:02:16 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat
[2010.04.14 16:02:16 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini
[2010.04.08 22:40:37 | 000,007,644 | ---- | C] () -- C:\Users\hasenbraten\AppData\Local\Resmon.ResmonCfg
[2010.04.06 18:14:36 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.04.06 16:05:10 | 000,327,168 | ---- | C] () -- C:\Windows\SysWow64\cutil32.dll
[2010.04.06 12:44:25 | 000,146,476 | ---- | C] () -- C:\Windows\War3Unin.dat
[2010.04.06 12:02:36 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.07.09 02:03:02 | 000,058,880 | ---- | C] () -- C:\Windows\SysWow64\bdmpegv.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[1997.06.14 12:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll
 
========== LOP Check ==========
 
[2011.07.13 14:20:51 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\.minecraft
[2010.12.01 23:34:49 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\Audacity
[2010.09.09 12:42:58 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\CCTV
[2010.07.17 02:14:02 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\DAEMON Tools Lite
[2010.10.28 22:01:45 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\DAEMON Tools Pro
[2010.07.26 00:24:12 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.11.10 17:42:34 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\EPSON
[2010.06.07 16:23:25 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\fltk.org
[2011.05.09 15:04:33 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\GameRanger
[2011.10.27 16:51:17 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\ICQ
[2011.05.03 20:45:33 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\Leadertech
[2010.11.01 17:26:40 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\LolClient
[2011.05.03 19:00:06 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\Media Get LLC
[2010.07.02 20:38:26 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\Nokia
[2011.04.01 23:57:57 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\Octoshape
[2011.02.19 00:05:36 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\PacificPoker
[2010.05.07 23:07:18 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\PC Suite
[2010.09.10 22:37:24 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\PixelPlanet
[2011.01.04 03:49:25 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\PPLive
[2011.12.04 14:02:26 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\RayV
[2011.09.25 23:29:09 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\SplitMediaLabs
[2011.02.06 23:44:46 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\TeamViewer
[2010.06.07 17:27:56 | 000,000,000 | ---D | M] -- C:\Users\hasenbraten\AppData\Roaming\TS3Client
[2011.08.30 07:58:06 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         

Extras.txt

OTL Extras logfile created on: 08.12.2011 18:43:12 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\hasenbraten\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
6,00 Gb Total Physical Memory | 5,07 Gb Available Physical Memory | 84,52% Memory free
12,00 Gb Paging File | 11,11 Gb Available in Paging File | 92,62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 596,07 Gb Total Space | 265,80 Gb Free Space | 44,59% Space Free | Partition Type: NTFS
 
