Windows gesperrt, Zahlungsaufforderung

neo1409 · 05.02.2012, 14:12

Hallo! Habe auch das Problem, dass mein Windows gesperrt wurde und ich nun 50 Euro für ein viren update zahlen.

Habe jetz die Scans mit OTL.exe durchgeführt.

Hier der Inhalt der OTL.Txt Datei:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 05.02.2012 13:29:40 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\FickiFuckiFruchteis\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,38 Gb Available Physical Memory | 79,47% Memory free
6,81 Gb Paging File | 6,42 Gb Available in Paging File | 94,31% Paging File free
Paging file location(s): [Binary data over 100 bytes]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 116,44 Gb Total Space | 4,77 Gb Free Space | 4,09% Space Free | Partition Type: NTFS
Drive D: | 116,44 Gb Total Space | 42,60 Gb Free Space | 36,58% Space Free | Partition Type: NTFS
Drive E: | 106,68 Gb Total Space | 47,38 Gb Free Space | 44,41% Space Free | Partition Type: NTFS
Drive F: | 116,44 Gb Total Space | 5,06 Gb Free Space | 4,35% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: FICKIFUCKI | User Name: FickiFuckiFruchteis | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\FickiFuckiFruchteis\Downloads\OTL (1).exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (de_serv) --  File not found
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software)
SRV - (BBSvc) -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (BBUpdate) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (WTGService) -- C:\Program Files\Verbindungsassistent\wtgservice.exe ()
SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.0.189\McCHSvc.exe (McAfee, Inc.)
SRV - (ServiceLayer) -- C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (Fabs) -- C:\Program Files\Common Files\MAGIX Services\Database_38f3d1\bin\FABS.exe (MAGIX AG)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files\Common Files\MAGIX Services\Database_38f3d1\bin\fbserver.exe (MAGIX®)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (ASLDRService) -- C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe ()
SRV - (ATKGFNEXSrv) -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe ()
SRV - (spmgr) -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe ()
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (StarWindServiceAE) -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
SRV - (ASBroker) -- C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll (Cognizance Corporation)
SRV - (ASChannel) -- C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsChnl.dll (Cognizance Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (libusb0) -- C:\Windows\System32\drivers\libusb0.sys (hxxp://libusb-win32.sourceforge.net)
DRV - (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.) -- C:\Windows\System32\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) -- C:\Windows\System32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek                                            )
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (spd3ssl) -- F:\Spyware Process Detector\spd320.sys ()
DRV - (hwusbdev) -- C:\Windows\System32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (RMCAST) RMCAST (Pgm) -- C:\Windows\System32\drivers\rmcast.sys (Microsoft Corporation)
DRV - (winusb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (acedrv11) -- C:\Windows\System32\drivers\acedrv11.sys (Protect Software GmbH)
DRV - (SLEE_16_DRIVER) -- C:\Windows\System32\drivers\sleen16.sys (Softwareentwicklung Remus - ArchiCrypt )
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (Point32) -- C:\Windows\System32\drivers\point32k.sys (Microsoft Corporation)
DRV - (kbfiltr) -- C:\Windows\System32\drivers\kbfiltr.sys ( )
DRV - (lullaby) -- C:\Windows\system32\DRIVERS\lullaby.sys (Windows (R) Codename Longhorn DDK provider)
DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- E:\Programme\Al Touch Media\PlayMovie\000.fcl (Cyberlink Corp.)
DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (FiltUSBET) -- C:\Windows\System32\drivers\etFilter.sys (eMPIA Technology Inc.)
DRV - (ScanUSBET) -- C:\Windows\System32\drivers\etScan.sys (eMPIA Technology, Inc.)
DRV - (itecir) -- C:\Windows\System32\drivers\itecir.sys (ITE Tech. Inc. )
DRV - (DCamUSBET) -- C:\Windows\System32\drivers\etDevice.sys (eMPIA Technology, Inc.)
DRV - (ghaio) -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys ()
DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (ASMMAP) -- C:\Program Files\ATKGFNEX\ASMMAP.sys ()
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor) -- C:\Windows\System32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (BDA_Capture_225) -- C:\Windows\System32\drivers\BDA_Capture_225.sys (WideViewer Electronics CO., LTD)
DRV - (BDA_Loader_225) -- C:\Windows\System32\drivers\BDA_Loader_225.sys (WideView Technology Inc.)
DRV - (StMp3Rec) -- C:\Windows\System32\drivers\StMp3Rec.sys (Generic)
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100)
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (EIO) -- C:\Windows\System32\drivers\EIO.sys (ASUSTeK Computer Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
IE - HKLM\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.defaultthis.engineName: "Eazel-DE Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811"
FF - prefs.js..browser.search.selectedEngine: "Search Results"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.2.26
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.2
FF - prefs.js..extensions.enabledItems: {888d99e7-e8b5-46a3-851e-1ec45da1e644}:4.0.0
FF - prefs.js..extensions.enabledItems: {C9B68337-E93A-44EA-94DC-CB300EC06444}:3.26.0
FF - prefs.js..extensions.enabledItems: {EEE6C361-6118-11DC-9C72-001320C79847}:1.1.0.2
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2
FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.5
FF - prefs.js..extensions.enabledItems: youtubedownloader@mybrowserbar.com:4.5
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.3.0.7550
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=410&sr=0&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2096149&SearchSource=3&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2096149&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@protectdisc.com/NPPDLicenseHelper: C:\Program Files\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF - HKLM\Software\MozillaPlugins\@thrixxx.com/WebLaunch: C:\Program Files\thriXXX\WebLaunch\Binaries\npWebLaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Users\FickiFuckiFruchteis\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\FickiFuckiFruchteis\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@thrixxx.com/WebLaunch: C:\Program Files\thriXXX\WebLaunch\Binaries\npWebLaunch.dll File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.01.12 10:25:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.16 00:26:31 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{d5bc46d8-67c7-11dc-8c1d-0097498c2b7a}: C:\Users\FickiFuckiFruchteis\Program Files\DNA [2010.06.19 07:39:47 | 000,000,000 | ---D | M]
 