Computer Name: MAHMUT-PC | User Name: hasenbraten| Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{23170F69-40C1-2702-0913-000001000000}" = 7-Zip 9.13 (x64 edition)
"{3DDACE1F-3B1E-D6AB-CD3D-B6E987511945}" = ATI Catalyst Install Manager
"{404BB1FF-A84F-432F-B77B-301E88E8D1C7}" = Apple Mobile Device Support
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{503640E5-B2ED-3173-D109-D4D03153471A}" = AMD Drag and Drop Transcoding
"{534A3680-A7CE-80D0-029B-2105ADA363AB}" = ATI AVIVO64 Codecs
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96D5EB02-DE18-4DCD-A713-929B4461CA8D}" = iTunes
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID-Anmelde-Assistent
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{C19D4D8F-4433-4F6D-9F0C-79589FD0B973}" = Bonjour
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FD53298A-4734-AFCB-B733-4C07776E589E}" = ccc-utility64
"05B59228C7E1C21DFBE89260F879BD95880548D8" = Windows-Treiberpaket - Nokia Modem  (10/05/2009 4.2)
"8CDCFB95BB84DD9C0F88F22266A0CA86035E55BA" = Windows-Treiberpaket - Nokia Modem  (06/01/2009 7.01.0.4)
"EPSON SX110 Series" = Druckerdeinstallation für EPSON SX110 Series
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{045A9539-37B6-464D-94F9-E4ADFA856903}" = PokerStrategy.com Equilator
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08B3869E-D282-424C-9AFC-870E04A4BA14}" = Rockstar Games Social Club
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{10A1D1C4-F0B0-4341-B49A-A9ED8FBDBF9D}" = Livestream Procaster
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{179C91E9-D9ED-D5CC-F0D8-9579DBDED8D6}" = CCC Help English
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{19DC9559-9C20-4A46-A67D-7ECBA52A2788}" = Nokia PC Suite
"{1E2FDD18-E514-4631-AF4A-0CC58FD93DCB}" = Quake Live Mozilla Plugin
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F77C418-2C90-459C-BD33-B56A4182B9FA}" = System Requirements Lab CYRI
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 25
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2C08D7E7-9EE1-4A08-AFE0-745F02DCD6A4}_is1" = Pokemon Online 0.9.76
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX
"{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}" = FIFA 11
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B7IL77L-LKS1-75B1-SKYRIM-18CD6E6334R1}_is1" = The Elder Scrolls V - Skyrim version 1.0
"{4E79A60F-15D2-4BEC-91AD-E41EC42E61B0}" = Batman: Arkham Asylum
"{4E9B398A-8F39-410C-8200-7F5289CD7B02}_is1" = The Sims 3 Ultimate Bundle (Generations Update)
"{4FA2DAFD-2D72-4ACF-BDD8-4178E8AFD459}_is1" = TGA Viewer
"{5454083B-1308-4485-BF17-111000028701}" = Grand Theft Auto: Episodes from Liberty City
"{5454083B-1308-4485-BF17-111000028702}" = Grand Theft Auto: Episodes from Liberty City
"{5454083B-1308-4485-BF17-111000028703}" = Grand Theft Auto: Episodes from Liberty City
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{59ABBDF0-E1E5-48AF-85FB-F523A08C3490}" = STREET FIGHTER IV
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{61B8B2F9-D8DA-4B24-89A9-DB09F38A4899}" = Grand Theft Auto: Episodes From Liberty City
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6C8B53B9-41EE-AD83-007A-55EE64DE6932}" = Catalyst Control Center Graphics Previews Common
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6DED41BC-C9EF-4330-B4E5-46CB2C5C6E2D}" = No23 Recorder
"{6E0352EE-6F0D-4FBC-B1B8-4FF032C78BE0}" = PC Connectivity Solution
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71BFC818-0CED-42D6-9C87-5142918957EE}" = ICQ7.1
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72DF62BD-FF36-424E-AA5F-D89BAFF2C249}" = RollerCoaster Tycoon 2
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7E659C5C-4DF1-499B-B802-77BAE9ABE4D4}" = Razer Diamondback 3G
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial 
"{8E5EAB78-59D0-9C95-4907-E50E359E7E5E}" = HydraVision
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{9193306E-5935-47E0-B458-2548778C1614}_is1" = MediaGet2 version 2.1.494.0
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E2BD6FF-CE8D-47B5-AD9C-0A5C2D54EB3C}" = League of Legends
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A03E4302-F387-47F3-8136-6D9D9286CD3B}" = SteelSeries Kinzu Optical Mouse
"{A3A61264-B075-46BE-9C97-376EA4CEEEF5}" = PdfGrabber 6.0
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.4 - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B823632F-3B72-4514-8861-B961CE263224}" = PostgreSQL 8.3
"{BC90276B-BE38-451C-8E4D-FF28FF08ABF6}" = Bloodline Champions Beta
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C2F8468F-85AB-4D08-A68E-01D328E7B261}" = PokerStrategy.com Elephant
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C50EF365-2898-489A-B6C7-30DAA466E9A2}" = Nokia Connectivity Cable Driver
"{C6115A28-F277-4E82-B067-84D28BF21031}" = Nero 7 Ultra Edition
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CF5DE1DD-F7E6-694D-1E82-84C7C9C9ABDB}" = Catalyst Control Center Graphics Previews Vista
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D55D7EE6-3013-47AC-BE71-51AA35A221AB}" = Quake Live Internet Explorer Plugin
"{DDA34038-89BD-4804-B0B8-DC48D5DFB463}" = Catalyst Control Center - Branding
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E}" = Nexon Game Manager
"{EEF985E8-8B36-4230-B174-117A2381C17F}" = LogMeIn Hamachi
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F71E7762-8A64-AECC-0917-DA51677041CF}" = Catalyst Control Center InstallProxy
"{F97E3841-CA9D-4964-9D64-26066241D26F}" = Microsoft Games for Windows - LIVE
"{F9D65BA1-84C5-B4CB-91FE-D68F07ECBA24}" = ccc-core-static
"{FAF34181-8A35-4182-B297-EB7E0F5B7A5A}" = XSplit
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"888poker" = 888poker
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Age of Empires 2.0" = Microsoft Age of Empires II
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.12 (Unicode)
"Avira AntiVir Desktop" = Avira Free Antivirus
"BandiMPEG1" = Bandisoft MPEG-1 Decoder
"CamStudio" = CamStudio
"Counter-Strike 1.6" = Counter-Strike 1.6
"DAEMON Tools Lite" = DAEMON Tools Lite
"Diablo III Beta" = Diablo III Beta
"DivX Setup.divx.com" = DivX-Setup
"DotAlicious Gaming Client" = DotAlicious Gaming Client
"EA Installer.-1797597899" = EA Installer
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EPSON Scanner" = EPSON Scan
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.50
"Fraps" = Fraps (remove only)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.6
"FUSSBALL MANAGER 11" = FUSSBALL MANAGER 11
"Garena" = Garena 2010
"GOM Player" = GOM Player
"GomTVStreamer" = GOMTV Streamer
"Google Chrome" = Google Chrome
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"hon" = Heroes of Newerth
"ICCup Launcher_is1" = ICCup Launcher
"InstallShield_{045A9539-37B6-464D-94F9-E4ADFA856903}" = PokerStrategy.com Equilator
"Intelore - RAR Password Recovery" = RAR Password Recovery v1.1 RC17 (remove only)
"ips XP_is1" = ips XP 1.11.2600
"IrfanView" = IrfanView (remove only)
"JDownloader" = JDownloader
"Just Cause 2_is1" = Just Cause 2
"LogMeIn Hamachi" = LogMeIn Hamachi
"MabinogiEU" = MabinogiEU
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live
"Messenger_Plus_Live_Germany Toolbar" = Messenger_Plus_Live_Germany Toolbar
"MinecraftAlpha" = MinecraftAlpha
"mIRC" = mIRC
"Mozilla Firefox 8.0 (x86 de)" = Mozilla Firefox 8.0 (x86 de)
"Nokia PC Suite" = Nokia PC Suite
"NSS" = Norton Security Scan
"PC Wizard 2010_is1" = PC Wizard 2010.1.93
"PDF Password Remover v3.0_is1" = PDF Password Remover v3.0
"PokerStars" = PokerStars
"PokerStars.net" = PokerStars.net
"PPGame" = PPGame V0.0.1.0018
"PPLite" = PPLite 1.0.0.6
"PPLive" = PPTV V2.7.0.0031
"Proxifier_is1" = Proxifier version 2.9
"PunkBusterSvc" = PunkBuster Services
"RayV" = DTVblizzcon
"Replay Explorer_is1" = Replay Explorer 2
"ShotOnline" = ShotOnline
"SopCast" = SopCast 3.2.4
"StarCraft II" = StarCraft II
"Steam App 35110" = Just Cause 2 Demo
"Steam App 400" = Portal
"Steam App 440" = Team Fortress 2
"Steam App 50280" = Mafia II - Demo
"Steam App 55410" = Warhammer 40,000: Space Marine Demo
"Steam App 570" = Dota 2
"TeamViewer 6" = TeamViewer 6
"Total Video Converter 3.50_is1" = Total Video Converter 3.50
"TVUPlayer" = TVUPlayer 2.5.3.1
"Uninstall_is1" = Uninstall 1.0.0.1
"Veetle TV" = Veetle TV 0.9.18
"VLC media player" = VLC media player 1.1.10
"Warcraft III" = Warcraft III
"Warkeys" = Warkeys 1.16.0.0b
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"WinLiveSuite_Wave3" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Betfred Poker" = Betfred Poker
"CCTVPlayer" = CCTV Player Uninstall
"GameRanger" = GameRanger
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"Octoshape Streaming Services" = Octoshape Streaming Services
"Warcraft III" = Warcraft III: All Products
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 13.04.2011 13:54:09 | Computer Name = hasenbraten-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 13.04.2011 13:54:09 | Computer Name = hasenbraten-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 13.04.2011 13:54:09 | Computer Name = hasenbraten-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 13.04.2011 14:33:28 | Computer Name = hasenbraten-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 2.0.0.4094 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: d00    Startzeit: 
01cbfa023535e73a    Endzeit: 18    Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:
 853cef37-65fc-11e0-a523-6cf04976b23d  
 
Error - 14.04.2011 19:25:59 | Computer Name = hasenbraten-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 14.04.2011 19:26:30 | Computer Name = hasenbraten-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 14.04.2011 19:26:31 | Computer Name = hasenbraten-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 14.04.2011 19:26:33 | Computer Name = hasenbraten-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 14.04.2011 19:26:43 | Computer Name = hasenbraten-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 16.04.2011 17:33:23 | Computer Name = hasenbraten-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\hasenbraten\Downloads\SoftonicDownloader64733.exe". Fehler in  Manifest- oder Richtliniendatei
 "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt
 mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt stehende Komponenten:.
Komponente
 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
 
[ OSession Events ]
Error - 03.10.2011 16:30:15 | Computer Name = hasenbraten-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 
Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session 
lasted 5 seconds with 0 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 08.12.2011 13:36:42 | Computer Name = hasenbraten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 08.12.2011 13:38:48 | Computer Name = hasenbraten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 08.12.2011 13:38:48 | Computer Name = hasenbraten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 08.12.2011 13:38:48 | Computer Name = hasenbraten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 08.12.2011 13:43:48 | Computer Name = hasenbraten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 08.12.2011 13:43:48 | Computer Name = hasenbraten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 08.12.2011 13:43:48 | Computer Name = hasenbraten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 08.12.2011 13:45:56 | Computer Name = hasenbraten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 08.12.2011 13:45:56 | Computer Name = hasenbraten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 08.12.2011 13:45:56 | Computer Name = hasenbraten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
 
< End of report >
         

Ich bitte um Hilfe und danke schonmal im vorraus.

hi

achtung!

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKCU..\Run: [{4EC3EFB5-419B-11DF-A4EA-806E6F6E6963}] C:\Users\hasenbraten\AppData\Roaming\Microsoft\hostrun.exe (Mozilla Foundation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
:Files
C:\Users\hasenbraten\AppData\Roaming\Microsoft\hostrun.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

öffne computer, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
folge dem link, und lade das archiv im upload channel hoch
http://www.trojaner-board.de/54791-a...ner-board.html

Schonmal vielen Dank für die Hilfe.

Wenn ich den Rechner normal hochfahre erscheint nur ein schwarzer Bildschirm und ich kann nichts machen.

Im abgeschicherten Modus lässt sich der Rechner starten, der _OTL Ordner existiert, soll ich den Hochladen ?


edit:

Nach ca. 3-4 min warten hat es doch geklappt.

ja bitte :-)

Hallo hier der Inhalt des Textdokuments:

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{4EC3EFB5-419B-11DF-A4EA-806E6F6E6963} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EC3EFB5-419B-11DF-A4EA-806E6F6E6963}\ not found.
C:\Users\Mahmut Külünk\AppData\Roaming\Microsoft\hostrun.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
========== FILES ==========
File\Folder C:\Users\Mahmut Külünk\AppData\Roaming\Microsoft\hostrun.exe not found.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: All Users
 
User: AppData
 
User: Default
 
User: Default User
 
User: elephant
 
User: Mahmut Külünk
->Flash cache emptied: 2492044 bytes
 
User: Public
 
Total Flash Files Cleaned = 2,00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: AppData
 
User: Default
->Temp folder emptied: 48 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: elephant
->Temp folder emptied: 48 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Mahmut Külünk
->Temp folder emptied: 3786457070 bytes
->Temporary Internet Files folder emptied: 164304523 bytes
->Java cache emptied: 2887555 bytes
->FireFox cache emptied: 70707307 bytes
->Google Chrome cache emptied: 357574248 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 200704 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 811960013 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 298705314 bytes
 
Total Files Cleaned = 5.238,00 mb
 
 
OTL by OldTimer - Version 3.2.31.0 log created on 12082011_200516

Files\Folders moved on Reboot...
C:\Users\Mahmut Külünk\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...
         

Die Datei wurde auch auf den Server hochgeladen.

ok
combofix:

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

• Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
  Tool
  
  Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  
• Hinweis:
  Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  
• Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Hier ist die log Datei von ComboFix:

ComboFix 11-12-08.01 - Mahmut Külünk 08.12.2011  21:06:21.1.4 - x64
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.6142.4209 [GMT 1:00]
ausgeführt von:: c:\users\Mahmut K³l³nk\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\favoritevideo\InvisibleFolder
c:\favoritevideo\InvisibleFolder\20100813174225_jingji100813zanting15s.swf
c:\favoritevideo\InvisibleFolder\20100902163248_jingji100902zhu15s.swf
c:\favoritevideo\InvisibleFolder\20100930152150_pptv100930zhu15s.swf
c:\favoritevideo\InvisibleFolder\20101014160145_sasa101014jiao15s1.swf
c:\favoritevideo\InvisibleFolder\20101028150745_sasa101028zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101029114223_sasa101029cha15s.swf
c:\favoritevideo\InvisibleFolder\20101029175115_biyadi101029zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101104115357_sasa101104zhu15s.swf
c:\favoritevideo\InvisibleFolder\20101104135837_shenghuojia101104zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101105155052_xixun101105zhu15s.wmv
c:\favoritevideo\InvisibleFolder\20101112141416_sasa101112cha2.swf
c:\favoritevideo\InvisibleFolder\20101118161832_kuowang101118zhu5s.swf
c:\favoritevideo\InvisibleFolder\20101119115856_taobao101119cha15sman.swf
c:\favoritevideo\InvisibleFolder\20101119120106_taobao101119cha15swoman.swf
c:\favoritevideo\InvisibleFolder\20101126174343_zhongguoliantong101129zhu15s.swf
c:\favoritevideo\InvisibleFolder\20101130183135_aixinbaoguo101201zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20101202165626_yuandayiyuan101202cha15s.gif
c:\favoritevideo\InvisibleFolder\20101208184307_yuanda101208cha15s.gif
c:\favoritevideo\InvisibleFolder\20101217100327_xiangganglvyouju101217zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101217112741_xiaogouwang101217zhu15s.swf
c:\favoritevideo\InvisibleFolder\20101220144744_biyadi101223zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20101220144923_biyadi101223cha15s.swf
c:\favoritevideo\InvisibleFolder\20101220164804_vip101220zhu15s.swf
c:\favoritevideo\InvisibleFolder\20101220164848_vip101220zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20101220170858_pingan101220cha15s.swf
c:\favoritevideo\InvisibleFolder\20101220171122_pingan101220zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101220172306_pingan101220houtie.swf
c:\favoritevideo\InvisibleFolder\20101220174642_dongfengrichan101220cha15s.swf
c:\favoritevideo\InvisibleFolder\20101220174837_dongfengrichan101220zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101220190559_taobao101221zhu15s.swf
c:\favoritevideo\InvisibleFolder\20101220190717_taobao101221bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20101222164804_tianxiaer101223zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101223092851_tianyijue101223bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20101223114801_tianyijue101223zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101223160139_wopaiwang101223zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101223181149_jianfengzhanji101223zhu15s.swf
c:\favoritevideo\InvisibleFolder\20101223181313_jianfengzhanji101223zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101223181751_shijitiancheng101224zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101224112404_woyouwangluo101224zhu15s.swf
c:\favoritevideo\InvisibleFolder\20101224161707_woyouwangluo101224zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101224162116_woyouwangluo101225bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20101228211855_kfc101228jiaobiao.swf
c:\favoritevideo\InvisibleFolder\20101228212043_kfc101228zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101229171754_taobao101230cha15s.swf
c:\favoritevideo\InvisibleFolder\20101229171842_taobao101230zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101229175616_tianxiaer101230zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101230102637_tianxiaer110101zhu15s.swf
c:\favoritevideo\InvisibleFolder\20101230103922_tianyijue110101zhu15s.swf
c:\favoritevideo\InvisibleFolder\20101230142434_zhoudafu101230zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20101230142738_zhoudafu101230cha15s.jpg
c:\favoritevideo\InvisibleFolder\20101231151726_pingan101231bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20101231152742_wopaiwang110103zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101231163830_baidu110101zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101231165505_oppo110101zhu15s.MP4
c:\favoritevideo\InvisibleFolder\20101231180112_taobao110104cha15s.swf
c:\favoritevideo\InvisibleFolder\20101231180328_taobao110104zhu15s.swf
c:\favoritevideo\InvisibleFolder\20101231192854_woyouwang110104bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20101231192955_woyouwang110104zhu15s.swf
c:\favoritevideo\InvisibleFolder\20101231194942_shengui110101zanting15s.swf
c:\favoritevideo\InvisibleFolder\20101231195034_ruishishoubiao110101zhu15s.swf
c:\favoritevideo\InvisibleFolder\20101231201102_woyouwang110104zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110104094313_wanglaoji110104zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110104095524_wanglaoji110104cha15s.swf
c:\favoritevideo\InvisibleFolder\20110104095800_wanglaoji110104jiao15s.swf
c:\favoritevideo\InvisibleFolder\20110104165621_ruishishoubiao110104zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110105145904_wanmeishenguishijie110108zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110105150645_tianxiaer110107zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110105161556_taobao110106cha15s.swf
c:\favoritevideo\InvisibleFolder\20110105161646_taobao110106zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110105161746_taobao110106zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110105170002_tianyijue110106zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110105183141_juedifanji110105cha15s.swf
c:\favoritevideo\InvisibleFolder\20110105183309_juedifanji110105zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110106152512_shinianyijian110106zaiting15s.swf
c:\favoritevideo\InvisibleFolder\20110106163101_yaotiaoshunv110106zanting15s.gif
c:\favoritevideo\InvisibleFolder\20110106174326_tianshuqitan110107zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110106174458_tianshuqitan110107zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110106184633_oulainuo110107zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110106235116_fanrenxiuxian110107zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110107113752_moptianshuqitan110107zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110107113836_moptianshuqitan110107zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110107115220_oulaiya110107zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110107142444_fanrenxiuzhen110107zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110107151338_mengbasha110110jiao15s.swf
c:\favoritevideo\InvisibleFolder\20110107152723_mengbasha110112cha15s.swf
c:\favoritevideo\InvisibleFolder\20110107155910_moplongzhiren110108zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110107155951_moplongzhiren110108zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110107160835_moplongzhiren110109zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110107164044_guangyuwendao110108qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110107170852_woyouwangluo110107bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20110107171232_woyouwangluo110107zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110107175703_jiguang110108zanting15s1.swf
c:\favoritevideo\InvisibleFolder\20110107181602_taobao110108cha15s.swf
c:\favoritevideo\InvisibleFolder\20110107181653_taobao110108zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110107182656_taobao110110cha15s.swf
c:\favoritevideo\InvisibleFolder\20110107182758_taobao110110zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110107182904_taobao110110zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110107185314_nikang110107zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110107185441_nikang110107zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110107185901_yimeng110110zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110110150804_fenghuangchuanshuo110112zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110110161433_guangyuwendao110115qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110110161527_guangyuwendao110111zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110110184927_chenggefengshang110111bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20110110185008_woyouwangluo110111zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110110185329_chenggefengshang110111zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110110230157_wpyou110111bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20110111105058_wopaiwang110111zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110111152957_shenguishijia110112zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110111161918_yimengcaopanshou110112zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110111174507_juedifanji110112zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110111174706_juedifanji110112zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110111174828_juedifanji110112cha15s.swf
c:\favoritevideo\InvisibleFolder\20110112095745_fankong110112zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110112151008_bianfeng110112zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110112151128_bianfeng101112zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110112160227_ruishishoubiao110112zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110112160420_xiaogou110112zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110112172412_tianxiaer110114zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110112173712_anjisi110113zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110112182830_taobao110113cha15s.swf
c:\favoritevideo\InvisibleFolder\20110112182915_taobao110113zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110112183023_taobao110113zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110113145618_sanguosha110114zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110113152901_doufaxiuxian110113zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110113153747_doufa110113zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110113165903_qiantengwang110114zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110114093829_taobao110114cha15s.swf
c:\favoritevideo\InvisibleFolder\20110114105142_taobao110115zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110114105528_taobao110115zhu15s1.swf
c:\favoritevideo\InvisibleFolder\20110114144843_ffanrenxiuxian110115zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110114145026_fanrenxiuxian110115zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110114175916_baokuang.swf