[2011.12.09 03:30:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\mozilla\Extensions
[2012.02.03 18:23:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\mozilla\Firefox\Profiles\zuyeb2zk.default\extensions
[2010.11.14 23:43:24 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\mozilla\Firefox\Profiles\zuyeb2zk.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.01.19 19:13:37 | 000,000,000 | ---D | M] (IMinent Toolbar) -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\mozilla\Firefox\Profiles\zuyeb2zk.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}
[2008.12.16 12:22:12 | 000,000,878 | ---- | M] () -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Mozilla\Firefox\Profiles\zuyeb2zk.default\searchplugins\conduit.xml
[2011.12.09 01:18:49 | 000,002,515 | ---- | M] () -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Mozilla\Firefox\Profiles\zuyeb2zk.default\searchplugins\Search_Results.xml
[2011.01.19 19:31:31 | 000,003,915 | ---- | M] () -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Mozilla\Firefox\Profiles\zuyeb2zk.default\searchplugins\sweetim.xml
[2011.12.30 09:07:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2011.10.15 23:47:27 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
() (No name found) -- C:\USERS\FICKIFUCKIFRUCHTEIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZUYEB2ZK.DEFAULT\EXTENSIONS\{888D99E7-E8B5-46A3-851E-1EC45DA1E644}.XPI
() (No name found) -- C:\USERS\FICKIFUCKIFRUCHTEIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZUYEB2ZK.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\FICKIFUCKIFRUCHTEIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZUYEB2ZK.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI
[2012.01.12 10:25:36 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.01.12 10:25:34 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.16 05:00:09 | 000,002,288 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012.01.12 10:25:34 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.01.12 10:25:34 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.12 10:25:34 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.12.09 01:18:49 | 000,002,515 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2012.01.12 10:25:34 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.12 10:25:34 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider:  ()
CHR - default_search_provider: search_url = 
CHR - default_search_provider: suggest_url = 
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (ASUS Security Protect Manager) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll (Bioscrypt Inc.)
O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - No CLSID value found.
O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Program Files\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [{6C77E4CD-5F6D-2F71-CA2E-583EDAB8AD76}] C:\Users\FickiFuckiFruchteis\AppData\Roaming\Bop\ehycys.exe ()
O4 - HKCU..\Run: [Firefox helper] C:\Users\FickiFuckiFruchteis\AppData\Local\Mozilla\Firefox\firefox.exe ()
O4 - HKCU..\Run: [KiesPDLR] E:\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives =  [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 File not found
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Local intranet)
O15 - HKCU\..Trusted Domains: moviez.to ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: secured.in ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: stealth.to ([]http in Trusted sites)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Local intranet)
O16 - DPF: {588031A3-94BF-4CDD-86D0-939F6F93910F} https://fixit.support.microsoft.com/ActiveX/FixItClient.CAB (FixItClient Class)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{740C28F7-6A8B-4BD3-9308-E14D4D0B86EB}: DhcpNameServer = 83.169.184.33 83.169.184.97
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CCE96F6D-28FB-40C3-B9CE-94653FC4BD19}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\haufereader - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (APSHook.dll) -C:\Windows\System32\APSHook.dll (Cognizance Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\FickiFuckiFruchteis\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\FickiFuckiFruchteis\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{11c4d887-a3ef-11df-8915-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{11c4d887-a3ef-11df-8915-002354931236}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{11c4d889-a3ef-11df-8915-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{11c4d889-a3ef-11df-8915-002354931236}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{11c4d88c-a3ef-11df-8915-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{11c4d88c-a3ef-11df-8915-002354931236}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{11c4d88e-a3ef-11df-8915-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{11c4d88e-a3ef-11df-8915-002354931236}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{1c916b1a-935f-11df-b7d8-002243be58ca}\Shell - "" = AutoRun
O33 - MountPoints2\{1c916b1a-935f-11df-b7d8-002243be58ca}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{1c916b1b-935f-11df-b7d8-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{1c916b1b-935f-11df-b7d8-002354931236}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{22cfdd96-0002-11de-a7d5-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{22cfdd96-0002-11de-a7d5-806e6f6e6963}\Shell\AutoRun\command - "" = G:\setup.exe
O33 - MountPoints2\{24d7d8ec-b12a-11df-b3e8-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{24d7d8ec-b12a-11df-b3e8-002354931236}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{24d7d8ff-b12a-11df-b3e8-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{24d7d8ff-b12a-11df-b3e8-002354931236}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{56025e23-2711-11de-ae6f-00215d36d3fe}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
O33 - MountPoints2\{584d251a-ffde-11dd-83df-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{584d251a-ffde-11dd-83df-002354931236}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe
O33 - MountPoints2\{584d2523-ffde-11dd-83df-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{584d2523-ffde-11dd-83df-002354931236}\Shell\AutoRun\command - "" = L:\StartVMCLite.exe
O33 - MountPoints2\{67f1efb5-90ef-11df-b195-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{67f1efb5-90ef-11df-b195-002354931236}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{67f1efc4-90ef-11df-b195-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{67f1efc4-90ef-11df-b195-002354931236}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{94ec0052-b2d0-11df-9d56-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{94ec0052-b2d0-11df-9d56-002354931236}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{94ec0054-b2d0-11df-9d56-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{94ec0054-b2d0-11df-9d56-002354931236}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{a0b009e8-b29e-11df-86c4-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{a0b009e8-b29e-11df-86c4-002354931236}\Shell\AutoRun\command - "" = I:\QsSetup.exe
O33 - MountPoints2\{a82c0149-9efa-11df-8b08-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{a82c0149-9efa-11df-8b08-002354931236}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{a82c014e-9efa-11df-8b08-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{a82c014e-9efa-11df-8b08-002354931236}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{a904c1a2-9bdb-11df-9d31-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{a904c1a2-9bdb-11df-9d31-002354931236}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{a904c1a8-9bdb-11df-9d31-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{a904c1a8-9bdb-11df-9d31-002354931236}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{ac1b9da9-3064-11e0-ae2b-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{ac1b9da9-3064-11e0-ae2b-002354931236}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a
O33 - MountPoints2\{df9824bd-a7ef-11df-a20f-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{df9824bd-a7ef-11df-a20f-002354931236}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{ec1ac39a-b2a6-11df-a5ba-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{ec1ac39a-b2a6-11df-a5ba-002354931236}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{ec1ac39c-b2a6-11df-a5ba-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{ec1ac39c-b2a6-11df-a5ba-002354931236}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{ec1ac3a8-b2a6-11df-a5ba-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{ec1ac3a8-b2a6-11df-a5ba-002354931236}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{ec1ac3a9-b2a6-11df-a5ba-002354931236}\Shell - "" = AutoRun
O33 - MountPoints2\{ec1ac3a9-b2a6-11df-a5ba-002354931236}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{eed621a9-0c51-11de-9dd0-00215d36d3fe}\Shell - "" = AutoRun
O33 - MountPoints2\{eed621a9-0c51-11de-9dd0-00215d36d3fe}\Shell\AutoRun\command - "" = I:\StartVMCLite.exe
O33 - MountPoints2\{eed621ab-0c51-11de-9dd0-00215d36d3fe}\Shell - "" = AutoRun
O33 - MountPoints2\{eed621ab-0c51-11de-9dd0-00215d36d3fe}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Windows Media Player 5.2
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: CLMLServer - hkey= - key= - E:\Programme\CyberLink DVD\Power2Go\CLMLSvc.exe (CyberLink)
MsConfig - StartUpReg: P2Go_Menu - hkey= - key= - E:\Programme\CyberLink DVD\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.04 16:47:32 | 000,000,000 | ---D | C] -- C:\Users\FickiFuckiFruchteis\Desktop\Musik
[2012.02.04 10:45:35 | 000,000,000 | ---D | C] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Yqxywol
[2012.02.04 10:45:35 | 000,000,000 | ---D | C] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Bop
[2012.02.04 04:54:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SixaxisPairTool
[2012.02.04 04:34:32 | 000,000,000 | -H-D | C] -- C:\Windows\System32\GroupPolicy
[2012.02.04 04:34:27 | 000,042,592 | ---- | C] (hxxp://libusb-win32.sourceforge.net) -- C:\Windows\System32\drivers\libusb0.sys
[2012.02.04 04:32:21 | 000,067,680 | ---- | C] (hxxp://libusb-win32.sourceforge.net) -- C:\Windows\System32\libusb0.dll
[2012.02.04 02:07:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Postal.3
[2012.02.03 17:32:12 | 000,000,000 | ---D | C] -- C:\Users\FickiFuckiFruchteis\Desktop\Neuer Ordner
[2012.01.29 15:42:11 | 000,000,000 | ---D | C] -- C:\Users\FickiFuckiFruchteis\AppData\Local\PackageAware
[2012.01.29 15:23:42 | 000,000,000 | ---D | C] -- C:\Program Files\Unlockroot
[2012.01.29 00:53:35 | 000,000,000 | ---D | C] -- C:\Users\FickiFuckiFruchteis\Desktop\Android
[2012.01.28 11:41:15 | 000,000,000 | ---D | C] -- C:\Users\FickiFuckiFruchteis\Documents\ANNO 2070
[2012.01.28 09:42:46 | 000,000,000 | ---D | C] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++
[2012.01.28 09:42:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
[2012.01.28 09:42:44 | 000,000,000 | ---D | C] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Notepad++
[2012.01.28 09:42:44 | 000,000,000 | ---D | C] -- C:\Program Files\Notepad++
[2012.01.28 05:42:12 | 000,000,000 | ---D | C] -- C:\Users\FickiFuckiFruchteis\Documents\NFSTR
[2012.01.28 05:36:49 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2012.01.28 05:36:40 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Logs
[2012.01.28 02:16:03 | 000,028,992 | ---- | C] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll
[2012.01.28 02:14:44 | 000,031,552 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe
[2012.01.28 02:14:43 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll
[2012.01.28 02:14:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012
[2012.01.28 02:14:12 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2012
[2012.01.28 01:58:30 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2012.01.27 18:52:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.01.27 18:51:46 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2009.02.21 12:19:12 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys
[7 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.05 13:28:16 | 000,008,268 | ---- | M] () -- C:\Users\FickiFuckiFruchteis\AppData\Local\d3d9caps.dat
[2012.02.05 13:23:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.05 12:55:42 | 000,096,099 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.02.05 12:54:20 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe
[2012.02.05 12:54:12 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.02.05 12:53:53 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.05 12:53:53 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.05 12:50:14 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.02.05 12:46:04 | 000,000,984 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-910203591-2235916584-2118161158-1000UA.job
[2012.02.04 17:57:45 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.02.04 04:35:17 | 000,000,306 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2012.02.04 04:34:27 | 000,042,592 | ---- | M] (hxxp://libusb-win32.sourceforge.net) -- C:\Windows\System32\drivers\libusb0.sys
[2012.02.04 04:31:44 | 000,096,099 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.02.04 00:46:01 | 000,000,962 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-910203591-2235916584-2118161158-1000Core.job
[2012.02.03 18:01:54 | 000,683,158 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.02.03 18:01:54 | 000,642,976 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.02.03 18:01:54 | 000,149,876 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.02.03 18:01:54 | 000,123,606 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.01.29 14:24:43 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_winusb_01007.Wdf
[2012.01.28 02:14:39 | 000,001,876 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2012.01.28 02:14:39 | 000,001,872 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities 2012.lnk
[2012.01.27 18:52:43 | 000,001,671 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[7 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.02.04 04:34:34 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012.01.29 14:24:43 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_winusb_01007.Wdf
[2012.01.28 02:14:39 | 000,001,876 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2012.01.28 02:14:39 | 000,001,872 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities 2012.lnk
[2012.01.28 02:14:38 | 000,001,884 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk
[2012.01.27 18:52:43 | 000,001,671 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.12.09 01:18:43 | 000,484,352 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2011.11.29 16:38:18 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.11.29 16:38:12 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011.11.29 16:38:12 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011.11.29 16:38:12 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011.11.29 16:38:12 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2011.10.22 17:53:32 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.09.27 11:23:52 | 000,000,058 | ---- | C] () -- C:\Users\FickiFuckiFruchteis\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2011.02.13 23:01:45 | 000,000,000 | ---- | C] () -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\chrtmp
[2010.11.16 19:43:31 | 000,000,005 | ---- | C] () -- C:\Windows\treeskp.sys
[2010.10.13 18:38:28 | 000,000,107 | ---- | C] () -- C:\Users\FickiFuckiFruchteis\AppData\Local\fusioncache.dat
[2010.08.28 13:25:00 | 000,000,962 | ---- | C] () -- C:\Windows\Mobile Partner Manager.INI
[2010.05.02 15:54:35 | 000,035,368 | ---- | C] () -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\SQLite3.dll
[2010.04.18 21:29:42 | 000,049,152 | ---- | C] () -- C:\Windows\System32\mgxasio2.dll
[2010.02.28 17:17:21 | 000,139,128 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.02.28 17:17:21 | 000,138,056 | ---- | C] () -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\PnkBstrK.sys
[2010.02.28 17:17:06 | 000,189,248 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2010.02.28 17:17:05 | 002,434,856 | ---- | C] () -- C:\Windows\System32\pbsvc_bc2.exe
[2010.02.28 17:17:05 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2009.12.06 05:44:14 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2009.12.06 00:38:17 | 000,000,046 | ---- | C] () -- C:\Windows\Speed.INI
[2009.12.05 19:49:22 | 000,096,099 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.12.05 19:35:44 | 000,096,099 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.12.03 09:27:30 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2009.10.21 05:53:20 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.10.21 05:53:19 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.09.27 05:39:28 | 000,000,089 | ---- | C] () -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\default.pls
[2009.09.19 02:40:31 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2009.05.18 18:10:59 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2009.05.17 12:05:54 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2009.05.10 14:33:23 | 000,000,005 | ---- | C] () -- C:\Windows\sbacknt.bin
[2009.04.30 03:17:27 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2009.04.30 03:17:27 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2009.04.19 08:05:04 | 000,006,656 | R--- | C] () -- C:\Windows\System32\pdfxcds.dll
[2009.04.04 19:26:06 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
[2009.04.04 19:25:58 | 000,000,031 | ---- | C] () -- C:\Windows\Ulead32.ini
[2009.03.16 18:05:44 | 002,990,080 | R--- | C] () -- C:\Windows\System32\IPdlg.exe
[2009.03.16 18:05:44 | 000,024,501 | R--- | C] () -- C:\Windows\System32\MWhid.sys
[2009.03.16 18:05:44 | 000,000,266 | R--- | C] () -- C:\Windows\System32\megastore.ini
[2009.03.10 22:00:06 | 000,000,000 | ---- | C] () -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\downloads.m3u
[2009.02.23 16:28:23 | 000,279,712 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2009.02.23 16:28:23 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2009.02.22 11:20:20 | 000,019,968 | ---- | C] () -- C:\Windows\System32\cpuinf32.dll
[2009.02.22 11:18:38 | 000,000,089 | ---- | C] () -- C:\Windows\magix.ini
[2009.02.22 11:18:37 | 000,007,272 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2009.02.22 03:06:25 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009.02.21 13:44:26 | 000,000,000 | ---- | C] () -- C:\Windows\OpPrintServer.INI
[2009.02.21 13:42:53 | 000,008,704 | ---- | C] () -- C:\Windows\System32\CNMVS78.DLL
[2009.02.21 13:37:51 | 000,000,021 | ---- | C] () -- C:\Windows\CS_SETUP.ini
[2009.02.21 12:54:54 | 000,000,225 | ---- | C] () -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\default.rss
[2009.02.21 12:24:51 | 000,193,024 | ---- | C] () -- C:\Users\FickiFuckiFruchteis\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.02.21 04:52:09 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2009.02.21 04:44:00 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe
[2009.02.21 04:09:06 | 000,004,767 | ---- | C] () -- C:\Windows\Irremote.ini
[2009.02.21 03:40:16 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2009.02.21 03:27:55 | 000,047,672 | ---- | C] () -- C:\Windows\AsScrProlog.exe
[2009.02.21 03:22:57 | 000,049,152 | ---- | C] () -- C:\Windows\revdevdll.dll
[2009.02.21 02:53:09 | 000,008,268 | ---- | C] () -- C:\Users\FickiFuckiFruchteis\AppData\Local\d3d9caps.dat
[2009.02.21 02:50:04 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008.07.01 19:28:38 | 000,061,440 | ---- | C] () -- C:\Program Files\Common Files\CPInstallAction.dll
[2008.05.22 09:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files\Common Files\banner.jpg
[2008.04.16 12:11:34 | 000,683,158 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.04.16 12:11:34 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.04.16 12:11:34 | 000,149,876 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.04.16 12:11:34 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2008.04.16 11:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini
[2008.01.21 03:24:13 | 001,868,944 | ---- | C] () -- C:\Windows\System32\RSA32_16.DLL
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 002,367,936 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,642,976 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,123,606 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:25:26 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.07.10 11:38:39 | 000,154,246 | -H-- | C] () -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\cglogs.dat
[2006.04.21 09:08:22 | 000,253,952 | ---- | C] () -- C:\Windows\System32\HtmlHelp.dll
[2005.04.03 00:30:00 | 000,110,592 | R--- | C] () -- C:\Windows\System32\scardsyn.dll
[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[2002.10.21 00:12:49 | 000,011,376 | R--- | C] () -- C:\Windows\System32\drivers\SECDRV.SYS
[1998.05.06 05:10:00 | 000,069,632 | R--- | C] () -- C:\Windows\System32\ODMA32.dll
 