c:\favoritevideo\InvisibleFolder\20110117111638_wopaiwang110117zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110117170905_yimaishang110118zhu8s.swf
c:\favoritevideo\InvisibleFolder\20110117171735_jinshan110120zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110117171818_jinshan110120zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110117183157_juedifanji110118zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110118135104_shilijia110118zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110118135212_shilijia110118cha15s.swf
c:\favoritevideo\InvisibleFolder\20110118151616_guangyu110122qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110118173357_maoxiandao110119zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110119150345_shinianyijian110120zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110119151040_shinianyijian110120zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110119171326_wanglaoji110120zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110119172009_wanglaoji110120cha15s.swf
c:\favoritevideo\InvisibleFolder\20110119173551_wanglaoji110120jiao15s.swf
c:\favoritevideo\InvisibleFolder\20110119174611_lumi110119zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110119222239_aiyaya110120zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110119222340_aiyaya110120jiao15s.png
c:\favoritevideo\InvisibleFolder\20110120120903_aiyaya110120jiaobiaob.png
c:\favoritevideo\InvisibleFolder\20110120175139_hanmei110121zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110121125809_aiyaya110121jiaobiao.png
c:\favoritevideo\InvisibleFolder\20110121130405_aiyay110121zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110124103209_hainanhangkong110124zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110124114904_aiyaya110124zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110125092435_aiyaya110125jiaobiao1.JPG
c:\favoritevideo\InvisibleFolder\20110125153233_huiyuan110125zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110125223521_shijitiancheng110127zanting15a.swf
c:\favoritevideo\InvisibleFolder\20110126134515_hudongbaike110126zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110126140202_tianyayouxi110126zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110126140419_tianyayouxi110126zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110127115622_huiyuan110127zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110127140610_mengsanguo110128zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110127191719_anjisi110128zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110127191826_anjisi110128zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110128091826_tiandiyinigxiong110128zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110128092246_tiandiyingxiong110128zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110128141758_aiyaya110128jiaobiao.JPG
c:\favoritevideo\InvisibleFolder\20110128170117_wopaiwang110128zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110128172504_panpan110201jiaobiao.swf
c:\favoritevideo\InvisibleFolder\20110128193852_guangqi110201zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110128194022_guangqi110201cha15s.swf
c:\favoritevideo\InvisibleFolder\20110129144448_wendao110131zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110131173248_huiyuan110201cha15sred.swf
c:\favoritevideo\InvisibleFolder\20110131173406_huiyuan110201cha15sor.swf
c:\favoritevideo\InvisibleFolder\20110131173528_huiyuan110201zanting15sred.swf
c:\favoritevideo\InvisibleFolder\20110131173635_huiyuan110201zanting15sor.swf
c:\favoritevideo\InvisibleFolder\20110131174053_huiyuan110201jiao15sred.swf
c:\favoritevideo\InvisibleFolder\20110131174155_huiyuan110201jiao15sor.swf
c:\favoritevideo\InvisibleFolder\20110209170756_wanglaoji110210jiao15s.swf
c:\favoritevideo\InvisibleFolder\20110209170954_wanglaoji110210zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110209171115_wanglaoji110210cha15s.swf
c:\favoritevideo\InvisibleFolder\20110210183244_honghuang110210zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110211143720_tianxiaer110211zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110211151921_480360.png
c:\favoritevideo\InvisibleFolder\20110211161119_400300.jpg
c:\favoritevideo\InvisibleFolder\20110212182422_wanzaimatou110213zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110212212316_tianxiaer110214zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110215164620_xiaochunzaixian110215zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110215165250_xiaochunzaixian110215zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110215171948_wendao110215zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110215172629_zuoxuan110215zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110215172746_zuoxuan110215zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110215213657_shijitiancheng110218zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110216101103_jinsheng110216jiaobiao.swf
c:\favoritevideo\InvisibleFolder\20110216101617_zainaer110216jiaobiao.swf
c:\favoritevideo\InvisibleFolder\20110217102848_fanrenxiuzhen110217zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110217115936_51job110217zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110217121204_51job110301zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110217153032_ganjiwang110217zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110217153640_ganjiwang110217bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20110217182439_zhengtu2110217zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110218171735_zhengtu2110219qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110218182706_maiwang110221zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110218185055_yimeng110218zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110221162855_taobao110221zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110221163330_taobao110221zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110221163558_taobao110221cha15s.swf
c:\favoritevideo\InvisibleFolder\20110222160721_zhengtumianfei110224zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110222160855_zhengtumianfei110225zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110222161225_zhengtumianfei110224qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110222180543_xiaochunzaixiang110222zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110222180855_xiaochunzaixian110222zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110223084615_hongghuang110222zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110224101138_haoya110224zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110224101426_suning110224zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110224112519_pinju110224zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110224145001_haolemai110224cha15s.swf
c:\favoritevideo\InvisibleFolder\20110224145756_haolemai110224zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110224164100_hudongbaike110225zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110224180735_aotuma110224zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110225130901_aotuma110225zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110225193446_kaixinwang110228qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110228135210_diguowenming110228zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110228180846_lanmiu110301cha15s.swf
c:\favoritevideo\InvisibleFolder\20110228181112_lanmiu110301zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110228181432_lanmiu110301zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110301100228_diguowenming110301zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110301141520_taohuawang110301bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20110301142105_taohuawang110301zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110301184330_guangyu110302zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110301214329_aojian110302zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110302155337_maiwang110303bkqipao.swf
c:\favoritevideo\InvisibleFolder\20110302155841_jiarenmeizhuang110302zt.jpg
c:\favoritevideo\InvisibleFolder\20110302160427_maiwang110303zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110302161027_maiwang110303zhanting15s.swf
c:\favoritevideo\InvisibleFolder\20110302161314_maiwang110303zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110303155639_n8110303zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110303170427_letaoqipao15s.swf
c:\favoritevideo\InvisibleFolder\20110303170728_letao110304cha15s.swf
c:\favoritevideo\InvisibleFolder\20110303170943_letao110304zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110303181200_maibaobao110304zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110303182716_zhengtu2110304zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110304165815_xianyu110307zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110304172051_zhengtu110305zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110304173215_xiaochunzaixian110304zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110304173904_xiaochunzaixian110304zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110304175623_caipiao110304zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110304180136_yimeng110305zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110304180331_yimeng110305zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110304181859_lanmiu110305zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110304182301_lanmiu110305cha15s.swf
c:\favoritevideo\InvisibleFolder\20110304183352_letao110305zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110304183526_letao110305cha15s.swf
c:\favoritevideo\InvisibleFolder\20110304183724_letao110305qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110304184535_rexueshijie110307zanting15s.gif
c:\favoritevideo\InvisibleFolder\20110304194245_baomashouji110304zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110305114814_jianeng100307zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110305123327_jianeng110307zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110307111147_jianeng110307zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110307165408_tianya110308zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110307170537_maiwang110308zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110307170949_maiwang110308zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110307171135_maiwang110308cha15s.swf
c:\favoritevideo\InvisibleFolder\20110307171614_xiaochunzaixian110307zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110307171753_xiaochuzaixian110307zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110307175225_DNF110307zhu8s.swf
c:\favoritevideo\InvisibleFolder\20110307175358_dnf110307zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110308141136_chuangshixiyou110309bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20110308141230_chuangshixiyou110312zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110308142604_huanxiangshidai110309zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110309171955_huhawang110309zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110309172753_diguowenming110309zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110309182540_jiguang110310zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110310142655_maiwang110311zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110310143056_maiwang110311cha15s.swf
c:\favoritevideo\InvisibleFolder\20110310213303_xiyou110311zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110311134216_yaodian100110311zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110311134354_yaodian100110311cha15s.swf
c:\favoritevideo\InvisibleFolder\20110311163707_shoubiao110311zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110311175903_qigou1103111zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110311180028_qiangxianwang110312zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110311180615_huanxiangshidaixiyou110312zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110311181215_chuangshixiyou110313zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110311181259_chuangshixiyou110312zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110311211857_tankeshijie110314qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110311212019_tankeshijie110313zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110314163957_lanmiu110315zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110314164254_lanmiu110315cha15s.swf
c:\favoritevideo\InvisibleFolder\20110314173630_shoubiao110314zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110314195115_honghuangshidai110315zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110314212226_tanke110315zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110315094634_honghuang110315bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20110315125550_bmw110315zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110315152058_yaodian110316cha15s.swf
c:\favoritevideo\InvisibleFolder\20110315152309_yaodian110316zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110315172101_changyou110317zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110315215843_fanren110316zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110316172119_ouluna110317zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110316181043_fanrenxiuxian110317zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110316182151_tankeshijie110317zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110316195754_wushen110317zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110316215828_alibaba110317zhu8s.swf
c:\favoritevideo\InvisibleFolder\20110316220050_alibaba110317cha15s.swf
c:\favoritevideo\InvisibleFolder\20110316221211_caipiao110316zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110316221307_caipiao110316bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20110317141854_yichuanmei110317qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110317145935_tianlongbabu110318zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110317154339_maibaobao110318zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110317170617_yimeng110318zhu15s.MP4
c:\favoritevideo\InvisibleFolder\20110317175626_chuangshixiyou110318bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20110317191220_fanrenxiuxian110318zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110317221838_tanke110318zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110318162734_chuangshixiyou110319zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110318163306_fanrenxiuxian110320zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110318172126_airui110318zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110318180416_wushen110319zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110318195654_tiandiyixiong110318zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110318202532_tankeshijie110318zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110318202819_tankeshijie110318zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110319002002_xiyou110320zanting.swf
c:\favoritevideo\InvisibleFolder\20110319002157_xiyou110320zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110319002325_xiyou110320qipao.swf
c:\favoritevideo\InvisibleFolder\20110319234532_xingji110320zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110321142207_hudongbaike110321zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110321171021_duleisi110322cha15s.swf
c:\favoritevideo\InvisibleFolder\20110322164832_maiwang110323zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110322170523_maiwang110323bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20110322171242_maiwang110323zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110322171445_maiwang110323cha15s.swf
c:\favoritevideo\InvisibleFolder\20110322175616_kongzhongwang110323zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110322181850_wushen110323zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110322183850_pinganchexian110322houtie.swf
c:\favoritevideo\InvisibleFolder\20110322184056_pinganchexian110322qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110322190849_hejian110322zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110322191408_chuangshixiyou110322zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110323093057_pptv110322morenzhu15s.swf
c:\favoritevideo\InvisibleFolder\20110323093215_pptv110323zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110323112144_honghuangshenhua110323zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110323112731_honghuangshenhua110323bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20110323115505_shenmozhixue110324zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110323172824_wushen110324zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110323182213_91wan110324qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110323182237_baihe110324zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110323182421_kunxun110324zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110323182653_tuniu110324zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110323182950_baihe110324zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110323183141_kuxun110324zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110323183319_tuniu110324zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110324135557_tankeshijie110325zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110324172544_huifeng110325zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110324172621_qijia110324zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110324172735_huifeng110324zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110324172822_qijiawang110324zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110324182452_sohuweibo110325zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110324195619_xingji110325zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110324195743_xingji110325zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110325165136_airui110325zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110325174213_91wan110326qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110325214938_hudongbaike110328zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110325220727_xingji2110328qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110325224420_xunyou110329zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110326222627_furenguo110327zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110326222724_furenguo110327zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110326222819_furenguo110327bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20110328161753_xunyou110329zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110328162329_xunyou110330zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110328171921_xialv110329zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110328172154_xialv110329zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110328230519_xingji2110329zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110329112247_xunyou110329zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110330135620_maiwang110330zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110330135907_maiwang110330bkqipao15s.swf
c:\favoritevideo\InvisibleFolder\20110330140053_maimang110330zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110331115028_91wan110331qipao.swf
c:\favoritevideo\InvisibleFolder\20110331144802_vasshinianyijian110401zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110331165855_guangfayinhang110401zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110331165954_guangfayinhang110401zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110331173637_tianxiguangzhimaoxian110401zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110331173737_tianxiguangzhimaoxian110401zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110331191123_91wan110401qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110331204249_24quan110401cha15s.swf
c:\favoritevideo\InvisibleFolder\20110401155313_shuanyingshan110403zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110401155430_guanyingshan110403zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110401170348_maibaobao110401zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110401171825_jurenzhengtu110402zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110401171934_jurenzhengtu110402qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110401172217_jurenzhengtu110403zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110401181006_jiaoyou110401zanting15s.jpg
c:\favoritevideo\InvisibleFolder\20110401183802_aifangwang110406jiao15s.swf
c:\favoritevideo\InvisibleFolder\20110401193045_gaopeng110402zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110401194647_gaopeng110402zanting15s.gif
c:\favoritevideo\InvisibleFolder\20110402112559_pinganchexian110402zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110402112907_pingan110402qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110402135808_lanmiu110403zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110402135945_lanmiu110403cha15s.swf
c:\favoritevideo\InvisibleFolder\20110402150348_xingji110406zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110402150655_xingji2110406zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110402155610_feixue110405zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110402161315_91wan110403qipao15s.swf
c:\favoritevideo\InvisibleFolder\20110418173323_20110415165825_baojun110415cha15s.swf
c:\favoritevideo\InvisibleFolder\20110418173438_pangu110419zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110418174651_feixue110419zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110419190241_zhengtu110423zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110430004837_honghuangshenhua110430cha15s.swf