========== LOP Check ==========
 
[2011.11.16 04:58:44 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Any DVD Converter Professional
[2009.04.25 22:18:43 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Any Video Converter
[2009.04.19 08:46:13 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Artweaver
[2011.06.24 19:08:35 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Babylon
[2010.02.13 18:49:19 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Bioshock2
[2012.02.04 10:45:35 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Bop
[2011.04.29 20:52:20 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\CasinoOnNet
[2009.04.04 14:52:28 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\CD-LabelPrint
[2010.04.18 07:46:12 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Cities3D
[2009.03.21 14:54:48 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Command & Conquer 3 Kanes Rache
[2009.03.16 13:27:37 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2009.02.27 19:01:56 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\DAEMON Tools
[2012.01.28 08:55:11 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\DAEMON Tools Lite
[2011.09.25 05:00:44 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\DAEMON Tools Pro
[2010.06.19 19:25:58 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\DNA
[2011.09.27 11:23:52 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\DonationCoder
[2011.12.09 01:19:16 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\FreeAudioPack
[2011.12.09 01:20:53 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\FreeCDRipper
[2010.03.11 01:47:54 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\FRITZ!
[2010.12.24 07:27:10 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Ibidxi
[2010.03.10 17:02:29 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Image Zone Express
[2009.05.17 10:17:11 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Lexware
[2010.04.18 21:31:48 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\MAGIX
[2009.03.03 17:53:29 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\MysteryStudio
[2011.04.13 15:12:51 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Nokia
[2011.04.13 15:12:52 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Nokia Ovi Suite
[2012.01.28 09:43:19 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Notepad++
[2011.03.27 04:58:15 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Ocirfa
[2009.11.02 19:21:11 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\PC Suite
[2010.02.28 11:48:15 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Printer Info Cache
[2009.04.20 16:57:37 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\ProtectDisc
[2011.10.30 04:38:24 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\PunkBuster
[2009.08.15 08:57:15 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Red Alert 3
[2011.12.29 04:59:16 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Samsung
[2009.05.16 18:37:40 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\SearchmeToolbar
[2009.02.23 16:47:48 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Sierra Entertainment
[2009.03.30 03:37:33 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\SoundSpectrum
[2011.12.09 01:23:02 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Steganos
[2009.10.25 08:49:08 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Stereoscopic Player
[2009.12.05 06:07:41 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\thriXXX
[2011.12.29 21:16:25 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Trine2
[2009.09.27 07:05:02 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Tropico 3
[2012.01.28 02:04:00 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\TuneUp Software
[2012.01.28 07:29:53 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Ubisoft
[2010.11.08 16:03:49 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Verbindungsassistent
[2009.05.10 14:54:38 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\vghd
[2010.06.03 16:55:56 | 000,000,000 | RHSD | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Winlog
[2012.02.04 10:45:55 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Yqxywol
[2009.11.30 01:03:04 | 000,000,000 | ---D | M] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\ZipZag
[2012.02.04 00:46:01 | 000,000,962 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-910203591-2235916584-2118161158-1000Core.job
[2012.02.05 12:46:04 | 000,000,984 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-910203591-2235916584-2118161158-1000UA.job
[2012.02.04 17:57:46 | 000,032,580 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2010.02.21 14:47:06 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2009.02.21 03:38:55 | 000,000,000 | -H-D | M] -- C:\ASUS.SYS
[2011.10.30 12:50:17 | 000,000,000 | -HSD | M] -- C:\Boot
[2011.09.17 07:08:57 | 000,000,000 | ---D | M] -- C:\Casino
[2009.05.10 22:31:55 | 000,000,000 | ---D | M] -- C:\CELab
[2012.02.04 04:54:21 | 000,000,000 | -H-D | M] -- C:\Config.Msi
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2009.02.21 03:02:36 | 000,000,000 | ---D | M] -- C:\Intel
[2011.10.22 17:58:09 | 000,000,000 | ---D | M] -- C:\Neuer Ordner
[2009.12.05 04:48:47 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2009.02.21 11:32:28 | 000,000,000 | ---D | M] -- C:\Pana_USB
[2009.10.11 16:00:19 | 000,000,000 | ---D | M] -- C:\Philips
[2012.01.29 15:23:42 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.02.04 04:35:17 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2012.01.08 10:23:47 | 000,000,000 | ---D | M] -- C:\Schreiben Andy
[2010.01.08 05:34:36 | 000,000,000 | ---D | M] -- C:\SD-Karte
[2012.02.05 12:38:48 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.12.29 05:07:34 | 000,000,000 | ---D | M] -- C:\Temp
[2009.02.21 02:53:08 | 000,000,000 | R--D | M] -- C:\Users
[2011.01.20 17:54:04 | 000,000,000 | ---D | M] -- C:\vghd
[2012.02.04 16:06:06 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2012.01.28 01:58:13 | 000,126,976 | RHS- | M] () MD5=8D56EBA34F6C4EDC13DFCAD65C1CBA50 -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2008.05.07 10:40:02 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\drivers\iaStor.sys
[2008.05.07 10:40:02 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_1ab0331f\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2009.02.27 18:20:45 | 000,717,296 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\sptd.sys
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\*.dll /lockedfiles >
[2011.04.19 04:14:43 | 000,353,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll
[2011.04.19 04:14:43 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll
[7 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
< %USERPROFILE%\*.* >
[2011.07.03 20:21:55 | 000,001,024 | ---- | M] () -- C:\Users\FickiFuckiFruchteis\.rnd
[2012.02.05 13:39:24 | 005,242,880 | ---- | M] () -- C:\Users\FickiFuckiFruchteis\ntuser.dat
[2012.02.05 13:39:24 | 000,262,144 | -H-- | M] () -- C:\Users\FickiFuckiFruchteis\ntuser.dat.LOG1
[2009.05.11 03:34:53 | 000,262,144 | -H-- | M] () -- C:\Users\FickiFuckiFruchteis\ntuser.dat.LOG2
[2009.09.28 16:23:53 | 003,670,016 | ---- | M] () -- C:\Users\FickiFuckiFruchteis\ntuser.dat_previous
[2009.11.21 19:34:07 | 000,000,000 | -H-- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT_tureg_new.LOG1
[2009.11.21 19:34:07 | 000,000,000 | -H-- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT_tureg_new.LOG2
[2011.10.30 12:50:40 | 005,242,880 | ---- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT_tureg_old
[2009.09.28 16:23:52 | 000,065,536 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{1909f5a4-a4b5-11de-9f95-002354931236}.TM.blf
[2009.09.28 16:23:52 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{1909f5a4-a4b5-11de-9f95-002354931236}.TMContainer00000000000000000001.regtrans-ms
[2009.09.19 03:53:27 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{1909f5a4-a4b5-11de-9f95-002354931236}.TMContainer00000000000000000002.regtrans-ms
[2009.12.05 05:16:04 | 000,065,536 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{21a26365-d6cc-11de-b4dd-806e6f6e6963}.TM.blf
[2009.12.05 05:16:04 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{21a26365-d6cc-11de-b4dd-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
[2009.11.22 18:16:07 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{21a26365-d6cc-11de-b4dd-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms
[2009.12.05 18:59:54 | 000,065,536 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\ntuser.dat{259ce9fb-e154-11de-9e2f-002354931236}.TM.blf
[2009.12.05 18:59:54 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\ntuser.dat{259ce9fb-e154-11de-9e2f-002354931236}.TMContainer00000000000000000001.regtrans-ms
[2009.12.05 05:19:58 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\ntuser.dat{259ce9fb-e154-11de-9e2f-002354931236}.TMContainer00000000000000000002.regtrans-ms
[2011.10.30 12:50:39 | 000,065,536 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\ntuser.dat{2b230d2d-e1c7-11de-a279-002354931236}.TM.blf
[2011.10.30 12:50:39 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\ntuser.dat{2b230d2d-e1c7-11de-a279-002354931236}.TMContainer00000000000000000001.regtrans-ms
[2009.12.05 19:10:59 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\ntuser.dat{2b230d2d-e1c7-11de-a279-002354931236}.TMContainer00000000000000000002.regtrans-ms
[2009.05.02 20:44:19 | 000,065,536 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{2d3c3e7e-17d6-11de-a584-002354931236}.TM.blf
[2009.05.02 20:44:19 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{2d3c3e7e-17d6-11de-a584-002354931236}.TMContainer00000000000000000001.regtrans-ms
[2009.03.23 23:34:34 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{2d3c3e7e-17d6-11de-a584-002354931236}.TMContainer00000000000000000002.regtrans-ms
[2009.03.23 23:27:34 | 000,065,536 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2009.03.23 23:27:34 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2009.02.21 04:41:29 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2009.11.21 19:34:17 | 000,065,536 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{7a297029-ab36-11de-8ea5-002354931236}.TM.blf
[2009.11.21 19:34:17 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{7a297029-ab36-11de-8ea5-002354931236}.TMContainer00000000000000000001.regtrans-ms
[2009.09.28 19:39:42 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{7a297029-ab36-11de-8ea5-002354931236}.TMContainer00000000000000000002.regtrans-ms
[2009.09.19 02:31:10 | 000,065,536 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{87fa2962-a36b-11de-9374-002354931236}.TM.blf
[2009.09.19 02:31:10 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{87fa2962-a36b-11de-9374-002354931236}.TMContainer00000000000000000001.regtrans-ms
[2009.09.17 12:37:59 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{87fa2962-a36b-11de-9374-002354931236}.TMContainer00000000000000000002.regtrans-ms
[2009.06.20 02:52:21 | 000,065,536 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{b4738ce7-372e-11de-b240-002243be58ca}.TM.blf
[2009.06.20 02:52:21 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{b4738ce7-372e-11de-b240-002243be58ca}.TMContainer00000000000000000001.regtrans-ms
[2009.05.03 18:36:33 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{b4738ce7-372e-11de-b240-002243be58ca}.TMContainer00000000000000000002.regtrans-ms
[2009.08.02 01:14:08 | 000,065,536 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{b62028aa-5d1e-11de-abde-002354931236}.TM.blf
[2009.08.02 01:14:08 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{b62028aa-5d1e-11de-abde-002354931236}.TMContainer00000000000000000001.regtrans-ms
[2009.06.20 09:40:38 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{b62028aa-5d1e-11de-abde-002354931236}.TMContainer00000000000000000002.regtrans-ms
[2012.02.04 17:57:58 | 000,065,536 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\ntuser.dat{bcf6d6e7-02ec-11e1-9b71-806e6f6e6963}.TM.blf
[2012.02.04 17:57:58 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\ntuser.dat{bcf6d6e7-02ec-11e1-9b71-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
[2011.10.30 14:04:16 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\ntuser.dat{bcf6d6e7-02ec-11e1-9b71-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms
[2009.09.17 10:34:17 | 000,065,536 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{e0ac1e2c-7ef6-11de-ba2e-002354931236}.TM.blf
[2009.09.17 10:34:17 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{e0ac1e2c-7ef6-11de-ba2e-002354931236}.TMContainer00000000000000000001.regtrans-ms
[2009.08.03 03:39:26 | 000,524,288 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\NTUSER.DAT{e0ac1e2c-7ef6-11de-ba2e-002354931236}.TMContainer00000000000000000002.regtrans-ms
[2009.02.21 02:53:09 | 000,000,020 | -HS- | M] () -- C:\Users\FickiFuckiFruchteis\ntuser.ini
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
<          >

< End of report >

--- --- ---

neo1409 · 05.02.2012, 14:22

log Extra.txt :OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 05.02.2012 13:29:40 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\FickiFuckiFruchteis\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,38 Gb Available Physical Memory | 79,47% Memory free
6,81 Gb Paging File | 6,42 Gb Available in Paging File | 94,31% Paging File free
Paging file location(s): [Binary data over 100 bytes]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 116,44 Gb Total Space | 4,77 Gb Free Space | 4,09% Space Free | Partition Type: NTFS
Drive D: | 116,44 Gb Total Space | 42,60 Gb Free Space | 36,58% Space Free | Partition Type: NTFS
Drive E: | 106,68 Gb Total Space | 47,38 Gb Free Space | 44,41% Space Free | Partition Type: NTFS
Drive F: | 116,44 Gb Total Space | 5,06 Gb Free Space | 4,35% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: FICKIFUCKI | User Name: FickiFuckiFruchteis | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-910203591-2235916584-2118161158-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03DC5761-7D88-4C85-849F-F6699FBA98F2}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{05ED577B-6D11-46CA-A10C-992374CE8265}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{10106445-33E7-4721-A01E-F5EC49CC4461}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{13A693C3-396A-455D-A47D-4FDBCD7D9D3F}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{21B2B309-973E-4650-A5D5-15A7F2CA562F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{230E4A97-CD2A-4C14-9077-7678CDC3B583}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{24F66052-2DA0-4C0C-B6CB-EFB1B3AE6E37}" = lport=139 | protocol=6 | dir=in | app=system | 
"{31AA5780-6E13-4280-8D2E-227F829BE945}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{31AFBDA8-DEA2-4BDD-9A74-C31E5A62CC4A}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{32F265ED-7329-4001-9DC2-7A7EA33BA3A3}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{37B50F9D-F72D-4F0A-85BD-14B6B8BF0413}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{3B878C17-4953-4B98-8301-1A37A494630A}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{42095A41-A472-4CDD-8599-3FA5B59B9D54}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{4EB6EED7-9204-447B-B216-DE161D7D5A34}" = rport=138 | protocol=17 | dir=out | app=system | 
"{51CF4F4A-D03F-4975-B5E9-328926C4A702}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{5D878C52-0FB7-4978-A452-A89FCE93C15E}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{603491EC-4FB4-422E-A7A1-97A67536F227}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6079BE12-78ED-43C6-B6FE-B7A4F0DDF100}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{6352C224-F712-4961-9595-D4CA4D816054}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{683E7659-5FE8-44E8-8662-D6AB49629A8D}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{692176AF-3DBE-45E0-8B4E-B8BDDE36484A}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{6B71C0C0-9084-4B80-BCE8-9A64EC4196E7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6F0D5092-B2BC-4264-AD2A-922533BA9725}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{775BA1AB-2D9F-4CE4-BB6D-BF97403E7C93}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 | 
"{7C7F0843-DD56-47E0-ACC1-8FC748D3DC07}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 | 
"{7DDC0B8C-F029-4930-82EB-048B0D733685}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{84F38FD0-729D-4050-A2E3-AA0398872213}" = rport=139 | protocol=6 | dir=out | app=system | 
"{872C6F27-471B-453F-BC30-720F7227C6C5}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{8D9246EA-43ED-42E1-8E4F-6B6F03C8A12E}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{93A124E6-6426-4177-A284-C6FA6B3B099E}" = lport=137 | protocol=17 | dir=in | app=system | 
"{97BBE7CA-3E10-403A-A2FF-619F479CB022}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{9ADB0EA6-A072-42B6-98CD-8633107B750E}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{9B007820-C562-48CD-8547-A67387FF580F}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 | 
"{A00D8899-3ACA-44E4-AE60-F2C8BE3D8EBF}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 | 
"{A0A10FA1-35F1-4FB1-BCCE-4847357EE083}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{A6075D47-A923-4A4C-955F-2972766804C1}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{AD45249C-FB4D-4083-AB67-050F1DEC27AD}" = rport=137 | protocol=17 | dir=out | app=system | 
"{AF35C68A-D5C0-4FA8-9F1E-808DC42D85C0}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{B04FEAED-7AB5-4B9E-A612-00EFEFDF779A}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=datei- und druckerfreigabe (spoolerdienst - rpc-epmap) | 
"{B4249318-F45A-40C1-910D-EF76A77EBB1A}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{B996755C-4954-44E2-B4F5-7F77CFF35BFC}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{BD1FF6DD-F59A-4A2C-8967-F29A867567F4}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{C5981896-9C41-4747-B1DE-FA39C7983F79}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=c:\windows\system32\spoolsv.exe | 
"{C6670D54-D11D-4190-8D57-2C3E4F47DBAA}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{CFAF35B8-88F6-4D73-A7C5-2B936F4ED562}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{D2C4A6DA-E0A4-408D-A5A8-2865705F4433}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{D7FD7D67-940A-4751-B30C-A0213A9C83CE}" = lport=138 | protocol=17 | dir=in | app=system | 
"{D86F4957-DACC-4AC6-BDC6-D2B1A820FD9C}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{DD0D51A5-EE9E-4896-933D-B02A8E92CF42}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{E492CC27-2F38-4B6D-B3D4-27DA7F28A612}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{E61E3C60-D8E5-4CCC-8066-73489CBE6343}" = lport=445 | protocol=6 | dir=in | app=system | 
"{EBA99DAB-29A4-4B1B-A055-BC8186D3C8FC}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{F4D7B936-A84C-4102-814F-F4AC6414EA1C}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{F8A40170-A358-4E8F-89AD-253F6E2FFC3D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F8BBBFFC-2149-4A4E-BFFD-54B9697A3103}" = rport=445 | protocol=6 | dir=out | app=system | 
"{FB5B4C2B-A77C-43F3-9A8C-8439E6C445B1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{023FD105-E160-422D-917E-21283AEE4E7B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{06BC8728-228A-4E4A-B784-BD0CF61FFFF4}" = protocol=17 | dir=in | app=f:\starcraft 2\starcraft ii\starcraft ii.exe | 
"{06CE7970-A96B-45C4-A7F2-D101A7C60685}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{076B17C6-644F-4ECF-B087-54C96499B7F1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{0F7E1E02-ADB9-43B2-88AE-89DF7B8B0995}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe | 
"{1310161E-1E4A-4E52-9958-7D4CFF58027D}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe | 
"{133A1DB6-0631-41C5-A9BB-61C0EF8317F1}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{1A743C53-8689-438B-B3E9-22613A6E30AA}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{1F67BE2A-A301-4FD8-8766-238392198CCC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{1F86BD4D-6EF3-4901-8A26-EA589E0E2F50}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{1FC566C2-D8C3-4D8B-9C74-63699F144894}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{21387B25-4E4B-436A-92BC-9D5985491085}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{22AC3189-9FC9-47CF-87B7-454C9D519C2E}" = dir=in | app=e:\programme\al touch media\ai touchmedia\powercinema.exe | 
"{23DE833E-DBCC-4AC5-8972-7F4DDDBFA6FF}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{26E72C1B-B7A8-4F5D-95D7-E2678D23702E}" = dir=in | app=e:\programme\al touch media\ai touchmedia\kernel\dms\clmsservice.exe | 
"{2A164D8B-250F-4594-BDC1-11E2958228BB}" = protocol=17 | dir=in | app=f:\assasins creed\uplaybrowser.exe | 
"{2DB136E1-5029-4A4C-8A6F-EAF844D5D5FF}" = protocol=6 | dir=in | app=f:\assasins creed\acbsp.exe | 
"{318BA588-C8A4-4D56-B364-315F216C6C0A}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{3355B928-5F37-4D1A-954B-19806C58D887}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{3C1B3107-B0E6-4A46-B380-D4F0AB34937A}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe | 
"{3DB79118-69A9-4D45-BF7A-1C9B11803D99}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{3E16717F-482D-4F13-AD27-C151056A6883}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe | 
"{41FF5070-F926-4703-937B-5C52BA64B76B}" = dir=in | app=e:\programme\al touch media\playmovie\playmovie.exe | 
"{44848C06-3FEF-441C-A019-B5AF0DA34E83}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{45F5EAF3-99FB-46D5-B733-4D4F6BFA4659}" = protocol=17 | dir=in | app=c:\program files\logitech\vid hd\vid.exe | 
"{47420579-9AD2-4917-A36D-DF9DE4DFB477}" = protocol=17 | dir=in | app=f:\overlord\overlord2.exe | 
"{47738A63-22B8-4184-82CB-187D9DB15265}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{4C0F4A3E-8990-417B-B8E8-DDD073758E0D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{4E50833E-B028-4ED8-821E-7F44601BF0D9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{4EC764B4-D2C4-4F33-A77E-61C058BC6F68}" = protocol=58 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv6 eingehend) | 
"{535DBC61-E92F-47ED-9A3E-7EDBD62ED854}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{56A06922-530F-47C6-8EF8-2C170EAD1DE0}" = protocol=6 | dir=in | app=f:\assasins creed\acbmp.exe | 
"{5848FB22-A2A7-4845-9F11-E2FEB85AFEE4}" = protocol=6 | dir=in | app=f:\burnout\burnoutconfigtool.exe | 
"{5863E57A-A5CF-4FE4-9C6E-7963840E0605}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe | 
"{594EC873-635C-4DB2-8A7A-EC01E7359DE7}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe | 
"{5B59415D-84FD-4A66-8F63-B6575DF07E42}" = protocol=6 | dir=in | app=f:\burnout\burnoutlauncher.exe | 
"{5E6B8966-3C2A-47E8-B162-5764B32E276A}" = protocol=17 | dir=in | app=f:\burnout\burnoutconfigtool.exe | 
"{5EE3179E-CFAA-4303-A903-D199EF3B567B}" = protocol=6 | dir=in | app=f:\batman\binaries\shippingpc-bmgame.exe | 
"{5F96D9A0-5BC7-46F7-887A-B40216C11407}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe | 
"{650FFB2D-997E-46BB-9AEF-2167AEA37CD8}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe | 
"{70728D04-5886-4125-A3CD-3A9CF2319CC4}" = protocol=6 | dir=in | app=c:\program files\logitech\vid hd\vid.exe | 
"{7493C8BA-7B91-4643-A49B-00FC90A09295}" = protocol=17 | dir=in | app=f:\assasins creed\acbmp.exe | 
"{76A53D07-D1FA-4B85-BCA7-39FB103B3452}" = protocol=6 | dir=in | app=f:\starcraft 2\starcraft ii\starcraft ii.exe | 
"{786B2EF3-1F68-4511-8B2F-6C403F2143BA}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe | 
"{7AF0EBA0-59B8-4BC4-92EB-9EA81062E629}" = protocol=6 | dir=in | app=f:\assasins creed\assassinscreedbrotherhood.exe | 
"{830BDDE3-1708-4D1D-ABAA-E0A0CF32E63E}" = protocol=6 | dir=in | app=f:\burnout\burnoutparadise.exe | 
"{835453E4-468E-4226-B01A-4ABE78D8CC89}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{83C7EA7B-5D4D-4E64-91F9-CEBD0CFFAB28}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe | 
"{8798FAE3-DBF3-4365-9F5D-D771EE6C40F6}" = dir=in | app=e:\programme\al touch media\playmovie\pmvservice.exe | 
"{8D90F139-3D79-40C4-9237-0FC7CD15B6C2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{91B3045D-9B1A-496B-9775-A07DA54D721C}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{921D8CB5-B525-49AA-89AF-18E391BD5DFB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{92808C92-E529-41DA-A282-347B14E90584}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{93B18768-6E27-4E0A-9454-47741512B3C2}" = dir=in | app=e:\programme\al touch media\ai touchmedia\kernel\dmp\clbrowserengine.exe | 
"{94602792-11BF-4664-AC6D-F4350DFE44A0}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{97E94F86-E902-4C1B-9CCC-59F705139082}" = protocol=1 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv4 eingehend) | 
"{9C700E66-5C46-41AE-A58C-D75E4C8AEA69}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{9EBFE853-74E9-42BA-A153-703AFB73693A}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{A1CCB8EA-3D45-417C-91E3-82401328DF16}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{A422E82F-8768-4759-B919-F7947FE43B02}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{A4A3B3FF-C147-470D-83DE-A8027B3A5EC8}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{A5317FB3-AFF6-4153-9761-2DA5299BD433}" = protocol=6 | dir=in | app=f:\assasins creed\uplaybrowser.exe | 
"{A55D951D-D5EF-4B6E-9965-595EB0B6AD8A}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{A5A2AE85-C395-4F59-A2D2-A4876499E523}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{A6D7BC9E-1152-4046-8EE9-5BC24E65E517}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{A71CF5DF-1D2A-4BB2-B3D0-2E2347E402B4}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{A7E9DBDB-F0F9-4F7D-A2DC-7EC81526567C}" = protocol=17 | dir=in | app=f:\assasins creed\assassinscreedbrotherhood.exe | 
"{A8DD6A38-DCDB-4EF6-8F07-93731A0C87C1}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{AAACEA5D-0E80-46BC-90D9-8900094DBABF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{AC042C5B-3907-4A5A-9290-F7A0ECF88C79}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{AF6A3AF3-7A4F-4E4B-90E5-E880C3061911}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{B1B7B0C0-F632-4E94-929B-8B905931C206}" = protocol=17 | dir=in | app=f:\burnout\burnoutparadise.exe | 
"{B2AA37A9-91F6-471A-B3DA-1DA5E811A72B}" = protocol=6 | dir=in | app=f:\overlord\overlord2.exe | 
"{B6D46742-3806-4FE8-A799-485CC29C7CCE}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe | 
"{B7A76879-DB5B-492B-8DD7-EB699444D3C4}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe | 
"{B997C687-93C8-4BF7-9C66-3D06925DEE57}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{BCB38D4F-27A2-4ECD-8BCC-8881919D948E}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{BDF66D85-45D3-4317-A8E1-698032FF2CAF}" = protocol=17 | dir=in | app=f:\batman\binaries\shippingpc-bmgame.exe | 
"{BF91AFD4-D5F5-44F8-B872-470760913D3C}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{C5695144-7EFD-41F1-B23D-18B4DACEF0A4}" = protocol=6 | dir=out | app=system | 
"{CA3CBDC3-6799-46E3-85FE-333F8F0F7B55}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{D4CB8502-486C-4775-B446-CCFAD8E00489}" = dir=in | app=c:\users\fickifuckifruchteis\appdata\local\facebook\video\skype\facebookvideocalling.exe | 
"{D7B3A443-C6EE-4F21-9585-C2D1FE0A455B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{D8F9642B-B282-4223-BF34-5A9465EEBBF1}" = protocol=17 | dir=in | app=f:\assasins creed\acbsp.exe | 
"{D9FA8FBA-F8D9-419B-ADC2-910618548510}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{E1FCCA33-3964-44F5-AECA-5448339756FF}" = protocol=6 | dir=in | app=c:\windows\temp\~osd23d.tmp\rlvknlg.exe | 
"{E283FB8B-17DB-4454-AF3D-1850647A8A3C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{E6965F6E-8B48-46E6-B739-DDA1B296EEDB}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe | 
"{E7962EEC-A88F-42AC-B5BB-B9D5469039DB}" = protocol=1 | dir=out | name=datei- und druckerfreigabe (echoanforderung - icmpv4 ausgehend) | 
"{E910C25C-87AD-4188-9030-1722B1A7A1AC}" = protocol=58 | dir=out | name=datei- und druckerfreigabe (echoanforderung - icmpv6 ausgehend) | 
"{E932D0DA-464E-4FB4-A5A4-A2C9B4A9CFF3}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{EC1D6DEB-F9DA-4C0C-B632-DEB1CDFA0C25}" = protocol=17 | dir=in | app=f:\burnout\burnoutlauncher.exe | 
"{ECA7669F-ABBC-48B2-96FC-7F7F7573550B}" = dir=in | app=e:\programme\al touch media\ai touchmedia\pcmservice.exe | 
"{EE071CEA-9707-4553-8507-0DABAAB7AAA9}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{F0DD8163-6989-4336-89C7-48BDE2BBE785}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{F185AA1D-258F-406B-838A-48A97F216E3E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe | 
"{F727BB74-1179-4A83-90C9-3921DB347AA7}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{F8C7C92C-DF46-4717-937C-08020AAB5E0A}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{FAB63EC3-2DD2-4F52-8631-1D57BCB7B186}" = protocol=6 | dir=in | app=c:\windows\temp\~os7521.tmp\rlvknlg.exe | 
"TCP Query User{146C5F45-E649-47E2-B9CB-2017805C07CA}C:\program files\java\jre1.6.0_02\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_02\bin\java.exe | 
"TCP Query User{1591C0F1-E8FF-4911-95BF-4A8572272E1C}C:\windows\system32\presentationhost.exe" = protocol=6 | dir=in | app=c:\windows\system32\presentationhost.exe | 
"TCP Query User{2518B24B-AF68-437E-9868-600576514F9F}C:\program files\java\jre6\launch4j-tmp\jdownloader.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\launch4j-tmp\jdownloader.exe | 
"TCP Query User{3207E49F-66D0-4046-A5A7-5BF9C4BF1A4C}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"TCP Query User{3F4EAE07-65B1-464C-AF9B-E1C70837FF31}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe | 
"TCP Query User{47DC438B-034A-4E7D-99FA-00CA9A00D53E}C:\program files\java\jre1.6.0_02\launch4j-tmp\jdownloader.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_02\launch4j-tmp\jdownloader.exe | 
"TCP Query User{4957832F-9CBC-43A0-968D-F0985F37BE47}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"TCP Query User{539B6258-836B-428F-87E3-2E2F4F6E6A49}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{58BE2739-18F6-4185-806C-3E622DFD7531}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe | 
"TCP Query User{5C18060D-868B-44F0-8456-0CCD01DC93FF}F:\starcraft 2\starcraft ii\versions\base15405\sc2.exe" = protocol=6 | dir=in | app=f:\starcraft 2\starcraft ii\versions\base15405\sc2.exe | 
"TCP Query User{61EBFDA0-6E82-47AE-8536-189713C3D09D}F:\borderlands\gearbox software\borderlands\binaries\borderlands.exe" = protocol=6 | dir=in | app=f:\borderlands\gearbox software\borderlands\binaries\borderlands.exe | 
"TCP Query User{6579D7B7-7419-4EEC-856E-98FDA05E4698}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe | 
"TCP Query User{65E4DA60-3E17-4B35-84C1-79E4E92681A5}I:\spiele\grid\grid.exe" = protocol=6 | dir=in | app=i:\spiele\grid\grid.exe | 
"TCP Query User{6899BFAA-829B-44CF-96A6-03FEEB632077}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe | 
"TCP Query User{6B45CD0C-96A2-44DE-A358-052123DA0A02}C:\program files\java\jre6\launch4j-tmp\jdownloader.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\launch4j-tmp\jdownloader.exe | 
"TCP Query User{7199FEC7-6E96-4062-AC7E-6A595438AFF9}F:\dead space 2\deadspace2.exe" = protocol=6 | dir=in | app=f:\dead space 2\deadspace2.exe | 
"TCP Query User{738C6C70-75A3-4A23-8261-0100373FFFF0}C:\program files\java\jre1.6.0_02\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_02\bin\javaw.exe | 
"TCP Query User{79B839B2-4C9E-43D6-B30B-4B3AB46C2590}C:\program files\logitech\vid hd\vid.exe" = protocol=6 | dir=in | app=c:\program files\logitech\vid hd\vid.exe | 
"TCP Query User{7A51E943-1551-4341-8044-A8DE7AE6B706}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"TCP Query User{7CDA01D1-06B2-4F01-8391-3B727F1C1B93}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"TCP Query User{91C6EFB7-9343-4E25-87A5-47034565B002}C:\program files\java\jre1.6.0_02\launch4j-tmp\jdownloader.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_02\launch4j-tmp\jdownloader.exe | 