c:\favoritevideo\InvisibleFolder\20110503184911_renbao110504zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110525173309_zhengtumianfei110527zanting.swf
c:\favoritevideo\InvisibleFolder\20110527133219_mengbasha110527zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110628183241_ipad110628zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110720101620_kelingkeli110720zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110720221233_hushubao110701cha15s.swf
c:\favoritevideo\InvisibleFolder\20110804143802_shasha110804zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110809194320_guangqi110810zanting.swf
c:\favoritevideo\InvisibleFolder\20110815140813_hanmei110815zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110816164011_taobao110818qipao.swf
c:\favoritevideo\InvisibleFolder\20110816181632_baojun110816zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110817104237_panpan110817jiaobiao1.swf
c:\favoritevideo\InvisibleFolder\20110817162445_chuanqi110817zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110824115125_kelingkeli110824morenhc5s.swf
c:\favoritevideo\InvisibleFolder\20110824133434_tianya110825zanting15s.swf
c:\favoritevideo\InvisibleFolder\20110824175443_maibaobao110825zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110831223843_taobao110901zanting.swf
c:\favoritevideo\InvisibleFolder\20110901184028_renbaochexian110901zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110903185600_shenxiandao110903kehuduanchabo.swf
c:\favoritevideo\InvisibleFolder\20110909163622_aiqingshuixingle110910kehuduanzanting.jpg
c:\favoritevideo\InvisibleFolder\20110909184311_ludingji110910zanting.swf
c:\favoritevideo\InvisibleFolder\20110912214940_aiqingshuixingle110913kehuduanzt.jpg
c:\favoritevideo\InvisibleFolder\20110923184800_zhengtu2110924zanting.swf
c:\favoritevideo\InvisibleFolder\20110923190518_kangzhan2110924zhu15s.swf
c:\favoritevideo\InvisibleFolder\20110927182112_xunxian111005zanting.swf
c:\favoritevideo\InvisibleFolder\20110929111421_yingxionglianmeng110906zanting.swf
c:\favoritevideo\InvisibleFolder\20110930143903_taobao111001houtie.swf
c:\favoritevideo\InvisibleFolder\20111018131518_shenxiandao111019chabo.swf
c:\favoritevideo\InvisibleFolder\20111019172403_dongfengbiaozhi111021zhu15s.swf
c:\favoritevideo\InvisibleFolder\20111103150013_luyou111105zanting15s.swf
c:\favoritevideo\InvisibleFolder\20111122172412_yingxionglianmeng111123zhu15s.swf
c:\favoritevideo\InvisibleFolder\20111128111606_37wan111128zhu15s.swf
c:\favoritevideo\InvisibleFolder\20111130144408_qingtianzhu111201zanting.swf
c:\favoritevideo\InvisibleFolder\20111201183928_fengshen111202zanting.swf
c:\favoritevideo\InvisibleFolder\20111202185758_fanrenxiuzhen111204zhu15s.swf
c:\favoritevideo\InvisibleFolder\admodule.dll
c:\favoritevideo\InvisibleFolder\condisp.dll
c:\favoritevideo\InvisibleFolder\kademlia.dll.tpp
c:\favoritevideo\InvisibleFolder\logclient.dll
c:\favoritevideo\InvisibleFolder\mir(0).dll
c:\favoritevideo\InvisibleFolder\mir.dll
c:\favoritevideo\InvisibleFolder\peer(0).dll
c:\favoritevideo\InvisibleFolder\peer(1).dll
c:\favoritevideo\InvisibleFolder\peer(2).dll
c:\favoritevideo\InvisibleFolder\peer(3).dll
c:\favoritevideo\InvisibleFolder\peer(4).dll
c:\favoritevideo\InvisibleFolder\peer.dll
c:\favoritevideo\InvisibleFolder\pplss2.swf
c:\favoritevideo\InvisibleFolder\ppp.dll
c:\favoritevideo\InvisibleFolder\pptvsetup_2.7.0.0032_s.exe
c:\favoritevideo\InvisibleFolder\pptvsetup_2.7.0.0036_s.exe
c:\favoritevideo\InvisibleFolder\pptvsetup_2.7.0.0038_s.exe
c:\favoritevideo\InvisibleFolder\productupdate.dll
c:\favoritevideo\InvisibleFolder\tipsclient(0).dll
c:\favoritevideo\InvisibleFolder\tipsclient.dll
c:\favoritevideo\InvisibleFolder\tipsdone.dll
c:\favoritevideo\InvisibleFolder\tipsstatistic.dll
c:\favoritevideo\InvisibleFolder\uilib.dll
C:\ghos
c:\ghos\giex
c:\msocache\ms0.dll
c:\windows\Downloaded Program Files\Install.inf
c:\windows\gsyspd.log
c:\windows\SysWow64\ui
c:\windows\SysWow64\ui\BANNER\LOADINGEVENT1.SOR
c:\windows\SysWow64\ui\BANNER\LOADINGIMGOPT.SOR
c:\windows\SysWow64\ui\BANNER\NOTICE_BANNER1.SOR
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-11-08 bis 2011-12-08  ))))))))))))))))))))))))))))))
.
.
2011-12-08 20:13 . 2011-12-08 20:13	--------	d-----w-	c:\users\elephant\AppData\Local\temp
2011-12-08 20:13 . 2011-12-08 20:13	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-12-08 19:31 . 2011-12-08 19:31	69000	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{21E157FC-63D9-4B60-917B-4A459E730A90}\offreg.dll
2011-12-08 19:05 . 2011-12-08 19:31	--------	d-----w-	C:\_OTL
2011-12-08 17:42 . 2011-12-08 17:42	--------	d-----w-	c:\users\Mahmut Külünk\AppData\Local\ElevatedDiagnostics
2011-12-06 16:12 . 2011-11-21 11:40	8822856	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{21E157FC-63D9-4B60-917B-4A459E730A90}\mpengine.dll
2011-11-15 11:38 . 2011-11-15 11:38	--------	d-----w-	c:\program files (x86)\SystemRequirementsLab
2011-11-11 15:41 . 2011-11-11 15:41	--------	d-----w-	c:\users\Mahmut Külünk\AppData\Local\Skyrim
2011-11-11 15:30 . 2011-11-11 15:30	--------	d-----w-	c:\program files (x86)\Black_Box
2011-11-10 16:42 . 2011-11-10 16:42	--------	d-----w-	c:\users\Mahmut Külünk\AppData\Roaming\EPSON
2011-11-09 10:29 . 2011-10-01 05:45	886784	----a-w-	c:\program files\Common Files\System\wab32.dll
2011-11-09 10:29 . 2011-10-01 04:37	708608	----a-w-	c:\program files (x86)\Common Files\System\wab32.dll
2011-11-09 10:29 . 2011-09-29 16:29	1923952	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-11-09 10:29 . 2011-09-29 04:03	3144704	----a-w-	c:\windows\system32\win32k.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-08 13:44 . 2011-10-16 12:58	130760	----a-w-	c:\windows\system32\drivers\avipbb.sys
2011-11-13 13:43 . 2011-05-28 11:33	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-11 13:00 . 2011-10-16 12:58	97312	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2011-10-11 13:00 . 2011-10-16 12:58	27760	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2011-10-01 03:25 . 2011-10-12 11:47	1638912	----a-w-	c:\windows\system32\mshtml.tlb
2011-10-01 02:42 . 2011-10-12 11:47	1638912	----a-w-	c:\windows\SysWow64\mshtml.tlb
2011-09-17 00:12 . 2009-08-18 10:49	564632	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
2011-09-17 00:12 . 2009-08-18 09:24	18328	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{542e4d79-1970-4e95-9862-fdb96f61b280}"= "c:\program files (x86)\Messenger_Plus_Live_Germany\tbMes1.dll" [2010-06-23 2515552]
.
[HKEY_CLASSES_ROOT\clsid\{542e4d79-1970-4e95-9862-fdb96f61b280}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{542e4d79-1970-4e95-9862-fdb96f61b280}]
2010-06-23 17:45	2515552	----a-w-	c:\program files (x86)\Messenger_Plus_Live_Germany\tbMes1.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-06-10 15:28	1233288	----a-w-	c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{542e4d79-1970-4e95-9862-fdb96f61b280}"= "c:\program files (x86)\Messenger_Plus_Live_Germany\tbMes1.dll" [2010-06-23 2515552]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-06-10 1233288]
.
[HKEY_CLASSES_ROOT\clsid\{542e4d79-1970-4e95-9862-fdb96f61b280}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-04-06 39408]
"PC Suite Tray"="c:\program files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]
"AlcoholAutomount"="c:\program files (x86)\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-09-30 203928]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"PPAP"="c:\program files (x86)\Common Files\PPLiveNetwork\PPAP.EXE" [2010-12-10 185784]
"RayV"="c:\program files (x86)\RayV\RayV\RayV.exe" [2010-10-21 2839848]
"Octoshape Streaming Services"="c:\users\Mahmut Külünk\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2009-01-08 70936]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 17351304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Diamondback"="c:\program files (x86)\Razer\Diamondback 3G\razerhid.exe" [2009-10-12 226816]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2010-03-05 1135912]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-04-28 142120]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-25 98304]
"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-05-25 1951112]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate1cad5d55e90a44d;Google Update Service (gupdate1cad5d55e90a44d);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-06 133104]
R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe [2008-02-01 65536]
R3 ALSysIO;ALSysIO;c:\users\MAHMUT~1\AppData\Local\Temp\ALSysIO64.sys [x]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files (x86)\Garena\safedrv.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-06 133104]
R3 nmwcdcx64;Nokia USB Generic;c:\windows\system32\drivers\ccdcmbox64.sys [x]
R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [x]
R3 Razerlow;Razer Pro|Solutions;c:\windows\system32\drivers\DB3G.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-10-11 86224]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-05-25 2275720]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2011-12-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-06 22:06]
.
2011-12-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-06 22:06]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2567732
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to Mp3 Converter - c:\users\Mahmut Külünk\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files (x86)\ICQ7.1\ICQ.exe
LSP: %SystemRoot%\system32\PrxerDrv.dll
FF - ProfilePath - c:\users\Mahmut Külünk\AppData\Roaming\Mozilla\Firefox\Profiles\id5tvacc.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2567732&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.readmore.de/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2567732&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-RGSC - c:\program files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe
WebBrowser-{542E4D79-1970-4E95-9862-FDB96F61B280} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-NSS - c:\program files (x86)\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS\LicenseType\2.7.3.34\InstStub.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
AddRemove-Octoshape add-in for Adobe Flash Player - c:\users\Mahmut Külünk\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10w_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10w_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-12-08  21:15:35
ComboFix-quarantined-files.txt  2011-12-08 20:15
.
Vor Suchlauf: 16 Verzeichnis(se), 291.647.737.856 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 291.174.604.800 Bytes frei
.
- - End Of File - - D7B769140BB66D09198026858EA86E2E
         