"TCP Query User{9AC8E87E-3631-4624-AF70-71F932AEDBD3}C:\users\fickifuckifruchteis\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\fickifuckifruchteis\program files\dna\btdna.exe | 
"TCP Query User{AA7FF738-D26A-4B60-9C6B-35BC297A2795}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe | 
"TCP Query User{AD7C842D-AC8C-4A08-BB6A-4E6BDE4EE7E9}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe | 
"TCP Query User{B3B75C94-1DCB-406E-AEB8-C2EF4A719FC8}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 
"TCP Query User{D6452986-C42A-4748-A870-64023B0B21E9}F:\overlord\overlord2.exe" = protocol=6 | dir=in | app=f:\overlord\overlord2.exe | 
"TCP Query User{DBAA3488-C0F6-46F9-B9CC-166881CBF9E9}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"TCP Query User{E15BF716-6FAC-4211-B5F8-3C5E5CBB2CC8}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"TCP Query User{F2F6BB1F-D1A3-4F11-8869-774EFC038CD1}C:\users\fickifuckifruchteis\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\fickifuckifruchteis\program files\dna\btdna.exe | 
"TCP Query User{F3278E6D-95E1-4C3D-8C9A-4FD959EAC03B}C:\windows\system32\java.exe" = protocol=6 | dir=in | app=c:\windows\system32\java.exe | 
"TCP Query User{FD5C8FD0-EB00-4C33-B490-5D5814668917}C:\windows\system32\java.exe" = protocol=6 | dir=in | app=c:\windows\system32\java.exe | 
"TCP Query User{FE0210DF-0CE3-4C1B-97B5-DAF322BEDCC5}F:\starcraft 2\starcraft ii\versions\base15405\sc2.exe" = protocol=6 | dir=in | app=f:\starcraft 2\starcraft ii\versions\base15405\sc2.exe | 
"UDP Query User{10CF1ADB-309D-4C36-953C-DF71EFDA895F}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{148FBBCD-2F94-4008-A064-1C7134C21BCE}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe | 
"UDP Query User{1CD982CC-F10E-47AC-88BD-CBFABF776BF5}C:\windows\system32\java.exe" = protocol=17 | dir=in | app=c:\windows\system32\java.exe | 
"UDP Query User{1DD03C01-56CC-449F-AE50-3A25A5E015B7}C:\program files\java\jre1.6.0_02\launch4j-tmp\jdownloader.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_02\launch4j-tmp\jdownloader.exe | 
"UDP Query User{1E95FD0E-9E9B-41E6-8C84-348879ED4FEF}C:\users\fickifuckifruchteis\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\fickifuckifruchteis\program files\dna\btdna.exe | 
"UDP Query User{1F700166-A16E-4DEA-AB4B-BFBBB7A0CC54}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"UDP Query User{2D625BFE-186A-4ADF-8AD3-AD7E9E32EB3E}F:\starcraft 2\starcraft ii\versions\base15405\sc2.exe" = protocol=17 | dir=in | app=f:\starcraft 2\starcraft ii\versions\base15405\sc2.exe | 
"UDP Query User{4BA3ED6C-52D3-4129-B3E6-B585868D3D17}C:\program files\java\jre1.6.0_02\launch4j-tmp\jdownloader.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_02\launch4j-tmp\jdownloader.exe | 
"UDP Query User{511489CA-9A4C-4A84-AAE0-B3DCADD2D034}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{52CB1789-C97B-448F-AF6C-D8DA5086DE62}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe | 
"UDP Query User{58BBBB4C-263E-40D1-97A8-CBF357C75B19}F:\borderlands\gearbox software\borderlands\binaries\borderlands.exe" = protocol=17 | dir=in | app=f:\borderlands\gearbox software\borderlands\binaries\borderlands.exe | 
"UDP Query User{64615833-F0E7-4FBE-B680-2F4B479D9C40}I:\spiele\grid\grid.exe" = protocol=17 | dir=in | app=i:\spiele\grid\grid.exe | 
"UDP Query User{69B26B7D-8514-48AB-9216-CCE90DBF1635}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe | 
"UDP Query User{6E64CDAE-D9C5-4C49-BEA5-279755223EE8}C:\program files\logitech\vid hd\vid.exe" = protocol=17 | dir=in | app=c:\program files\logitech\vid hd\vid.exe | 
"UDP Query User{75497F63-6C5A-430F-A121-7F1C14718B1E}F:\dead space 2\deadspace2.exe" = protocol=17 | dir=in | app=f:\dead space 2\deadspace2.exe | 
"UDP Query User{771F7EE6-5408-4404-9D07-74B67A4F321C}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 
"UDP Query User{78397BE1-FA93-4E50-A957-58EA01E37E3D}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe | 
"UDP Query User{7BEED51C-F12B-45DA-BC01-9682ECFD8BD5}C:\windows\system32\java.exe" = protocol=17 | dir=in | app=c:\windows\system32\java.exe | 
"UDP Query User{7FEE9DB0-6616-4489-AFF6-78A7B3F5D95E}C:\windows\system32\presentationhost.exe" = protocol=17 | dir=in | app=c:\windows\system32\presentationhost.exe | 
"UDP Query User{82154472-6DCE-4145-B70D-96158D060F25}C:\users\fickifuckifruchteis\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\fickifuckifruchteis\program files\dna\btdna.exe | 
"UDP Query User{8CE82B87-859A-4BF0-9336-7C29517EAE39}C:\program files\java\jre1.6.0_02\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_02\bin\javaw.exe | 
"UDP Query User{8F1B00E1-2F4D-488B-82D5-653B97EC4D63}C:\program files\java\jre6\launch4j-tmp\jdownloader.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\launch4j-tmp\jdownloader.exe | 
"UDP Query User{900C5C28-2C0A-409B-95C3-D092F76FBFA6}F:\overlord\overlord2.exe" = protocol=17 | dir=in | app=f:\overlord\overlord2.exe | 
"UDP Query User{90FC87B2-51E2-407F-82BD-B3BF702FCDF1}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe | 
"UDP Query User{97BC0A63-8E19-47E0-9A96-4935E71BAB46}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"UDP Query User{AAB577A6-6503-4B37-913D-4CC404BAE202}C:\program files\java\jre1.6.0_02\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_02\bin\java.exe | 
"UDP Query User{AD484297-F27C-41E2-80B4-CF0494AE9B42}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"UDP Query User{B7A44E0F-4ED8-435A-83D9-3061A4969F53}F:\starcraft 2\starcraft ii\versions\base15405\sc2.exe" = protocol=17 | dir=in | app=f:\starcraft 2\starcraft ii\versions\base15405\sc2.exe | 
"UDP Query User{BF0BADB9-F9A5-45FE-8321-00E5276D31EA}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe | 
"UDP Query User{C0D65FCD-1059-4346-A6C2-F7D312EE001E}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"UDP Query User{D01C9919-E5FF-4C60-AA41-148980A7C371}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{F9E1C48B-B961-43C5-8569-6BF45F1CBF61}C:\program files\java\jre6\launch4j-tmp\jdownloader.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\launch4j-tmp\jdownloader.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{02627ee5-eaca-4742-a9cc-e687631773e4}" = Nero ShowTime
"{03528A01-7E5E-4C5F-94DF-1D8012E969EF}" = Nokia Map Loader
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{086a7d8c-0a38-4c7f-819a-620275550d5c}" = Nero BurningROM
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4
"{0a078f51-6d39-4b55-a8f0-97d25fa8611d}" = Nero MediaHome 4
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4
"{0EABFEF6-6D10-4C12-8667-3029C481D355}" = Nokia Photos
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 3.4
"{1A9C3B2E-360E-4353-8E17-312342E24194}" = Speed-Link SL-6535 USB Pad
"{1c00c7c5-e615-4139-b817-7f4003de68c0}" = Nero PhotoSnap Help
"{1ce83c52-99ef-4e09-aefd-c0373bf8fc07}" = Nero Move it
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{20400dbd-e6db-45b8-9b6b-1dd7033818ec}" = Nero InfoTool
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2348b586-c9ae-46ce-936c-a68e9426e214}" = Nero StartSmart Help
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = AI TouchMedia
"{26A1E9CF-BFC1-4309-80CD-C182D80922DB}_is1" = Artweaver 0.5
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 26
"{27D51A76-371D-48B6-B06E-4137A15B7583}" = Express Gate
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{33cf58f5-48d8-4575-83d6-96f574e4d83a}" = Nero DriveSpeed
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{359cfc0a-beb1-440d-95ba-cf63a86da34f}" = Nero Recode
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{368ba326-73ad-4351-84ed-3c0a7a52cc53}" = Nero Rescue Agent
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3B05F2FB-745B-4012-ADF2-439F36B2E70B}" = ATKOSD2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{40580068-9B10-40B5-9548-536CE88AB23C}" = ITECIR
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{427DDB05-8AAC-431E-A47A-F42C00493332}_is1" = Postal.3 version 1.0
"{435C32E1-96F0-4518-B051-A5403900C389}_is1" = Anno 2070
"{43e39830-1826-415d-8bae-86845787b54b}" = Nero Vision
"{45DF6D99-666D-41FA-8D62-0E183B6240F3}" = PC Connectivity Solution
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C3EF687-803F-4825-B815-04AE32DDEB41}" = YAVIDO
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4E79A60F-15D2-4BEC-91AD-E41EC42E61B0}" = Batman: Arkham Asylum
"{4E8C27C2-D727-4C00-A90E-C3F6376EEE70}" = Nero ControlCenter
"{4EE2B017-D82C-4B12-B071-5CF1B23D1A42}" = SweetIM for Messenger 3.4
"{52B65911-1559-4ED5-9461-46957FDD48CD}" = Borderlands
"{53480870-02D8-48FB-BC27-72C956885168}" = O&O MediaRecovery
"{56BE5CC9-95E6-4128-ABEA-968414CA9C80}" = DolbyFiles
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{595a3116-40bb-4e0f-a2e8-d7951da56270}" = NeroExpress
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.55.01
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5d9be3c1-8ba4-4e7e-82fd-9f74fa6815d1}" = Nero Vision
"{5e08ecd1-c98e-4711-bf65-8fd736b3f969}" = Nero RescueAgent Help
"{60c731fb-c951-41ce-ad41-8e54c8594609}" = Nero Disc Copy Gadget Help
"{624E54D0-E4F4-434F-9EF6-D4D066EE4348}" = Facebook Video Calling 1.1.1.1
"{62ac81f6-bdd3-4110-9d36-3e9eaab40999}" = Nero CoverDesigner
"{6304CCF6-3343-4DA5-96B6-84B3A644B93B}" = USB Driver for Panasonic DVC
"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{65C043EC-BEB5-4791-8EB3-EF9EDBEDA7DB}" = QuickSteuer Wissens-Center 2009
"{663CFAE6-6B03-44E8-9B0D-C156F97C10E3}_is1" = Trine 2 Collector's Edition
"{66A9D30D-1464-4C7F-B2F3-507DADAF2595}" = Microsoft IntelliPoint 6.3
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{69496452-FAF3-43BC-9907-BA9CEC65FC10}" = Lexware Info Service
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}" = ASUS CopyProtect
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73C0DA51-DB32-4F66-970B-7298F3CAF37F}" = Nokia Software Updater
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{76F79738-4234-45E8-80AA-F56F8FCD4FBE}" = QuickSteuer 2009
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart
"{77e33d87-255e-413e-9c8d-eed2a7f9bebf}" = Nero Live Help
"{7829db6f-a066-4e40-8912-cb07887c20bb}" = Nero BurnRights
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7C05592D-424B-46CB-B505-E0013E8E75C9}" = ATK Hotkey
"{7C3D8108-8D99-427F-A1C2-D8E0D25A469C}" = Tom Clancy's EndWar
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{825E9A84-1E03-4526-9F8E-45015C938A7C}" = WBFS Manager 4.0
"{83202942-84b3-4c50-8622-b8c0aa2d2885}" = Nero Express
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{869200db-287a-4dc0-b02b-2b6787fbcd4c}" = Nero DiscSpeed
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel
"{9312191B-30A5-44E1-8D8D-6936FE06CDE8}" = Wanted: Weapons of Fate
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9530AE42-DAE1-4619-9594-B23487285D17}" = NVIDIA PhysX
"{961D53EA-40DC-4156-AD74-25684CE05F81}" = Nero Installer
"{96D06FDD-6AF4-4309-BC1B-1C9588B0575E}" = Dead Space™ 2
"{98a67610-a3b5-4098-a423-3708040026d3}" = "Nero SoundTrax Help
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4F72EE-8378-49BD-8C10-301E25907B5B}" = Steganos Safe OEM
"{9A875B56-A35C-46BA-A3AA-DF8D03EE9F2F}" = Nero ControlCenter
"{9A996B6A-846E-4A89-B9C4-17546B7BE49F}" = Burnout(TM) Paradise The Ultimate Box
"{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear eXtreme
"{9B9DAB2F-DEEA-45D5-A812-15C1628F99E0}" = Stereoscopic Player
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = ASUS MultiFrame
"{9e82b934-9a25-445b-b8df-8012808074ac}" = Nero PhotoSnap
"{9F3523F8-DAD7-AE52-6DA7-45CDDDF33726}" = Advertising Center
"{a209525b-3377-43f4-b886-32f6b6e7356f}" = Nero WaveEditor
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.1 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ad6bc5cc-2ef0-49c4-b33d-cdc8b2c4dc80}" = Nero Recode Help
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AF37F9DE-0726-439E-BC10-43D9195394D0}" = Firebird SQL Server - MAGIX Edition
"{b000312b-f03f-4bda-9ba7-2089e51c3052}" = Nero BackItUp 4
"{b07207aa-e04c-43e0-aa03-e4cb7ef82dcf}" = Gracenote Plug-in
"{B17E235C-7A3B-4482-B650-21FFDE1D452E}" = Empire Earth III
"{b1adf008-e898-4fe2-8a1f-690d9a06acaf}" = DolbyFiles
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{b2ec4a38-b545-4a00-8214-13fe0e915e6d}" = Advertising Center
"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar
"{B5761811-28F3-4257-B537-815C5EEF472C}" = Vodafone Mobile Connect Lite
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B725D249-58A9-4579-809E-B9767F363B99}" = Dawn Of Magic 2
"{b78120a0-cf84-4366-a393-4d0a59bc546c}" = Menu Templates - Starter Kit
"{B9242864-2841-4ADE-86E0-8F90F91B04DD}" = Logitech Gaming Software
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BBBC2B89-E193-4348-A83C-C8DD8210A4AC}" = Canon PhotoRecord
"{BBF0A67B-5DBA-452F-9D2E-6F168BC226E4}" = Need for Speed™ SHIFT
"{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BE4BA698-8533-4F77-9559-C7F3F78C0B05}" = Assassin's Creed Brotherhood
"{BF34527D-7B27-43AD-9994-7B3ABCEF3625}" = Phoenix Backup Professional
"{BF67F764-95B6-4360-BB57-B2E5AA6C814B}" = SweetIM Toolbar for Internet Explorer 4.0
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{c5a7cb6c-e76d-408f-ba0e-85605420fe9d}" = SoundTrax
"{C82E9E85-00A2-4320-8ED3-B6CEF207A850}" = ArcSoft Software Suite
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CBCD1FF1-6127-41A5-ABF3-D8C494E59094}" = SA31xx Device Manager & Media Converter
"{cc019e3f-59d2-4486-8d4b-878105b62a71}" = Nero DiscSpeed
"{CC122757-C7AD-412C-9BB2-8CB1ABFD6A50}" = ColorCodeShow
"{CC13FB47-0B90-46C3-9BB7-57D2DB455D4D}" = Microsoft Xbox 360 Accessories 1.1
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{ce96f5a5-584d-4f8f-aa3e-9baed413db72}" = Nero CoverDesigner Help
"{d025a639-b9c9-417d-8531-208859000af8}" = NeroBurningROM
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D1E5870E-E3E5-4475-98A6-ADD614524ADF}" = ATK Media
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.3.22 Game
"{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service
"{D6C9AF27-9414-46C8-B9D8-D878BA041031}" = Nero 8 Ultra Edition HD
"{D8D4AF9A-6ADE-4B14-A7F5-BA858792729E}" = ASUS Security Protect Manager
"{d9dcf92e-72eb-412d-ac71-3b01276e5f8b}" = Nero ShowTime
"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash
"{df6a95f5-adc1-406a-bdc6-2aa7cc0182aa}" = Nero Live
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E426CEC1-35C5-42BF-913E-6EF8F1211D01}" = Overlord II
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{e498385e-1c51-459a-b45f-1721e37aa1a0}" = Movie Templates - Starter Kit
"{E572B060-C98B-4984-A48E-E4FA56265903}" = SA31xx Device Manager & Media Converter
"{e5c7d048-f9b4-4219-b323-8bdb01a2563d}" = Nero DriveSpeed
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{e8631efb-6b9a-426c-b1ce-e7173ca26bf8}" = Nero WaveEditor Help
"{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer
"{EB4DF30B-102B-4F0C-927A-D50E037A325D}" = AuthenTec Fingerprint Sensor Minimum Install
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{ed42c13f-5f78-42a3-b778-bc052a81d414}" = Blu-ray Disc Authoring Plug-in
"{EE5BCA77-F9B8-4896-BB04-6CBE587BC8CE}" = QuickSteuer 2009
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{f1861f30-3419-44db-b2a1-c274825698b3}" = Nero Disc Copy Gadget
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F2AF3E5D-9697-485C-A5AC-E2B9468C446A}" = Safari
"{f4041dce-3fe1-4e18-8a9e-9de65231ee36}" = Nero ControlCenter
"{f6bdd7c5-89ed-4569-9318-469aa9732572}" = Nero BurnRights
"{F6D6B258-E3CA-4AAC-965A-68D3E3140A8C}" = iTunes
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{fbcdfd61-7dcf-4e71-9226-873ba0053139}" = Nero InfoTool
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FDB5E0F3-86EA-4379-8A2F-1BC2436543E9}" = iCloud
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3D SexVilla 2 - Everlust (MegaPack)" = 3D SexVilla 2 - Everlust (MegaPack)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"7-Zip" = 7-Zip 4.65
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 2.0" = Adobe Photoshop Elements 2.0
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"Any DVD Converter Professional_is1" = Any DVD Converter Professional 3.7.0
"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver
"AviFiXP_is1" = AviFiXP 0.2.2.5
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon Setup Utility 2.0" = Canon Setup Utility 2.0
"CANONBJ_Deinstall_CNMCP78.DLL" = Canon iP4200
"CCleaner" = CCleaner
"CitiesOnline" = CitiesOnline
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"Digital Video Repair" = Digital Video Repair 1.0
"Duke Nukem Forever_is1" = Duke Nukem Forever
"EADM" = EA Download Manager
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"Easy-PrintToolBox" = Canon Utilities Easy-PrintToolBox
"Free Mp3 Wma Converter_is1" = Free Mp3 Wma Converter V 2.1
"FreePortScanner_is1" = FreePortScanner 2.8.1
"GameSpy Arcade" = GameSpy Arcade
"Google Chrome" = Google Chrome
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = AI TouchMedia
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{6304CCF6-3343-4DA5-96B6-84B3A644B93B}" = USB Driver for Panasonic DVC
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"IrfanView" = IrfanView (remove only)
"IsoBuster_is1" = IsoBuster 2.5
"Just Cause 2_is1" = Just Cause 2
"Left 4 Dead" = Left 4 Dead
"Logitech Vid" = Logitech Vid HD
"MAGIX Music Maker 16 Premium Download-Version D" = MAGIX Music Maker 16 Premium Download-Version
"MAGIX Music Maker Techno Edition 2 D" = MAGIX Music Maker Techno Edition 2 4.0.0.10 (D)
"McAfee Security Scan" = McAfee Security Scan Plus
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mobile Partner" = Mobile Partner
"MortPlayer" = MortPlayer
"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)
"Notepad++" = Notepad++
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"Postal 2" = Postal 2
"ProgDVB" = ProgDVB
"Protect Disc License Helper" = Protect Disc License Helper 1.0.118
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"PunkBusterSvc" = PunkBuster Services
"SixaxisPairTool_is1" = SixaxisPairTool 0.2.3
"SMPlayer_is1" = SMPlayer 0.6.6
"Softonic_Deutsch Toolbar" = Softonic_Deutsch Toolbar
"Spyware Process Detector_is1" = Spyware Process Detector v3.20
"StarCraft II" = StarCraft II
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"USB2.0 1.3M UVC WebCam" = USB2.0 1.3M UVC WebCam
"Verbindungsassistent" = Verbindungsassistent
"VLC media player" = VLC media player 1.1.11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"Xvid_is1" = Xvid 1.1.2 final uninstall
"ZipZag_is1" = ZipZag 1.80 Archiver
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent DNA" = DNA
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 11.07.2010 10:17:38 | Computer Name = FickiFucki | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 11.07.2010 10:17:47 | Computer Name = FickiFucki | Source = WinMgmt | ID = 10
Description = 
 
Error - 11.07.2010 11:14:03 | Computer Name = FickiFucki | Source = Google Update | ID = 20
Description = 
 
Error - 11.07.2010 12:13:43 | Computer Name = FickiFucki | Source = Google Update | ID = 20
Description = 
 
Error - 11.07.2010 14:13:17 | Computer Name = FickiFucki | Source = Google Update | ID = 20
Description = 
 
Error - 11.07.2010 15:10:32 | Computer Name = FickiFucki | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 11.07.2010 15:10:32 | Computer Name = FickiFucki | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 11.07.2010 15:13:15 | Computer Name = FickiFucki | Source = Google Update | ID = 20
Description = 
 
Error - 11.07.2010 16:13:15 | Computer Name = FickiFucki | Source = Google Update | ID = 20
Description = 
 
Error - 11.07.2010 17:13:21 | Computer Name = FickiFucki | Source = Google Update | ID = 20
Description = 
 
[ ASUS Security Protect Manager Events ]
Error - 11.03.2011 10:09:34 | Computer Name = FickiFucki | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: FickiFuckiFruchteis@FICKIFUCKI
Anmeldeinformationen:
 Kennwort   Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 08.04.2011 08:19:15 | Computer Name = FickiFucki | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: FickiFuckiFruchteis@FICKIFUCKI
Anmeldeinformationen:
 Kennwort   Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 11.05.2011 18:17:24 | Computer Name = FickiFucki | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: FickiFuckiFruchteis@FICKIFUCKI
Anmeldeinformationen:
 Kennwort   Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 21.05.2011 03:26:20 | Computer Name = FickiFucki | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: FickiFuckiFruchteis@FICKIFUCKI
Anmeldeinformationen:
 Kennwort   Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 30.05.2011 23:26:00 | Computer Name = FickiFucki | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: FickiFuckiFruchteis@FICKIFUCKI
Anmeldeinformationen:
 Kennwort   Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 25.07.2011 14:15:53 | Computer Name = FickiFucki | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: FickiFuckiFruchteis@FICKIFUCKI
Anmeldeinformationen:
 Kennwort   Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 07.09.2011 15:42:36 | Computer Name = FickiFucki | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: FickiFuckiFruchteis@FICKIFUCKI
Anmeldeinformationen:
 Kennwort   Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 17.09.2011 02:13:54 | Computer Name = FickiFucki | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: FickiFuckiFruchteis@FICKIFUCKI
Anmeldeinformationen:
 Kennwort   Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 25.10.2011 21:26:03 | Computer Name = FickiFucki | Source = AuthWiz | ID = 100796070
Description = The submitted user identity was rejected.    Benutzer: FickiFuckiFruchteis@FICKIFUCKI
   Fehler: (0xC516043A) Das System konnte den angeforderten Vorgang nicht ausführen.
  Der Hauptschlüsselsatz des Authentifizierungsservers ist nicht ordnungsgemäß konfiguriert.

Bitte
 wenden Sie sich an Ihren Systemadministrator.
 
Error - 11.12.2011 05:41:03 | Computer Name = FickiFucki | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: FickiFuckiFruchteis@FICKIFUCKI
Anmeldeinformationen:
 Kennwort   Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
[ Media Center Events ]
Error - 26.09.2010 03:25:46 | Computer Name = FickiFucki | Source = ehRecvr | ID = 3
Description = 
 
Error - 02.10.2010 07:46:57 | Computer Name = FickiFucki | Source = ehRecvr | ID = 3
Description = 
 
Error - 02.10.2010 07:49:29 | Computer Name = FickiFucki | Source = ehRecvr | ID = 3
Description = 
 
Error - 05.10.2010 12:08:46 | Computer Name = FickiFucki | Source = ehRecvr | ID = 3
Description = 
 
Error - 06.10.2010 12:51:50 | Computer Name = FickiFucki | Source = ehRecvr | ID = 3
Description = 
 
Error - 10.10.2010 07:28:51 | Computer Name = FickiFucki | Source = ehRecvr | ID = 3
Description = 
 
Error - 10.10.2010 08:31:03 | Computer Name = FickiFucki | Source = ehRecvr | ID = 3
Description = 
 
Error - 23.10.2010 14:43:52 | Computer Name = FickiFucki | Source = ehRecvr | ID = 3
Description = 
 
Error - 28.10.2010 11:39:31 | Computer Name = FickiFucki | Source = ehRecvr | ID = 3
Description = 
 
Error - 28.10.2010 12:05:06 | Computer Name = FickiFucki | Source = ehRecvr | ID = 3
Description = 
 
[ System Events ]
Error - 05.02.2012 07:53:41 | Computer Name = FickiFucki | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 05.02.2012 um 12:52:18 unerwartet heruntergefahren.
 
Error - 05.02.2012 07:55:10 | Computer Name = FickiFucki | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
 werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner 
Fehler ist im Speicher-Manager aufgetreten.
 
Error - 05.02.2012 08:22:49 | Computer Name = FickiFucki | Source = volmgr | ID = 262193
Description = Die Konfiguration der Auslagerungsdatei für das Speicherabbild ist
 fehlgeschlagen. Stellen  Sie sicher, dass eine Auslagerungsdatei auf der Startpartition
 vorhanden ist und dass diese  groß genug ist, um den gesamten physikalischen Speicher
 abbilden zu können.
 
Error - 05.02.2012 08:23:01 | Computer Name = FickiFucki | Source = volmgr | ID = 262193
Description = Die Konfiguration der Auslagerungsdatei für das Speicherabbild ist
 fehlgeschlagen. Stellen  Sie sicher, dass eine Auslagerungsdatei auf der Startpartition
 vorhanden ist und dass diese  groß genug ist, um den gesamten physikalischen Speicher
 abbilden zu können.
 
Error - 05.02.2012 08:23:21 | Computer Name = FickiFucki | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 05.02.2012 um 12:55:41 unerwartet heruntergefahren.
 
Error - 05.02.2012 08:23:55 | Computer Name = FickiFucki | Source = DCOM | ID = 10005
Description = 
 
Error - 05.02.2012 08:24:02 | Computer Name = FickiFucki | Source = DCOM | ID = 10005
Description = 
 
Error - 05.02.2012 08:24:04 | Computer Name = FickiFucki | Source = DCOM | ID = 10005
Description = 
 
Error - 05.02.2012 08:24:12 | Computer Name = FickiFucki | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 05.02.2012 08:24:12 | Computer Name = FickiFucki | Source = Service Control Manager | ID = 7026
Description = 
 
[ TuneUp Events ]
Error - 24.05.2009 13:56:43 | Computer Name = FickiFucki | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 24.05.2009 13:57:38 | Computer Name = FickiFucki | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 24.05.2009 13:57:53 | Computer Name = FickiFucki | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 24.05.2009 13:59:08 | Computer Name = FickiFucki | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 24.05.2009 14:00:58 | Computer Name = FickiFucki | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 24.05.2009 14:02:33 | Computer Name = FickiFucki | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 24.05.2009 14:04:48 | Computer Name = FickiFucki | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 24.05.2009 14:05:43 | Computer Name = FickiFucki | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 24.05.2009 14:06:54 | Computer Name = FickiFucki | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 19.06.2009 02:29:05 | Computer Name = FickiFucki | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
 
< End of report >

--- --- ---

markusg · 05.02.2012, 16:35

hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

ATTFilter

:OTL
O4 - HKCU..\Run: [Firefox helper] C:\Users\FickiFuckiFruchteis\AppData\Local\Mozilla\Firefox\firefox.exe ()
O4 - HKCU..\Run: [{6C77E4CD-5F6D-2F71-CA2E-583EDAB8AD76}] C:\Users\FickiFuckiFruchteis\AppData\Roaming\Bop\ehycys.exe ()
[2012.02.04 10:45:35 | 000,000,000 | ---D | C] -- C:\Users\FickiFuckiFruchteis\AppData\Roaming\Yqxywol
 :Files
C:\Users\FickiFuckiFruchteis\AppData\Local\Mozilla\Firefox\firefox.exe
C:\Users\FickiFuckiFruchteis\AppData\Roaming\Bop
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Drücke bitte die

+ E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

neo1409 · 05.02.2012, 18:39

upload hat geklappt! danke

markusg · 05.02.2012, 18:40

danke für den upload.
nutzt du das system für onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches?

neo1409 · 05.02.2012, 20:16

hey ich nochmal hab das selbe problem mit dem virus grade noch auf nem anderen pc bitte nochmal um hilfe danke!