malwarebytes:
Downloade Dir bitte Malwarebytes

• Installiere
  das Programm in den vorgegebenen Pfad.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Starte Malwarebytes, klicke auf Aktualisierung --> Suche
  nach Aktualisierung
• Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
• Wenn der Scan beendet
  ist, klicke auf Ergebnisse anzeigen.
• Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
• Poste
  das Logfile, welches sich in Notepad öffnet, hier in den Thread.
• Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Die Logdatei nach dem scan:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8336

Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514

08.12.2011 22:16:06
mbam-log-2011-12-08 (22-16-06).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 450216
Laufzeit: 44 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Betfred Poker (PUP.Casino) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Poker\betfred poker\_setuppoker_25ed.exe (PUP.Casino) -> Quarantined and deleted successfully.
c:\program files (x86)\alcohol soft\alcohol 120\Langs\AX_RU.dll (Malware.Packer.GenX) -> Quarantined and deleted successfully.
c:\program files (x86)\ICCup\Launcher\update\iccwc3.icc (PUP.GameTool) -> Quarantined and deleted successfully.
c:\Users\mahmut külünk\Desktop\Stuff\SC2Tools.exe (Spyware.Banker.Gen) -> Quarantined and deleted successfully.
         

wie läuft das system?

Das Problem mit dem schwarzen Bildschirm, wenn der Rechner hochgefahren wird, existiert immernoch. Ich kann nur den Mauszeiger sehen, der Task-Manager kann gestartet werden. Es werden nur sehr wenige Prozesse angezeigt unteranderem auch "explorer.exe" was mich verwundert weil ich nur ein schwarzes Bild sehe und die Maus. Die Prozesse zum Start werden wahrscheinlich sehr langsam geladen, da es, wie im obrigen post geschrieben, nach 3-4 min. "normal" läuft.

Das eigentliche Problem scheint behoben zu sein, ich bekomme keine Meldung und wenn das System erstmal "angelaufen" ist läuft es auch stabil.

edit:

Das Problem tretet nicht mehr auf und ich weiss nicht wieso.