OTL.Txt log:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 05.02.2012 19:23:33 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\gabi\Desktop
 Ultimate Edition  (Version = 6.1.7260) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7260.0)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1022,18 Mb Total Physical Memory | 647,81 Mb Available Physical Memory | 63,38% Memory free
2,00 Gb Paging File | 1,66 Gb Available in Paging File | 82,89% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,51 Gb Total Space | 22,29 Gb Free Space | 29,92% Space Free | Partition Type: NTFS
Drive D: | 66,61 Gb Total Space | 54,53 Gb Free Space | 81,86% Space Free | Partition Type: NTFS
 
Computer Name: GABI-PC | User Name: gabi | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.02.05 19:20:04 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\gabi\Desktop\OTL.exe
PRC - [2009.06.13 10:15:55 | 002,613,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.03.08 13:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.01.30 02:41:12 | 004,254,560 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.13 09:32:32 | 001,527,104 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011.12.13 09:29:16 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2011.07.21 11:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.05.04 11:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Stopped] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010.04.09 13:37:34 | 000,722,288 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Update 5\VUAgent.exe -- (VUAgent)
SRV - [2010.03.25 10:25:22 | 030,969,208 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2009.06.13 10:17:17 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.06.13 10:17:16 | 001,004,032 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.06.13 10:17:00 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.07.21 11:11:12 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.21 11:11:11 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.07.08 11:00:06 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Stopped] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2009.10.08 16:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.08.13 07:23:02 | 000,022,528 | ---- | M] (CSR, plc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BthAvrcp.sys -- (BthAvrcp)
DRV - [2009.06.21 10:19:23 | 000,291,712 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\vpcvmm.sys -- (vpcvmm)
DRV - [2009.06.21 10:19:23 | 000,165,888 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpchbus.sys -- (vpcbus)
DRV - [2009.06.21 10:19:23 | 000,076,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vpcusb.sys -- (vpcusb)
DRV - [2009.06.21 10:19:23 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV - [2009.06.13 10:25:38 | 000,028,240 | ---- | M] (Μїćґθŝбƒт €σŕþόŕäťíőπ) [Kernel | System | Running] -- C:\Windows\System32\drivers\mssmbios.sys -- (mssmbios)
DRV - [2009.06.13 10:22:12 | 000,175,808 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)
DRV - [2009.06.13 10:22:04 | 000,040,784 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)
DRV - [2009.06.13 10:21:59 | 000,028,240 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)
DRV - [2009.06.13 09:05:01 | 000,101,888 | ---- | M] (Μι¢ѓøѕǿƒт Сòѓρòґáτιóń) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ipnat.sys -- (IPNAT)
DRV - [2009.06.13 09:02:45 | 000,258,560 | ---- | M] (Мï¢ŗõśбƒţ Ċбяφôґаτìõñ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbhub.sys -- (usbhub)
DRV - [2009.06.13 09:02:31 | 000,163,328 | ---- | M] (Μíсřó§ǿƒť Ćõґрοŗāťįθл) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\1394ohci.sys -- (1394ohci)
DRV - [2009.06.13 09:02:22 | 000,304,128 | ---- | M] (Μĩçгоŝóƒŧ Ċöřþôґäťΐöņ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\HdAudio.sys -- (HdAudAddService)
DRV - [2009.06.13 09:02:20 | 000,093,696 | ---- | M] (Мïćѓόѕôƒţ Сōřþóřάŧìøŉ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bthpan.sys -- (BthPan) Bluetooth-Gerät (PAN)
DRV - [2009.06.13 09:02:15 | 000,039,936 | ---- | M] (Μίćŕôŝöƒт €öґφόŗáťįòπ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\umbus.sys -- (umbus)
DRV - [2009.06.13 09:02:04 | 000,062,464 | ---- | M] (Мїçгõ§óƒť Čσґρσяāţíǿñ) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ohci1394.sys -- (ohci1394) 1394 OHCI Compliant Host Controller (Legacy)
DRV - [2009.06.13 09:01:49 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009.06.13 08:57:34 | 000,021,632 | ---- | M] (Μіćгŏşθƒţ Ćǿѓφøŕǻţΐōⁿ) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\wacompen.sys -- (WacomPen)
DRV - [2009.06.13 08:39:40 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)
DRV - [2009.06.13 08:39:37 | 000,017,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)
DRV - [2009.06.13 08:26:21 | 000,309,760 | ---- | M] (Мìçŗôšбƒť Çǿřþōѓāτįби) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\srv.sys -- (srv)
DRV - [2009.06.13 08:22:19 | 000,055,296 | ---- | M] (Мīčřǿşőƒŧ Çōřþòґåτïõŉ) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdk8.sys -- (AmdK8)
DRV - [2009.06.13 08:22:19 | 000,053,760 | ---- | M] (Μίčŕσšσƒτ Ĉŏгρσřăŧїóń) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\intelppm.sys -- (intelppm)
DRV - [2009.06.13 08:22:19 | 000,052,736 | ---- | M] (Μіćѓοşбƒτ Ĉοґρöŕªťĩõņ) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\viac7.sys -- (ViaC7)
DRV - [2009.06.13 08:22:19 | 000,052,736 | ---- | M] (Μĭčѓǿ§σƒť Čöŕрòřάŧīòń) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdppm.sys -- (AmdPPM)
DRV - [2009.06.13 08:22:19 | 000,052,224 | ---- | M] (Мį¢ѓøѕøƒţ Ċǿřφōѓåтĭòņ) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\processr.sys -- (Processor)
DRV - [2009.06.13 07:14:34 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R)
DRV - [2007.08.03 04:36:10 | 000,009,344 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SFEP.sys -- (SFEP)
DRV - [2007.02.20 16:44:00 | 004,457,920 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006.05.25 23:59:12 | 001,177,032 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sthda.sys -- (STHDA)
DRV - [2006.02.21 10:32:32 | 000,226,304 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ti21sony.sys -- (ti21sony)
DRV - [2005.12.29 10:42:00 | 000,234,496 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbvm321.sys -- (usbvm321)
DRV - [2000.11.09 11:15:08 | 000,048,896 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SonyNC.sys -- (SNC)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 70 40 EC 6B 66 E1 CB 01  [binary data]
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "DVDVideoSoftTB Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.13.1.18107
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.5.0.12
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=DVS2&o=1586&locale=de_DE&apn_uid=babef2e4-488b-41a4-9dc8-20c45f818829&apn_ptnrs=^AAA&apn_sauid=0B1C7584-1B04-4304-AE31-BCE01E36DAF5&apn_dtid=^YYYYYY^YY^DE&&q="
 
 
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.0: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.11.30 14:12:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.30 14:12:59 | 000,000,000 | ---D | M]
 
[2011.03.13 10:40:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\gabi\AppData\Roaming\mozilla\Extensions
[2011.10.02 00:15:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\gabi\AppData\Roaming\mozilla\Firefox\Profiles\i4epvapf.default\extensions
[2011.07.22 15:25:55 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\gabi\AppData\Roaming\mozilla\Firefox\Profiles\i4epvapf.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2011.07.22 15:23:07 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\gabi\AppData\Roaming\mozilla\Firefox\Profiles\i4epvapf.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.10.02 00:15:00 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\gabi\AppData\Roaming\mozilla\Firefox\Profiles\i4epvapf.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2012.01.11 12:40:46 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\gabi\AppData\Roaming\mozilla\Firefox\Profiles\i4epvapf.default\extensions\toolbar@ask.com
[2011.10.01 23:54:46 | 000,002,404 | ---- | M] () -- C:\Users\gabi\AppData\Roaming\Mozilla\Firefox\Profiles\i4epvapf.default\searchplugins\askcom.xml
[2011.08.10 19:04:41 | 000,002,306 | ---- | M] () -- C:\Users\gabi\AppData\Roaming\Mozilla\Firefox\Profiles\i4epvapf.default\searchplugins\askcomsearch.xml
[2011.06.22 13:15:18 | 000,000,931 | ---- | M] () -- C:\Users\gabi\AppData\Roaming\Mozilla\Firefox\Profiles\i4epvapf.default\searchplugins\conduit.xml
[2011.10.02 00:15:04 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2011.03.13 10:42:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011.03.13 12:00:43 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.08.10 19:03:27 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010.06.26 09:03:55 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.06.26 09:03:55 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.06.26 09:03:55 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.06.26 09:03:55 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.06.26 09:03:55 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NBAgent] C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKCU..\Run: [Firefox helper] C:\Users\gabi\AppData\Local\Mozilla\Firefox\firefox.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\gabi\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\gabi\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4C1C8431-4AE6-4531-8C07-6AC2BC259406}: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22 - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\System32\DreamScene.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {23A20C3C-2ADD-4A80-AFB4-C146F8847D79} - .NET Framework
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.05 19:20:04 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\gabi\Desktop\OTL.exe
[2012.02.05 16:30:47 | 000,000,000 | -H-D | C] -- C:\Windows\AxInstSV
[2012.01.27 19:24:57 | 000,000,000 | ---D | C] -- C:\Users\gabi\AppData\Local\{32B696E7-5A36-4A55-AD4F-B7B0BA6B3D5D}
[2012.01.27 19:24:42 | 000,000,000 | ---D | C] -- C:\Users\gabi\AppData\Local\{12DF1391-3857-4EF2-8A8B-472A4779AD8A}
[2012.01.13 15:23:11 | 000,029,504 | ---- | C] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll
[2012.01.13 15:23:11 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll
[2012.01.13 13:27:46 | 000,000,000 | ---D | C] -- C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
[2012.01.13 13:19:26 | 000,000,000 | ---D | C] -- C:\Users\gabi\AppData\Local\PackageAware
[2012.01.09 16:08:18 | 000,000,000 | ---D | C] -- C:\Users\gabi\AppData\Local\{F9ED7D4F-FA6A-43B5-BC92-510D75E63C53}
[2012.01.09 16:08:05 | 000,000,000 | ---D | C] -- C:\Users\gabi\AppData\Local\{EF2FA6F0-689F-46D4-8670-C0BE5D88B595}
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.05 19:20:04 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\gabi\Desktop\OTL.exe
[2012.02.05 19:12:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.05 18:51:18 | 000,607,728 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.02.05 18:51:18 | 000,104,106 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.02.05 18:47:13 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.02.05 16:39:46 | 000,013,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.05 16:39:46 | 000,013,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.05 16:30:51 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.01.08 12:14:33 | 000,056,426 | ---- | M] () -- C:\Users\gabi\Documents\Dechblatt mit foto 2.odt
 
========== Files Created - No Company Name ==========
 
[2011.10.01 22:35:27 | 000,000,017 | ---- | C] () -- C:\Users\gabi\AppData\Local\resmon.resmoncfg
[2011.06.30 13:08:20 | 000,001,164 | ---- | C] () -- C:\Users\gabi\AppData\Local\9A5FF4EA.il
[2011.06.30 13:08:20 | 000,000,280 | ---- | C] () -- C:\Users\gabi\AppData\Local\IndexIE_9A5FF4EA.il
[2011.03.30 08:05:10 | 000,006,144 | ---- | C] () -- C:\Users\gabi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.03.13 10:47:45 | 000,165,376 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2011.03.13 10:47:45 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2011.03.13 10:47:44 | 000,790,528 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2011.03.13 10:47:44 | 000,134,144 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2011.03.13 10:47:44 | 000,108,032 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009.06.21 10:19:23 | 000,007,680 | ---- | C] () -- C:\Windows\System32\vmsal.dll
[2009.06.13 19:41:01 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.06.13 18:47:22 | 000,406,584 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.06.13 11:06:28 | 000,607,728 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.06.13 11:06:28 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.06.13 11:06:28 | 000,104,106 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.06.13 11:06:28 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.06.13 11:05:39 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.06.13 11:04:46 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.06.13 10:01:38 | 001,332,736 | ---- | C] () -- C:\Windows\System32\hpotiop1.dll
[2009.06.13 09:29:27 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009.06.13 09:05:35 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.06.13 09:02:16 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.06.13 08:52:52 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
 
========== LOP Check ==========
 
[2011.07.22 15:26:02 | 000,000,000 | ---D | M] -- C:\Users\gabi\AppData\Roaming\DVDVideoSoft
[2011.07.22 13:01:41 | 000,000,000 | ---D | M] -- C:\Users\gabi\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.10.01 22:53:26 | 000,000,000 | ---D | M] -- C:\Users\gabi\AppData\Roaming\TuneUp Software
[2011.12.13 18:17:40 | 000,032,552 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.05.09 15:06:43 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.03.13 01:18:56 | 000,000,000 | -HSD | M] -- C:\Boot
[2006.07.28 08:46:23 | 000,000,000 | ---D | M] -- C:\Documentation
[2009.06.13 19:07:31 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2009.10.10 23:26:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2011.03.19 14:05:37 | 000,000,000 | ---D | M] -- C:\Driver-7
[2011.03.13 01:29:16 | 000,000,000 | ---D | M] -- C:\Drivers
[2009.10.11 12:22:33 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2011.03.13 12:06:06 | 000,000,000 | ---D | M] -- C:\output
[2012.01.13 13:27:46 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.01.13 15:25:26 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011.03.13 12:10:05 | 000,000,000 | R--D | M] -- C:\Programme
[2011.03.13 01:07:04 | 000,000,000 | -HSD | M] -- C:\Recovery
[2009.10.11 00:00:30 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2012.02.05 19:00:39 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010.01.15 11:50:20 | 000,000,000 | ---D | M] -- C:\totalcmd
[2011.11.28 10:34:42 | 000,000,000 | ---D | M] -- C:\Update
[2011.03.13 11:50:01 | 000,000,000 | ---D | M] -- C:\Upgrade
[2011.03.13 01:09:13 | 000,000,000 | R--D | M] -- C:\Users
[2009.10.11 01:13:55 | 000,000,000 | ---D | M] -- C:\VAIO Entertainment
[2012.02.05 19:12:54 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009.06.13 10:28:51 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=7B0EC418B56CCCBA4AB8C1783DCE2E39 -- C:\Windows\System32\drivers\AGP440.sys
[2009.06.13 10:28:51 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=7B0EC418B56CCCBA4AB8C1783DCE2E39 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_b24e0aabe87b4a24\AGP440.sys
[2009.06.13 10:28:51 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=7B0EC418B56CCCBA4AB8C1783DCE2E39 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7260.0_none_2b8e6f222ce580f2\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.06.13 10:28:46 | 000,021,568 | ---- | M] (Microsoft Corporation) MD5=896F9178BBE0B3A79FE8E69C61B4863E -- C:\Windows\System32\drivers\atapi.sys
[2009.06.13 10:28:46 | 000,021,568 | ---- | M] (Microsoft Corporation) MD5=896F9178BBE0B3A79FE8E69C61B4863E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_330a45316bb06b94\atapi.sys
[2009.06.13 10:28:46 | 000,021,568 | ---- | M] (Microsoft Corporation) MD5=896F9178BBE0B3A79FE8E69C61B4863E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7260.0_none_4eb3aa008fbe7614\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.06.13 10:16:28 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=2E24DF7312C35DDE1A32759D0FBF5144 -- C:\Windows\System32\cngaudit.dll
[2009.06.13 10:16:28 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=2E24DF7312C35DDE1A32759D0FBF5144 -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7260.0_none_59df6d0b9dc92532\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2009.06.13 10:15:55 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=A3109A72E1D4BEC38B6FCD017EBDD3F4 -- C:\Windows\explorer.exe
[2009.06.13 10:15:55 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=A3109A72E1D4BEC38B6FCD017EBDD3F4 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7260.0_none_c33028f8e7f11637\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2009.06.13 10:25:58 | 000,332,352 | ---- | M] (Intel Corporation) MD5=5C8A929E6240A45B86C31252B27AAF9B -- C:\Windows\System32\drivers\iaStorV.sys
[2009.06.13 10:25:58 | 000,332,352 | ---- | M] (Intel Corporation) MD5=5C8A929E6240A45B86C31252B27AAF9B -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.06.13 10:25:58 | 000,332,352 | ---- | M] (Intel Corporation) MD5=5C8A929E6240A45B86C31252B27AAF9B -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7260.0_none_208cd45ef5fca207\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.06.13 10:17:14 | 000,563,200 | ---- | M] (Microsoft Corporation) MD5=B7413365132D2A491E658BFE824A2F81 -- C:\Windows\System32\netlogon.dll
[2009.06.13 10:17:14 | 000,563,200 | ---- | M] (Microsoft Corporation) MD5=B7413365132D2A491E658BFE824A2F81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7260.0_none_6f333929a62e8fcf\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.06.13 10:25:53 | 000,142,400 | ---- | M] (NVIDIA Corporation) MD5=12054907B9F1B20F5FE67D9EE588F123 -- C:\Windows\System32\drivers\nvstor.sys
[2009.06.13 10:25:53 | 000,142,400 | ---- | M] (NVIDIA Corporation) MD5=12054907B9F1B20F5FE67D9EE588F123 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.06.13 10:25:53 | 000,142,400 | ---- | M] (NVIDIA Corporation) MD5=12054907B9F1B20F5FE67D9EE588F123 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7260.0_none_ab56450e2d334bdf\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.06.13 10:17:17 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=433ED81B70D9E2108465D8A3602B1646 -- C:\Windows\System32\scecli.dll
[2009.06.13 10:17:17 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=433ED81B70D9E2108465D8A3602B1646 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7260.0_none_a98964424750168a\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.06.13 10:17:20 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=8E423C16AABBDCF242B79083BAF60331 -- C:\Windows\System32\user32.dll
[2009.06.13 10:17:20 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=8E423C16AABBDCF242B79083BAF60331 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7260.0_none_3eb3ee27db9126aa\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.06.13 10:16:14 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=D4756B4C04408183B4A4FE3AED79BCB0 -- C:\Windows\System32\userinit.exe
[2009.06.13 10:16:14 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=D4756B4C04408183B4A4FE3AED79BCB0 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7260.0_none_4da43bfc3fe49f83\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.06.13 10:16:16 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=1BD9EA57D416514ABC309BD80A88FDD2 -- C:\Windows\System32\winlogon.exe
[2009.06.13 10:16:16 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=1BD9EA57D416514ABC309BD80A88FDD2 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7260.0_none_e13e82fd4326236d\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.06.13 09:05:38 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=EBB82813E34D6E50EA225C4DA002B576 -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.06.13 09:05:38 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=EBB82813E34D6E50EA225C4DA002B576 -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7260.0_none_c10222bb36024db9\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.06.13 10:16:36 | 000,346,112 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll
[2009.06.13 10:16:36 | 000,215,552 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll
 
< %USERPROFILE%\*.* >
[2012.01.05 20:17:30 | 000,471,644 | ---- | M] () -- C:\Users\gabi\.TransferManager.db
[2012.02.05 19:26:28 | 003,407,872 | -HS- | M] () -- C:\Users\gabi\NTUSER.DAT
[2012.02.05 19:26:28 | 000,262,144 | -HS- | M] () -- C:\Users\gabi\ntuser.dat.LOG1
[2011.10.30 10:05:37 | 000,262,144 | -HS- | M] () -- C:\Users\gabi\ntuser.dat.LOG2
[2011.03.13 01:16:24 | 000,065,536 | -HS- | M] () -- C:\Users\gabi\NTUSER.DAT{14dbde70-5732-11de-8bed-001e0bcd1824}.TM.blf
[2011.03.13 01:16:24 | 000,524,288 | -HS- | M] () -- C:\Users\gabi\NTUSER.DAT{14dbde70-5732-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
[2011.03.13 01:16:24 | 000,524,288 | -HS- | M] () -- C:\Users\gabi\NTUSER.DAT{14dbde70-5732-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
[2011.09.16 14:58:00 | 001,048,576 | -HS- | M] () -- C:\Users\gabi\NTUSER.DAT{cd0a2fac-517c-11e0-942c-0016fe90e84b}.TxR.0.regtrans-ms
[2011.09.16 14:58:00 | 001,048,576 | -HS- | M] () -- C:\Users\gabi\NTUSER.DAT{cd0a2fac-517c-11e0-942c-0016fe90e84b}.TxR.1.regtrans-ms
[2011.09.16 14:58:00 | 001,048,576 | -HS- | M] () -- C:\Users\gabi\NTUSER.DAT{cd0a2fac-517c-11e0-942c-0016fe90e84b}.TxR.2.regtrans-ms
[2011.09.16 14:57:59 | 000,065,536 | -HS- | M] () -- C:\Users\gabi\NTUSER.DAT{cd0a2fac-517c-11e0-942c-0016fe90e84b}.TxR.blf
[2011.03.18 17:29:30 | 000,065,536 | -HS- | M] () -- C:\Users\gabi\NTUSER.DAT{cd0a2fad-517c-11e0-942c-0016fe90e84b}.TM.blf
[2011.03.18 17:29:30 | 000,524,288 | -HS- | M] () -- C:\Users\gabi\NTUSER.DAT{cd0a2fad-517c-11e0-942c-0016fe90e84b}.TMContainer00000000000000000001.regtrans-ms
[2011.03.18 17:29:30 | 000,524,288 | -HS- | M] () -- C:\Users\gabi\NTUSER.DAT{cd0a2fad-517c-11e0-942c-0016fe90e84b}.TMContainer00000000000000000002.regtrans-ms
[2011.03.13 01:09:14 | 000,000,020 | -HS- | M] () -- C:\Users\gabi\ntuser.ini
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
<           >

< End of report >

--- --- ---

neo1409 · 05.02.2012, 20:21

Extras.TXt log:OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 05.02.2012 19:23:33 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\gabi\Desktop
 Ultimate Edition  (Version = 6.1.7260) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7260.0)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1022,18 Mb Total Physical Memory | 647,81 Mb Available Physical Memory | 63,38% Memory free
2,00 Gb Paging File | 1,66 Gb Available in Paging File | 82,89% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,51 Gb Total Space | 22,29 Gb Free Space | 29,92% Space Free | Partition Type: NTFS
Drive D: | 66,61 Gb Total Space | 54,53 Gb Free Space | 81,86% Space Free | Partition Type: NTFS
 
Computer Name: GABI-PC | User Name: gabi | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM)
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F7FB68F-52F6-46A3-B42F-38CE46295AE5}" = Nero MediaHub 10
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 26
"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10
"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)
"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{59452470-A902-477F-9338-9B88101681BD}" = Setting Utility Series
"{5BEE8F1F-BD32-4553-8107-500439E43BD7}" = VAIO Update
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{5F548A02-80BC-404D-BAE6-F05F9BF6B449}" = Nero DiscCopyGadget 10 Help (CHM)
"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM)
"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}" = Nero Recode 10
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)
"{92EC1A84-7FFC-42DF-A8F6-79C21C4765A5}" = Nero DiscCopy Gadget 10
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10
"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.6 - Deutsch
"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)
"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM)
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}" = Nero SoundTrax 10
"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10
"{EF3D45BB-2260-4008-88EA-492E7744A9DF}" = Sony Utilities DLL
"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10
"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FC37C108-821D-4EDE-8F40-D5B497586805}" = VAIO Control Center
"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"conduitEngine" = Conduit Engine
"DVDFab 8_is1" = DVDFab 8.0.5.6 (05/12/2010)
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"Free YouTube Download 3_is1" = Free YouTube Download 3 version 3.0.10.722
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.5.722
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 6.5.0
"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"TuneUp Utilities 2011" = TuneUp Utilities 2011
"VLC media player" = VLC media player 1.1.0
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.00 (32-Bit)
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 05.02.2012 07:38:30 | Computer Name = gabi-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
Error - 05.02.2012 07:38:30 | Computer Name = gabi-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
Error - 05.02.2012 11:06:58 | Computer Name = gabi-PC | Source = BackItUp5 | ID = 5225
Description = 
 
Error - 05.02.2012 11:11:01 | Computer Name = gabi-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
Error - 05.02.2012 11:11:01 | Computer Name = gabi-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
Error - 05.02.2012 11:31:36 | Computer Name = gabi-PC | Source = BackItUp5 | ID = 5225
Description = 
 
Error - 05.02.2012 11:38:08 | Computer Name = gabi-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
Error - 05.02.2012 11:38:08 | Computer Name = gabi-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
Error - 05.02.2012 13:51:17 | Computer Name = gabi-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
Error - 05.02.2012 13:51:18 | Computer Name = gabi-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
[ Media Center Events ]
Error - 29.06.2011 12:07:49 | Computer Name = gabi-PC | Source = MCUpdate | ID = 0
Description = 18:07:48 - Fehler beim Herstellen der Internetverbindung.  18:07:48 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 29.06.2011 12:08:23 | Computer Name = gabi-PC | Source = MCUpdate | ID = 0
Description = 18:08:18 - Fehler beim Herstellen der Internetverbindung.  18:08:18 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 02.07.2011 19:53:00 | Computer Name = gabi-PC | Source = MCUpdate | ID = 0
Description = 01:53:00 - Fehler beim Herstellen der Internetverbindung.  01:53:00 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 02.07.2011 19:53:11 | Computer Name = gabi-PC | Source = MCUpdate | ID = 0
Description = 01:53:05 - Fehler beim Herstellen der Internetverbindung.  01:53:05 
-     Serververbindung konnte nicht hergestellt werden..  
 
[ System Events ]
Error - 05.02.2012 14:27:32 | Computer Name = gabi-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 05.02.2012 14:29:39 | Computer Name = gabi-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 05.02.2012 14:29:39 | Computer Name = gabi-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 05.02.2012 14:29:39 | Computer Name = gabi-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 05.02.2012 14:34:39 | Computer Name = gabi-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 05.02.2012 14:34:39 | Computer Name = gabi-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 05.02.2012 14:34:39 | Computer Name = gabi-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 05.02.2012 14:36:46 | Computer Name = gabi-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 05.02.2012 14:36:46 | Computer Name = gabi-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 05.02.2012 14:36:46 | Computer Name = gabi-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
 
< End of report >

--- --- ---

markusg · 05.02.2012, 20:34

wir sind nicht fertig mit em andern pc. was ist mit der beantwortung meiner frage.

neo1409 · 05.02.2012, 21:05

ach so ich dachte das war es jetzt denn nach der letzten handlung taucht der banner vom virus nicht mehr auf!? hab grade irgendwie nen komisches gefühl bei der sache nich das du meine gesamten geschickten daten nun auch noch gegen mich verwendest!?

markusg · 06.02.2012, 11:08

ja, denn das würde ja auch überhaupt nicht auffallen wenn wir hier die daten der nutzer verwenden würden...
es ist wichtig zu wissen ob du onlinebanking mit dem pc machst, denn du müsstest es auf grund eines fundes sperren lassen und den pc formatieren.

neo1409 · 06.02.2012, 15:31

ok also ich mache online banking über meinen rechner. wie geht es nun weiter?

markusg · 06.02.2012, 15:38

hi, rufe bitte umgehend die bank an, lasse das banking wegen dem trojan.zeus (zbot) sperren.
pc 1 muss außerdem neu aufgesetzt werden.
1. Datenrettung:

deaktiviere Autorun: http://www.trojaner-board.de/83238-a...sschalten.html
dann sichere Daten auf einen externen Datenträger (USB-Platte): http://www.trojaner-board.de/82533-d...ted-magic.html
Bider, Dokumente, Musik, Videos (persönliches) http://www.trojaner-board.de/71715-k...iendungen.html

2. Formatieren, Windows neuinstallieren:

nutzt du eine Windows CD: http://www.trojaner-board.de/51262-a...sicherung.html
Recovery CD oder Recovery Partition?
falls dies ein Fertig-PC ist, nenne Hersteller + Typ.
Keine Windows 7 DVD? http://www.trojaner-board.de/100776-...-download.html

3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.

neo1409 · 06.02.2012, 15:45

oh man is ja voll übel hätte nich gedacht das es so dramatisch werden würde! warum kommt dieser banner auf einmal nicht mehr wo stand das ich 50 euro überweisen soll? habe gestern im abgesicherten modus avira durchlaufen lassen und ein paar funde gehabt!

neo1409 · 06.02.2012, 15:54

habe einen laptop von asus. nein formatiert habe ich noch nie aber denke sollte es irgendwie schon hinbekommen! habe grade online banking bei meiner bank schon mal sperren lassen!

markusg · 06.02.2012, 16:27

hi, sag mir wenn die daten gesichert sind, dann erkläre ich es dir wie es mit dem neu aufsetzen klappen sollte.

Windows gesperrt, Zahlungsaufforderung

Log-Analyse und Auswertung: Windows gesperrt, Zahlungsaufforderung